@personaxis/core 0.11.0

package/dist/compile/faithfulness.js

@@ -0,0 +1,112 @@
+/**
+ * F3.1 — the DETERMINISTIC faithfulness check (guards stage 2 of the pipeline).
+ *
+ * Stage 2 (the optional LLM "polish") is constrained to REPHRASE the assembled
+ * document, never to ADD or DROP claims. This check enforces that contract
+ * deterministically by diffing the polished document against the assembled one
+ * (the ground truth), section by section, over the PROTECTED claim classes:
+ *
+ *   - Hard limits          — a dropped safety limit is a hard failure.
+ *   - Staying in character  — same (these are hard limits too).
+ *   - What you always/never — behavioral anchors.
+ *   - What is fixed/change   — consistency dimensions.
+ *
+ * The historical CMO regression — the compiled PERSONA.md invented `consistency`
+ * items the source never declared — fails here as an INVENTED finding.
+ *
+ * Matching is token-coverage based (deterministic, no model): a claim is
+ * "preserved" iff some claim on the other side shares enough content tokens.
+ * Rephrasing (synonym-free reordering, added connective words) passes; adding a
+ * genuinely new bullet or dropping one does not.
+ */
+const STOPWORDS = new Set([
+    "a", "an", "and", "are", "as", "at", "be", "but", "by", "for", "from", "in", "into", "is", "it",
+    "its", "of", "on", "or", "that", "the", "their", "them", "then", "they", "this", "to", "you",
+    "your", "with", "when", "what", "which", "who", "will", "not", "no", "do", "does", "done", "any",
+    "every", "each", "must", "may", "can", "cannot", "never", "always", "always:", "never:",
+]);
+function tokens(s) {
+    return new Set(s
+        .toLowerCase()
+        .replace(/[`*_#>[\]()"'.,;:!?]/g, " ")
+        .split(/\s+/)
+        .map((t) => t.replace(/s$/, "")) // crude singularize so plural rephrasing still matches
+        .filter((t) => t.length > 2 && !STOPWORDS.has(t)));
+}
+/** Content-token coverage of `a` by `b`: |a∩b| / |a|. */
+function coverage(a, b) {
+    if (a.size === 0)
+        return 1;
+    let hit = 0;
+    for (const t of a)
+        if (b.has(t))
+            hit++;
+    return hit / a.size;
+}
+/** Extract the bullet claims under each protected `## section` heading. */
+function claimsBySection(doc) {
+    const map = new Map();
+    const lines = doc.split(/\r?\n/);
+    let current;
+    for (const line of lines) {
+        const h = line.match(/^##\s+(.*)$/);
+        if (h) {
+            current = h[1].trim().toLowerCase();
+            map.set(current, []);
+            continue;
+        }
+        const b = line.match(/^\s*[-*]\s+(.*)$/);
+        if (b && current) {
+            const text = b[1].replace(/^\*\*[^*]+\*\*:?\s*/, "").trim(); // drop a leading **bold:** label
+            if (text)
+                map.get(current).push(text);
+        }
+    }
+    return map;
+}
+const DEFAULT_SECTIONS = [
+    "hard limits (never overridden)",
+    "staying in character",
+    "what you always / never do",
+    "what is fixed, what can change",
+];
+/**
+ * Diff `polished` against `assembled` (the ground truth). Returns findings for
+ * dropped source claims and invented polish claims in the protected sections.
+ */
+export function checkFaithfulness(assembled, polished, opts = {}) {
+    const threshold = opts.threshold ?? 0.5;
+    const sections = opts.sections ?? DEFAULT_SECTIONS;
+    const src = claimsBySection(assembled);
+    const out = claimsBySection(polished);
+    const findings = [];
+    for (const section of sections) {
+        const srcClaims = (src.get(section) ?? []).map((t) => ({ text: t, tok: tokens(t) }));
+        const outClaims = (out.get(section) ?? []).map((t) => ({ text: t, tok: tokens(t) }));
+        // Dropped: a source claim with no sufficiently-covering polish claim.
+        for (const s of srcClaims) {
+            let best = 0;
+            for (const o of outClaims)
+                best = Math.max(best, coverage(s.tok, o.tok));
+            if (best < threshold)
+                findings.push({ kind: "dropped", section, text: s.text, bestCoverage: best });
+        }
+        // Invented: a polish claim with no sufficiently-covering source claim.
+        for (const o of outClaims) {
+            let best = 0;
+            for (const s of srcClaims)
+                best = Math.max(best, coverage(o.tok, s.tok));
+            if (best < threshold)
+                findings.push({ kind: "invented", section, text: o.text, bestCoverage: best });
+        }
+    }
+    return { ok: findings.length === 0, findings };
+}
+/** One-line human summary of a report (for CLI output / logs). */
+export function summarizeFaithfulness(report) {
+    if (report.ok)
+        return "faithfulness: OK (polish preserved every protected claim)";
+    const dropped = report.findings.filter((f) => f.kind === "dropped").length;
+    const invented = report.findings.filter((f) => f.kind === "invented").length;
+    return `faithfulness: FAIL — ${dropped} dropped, ${invented} invented protected claim(s)`;
+}

package/dist/compile/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * F3.1 — the two-stage compile pipeline, framework-agnostic and in core so the
+ * Living Loop (inline recompile) and the SaaS (server-side compile) share it
+ * with the CLI. Stage 1 (assemble) is deterministic and always runs; stage 2
+ * (LLM polish) is optional and validated by the faithfulness check.
+ */
+export * from "./assemble.js";
+export * from "./faithfulness.js";
+export * from "./targets.js";
+export * from "./dist.js";

package/dist/compile/index.js

@@ -0,0 +1,10 @@
+/**
+ * F3.1 — the two-stage compile pipeline, framework-agnostic and in core so the
+ * Living Loop (inline recompile) and the SaaS (server-side compile) share it
+ * with the CLI. Stage 1 (assemble) is deterministic and always runs; stage 2
+ * (LLM polish) is optional and validated by the faithfulness check.
+ */
+export * from "./assemble.js";
+export * from "./faithfulness.js";
+export * from "./targets.js";
+export * from "./dist.js";

package/dist/compile/targets.d.ts

@@ -0,0 +1,62 @@
+/**
+ * F3.2 — the host placement target registry (in core so the SaaS can place
+ * documents server-side, not only the CLI).
+ *
+ * A COMPILE TARGET adapts the canonical compiled document (produced by the
+ * stage-1 assembler + optional polish) into a specific host's identity/subagent
+ * convention — computing both the path and the content. Targets are registered
+ * as plugins: `registerTarget()` adds one, `getTarget()`/`listTargets()` read
+ * the registry, and the four built-ins (claude-code, codex, openclaw, hermes)
+ * are registered on import.
+ *
+ *   claude-code  root → <rootOutputPath> (shared)  · sub → .claude/agents/<slug>.md
+ *   codex        root → <rootOutputPath> (shared)  · sub → .codex/agents/<slug>.toml
+ *   openclaw     root → SOUL.md                     · sub → .openclaw/agents/<slug>/SOUL.md
+ *   hermes       root → .hermes/SOUL.md             · sub → .hermes/agents/<slug>/SOUL.md
+ *
+ * SOUL.md hosts (openclaw, Hermes) read the file as the FIRST system-prompt
+ * section and RE-READ it fresh at the start of every message/session — so a
+ * recompile takes effect with no restart (hot reload). Claude Code / Codex read
+ * the root document via an `@PERSONA.md` reference from CLAUDE.md / AGENTS.md,
+ * so only a SUBAGENT compile places a new file for them.
+ */
+export interface PlacementContext {
+    isSubagent: boolean;
+    slug?: string;
+    /** Where the canonical root document lives (e.g. "PERSONA.md") — used by shared-root targets. */
+    rootOutputPath: string;
+}
+export interface PlacementResult {
+    /** Relative path the placed document should be written to. */
+    path: string;
+    content: string;
+}
+export interface CompileTarget {
+    /** Stable id used on the CLI (`--platform <id>`) and in configs. */
+    id: string;
+    /** True for hosts that read SOUL.md at the workspace/profile root (no @PERSONA.md baseline). */
+    isSoul: boolean;
+    /** Adapt the compiled document to this host's convention. */
+    place(compiledText: string, ctx: PlacementContext): PlacementResult;
+}
+/** TOML string literal (JSON encoding is a valid TOML basic string). */
+export declare function tomlString(value: string): string;
+/**
+ * SOUL.md placement — reuse the canonical compiled document (already a
+ * second-person qualitative identity doc), stripping only the subagent
+ * `name`/`description` frontmatter that openclaw/Hermes don't use.
+ */
+export declare function toSoulMd(compiledText: string): string;
+/** Register (or override) a compile target plugin. */
+export declare function registerTarget(target: CompileTarget): void;
+/** Resolve a target by id (undefined when unknown). */
+export declare function getTarget(id: string): CompileTarget | undefined;
+/** All registered target ids, in registration order. */
+export declare function listTargets(): string[];
+/** The built-in host ids (stable order), for CLI help and validation. */
+export declare const BUILTIN_TARGETS: readonly ["claude-code", "codex", "openclaw", "hermes"];
+export type BuiltinTarget = (typeof BUILTIN_TARGETS)[number];
+/** Convenience: place a document for a host id. Throws on an unknown target. */
+export declare function placeForTarget(compiledText: string, targetId: string, ctx: PlacementContext): PlacementResult;
+/** Whether a host reads SOUL.md at the root (no @PERSONA.md baseline injection). */
+export declare function isSoulTarget(targetId: string | undefined): boolean;

package/dist/compile/targets.js

@@ -0,0 +1,114 @@
+/**
+ * F3.2 — the host placement target registry (in core so the SaaS can place
+ * documents server-side, not only the CLI).
+ *
+ * A COMPILE TARGET adapts the canonical compiled document (produced by the
+ * stage-1 assembler + optional polish) into a specific host's identity/subagent
+ * convention — computing both the path and the content. Targets are registered
+ * as plugins: `registerTarget()` adds one, `getTarget()`/`listTargets()` read
+ * the registry, and the four built-ins (claude-code, codex, openclaw, hermes)
+ * are registered on import.
+ *
+ *   claude-code  root → <rootOutputPath> (shared)  · sub → .claude/agents/<slug>.md
+ *   codex        root → <rootOutputPath> (shared)  · sub → .codex/agents/<slug>.toml
+ *   openclaw     root → SOUL.md                     · sub → .openclaw/agents/<slug>/SOUL.md
+ *   hermes       root → .hermes/SOUL.md             · sub → .hermes/agents/<slug>/SOUL.md
+ *
+ * SOUL.md hosts (openclaw, Hermes) read the file as the FIRST system-prompt
+ * section and RE-READ it fresh at the start of every message/session — so a
+ * recompile takes effect with no restart (hot reload). Claude Code / Codex read
+ * the root document via an `@PERSONA.md` reference from CLAUDE.md / AGENTS.md,
+ * so only a SUBAGENT compile places a new file for them.
+ */
+import matter from "gray-matter";
+/** TOML string literal (JSON encoding is a valid TOML basic string). */
+export function tomlString(value) {
+    return JSON.stringify(value);
+}
+/**
+ * SOUL.md placement — reuse the canonical compiled document (already a
+ * second-person qualitative identity doc), stripping only the subagent
+ * `name`/`description` frontmatter that openclaw/Hermes don't use.
+ */
+export function toSoulMd(compiledText) {
+    const { content } = matter(compiledText);
+    const body = content.trim();
+    return body.startsWith("#") ? body : `# SOUL\n\n${body}`;
+}
+const claudeCodeTarget = {
+    id: "claude-code",
+    isSoul: false,
+    place(compiledText, ctx) {
+        if (!ctx.isSubagent)
+            return { path: ctx.rootOutputPath, content: compiledText };
+        return { path: `.claude/agents/${ctx.slug ?? "agent"}.md`, content: compiledText };
+    },
+};
+const codexTarget = {
+    id: "codex",
+    isSoul: false,
+    place(compiledText, ctx) {
+        if (!ctx.isSubagent)
+            return { path: ctx.rootOutputPath, content: compiledText };
+        const slug = ctx.slug ?? "agent";
+        const { data, content } = matter(compiledText);
+        const name = typeof data.name === "string" ? data.name : slug;
+        const description = typeof data.description === "string" ? data.description : "";
+        const toml = [
+            `name = ${tomlString(name)}`,
+            `description = ${tomlString(description)}`,
+            `developer_instructions = ${tomlString(content.trim())}`,
+        ].join("\n") + "\n";
+        return { path: `.codex/agents/${slug}.toml`, content: toml };
+    },
+};
+const openclawTarget = {
+    id: "openclaw",
+    isSoul: true,
+    place(compiledText, ctx) {
+        const slug = ctx.slug ?? "agent";
+        return {
+            path: ctx.isSubagent ? `.openclaw/agents/${slug}/SOUL.md` : "SOUL.md",
+            content: toSoulMd(compiledText),
+        };
+    },
+};
+const hermesTarget = {
+    id: "hermes",
+    isSoul: true,
+    place(compiledText, ctx) {
+        const slug = ctx.slug ?? "agent";
+        return {
+            path: ctx.isSubagent ? `.hermes/agents/${slug}/SOUL.md` : ".hermes/SOUL.md",
+            content: toSoulMd(compiledText),
+        };
+    },
+};
+const registry = new Map();
+/** Register (or override) a compile target plugin. */
+export function registerTarget(target) {
+    registry.set(target.id, target);
+}
+/** Resolve a target by id (undefined when unknown). */
+export function getTarget(id) {
+    return registry.get(id);
+}
+/** All registered target ids, in registration order. */
+export function listTargets() {
+    return [...registry.keys()];
+}
+for (const t of [claudeCodeTarget, codexTarget, openclawTarget, hermesTarget])
+    registerTarget(t);
+/** The built-in host ids (stable order), for CLI help and validation. */
+export const BUILTIN_TARGETS = ["claude-code", "codex", "openclaw", "hermes"];
+/** Convenience: place a document for a host id. Throws on an unknown target. */
+export function placeForTarget(compiledText, targetId, ctx) {
+    const target = getTarget(targetId);
+    if (!target)
+        throw new Error(`Unknown compile target "${targetId}". Known: ${listTargets().join(", ")}`);
+    return target.place(compiledText, ctx);
+}
+/** Whether a host reads SOUL.md at the root (no @PERSONA.md baseline injection). */
+export function isSoulTarget(targetId) {
+    return targetId ? getTarget(targetId)?.isSoul ?? false : false;
+}

package/dist/config-layers.d.ts

@@ -0,0 +1,42 @@
+/**
+ * FR.5 — explicit numeric configuration-layer precedence.
+ *
+ * The Codex `config_layer_source` pattern (converging with Claude Code's
+ * managed→user deny-wins): every configurable value belongs to a LAYER with a
+ * numeric rank; higher rank wins, and the winner is ATTRIBUTABLE (a host can
+ * always answer "why is this value in effect?").
+ *
+ * Two tiers of keys:
+ *   - ordinary keys  → highest layer wins (resolveLayered);
+ *   - POLICY-TIER keys → a lower layer may only RESTRICT, never relax
+ *     (resolvePolicyTier, strictest-wins) — the generalization of the
+ *     improvement-mode min-wins rule (SPEC.md §7.2).
+ */
+export declare const CONFIG_LAYERS: {
+    /** Org-managed defaults (reserved — MDM/enterprise distribution). */
+    readonly managed: 0;
+    /** ~/.personaxis/config.json */
+    readonly global: 10;
+    /** <project>/.personaxis/config.json */
+    readonly project: 20;
+    /** per-persona settings (config.json personas.<slug> section) */
+    readonly persona: 25;
+    /** the persona document's own frontmatter (runtime block) */
+    readonly frontmatter: 28;
+    /** PERSONAXIS_* environment variables / session flags */
+    readonly env: 30;
+};
+export type ConfigLayer = keyof typeof CONFIG_LAYERS;
+export interface LayeredValue<T> {
+    value: T;
+    /** The layer that supplied the winning value. */
+    source: ConfigLayer;
+}
+/** Highest-ranked defined layer wins. Undefined when no layer defines it. */
+export declare function resolveLayered<T>(values: Partial<Record<ConfigLayer, T | undefined>>): LayeredValue<T> | undefined;
+/**
+ * Policy-tier resolution: the value is ordered by `strictness` (index 0 =
+ * most permissive) and the STRICTEST defined layer wins regardless of rank —
+ * a lower layer can tighten what a higher layer set, never loosen it.
+ */
+export declare function resolvePolicyTier<T>(values: Partial<Record<ConfigLayer, T | undefined>>, strictness: readonly T[]): LayeredValue<T> | undefined;

package/dist/config-layers.js

@@ -0,0 +1,59 @@
+/**
+ * FR.5 — explicit numeric configuration-layer precedence.
+ *
+ * The Codex `config_layer_source` pattern (converging with Claude Code's
+ * managed→user deny-wins): every configurable value belongs to a LAYER with a
+ * numeric rank; higher rank wins, and the winner is ATTRIBUTABLE (a host can
+ * always answer "why is this value in effect?").
+ *
+ * Two tiers of keys:
+ *   - ordinary keys  → highest layer wins (resolveLayered);
+ *   - POLICY-TIER keys → a lower layer may only RESTRICT, never relax
+ *     (resolvePolicyTier, strictest-wins) — the generalization of the
+ *     improvement-mode min-wins rule (SPEC.md §7.2).
+ */
+export const CONFIG_LAYERS = {
+    /** Org-managed defaults (reserved — MDM/enterprise distribution). */
+    managed: 0,
+    /** ~/.personaxis/config.json */
+    global: 10,
+    /** <project>/.personaxis/config.json */
+    project: 20,
+    /** per-persona settings (config.json personas.<slug> section) */
+    persona: 25,
+    /** the persona document's own frontmatter (runtime block) */
+    frontmatter: 28,
+    /** PERSONAXIS_* environment variables / session flags */
+    env: 30,
+};
+/** Highest-ranked defined layer wins. Undefined when no layer defines it. */
+export function resolveLayered(values) {
+    let winner;
+    for (const [layer, rank] of Object.entries(CONFIG_LAYERS)) {
+        const v = values[layer];
+        if (v === undefined)
+            continue;
+        if (!winner || rank >= CONFIG_LAYERS[winner.source])
+            winner = { value: v, source: layer };
+    }
+    return winner;
+}
+/**
+ * Policy-tier resolution: the value is ordered by `strictness` (index 0 =
+ * most permissive) and the STRICTEST defined layer wins regardless of rank —
+ * a lower layer can tighten what a higher layer set, never loosen it.
+ */
+export function resolvePolicyTier(values, strictness) {
+    let winner;
+    for (const layer of Object.keys(CONFIG_LAYERS)) {
+        const v = values[layer];
+        if (v === undefined)
+            continue;
+        const idx = strictness.indexOf(v);
+        if (idx === -1)
+            continue; // unknown value: never wins a policy decision
+        if (!winner || idx > strictness.indexOf(winner.value))
+            winner = { value: v, source: layer };
+    }
+    return winner;
+}

package/dist/config-scan.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Agent-config security scanner (v0.9 — the "Shield" wedge).
+ *
+ * AI-agent config files (CLAUDE.md, AGENTS.md, .cursorrules, .codex/*.toml,
+ * agents.json, personaxis.md) are an unattended attack surface: prompt injection
+ * hidden in instructions/skill descriptions, over-broad permissions, and leaked
+ * credentials. (AgentShield reports 520 of 17,022 audited skills leak creds.) This
+ * scanner audits any of those, cross-harness, in three passes — red-team (find the
+ * attack), blue-team (check the boundaries), auditor (leaks + structured report) —
+ * reusing the engine's injection scanner. Pure + dependency-free; CLI exit codes.
+ */
+export type ConfigKind = "personaxis" | "persona-md" | "claude-md" | "agents-md" | "cursorrules" | "codex-toml" | "agents-json" | "unknown";
+export type ScanTeam = "red" | "blue" | "auditor";
+export type ScanSeverity = "error" | "warning" | "info";
+export interface ScanFinding {
+    rule: string;
+    severity: ScanSeverity;
+    team: ScanTeam;
+    message: string;
+    match?: string;
+}
+export type ScanVerdict = "clean" | "suspicious" | "risky" | "malicious";
+export interface ConfigScanResult {
+    kind: ConfigKind;
+    verdict: ScanVerdict;
+    score: number;
+    findings: ScanFinding[];
+}
+export declare function detectKind(nameOrPath: string): ConfigKind;
+export declare function scanAgentConfig(text: string, kindHint?: ConfigKind): ConfigScanResult;

package/dist/config-scan.js

@@ -0,0 +1,118 @@
+/**
+ * Agent-config security scanner (v0.9 — the "Shield" wedge).
+ *
+ * AI-agent config files (CLAUDE.md, AGENTS.md, .cursorrules, .codex/*.toml,
+ * agents.json, personaxis.md) are an unattended attack surface: prompt injection
+ * hidden in instructions/skill descriptions, over-broad permissions, and leaked
+ * credentials. (AgentShield reports 520 of 17,022 audited skills leak creds.) This
+ * scanner audits any of those, cross-harness, in three passes — red-team (find the
+ * attack), blue-team (check the boundaries), auditor (leaks + structured report) —
+ * reusing the engine's injection scanner. Pure + dependency-free; CLI exit codes.
+ */
+import matter from "gray-matter";
+import { scanForInjection } from "./injection.js";
+export function detectKind(nameOrPath) {
+    const n = nameOrPath.toLowerCase().replace(/\\/g, "/");
+    if (n.endsWith("personaxis.md"))
+        return "personaxis";
+    if (n.endsWith("persona.md") || /\.claude\/agents\/.*\.md$/.test(n))
+        return "persona-md";
+    if (n.endsWith("claude.md"))
+        return "claude-md";
+    if (n.endsWith("agents.md"))
+        return "agents-md";
+    if (n.endsWith(".cursorrules") || n.endsWith("persona.mdc"))
+        return "cursorrules";
+    if (n.endsWith(".toml") && n.includes("agents"))
+        return "codex-toml";
+    if (n.endsWith("agents.json"))
+        return "agents-json";
+    return "unknown";
+}
+// ── Credential leak patterns (auditor) ───────────────────────────────────────
+const SECRET_PATTERNS = [
+    { rule: "secret:openai-key", re: /\bsk-[A-Za-z0-9]{20,}\b/g },
+    { rule: "secret:aws-access-key", re: /\bAKIA[0-9A-Z]{16}\b/g },
+    { rule: "secret:google-key", re: /\bAIza[0-9A-Za-z_\-]{35}\b/g },
+    { rule: "secret:github-token", re: /\bgh[posru]_[A-Za-z0-9]{30,}\b/g },
+    { rule: "secret:slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+    { rule: "secret:bearer", re: /\bBearer\s+[A-Za-z0-9._\-]{16,}/g },
+    { rule: "secret:private-key", re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g },
+    { rule: "secret:assignment", re: /\b(?:api[_-]?key|secret|password|access[_-]?token)\b\s*[:=]\s*["']?[A-Za-z0-9_\-]{12,}/gi },
+];
+// ── Dangerous-permission tokens (blue-team) ──────────────────────────────────
+const DANGER_TOKENS = [
+    { rule: "perm:full-access", re: /danger-full-access|"?bypassPermissions"?|dangerously[-_]?skip/i, message: "grants unrestricted access (no sandbox)" },
+    { rule: "perm:approval-never", re: /approval\s*[:=]\s*["']?never/i, message: "never asks for approval before risky actions" },
+    { rule: "perm:autorun", re: /auto[-_]?(approve|run|accept)\s*[:=]\s*(true|all|yes)/i, message: "auto-approves/auto-runs actions" },
+];
+// ── Remote skill/source references (auditor — supply chain) ──────────────────
+const REMOTE_SOURCE = /\b(github:[\w./-]+|https?:\/\/[^\s"')]+)/gi;
+function inject(findings, f) {
+    findings.push(f);
+}
+export function scanAgentConfig(text, kindHint) {
+    const kind = kindHint ?? "unknown";
+    const findings = [];
+    // RED TEAM — prompt injection in the config body / instructions / descriptions.
+    const scan = scanForInjection(text);
+    if (scan.verdict !== "clean") {
+        inject(findings, {
+            rule: `injection:${scan.verdict}`,
+            severity: scan.verdict === "malicious" ? "error" : "warning",
+            team: "red",
+            message: `prompt-injection signals (${scan.findings.map((x) => x.rule).slice(0, 4).join(", ")})`,
+        });
+    }
+    // Classic override phrases (caught explicitly even when sub-threshold).
+    for (const m of text.matchAll(/ignore (?:all )?previous instructions|disregard (?:the )?(?:above|system)|reveal (?:your )?system prompt|you are now/gi)) {
+        inject(findings, { rule: "injection:override-phrase", severity: "warning", team: "red", message: "instruction-override phrase present", match: m[0].slice(0, 60) });
+    }
+    // BLUE TEAM — permission posture.
+    for (const d of DANGER_TOKENS) {
+        const m = text.match(d.re);
+        if (m)
+            inject(findings, { rule: d.rule, severity: "error", team: "blue", message: d.message, match: m[0].slice(0, 60) });
+    }
+    // For personaxis/persona configs, parse the permissions block and check guards.
+    if (kind === "personaxis" || kind === "persona-md") {
+        try {
+            const fm = matter(text).data;
+            const perms = fm.permissions;
+            if (perms) {
+                const denies = Array.isArray(perms.deny) ? perms.deny.map(String) : [];
+                const hasRmGuard = denies.some((d) => /rm\b|rmdir|del\b/.test(d));
+                const hasPipeGuard = denies.some((d) => /curl|wget|\|\s*(ba)?sh/.test(d));
+                if (perms.sandbox !== "read-only" && !hasRmGuard)
+                    inject(findings, { rule: "perm:no-rm-guard", severity: "warning", team: "blue", message: "writable sandbox without a deny rule for destructive `rm`/`del`" });
+                if (perms.sandbox === "danger-full-access" && !hasPipeGuard)
+                    inject(findings, { rule: "perm:no-pipe-guard", severity: "warning", team: "blue", message: "full access without a deny rule for `curl|sh` remote execution" });
+            }
+        }
+        catch {
+            /* not valid frontmatter; the token scan above still applies */
+        }
+    }
+    // AUDITOR — credential leaks.
+    for (const s of SECRET_PATTERNS) {
+        for (const m of text.matchAll(s.re)) {
+            inject(findings, { rule: s.rule, severity: "error", team: "auditor", message: "looks like a hardcoded credential — never ship secrets in a config", match: m[0].slice(0, 8) + "…" });
+        }
+    }
+    // AUDITOR — remote skill/source references to review (supply chain).
+    const remotes = new Set();
+    for (const m of text.matchAll(REMOTE_SOURCE))
+        remotes.add(m[1]);
+    for (const r of [...remotes].slice(0, 20)) {
+        if (/skill|agent|prompt|tool/i.test(r) || r.startsWith("github:"))
+            inject(findings, { rule: "supply-chain:remote-source", severity: "info", team: "auditor", message: "external source — audit before trusting", match: r.slice(0, 60) });
+    }
+    // Score + verdict.
+    const weight = (s) => (s === "error" ? 1 : s === "warning" ? 0.4 : 0.1);
+    const score = Number(findings.reduce((a, f) => a + weight(f.severity), 0).toFixed(2));
+    const hasLeakOrMalicious = findings.some((f) => f.team === "auditor" && f.severity === "error") || findings.some((f) => f.rule === "injection:malicious");
+    const hasError = findings.some((f) => f.severity === "error");
+    const hasWarn = findings.some((f) => f.severity === "warning");
+    const verdict = hasLeakOrMalicious ? "malicious" : hasError ? "risky" : hasWarn ? "suspicious" : "clean";
+    return { kind, verdict, score, findings };
+}

package/dist/context.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Context-window management (the bottom-bar meter + auto-compaction).
+ *
+ * Every serious agent tracks how full the model's context window is and compacts
+ * before it overflows (Claude Code auto-compacts ~80%; Hermes shows `model │
+ * 14.4K/256K │ %`). Two hard parts handled here, model-agnostically:
+ *   1. The window VARIES per model and we won't hardcode thousands — so we resolve
+ *      it dynamically from the endpoint's `/models` (OpenRouter/Ollama expose
+ *      `context_length`), cache it, and fall back to a small pattern table.
+ *   2. Compaction must fire with HEADROOM (default 0.8): summarizing is itself a
+ *      model call that needs room for the conversation + the summary; waiting for
+ *      100% leaves no space and most providers hard-error at the limit.
+ */
+import type { TokenUsage } from "./tool-calling.js";
+import type { ChatMessage } from "./tool-calling.js";
+export interface ModelEndpoint {
+    endpoint: string;
+    model: string;
+    apiKey?: string;
+    fetchImpl?: typeof fetch;
+}
+export declare function tableContextWindow(model: string): number;
+/** Synchronous best-known window (cache → table). Safe for render paths. */
+export declare function cachedContextWindow(model: string): number;
+/**
+ * Resolve the model's context window, best-effort: query `{endpoint}/models`,
+ * read context_length/context_window, cache it; else fall back to the table.
+ * Never throws; never blocks startup beyond a short timeout.
+ */
+export declare function resolveContextWindow(cfg: ModelEndpoint, timeoutMs?: number): Promise<number>;
+/** Rough token estimate when the provider doesn't report usage (~4 chars/token). */
+export declare function estimateTokens(text: string): number;
+export declare function estimateMessagesTokens(messages: ChatMessage[]): number;
+/**
+ * Tracks how full the context window is across a session. `used` is the size of
+ * the last prompt sent (the live context), preferring provider-reported tokens.
+ */
+export declare class ContextMeter {
+    limit: number;
+    used: number;
+    readonly startedAt: number;
+    constructor(limit: number);
+    /** Record the provider's reported usage for the last call. */
+    observe(usage?: TokenUsage): void;
+    /** Fallback: estimate from the current message array. */
+    estimate(messages: ChatMessage[]): void;
+    get pct(): number;
+    get elapsedSeconds(): number;
+}
+export interface CompactOptions {
+    llm: ModelEndpoint;
+    threshold?: number;
+    keepLastN?: number;
+}
+export interface CompactResult {
+    messages: ChatMessage[];
+    compacted: boolean;
+    summary?: string;
+    removed?: number;
+}
+/**
+ * Compact the conversation when the meter crosses the threshold: summarize the
+ * older messages into one, keep the system message + the last N turns. The
+ * summary is produced by the model itself (Claude-Code style). Best-effort: if the
+ * summarizer call fails, returns the messages unchanged (never breaks the session).
+ */
+export declare function compactMessages(messages: ChatMessage[], meter: ContextMeter, opts: CompactOptions): Promise<CompactResult>;