@pugi/cli 0.1.0-beta.10 → 0.1.0-beta.100

package/dist/tools/registry.js

@@ -1,33 +1,148 @@
 const registry = [
-    // α7.7: unified-diff patch apply. Routes through the same security
+    // : unified-diff patch apply. Routes through the same security
     // gate as Layer A/B/C, so the risk class matches `edit`/`write`
     // (medium — writes inside the workspace, never to protected files).
     { name: 'apply_patch', permission: 'edit', risk: 'medium', concurrencySafe: false, m1: true },
+    // structured multi-choice clarifier tool. Risk =
+    // low because the dispatch is a pure UI surface — no file writes, no
+    // shell, no network. Permission = none (no workspace access required).
+    // concurrencySafe = true because the prompt-budget gate runs in the
+    // engine loop, not via tool-side mutex (one prompt per turn is enforced
+    // by the persona system prompt + the engine's tool_calls budget).
+    { name: 'ask_user_question', permission: 'none', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'bash', permission: 'bash', risk: 'high', concurrencySafe: false, m1: true },
+    // Tool gap pack : structured progress brief. Writes
+    // one JSONL record to `.pugi/briefs/<session>.jsonl` per call via
+    // atomic tmp+rename. Risk = low (metadata only, no source mutation).
+    // concurrencySafe = false because the read-modify-write loop is not
+    // atomic (the rename is atomic but two parallel dispatches could lose
+    // the loser's record).
+    { name: 'brief', permission: 'none', risk: 'low', concurrencySafe: false, m1: false },
+    // Backlog #5 P0 : verify_plan_execution anti-fake-dispatch gate.
+    // Reads session audit events only; safe для parallel dispatches.
+    { name: 'verify_plan_execution', permission: 'none', risk: 'low', concurrencySafe: true, m1: false },
+    // Backlog PUGI-7 : cron_* tool family. Persists routine registry to
+    // `.pugi/cron/<name>.json` (one file per routine, atomic tmp+rename).
+    // Permission = none because the writes land in metadata, not source —
+    // mirrors the brief / todo_write posture. concurrencySafe = false for
+    // create + delete because per-file persistence is atomic individually
+    // but two parallel creates of the SAME name race on the rename and
+    // the loser's body is dropped silently; cron_list is read-only and
+    // safe for concurrent dispatch. Risk = low across the board: routines
+    // are configuration objects, the actual scheduler runner lives behind
+    // an explicit `pugi routines run` opt-in and is OUT of this surface.
+    { name: 'cron_create', permission: 'none', risk: 'low', concurrencySafe: false, m1: false },
+    { name: 'cron_delete', permission: 'none', risk: 'low', concurrencySafe: false, m1: false },
+    { name: 'cron_list', permission: 'none', risk: 'low', concurrencySafe: true, m1: false },
     { name: 'edit', permission: 'edit', risk: 'medium', concurrencySafe: false, m1: true },
+    // Tool gap pack : scratch worktree open. Spawns
+    // `git worktree add` under `.pugi/worktrees/<taskId>/`. Permission =
+    // edit because the spawn materialises files on disk; risk = medium
+    // to mirror the existing worktree_create posture (PR r1 raised
+    // that one for disk-pressure parity, same applies here).
+    { name: 'enter_worktree', permission: 'edit', risk: 'medium', concurrencySafe: false, m1: false },
+    // Tool gap pack : scratch worktree teardown. The
+    // destructive primitive — runs `git worktree remove --force` then a
+    // recursive rmSync, both gated by a strict containment check that
+    // refuses any path outside <workspace>/.pugi/worktrees/. Mirrors
+    // worktree_drop's medium-risk posture for the same reason.
+    { name: 'exit_worktree', permission: 'edit', risk: 'medium', concurrencySafe: false, m1: false },
     { name: 'glob', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'grep', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
-    // α7.7: LSP read-only surface. Server runs locally, no Anvil
+    // Phase 1 runtime evidence pack (PUGI-291..295): http_request issues a
+    // single HTTP call, mostly against loopback URLs produced by
+    // `server_start`. permission = 'network' to share the same egress
+    // gate as web_fetch; risk = 'medium' because the dispatcher will
+    // accept arbitrary verbs (POST/PUT/DELETE) - destructive verbs only
+    // when the caller opts in by URL/body. concurrencySafe = true because
+    // every dispatch is a fresh fetch with no shared state.
+    { name: 'http_request', permission: 'network', risk: 'medium', concurrencySafe: true, m1: false },
+    // : LSP read-only surface. Server runs locally, no Anvil
     // round-trip. Concurrency-safe because every operation reads
     // server state without mutating workspace files.
     { name: 'lsp_definition', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'lsp_diagnostics', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'lsp_hover', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'lsp_references', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
+    // PUGI-78 Phase 1 — symbols.* namespace. 13 first-class tools that
+    // expose the full LSP symbol-aware surface (definition, references,
+    // hover, signature, document/workspace symbols, rename preview, call
+    // hierarchy, implementations, type definition, code actions,
+    // formatter, diagnostics). All read-only in Phase 1 — `rename` /
+    // `format` / `code_actions` return PREVIEW edits the dispatcher
+    // applies via apply_patch in a future ticket. Permission stays
+    // `read` because no workspace mutation happens on dispatch; risk
+    // stays `low` because the LSP server is local and the payload is
+    // capped at 8 KB per tool.
+    { name: 'symbols_call_hierarchy', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'symbols_code_actions', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'symbols_diagnostics', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'symbols_find_definition', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'symbols_find_references', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'symbols_format', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'symbols_hover', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'symbols_implementations', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'symbols_list_in_file', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'symbols_rename', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'symbols_signature', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'symbols_type_definition', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'symbols_workspace_symbols', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    // β7 L5+T11: multi_edit dispatches an ordered batch of Layer A edits
+    // as a single transaction. Risk = medium (same chokepoints as `edit`).
+    // concurrencySafe = false because the journal serialises one dispatch
+    // per session.
+    { name: 'multi_edit', permission: 'edit', risk: 'medium', concurrencySafe: false, m1: true },
+    // PowerShell tool for Windows-first workflows. Same
+    // bash permission class — destructive-pattern classification fires the
+    // same gate. concurrencySafe = false because spawn-shell child cwd /
+    // env carry-over could race across parallel agent calls.
+    { name: 'powershell', permission: 'bash', risk: 'high', concurrencySafe: false, m1: false },
     { name: 'question', permission: 'none', risk: 'low', concurrencySafe: false, m1: true },
     { name: 'read', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
-    { name: 'skill', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
+    // Phase 1 runtime evidence pack (PUGI-291..295): server_* family.
+    // server_start spawns a process under /bin/sh -c and persists pid +
+    // log path к .pugi/runs/<runId>/. permission = 'bash' shares the
+    // same destructive-classifier gate as the bash tool (the command
+    // ultimately runs in a real shell). risk = 'high' for start/stop
+    // (process lifecycle mutates the operator's machine) and 'low' for
+    // health/logs (read-only probes). concurrencySafe = false for
+    // start/stop because the pid registry is not transactional;
+    // health/logs are safe to dispatch in parallel.
+    { name: 'server_health', permission: 'network', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'server_logs', permission: 'read', risk: 'low', concurrencySafe: true, m1: false },
+    { name: 'server_start', permission: 'bash', risk: 'high', concurrencySafe: false, m1: false },
+    { name: 'server_stop', permission: 'bash', risk: 'high', concurrencySafe: false, m1: false },
+    // Tool gap pack : wall-clock pause primitive. No
+    // filesystem / network / shell side-effects. concurrencySafe = true
+    // because every dispatch is a fresh setTimeout closure with no
+    // shared state.
+    { name: 'sleep', permission: 'none', risk: 'low', concurrencySafe: true, m1: false },
+    // Tool gap pack : experimental engine-only echo
+    // helper. Writes verbatim bytes to the requested stream so a test
+    // harness can assert on the dispatch without spinning the full
+    // engine loop. NOT advertised to customer agents (allowSyntheticOutput
+    // opt-in at the executor level). Risk = low (no source mutation, no
+    // shell), concurrencySafe = true (writes go to fresh stream calls).
+    { name: 'synthetic_output', permission: 'none', risk: 'low', concurrencySafe: true, m1: false },
     { name: 'task_create', permission: 'none', risk: 'low', concurrencySafe: false, m1: true },
     { name: 'task_get', permission: 'none', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'task_list', permission: 'none', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'task_update', permission: 'none', risk: 'low', concurrencySafe: false, m1: true },
+    // batch TodoWrite. Mirrors the standard tool's upstream
+    // surface — full board snapshot, single-in-progress invariant, atomic
+    // tmp+rename persistence to `.pugi/todos.json`. `concurrencySafe = false`
+    // because two concurrent writes could lose the loser's snapshot (the
+    // rename is atomic but the read-modify-write loop is not). Risk = low
+    // because the only filesystem mutation lands inside `.pugi/todos.json`,
+    // which is metadata, not source.
+    { name: 'todo_write', permission: 'none', risk: 'low', concurrencySafe: false, m1: true },
     { name: 'web_fetch', permission: 'network', risk: 'medium', concurrencySafe: true, m1: true },
-    // α7.7: scratch worktree management. `worktree_create` writes nothing
+    // : scratch worktree management. `worktree_create` writes nothing
     // dangerous (a clone under `.pugi/worktrees/`); `worktree_promote`
     // applies a diff back to the main tree, so it shares the `edit`
     // risk class. `worktree_drop` is the cleanup primitive.
     //
-    // R1 fix (2026-05-26, PR #413 r1, Fix 9): raised `worktree_create`
+    // R1 fix (2026-05-26, PR r1, Fix 9): raised `worktree_create`
     // and `worktree_drop` from `low` to `medium`. `worktree_drop` runs
     // `rmSync` on its target — even with the new path-containment gate
     // in `core/edits/worktree.ts::dropWorktree`, a destructive primitive