@rewind-ai/cli 0.6.2

package/dist/src/enforcement/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../../../src/enforcement/detect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAe,EACf,WAAW,GAAG,cAAc,EAAE;IAM9B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,OAAO,IAAI,sBAAsB,CAAC,KAAK,yBAAyB;QACnE,CAAC,CAAC,MAAM,KAAK,WAAW;QACxB,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,eAAe,KAAK,OAAO,CAAC,CAC1D,CAAC;IAEF,0FAA0F;IAC1F,MAAM,GAAG,GAAG,GAAG,sBAAsB,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC;IAChE,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YAChB,QAAQ,GAAG,MAAM,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3C,MAAM,KAAK,GACT,CAAC,CAAC,MAAM,KAAK,OAAO;YAClB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;YACd,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,IAAI,IAAI,IAAI,CAAC;QACrC,IAAI,QAAQ,IAAI,KAAK,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC5C,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,2BAA2B,CAAC,CAAC,EAAE,EAAE;aAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,iBAAiB,CACnC;QACE,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,kBAAkB;QAC7B,QAAQ,EAAE,0DAA0D,OAAO,cAAc,QAAQ,IAAI,QAAQ,GAAG;QAChH,MAAM,EAAE,WAAW;KACpB,EACD,WAAW,CACZ,CAAC;IACF,MAAM,aAAa,CACjB,OAAO,EACP,KAAK,CAAC,EAAE,EACR,+BAA+B,EAC/B,WAAW,CACZ,CAAC;IACF,OAAO;QACL,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,KAAK,CAAC,EAAE;QACvB,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,SAAiB,EACjB,QAAgB,EAChB,WAAW,GAAG,cAAc,EAAE;IAE9B,OAAO,iBAAiB,CACtB;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,OAAO;QACb,SAAS;QACT,QAAQ;QACR,MAAM,EAAE,SAAS;KAClB,EACD,WAAW,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,WAAW,GAAG,cAAc,EAAE;IAE9B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,KAAK,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC,iBAAiB,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,aAAa,CAAC;AAC9B,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}

package/dist/src/enforcement/hook-policy.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Pure policy decision helpers for Cursor hooks / harnesses.
+ * Prompt compliance is NOT used here — these return allow/deny for tool gates.
+ */
+export type HookPermission = "allow" | "deny";
+export interface HookDecision {
+    permission: HookPermission;
+    user_message?: string;
+    agent_message?: string;
+}
+export declare function pathTouchesEnforced(candidate: string | null | undefined, enforcedRootAbs?: string): boolean;
+/**
+ * preToolUse decision: deny native mutating tools targeting enforced sandbox.
+ * Allow Read/Grep/Glob and non-enforced paths.
+ */
+export declare function decidePreToolUse(input: {
+    tool_name?: string;
+    tool_input?: unknown;
+    enforcedRootAbs?: string;
+}): HookDecision;
+/**
+ * beforeShellExecution: deny mutation commands that mention the enforced sandbox.
+ * Read-only commands (cat, ls, find without -delete, etc.) that only read are allowed
+ * even if they mention the path — but redirection / rm / chmod are denied.
+ */
+export declare function decideShellExecution(input: {
+    command?: string;
+    enforcedRootAbs?: string;
+}): HookDecision;
+/**
+ * beforeMCPExecution: allow REWIND tools; deny nothing by default for rewind server.
+ */
+export declare function decideMcpExecution(input: {
+    tool_name?: string;
+    mcp_server_name?: string;
+}): HookDecision;
+/** Test harness: classify whether a shell write should be blocked by policy. */
+export declare function shellWriteWouldBeBlocked(command: string, enforcedRootAbs?: string): boolean;

package/dist/src/enforcement/hook-policy.js

@@ -0,0 +1,111 @@
+/**
+ * Pure policy decision helpers for Cursor hooks / harnesses.
+ * Prompt compliance is NOT used here — these return allow/deny for tool gates.
+ */
+import { ENFORCED_SANDBOX_DIR_NAME } from "../paths.js";
+const MUTATING_NATIVE_TOOLS = new Set([
+    "Write",
+    "Delete",
+    "StrReplace",
+    "EditNotebook",
+    "DeleteNotebookCell",
+]);
+/** Shell tokens that indicate filesystem mutation. */
+const SHELL_MUTATION_RE = /(^|[\s;|&])(rm|mv|cp|mkdir|rmdir|touch|chmod|chown|ln|tee|install|dd|truncate|sed\s+-i)\b|>|>>|>\(/i;
+export function pathTouchesEnforced(candidate, enforcedRootAbs) {
+    if (!candidate)
+        return false;
+    const norm = candidate.replace(/\\/g, "/");
+    // Segment match: ".../name/...", " name/...", or exact name.
+    const seg = new RegExp(`(?:^|[\\s/"'])${ENFORCED_SANDBOX_DIR_NAME}(?:/|$|[\\s"'])`);
+    if (seg.test(norm))
+        return true;
+    if (enforcedRootAbs) {
+        const root = enforcedRootAbs.replace(/\\/g, "/");
+        const c = norm;
+        if (c === root || c.startsWith(root.endsWith("/") ? root : root + "/")) {
+            return true;
+        }
+    }
+    return false;
+}
+function extractPathsFromToolInput(toolInput) {
+    if (!toolInput || typeof toolInput !== "object")
+        return [];
+    const o = toolInput;
+    const keys = ["path", "file_path", "target_notebook", "from", "to"];
+    const out = [];
+    for (const k of keys) {
+        if (typeof o[k] === "string")
+            out.push(o[k]);
+    }
+    if (Array.isArray(o.paths)) {
+        for (const p of o.paths) {
+            if (typeof p === "string")
+                out.push(p);
+        }
+    }
+    return out;
+}
+/**
+ * preToolUse decision: deny native mutating tools targeting enforced sandbox.
+ * Allow Read/Grep/Glob and non-enforced paths.
+ */
+export function decidePreToolUse(input) {
+    const name = input.tool_name ?? "";
+    if (!MUTATING_NATIVE_TOOLS.has(name)) {
+        return { permission: "allow" };
+    }
+    const paths = extractPathsFromToolInput(input.tool_input);
+    const hits = paths.filter((p) => pathTouchesEnforced(p, input.enforcedRootAbs));
+    if (hits.length === 0) {
+        return { permission: "allow" };
+    }
+    return {
+        permission: "deny",
+        user_message: "REWIND V3: native write/delete to sandbox-enforced-project is blocked. Use REWIND MCP.",
+        agent_message: "POLICY: Direct native mutation of sandbox-enforced-project is denied. Use rewind_write_file / rewind_create_file / other REWIND MCP tools with sandbox=enforced.",
+    };
+}
+/**
+ * beforeShellExecution: deny mutation commands that mention the enforced sandbox.
+ * Read-only commands (cat, ls, find without -delete, etc.) that only read are allowed
+ * even if they mention the path — but redirection / rm / chmod are denied.
+ */
+export function decideShellExecution(input) {
+    const cmd = input.command ?? "";
+    if (!cmd.trim())
+        return { permission: "allow" };
+    const touches = pathTouchesEnforced(cmd, input.enforcedRootAbs);
+    if (!touches)
+        return { permission: "allow" };
+    if (SHELL_MUTATION_RE.test(cmd)) {
+        return {
+            permission: "deny",
+            user_message: "REWIND V3: shell mutation of sandbox-enforced-project is blocked.",
+            agent_message: "POLICY: Shell filesystem mutation against sandbox-enforced-project is denied. Use REWIND MCP mediation.",
+        };
+    }
+    // Mentions enforced path but no obvious mutation token — still deny chmod-like patterns
+    // already covered. Allow pure reads.
+    return { permission: "allow" };
+}
+/**
+ * beforeMCPExecution: allow REWIND tools; deny nothing by default for rewind server.
+ */
+export function decideMcpExecution(input) {
+    const server = (input.mcp_server_name ?? "").toLowerCase();
+    const tool = input.tool_name ?? "";
+    if (server === "rewind" || tool.startsWith("rewind_")) {
+        return { permission: "allow" };
+    }
+    return { permission: "allow" };
+}
+/** Test harness: classify whether a shell write should be blocked by policy. */
+export function shellWriteWouldBeBlocked(command, enforcedRootAbs) {
+    const input = { command };
+    if (enforcedRootAbs !== undefined)
+        input.enforcedRootAbs = enforcedRootAbs;
+    return decideShellExecution(input).permission === "deny";
+}
+//# sourceMappingURL=hook-policy.js.map

package/dist/src/enforcement/hook-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-policy.js","sourceRoot":"","sources":["../../../src/enforcement/hook-policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAUxD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,oBAAoB;CACrB,CAAC,CAAC;AAEH,sDAAsD;AACtD,MAAM,iBAAiB,GACrB,qGAAqG,CAAC;AAExG,MAAM,UAAU,mBAAmB,CACjC,SAAoC,EACpC,eAAwB;IAExB,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,6DAA6D;IAC7D,MAAM,GAAG,GAAG,IAAI,MAAM,CACpB,iBAAiB,yBAAyB,iBAAiB,CAC5D,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC;QACf,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAkB;IACnD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,CAAC,GAAG,SAAoC,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAIhC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,KAAK,GAAG,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9B,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,CAC9C,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,YAAY,EACV,wFAAwF;QAC1F,aAAa,EACX,kKAAkK;KACrK,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAGpC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,UAAU,EAAE,MAAM;YAClB,YAAY,EACV,mEAAmE;YACrE,aAAa,EACX,yGAAyG;SAC5G,CAAC;IACJ,CAAC;IACD,wFAAwF;IACxF,qCAAqC;IACrC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAGlC;IACC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,eAAwB;IAExB,MAAM,KAAK,GAAmD,EAAE,OAAO,EAAE,CAAC;IAC1E,IAAI,eAAe,KAAK,SAAS;QAAE,KAAK,CAAC,eAAe,GAAG,eAAe,CAAC;IAC3E,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC;AAC3D,CAAC"}

package/dist/src/enforcement/index.d.ts

@@ -0,0 +1,8 @@
+export type { PolicyEvent, EnforcementState, PathTrustRecord } from "./types.js";
+export { recordPolicyEvent, listPolicyEvents, loadPolicyEvent, formatPolicyViolation, } from "./policy.js";
+export { markAuthoritative, markUntrusted, getPathTrust, listTrustRecords, setPathTrust, } from "./trust.js";
+export { decidePreToolUse, decideShellExecution, decideMcpExecution, shellWriteWouldBeBlocked, pathTouchesEnforced, } from "./hook-policy.js";
+export { lockEnforcedReadonly, unlockEnforcedWritable, withEnforcedWriteAccess, probeDirectWriteBlocked, } from "./readonly.js";
+export { enableEnforcement, disableEnforcement, createEnforcedSandbox, loadEnforcementState, isEnforcedLocked, runUnderWriteDenySeatbelt, writeSeatbeltProfile, } from "./setup.js";
+export { classifyExternalMutation, recordBlockedWrite, } from "./detect.js";
+export { measureMs, formatPerfTable } from "./perf.js";

package/dist/src/enforcement/index.js

@@ -0,0 +1,8 @@
+export { recordPolicyEvent, listPolicyEvents, loadPolicyEvent, formatPolicyViolation, } from "./policy.js";
+export { markAuthoritative, markUntrusted, getPathTrust, listTrustRecords, setPathTrust, } from "./trust.js";
+export { decidePreToolUse, decideShellExecution, decideMcpExecution, shellWriteWouldBeBlocked, pathTouchesEnforced, } from "./hook-policy.js";
+export { lockEnforcedReadonly, unlockEnforcedWritable, withEnforcedWriteAccess, probeDirectWriteBlocked, } from "./readonly.js";
+export { enableEnforcement, disableEnforcement, createEnforcedSandbox, loadEnforcementState, isEnforcedLocked, runUnderWriteDenySeatbelt, writeSeatbeltProfile, } from "./setup.js";
+export { classifyExternalMutation, recordBlockedWrite, } from "./detect.js";
+export { measureMs, formatPerfTable } from "./perf.js";
+//# sourceMappingURL=index.js.map

package/dist/src/enforcement/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/enforcement/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC"}

package/dist/src/enforcement/perf.d.ts

@@ -0,0 +1,6 @@
+import type { PerfSample } from "./types.js";
+export declare function measureMs<T>(name: string, fn: () => Promise<T>, detail?: string): Promise<{
+    result: T;
+    sample: PerfSample;
+}>;
+export declare function formatPerfTable(samples: PerfSample[]): string;

package/dist/src/enforcement/perf.js

@@ -0,0 +1,18 @@
+import { performance } from "node:perf_hooks";
+export async function measureMs(name, fn, detail) {
+    const t0 = performance.now();
+    const result = await fn();
+    const ms = performance.now() - t0;
+    const sample = { name, ms };
+    if (detail !== undefined)
+        sample.detail = detail;
+    return { result, sample };
+}
+export function formatPerfTable(samples) {
+    const lines = ["REWIND V3 PERFORMANCE (no optimisation)", ""];
+    for (const s of samples) {
+        lines.push(`${s.name.padEnd(32)} ${s.ms.toFixed(2).padStart(10)} ms${s.detail ? `  (${s.detail})` : ""}`);
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=perf.js.map

package/dist/src/enforcement/perf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"perf.js","sourceRoot":"","sources":["../../../src/enforcement/perf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,EAAoB,EACpB,MAAe;IAEf,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IAClC,MAAM,MAAM,GAAe,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACxC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAqB;IACnD,MAAM,KAAK,GAAG,CAAC,yCAAyC,EAAE,EAAE,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/src/enforcement/policy.d.ts

@@ -0,0 +1,12 @@
+import type { PolicyEvent, PolicyEventType, PolicyEventStatus } from "./types.js";
+export declare function newPolicyEventId(): string;
+export declare function recordPolicyEvent(input: {
+    type: PolicyEventType;
+    path?: string | null;
+    mechanism: string;
+    evidence: string;
+    status: PolicyEventStatus;
+}, projectRoot?: string): Promise<PolicyEvent>;
+export declare function loadPolicyEvent(id: string, projectRoot?: string): Promise<PolicyEvent>;
+export declare function listPolicyEvents(projectRoot?: string): Promise<PolicyEvent[]>;
+export declare function formatPolicyViolation(event: PolicyEvent): string;

package/dist/src/enforcement/policy.js

@@ -0,0 +1,84 @@
+import path from "node:path";
+import { mkdir, writeFile, readFile, readdir, rename, } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
+import { getPolicyDir, getProjectRoot } from "../paths.js";
+async function writeJsonAtomic(file, data) {
+    await mkdir(path.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp-${process.pid}`;
+    await writeFile(tmp, JSON.stringify(data, null, 2) + "\n", "utf8");
+    await rename(tmp, file);
+}
+export function newPolicyEventId() {
+    return `pol_${randomBytes(8).toString("hex")}`;
+}
+export async function recordPolicyEvent(input, projectRoot = getProjectRoot()) {
+    const event = {
+        id: newPolicyEventId(),
+        version: 3,
+        time: new Date().toISOString(),
+        type: input.type,
+        path: input.path ?? null,
+        mechanism: input.mechanism,
+        evidence: input.evidence,
+        status: input.status,
+    };
+    const dir = getPolicyDir(projectRoot);
+    await mkdir(dir, { recursive: true });
+    await writeJsonAtomic(path.join(dir, `${event.id}.json`), event);
+    await writeFile(path.join(dir, "index.jsonl"), JSON.stringify({
+        id: event.id,
+        type: event.type,
+        path: event.path,
+        status: event.status,
+        time: event.time,
+    }) + "\n", { flag: "a" });
+    await writeJsonAtomic(path.join(dir, "latest.json"), { id: event.id });
+    return event;
+}
+export async function loadPolicyEvent(id, projectRoot = getProjectRoot()) {
+    if (!/^pol_[A-Za-z0-9]+$/.test(id)) {
+        throw new Error(`Invalid policy event id: ${id}`);
+    }
+    const raw = await readFile(path.join(getPolicyDir(projectRoot), `${id}.json`), "utf8");
+    return JSON.parse(raw);
+}
+export async function listPolicyEvents(projectRoot = getProjectRoot()) {
+    const dir = getPolicyDir(projectRoot);
+    let names;
+    try {
+        names = await readdir(dir);
+    }
+    catch {
+        return [];
+    }
+    const events = [];
+    for (const n of names) {
+        if (!n.startsWith("pol_") || !n.endsWith(".json"))
+            continue;
+        try {
+            events.push(await loadPolicyEvent(n.replace(/\.json$/, ""), projectRoot));
+        }
+        catch {
+            /* skip */
+        }
+    }
+    events.sort((a, b) => a.time.localeCompare(b.time) || a.id.localeCompare(b.id));
+    return events;
+}
+export function formatPolicyViolation(event) {
+    return [
+        "POLICY VIOLATION",
+        "",
+        `Unexpected filesystem mutation detected:`,
+        event.path ?? "(unknown path)",
+        "",
+        "No mediated REWIND action exists for this change.",
+        "",
+        `Type: ${event.type}`,
+        `Mechanism: ${event.mechanism}`,
+        `Evidence: ${event.evidence}`,
+        `Status: ${event.status}`,
+        `Event: ${event.id}`,
+    ].join("\n");
+}
+//# sourceMappingURL=policy.js.map

package/dist/src/enforcement/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/enforcement/policy.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,KAAK,EACL,SAAS,EACT,QAAQ,EACR,OAAO,EACP,MAAM,GACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG3D,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAa;IACxD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAMC,EACD,WAAW,GAAG,cAAc,EAAE;IAE9B,MAAM,KAAK,GAAgB;QACzB,EAAE,EAAE,gBAAgB,EAAE;QACtB,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAC7B,IAAI,CAAC,SAAS,CAAC;QACb,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,GAAG,IAAI,EACT,EAAE,IAAI,EAAE,GAAG,EAAE,CACd,CAAC;IACF,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAU,EACV,WAAW,GAAG,cAAc,EAAE;IAE9B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,EAClD,MAAM,CACP,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAW,GAAG,cAAc,EAAE;IAE9B,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5D,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAkB;IACtD,OAAO;QACL,kBAAkB;QAClB,EAAE;QACF,0CAA0C;QAC1C,KAAK,CAAC,IAAI,IAAI,gBAAgB;QAC9B,EAAE;QACF,mDAAmD;QACnD,EAAE;QACF,SAAS,KAAK,CAAC,IAAI,EAAE;QACrB,cAAc,KAAK,CAAC,SAAS,EAAE;QAC/B,aAAa,KAAK,CAAC,QAAQ,EAAE;QAC7B,WAAW,KAAK,CAAC,MAAM,EAAE;QACzB,UAAU,KAAK,CAAC,EAAE,EAAE;KACrB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/src/enforcement/readonly.d.ts

@@ -0,0 +1,17 @@
+export declare function lockEnforcedReadonly(projectRoot?: string): Promise<{
+    files: number;
+    dirs: number;
+}>;
+export declare function unlockEnforcedWritable(projectRoot?: string): Promise<{
+    files: number;
+    dirs: number;
+}>;
+/**
+ * Run fn while the enforced tree is briefly writable, then re-lock.
+ * Fail-closed: always attempts re-lock in finally.
+ */
+export declare function withEnforcedWriteAccess<T>(projectRoot: string, fn: () => Promise<T>): Promise<T>;
+export declare function probeDirectWriteBlocked(projectRoot?: string): Promise<{
+    blocked: boolean;
+    error: string | null;
+}>;

package/dist/src/enforcement/readonly.js

@@ -0,0 +1,124 @@
+import path from "node:path";
+import { chmod, lstat, readdir, realpath, } from "node:fs/promises";
+import { ENFORCED_SANDBOX_DIR_NAME, PathSafetyError, assertApprovedSandbox, getEnforcedSandboxPath, getProjectRoot, isPathInside, } from "../paths.js";
+/**
+ * Filesystem read-only lock for sandbox-enforced-project.
+ * Same UID as REWIND — broker must unlock briefly to mutate.
+ * This is NOT a separate identity boundary; document that clearly.
+ */
+async function walk(abs, root, visit) {
+    if (!(await isPathInsideAsync(root, abs))) {
+        throw new PathSafetyError(`Walk escape blocked: ${abs}`);
+    }
+    const st = await lstat(abs);
+    if (st.isSymbolicLink()) {
+        // Do not follow; leave symlink mode alone (often irrelevant)
+        return;
+    }
+    if (st.isDirectory()) {
+        const kids = await readdir(abs);
+        for (const name of kids) {
+            await walk(path.join(abs, name), root, visit);
+        }
+        await visit(abs, true);
+        return;
+    }
+    if (st.isFile()) {
+        await visit(abs, false);
+    }
+}
+async function isPathInsideAsync(root, candidate) {
+    if (isPathInside(root, candidate))
+        return true;
+    try {
+        const rr = await realpath(root);
+        const rc = await realpath(candidate);
+        return isPathInside(rr, rc);
+    }
+    catch {
+        return false;
+    }
+}
+export async function lockEnforcedReadonly(projectRoot = getProjectRoot()) {
+    const root = getEnforcedSandboxPath(projectRoot);
+    await assertApprovedSandbox(root, projectRoot, ENFORCED_SANDBOX_DIR_NAME);
+    let files = 0;
+    let dirs = 0;
+    await walk(root, root, async (abs, isDir) => {
+        if (isDir) {
+            await chmod(abs, 0o555);
+            dirs += 1;
+        }
+        else {
+            await chmod(abs, 0o444);
+            files += 1;
+        }
+    });
+    return { files, dirs };
+}
+export async function unlockEnforcedWritable(projectRoot = getProjectRoot()) {
+    const root = getEnforcedSandboxPath(projectRoot);
+    await assertApprovedSandbox(root, projectRoot, ENFORCED_SANDBOX_DIR_NAME);
+    let files = 0;
+    let dirs = 0;
+    // Unlock root first so we can traverse
+    await chmod(root, 0o755);
+    await walk(root, root, async (abs, isDir) => {
+        if (isDir) {
+            await chmod(abs, 0o755);
+            dirs += 1;
+        }
+        else {
+            await chmod(abs, 0o644);
+            files += 1;
+        }
+    });
+    return { files, dirs };
+}
+/**
+ * Run fn while the enforced tree is briefly writable, then re-lock.
+ * Fail-closed: always attempts re-lock in finally.
+ */
+export async function withEnforcedWriteAccess(projectRoot, fn) {
+    await unlockEnforcedWritable(projectRoot);
+    let result;
+    let fnError;
+    try {
+        result = await fn();
+    }
+    catch (err) {
+        fnError = err;
+    }
+    try {
+        await lockEnforcedReadonly(projectRoot);
+    }
+    catch (err) {
+        process.stderr.write(`[rewind-enforcement] CRITICAL: failed to re-lock enforced sandbox: ${err instanceof Error ? err.message : String(err)}\n` +
+            `Recovery: chmod -R u+w "${getEnforcedSandboxPath(projectRoot)}" && ` +
+            `find "${getEnforcedSandboxPath(projectRoot)}" -type d -exec chmod 555 {} \\; && ` +
+            `find "${getEnforcedSandboxPath(projectRoot)}" -type f -exec chmod 444 {} \\;\n`);
+        if (fnError === undefined)
+            throw err;
+        throw fnError;
+    }
+    if (fnError !== undefined)
+        throw fnError;
+    return result;
+}
+export async function probeDirectWriteBlocked(projectRoot = getProjectRoot()) {
+    const root = getEnforcedSandboxPath(projectRoot);
+    const probe = path.join(root, `.rewind-probe-${process.pid}.txt`);
+    const { writeFile, rm } = await import("node:fs/promises");
+    try {
+        await writeFile(probe, "should-fail");
+        await rm(probe, { force: true }).catch(() => undefined);
+        return { blocked: false, error: null };
+    }
+    catch (err) {
+        return {
+            blocked: true,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+//# sourceMappingURL=readonly.js.map

package/dist/src/enforcement/readonly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readonly.js","sourceRoot":"","sources":["../../../src/enforcement/readonly.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,KAAK,EACL,KAAK,EACL,OAAO,EACP,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AAEH,KAAK,UAAU,IAAI,CACjB,GAAW,EACX,IAAY,EACZ,KAAyD;IAEzD,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QACxB,6DAA6D;QAC7D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAiB;IAC9D,IAAI,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAW,GAAG,cAAc,EAAE;IAE9B,MAAM,IAAI,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,qBAAqB,CAAC,IAAI,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC;IAC1E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxB,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAW,GAAG,cAAc,EAAE;IAE9B,MAAM,IAAI,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,qBAAqB,CAAC,IAAI,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC;IAC1E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,uCAAuC;IACvC,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxB,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,EAAoB;IAEpB,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,MAAS,CAAC;IACd,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,GAAG,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sEACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI;YACF,2BAA2B,sBAAsB,CAAC,WAAW,CAAC,OAAO;YACrE,SAAS,sBAAsB,CAAC,WAAW,CAAC,sCAAsC;YAClF,SAAS,sBAAsB,CAAC,WAAW,CAAC,oCAAoC,CACnF,CAAC;QACF,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,GAAG,CAAC;QACrC,MAAM,OAAO,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC;IACzC,OAAO,MAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAW,GAAG,cAAc,EAAE;IAE9B,MAAM,IAAI,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IAClE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/enforcement/sandbox-clone.d.ts

@@ -0,0 +1,6 @@
+/** Materialize deterministic sandbox content at an already-validated root. */
+export declare function planSandboxForRoot(root: string, seed?: string): Promise<{
+    fileCount: number;
+    directoryCount: number;
+    symlinkCount: number;
+}>;

package/dist/src/enforcement/sandbox-clone.js

@@ -0,0 +1,11 @@
+import { materializeSandbox, SANDBOX_SEED } from "../sandbox.js";
+/** Materialize deterministic sandbox content at an already-validated root. */
+export async function planSandboxForRoot(root, seed = SANDBOX_SEED) {
+    const result = await materializeSandbox(root, seed);
+    return {
+        fileCount: result.fileCount,
+        directoryCount: result.directoryCount,
+        symlinkCount: result.symlinkCount,
+    };
+}
+//# sourceMappingURL=sandbox-clone.js.map

package/dist/src/enforcement/sandbox-clone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-clone.js","sourceRoot":"","sources":["../../../src/enforcement/sandbox-clone.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEjE,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,OAAe,YAAY;IAM3B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC;AACJ,CAAC"}

package/dist/src/enforcement/setup.d.ts

@@ -0,0 +1,33 @@
+import type { EnforcementMechanism, EnforcementState } from "./types.js";
+export declare function enforcementStatePath(projectRoot?: string): string;
+export declare function loadEnforcementState(projectRoot?: string): Promise<EnforcementState | null>;
+export declare function saveEnforcementState(state: EnforcementState, projectRoot?: string): Promise<void>;
+/**
+ * Create sandbox-enforced-project from the same deterministic plan as V0,
+ * without touching sandbox-test-project.
+ */
+export declare function createEnforcedSandbox(projectRoot?: string): Promise<{
+    root: string;
+    fileCount: number;
+    directoryCount: number;
+    symlinkCount: number;
+}>;
+export declare function writeSeatbeltProfile(projectRoot?: string): Promise<string>;
+/**
+ * Run a command under sandbox-exec with writes to enforced sandbox denied.
+ */
+export declare function runUnderWriteDenySeatbelt(command: string, args: string[], profilePath: string): Promise<{
+    code: number;
+    stdout: string;
+    stderr: string;
+}>;
+export interface EnableEnforcementOptions {
+    mechanism?: EnforcementMechanism;
+    installHooks?: boolean;
+}
+export declare function enableEnforcement(projectRoot?: string, options?: EnableEnforcementOptions): Promise<EnforcementState>;
+export declare function disableEnforcement(projectRoot?: string, options?: {
+    removeTree?: boolean;
+}): Promise<void>;
+/** True when mediated writes to enforced sandbox must use broker unlock. */
+export declare function isEnforcedLocked(projectRoot?: string): Promise<boolean>;