@shepai/cli 1.170.0 → 1.171.0-pr527.e2ee839

package/dist/packages/core/src/infrastructure/repositories/sqlite-security-event.repository.js

@@ -0,0 +1,96 @@
+/**
+ * SQLite Security Event Repository Implementation
+ *
+ * Implements ISecurityEventRepository using SQLite database.
+ * Uses prepared statements to prevent SQL injection.
+ * Supports 90-day retention cleanup.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { injectable } from 'tsyringe';
+import { toDatabase, fromDatabase, } from '../persistence/sqlite/mappers/security-event.mapper.js';
+/**
+ * SQLite implementation of ISecurityEventRepository.
+ * Manages SecurityEvent persistence with repository-scoped queries.
+ */
+let SQLiteSecurityEventRepository = class SQLiteSecurityEventRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async save(event) {
+        const row = toDatabase(event);
+        const stmt = this.db.prepare(`
+      INSERT INTO security_events (
+        id, repository_path, feature_id, severity, category,
+        disposition, actor, message, remediation_summary, created_at
+      ) VALUES (
+        @id, @repository_path, @feature_id, @severity, @category,
+        @disposition, @actor, @message, @remediation_summary, @created_at
+      )
+    `);
+        stmt.run(row);
+    }
+    async findByRepository(repositoryPath, options) {
+        let sql = 'SELECT * FROM security_events WHERE repository_path = ?';
+        const params = [repositoryPath];
+        if (options?.severity) {
+            sql += ' AND severity = ?';
+            params.push(options.severity);
+        }
+        sql += ' ORDER BY created_at DESC';
+        if (options?.limit) {
+            sql += ' LIMIT ?';
+            params.push(options.limit);
+        }
+        if (options?.offset) {
+            sql += ' OFFSET ?';
+            params.push(options.offset);
+        }
+        const stmt = this.db.prepare(sql);
+        const rows = stmt.all(...params);
+        return rows.map(fromDatabase);
+    }
+    async findByFeature(featureId, options) {
+        let sql = 'SELECT * FROM security_events WHERE feature_id = ?';
+        const params = [featureId];
+        if (options?.severity) {
+            sql += ' AND severity = ?';
+            params.push(options.severity);
+        }
+        sql += ' ORDER BY created_at DESC';
+        if (options?.limit) {
+            sql += ' LIMIT ?';
+            params.push(options.limit);
+        }
+        if (options?.offset) {
+            sql += ' OFFSET ?';
+            params.push(options.offset);
+        }
+        const stmt = this.db.prepare(sql);
+        const rows = stmt.all(...params);
+        return rows.map(fromDatabase);
+    }
+    async deleteOlderThan(date) {
+        const stmt = this.db.prepare('DELETE FROM security_events WHERE created_at < ?');
+        const result = stmt.run(date.toISOString());
+        return result.changes;
+    }
+    async count(repositoryPath) {
+        const stmt = this.db.prepare('SELECT COUNT(*) as cnt FROM security_events WHERE repository_path = ?');
+        const row = stmt.get(repositoryPath);
+        return row.cnt;
+    }
+};
+SQLiteSecurityEventRepository = __decorate([
+    injectable(),
+    __metadata("design:paramtypes", [Object])
+], SQLiteSecurityEventRepository);
+export { SQLiteSecurityEventRepository };

package/dist/packages/core/src/infrastructure/repositories/sqlite-settings.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-settings.repository.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/src/infrastructure/repositories/sqlite-settings.repository.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACxH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAOjE;;;GAGG;AACH,qBACa,wBAAyB,YAAW,mBAAmB;IACtD,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAElD;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAmFnD;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAgBtC;;;;;OAKG;IACG,MAAM,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CA2FhD"}
+{"version":3,"file":"sqlite-settings.repository.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/src/infrastructure/repositories/sqlite-settings.repository.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACxH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAOjE;;;GAGG;AACH,qBACa,wBAAyB,YAAW,mBAAmB;IACtD,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAElD;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAuFnD;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAgBtC;;;;;OAKG;IACG,MAAM,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAgGhD"}

package/dist/packages/core/src/infrastructure/repositories/sqlite-settings.repository.js

@@ -73,7 +73,9 @@ let SQLiteSettingsRepository = class SQLiteSettingsRepository {
         interactive_agent_max_concurrent_sessions,
         auto_archive_delay_minutes,
         stage_timeout_fast_implement_ms,
-        fab_position_swapped
+        fab_position_swapped,
+        skill_injection_enabled, skill_injection_skills,
+        security_mode, security_last_evaluation_at, security_policy_source
       ) VALUES (
         @id, @created_at, @updated_at,
         @model_analyze, @model_requirements, @model_plan, @model_implement, @model_default,
@@ -105,7 +107,9 @@ let SQLiteSettingsRepository = class SQLiteSettingsRepository {
         @interactive_agent_max_concurrent_sessions,
         @auto_archive_delay_minutes,
         @stage_timeout_fast_implement_ms,
-        @fab_position_swapped
+        @fab_position_swapped,
+        @skill_injection_enabled, @skill_injection_skills,
+        @security_mode, @security_last_evaluation_at, @security_policy_source
       )
     `);
         // Execute with named parameters (safe from SQL injection)
@@ -211,7 +215,12 @@ let SQLiteSettingsRepository = class SQLiteSettingsRepository {
         interactive_agent_max_concurrent_sessions = @interactive_agent_max_concurrent_sessions,
         auto_archive_delay_minutes = @auto_archive_delay_minutes,
         stage_timeout_fast_implement_ms = @stage_timeout_fast_implement_ms,
-        fab_position_swapped = @fab_position_swapped
+        fab_position_swapped = @fab_position_swapped,
+        skill_injection_enabled = @skill_injection_enabled,
+        skill_injection_skills = @skill_injection_skills,
+        security_mode = @security_mode,
+        security_last_evaluation_at = @security_last_evaluation_at,
+        security_policy_source = @security_policy_source
       WHERE id = @id
     `);
         // Execute with named parameters (safe from SQL injection)

package/dist/packages/core/src/infrastructure/services/agents/common/executors/claude-code-executor.service.d.ts

@@ -23,6 +23,8 @@ export declare class ClaudeCodeExecutorService implements IAgentExecutor {
     constructor(spawn: SpawnFunction);
     /** Debug logging — writes to stdout so it appears in the worker log file */
     private log;
+    /** Executor capabilities for security constraint validation */
+    private static readonly CAPABILITIES;
     execute(prompt: string, options?: AgentExecutionOptions): Promise<AgentExecutionResult>;
     executeStream(prompt: string, options?: AgentExecutionOptions): AsyncIterable<AgentExecutionStreamEvent>;
     /**

package/dist/packages/core/src/infrastructure/services/agents/common/executors/claude-code-executor.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code-executor.service.d.ts","sourceRoot":"","sources":["../../../../../../../../../packages/core/src/infrastructure/services/agents/common/executors/claude-code-executor.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,KAAK,EACV,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EAEpB,yBAAyB,EAC1B,MAAM,4EAA4E,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAajD;;;GAGG;AACH,qBAAa,yBAA0B,YAAW,cAAc;IAMlD,OAAO,CAAC,QAAQ,CAAC,KAAK;IALlC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAA8B;IAE3D,4EAA4E;IAC5E,OAAO,CAAC,MAAM,CAAS;gBAEM,KAAK,EAAE,aAAa;IAEjD,4EAA4E;IAC5E,OAAO,CAAC,GAAG;IAML,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoHtF,aAAa,CAClB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,qBAAqB,GAC9B,aAAa,CAAC,yBAAyB,CAAC;IAgG3C;;;OAGG;IACH,OAAO,CAAC,cAAc;IA0CtB,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO;IAI/C,OAAO,CAAC,SAAS;IAejB,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,iBAAiB;IAyBzB,OAAO,CAAC,eAAe;IA6BvB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAqBpB,OAAO,CAAC,eAAe;CAkExB"}
+{"version":3,"file":"claude-code-executor.service.d.ts","sourceRoot":"","sources":["../../../../../../../../../packages/core/src/infrastructure/services/agents/common/executors/claude-code-executor.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,KAAK,EACV,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EAEpB,yBAAyB,EAC1B,MAAM,4EAA4E,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAiBjD;;;GAGG;AACH,qBAAa,yBAA0B,YAAW,cAAc;IAMlD,OAAO,CAAC,QAAQ,CAAC,KAAK;IALlC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAA8B;IAE3D,4EAA4E;IAC5E,OAAO,CAAC,MAAM,CAAS;gBAEM,KAAK,EAAE,aAAa;IAEjD,4EAA4E;IAC5E,OAAO,CAAC,GAAG;IAMX,+DAA+D;IAC/D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAGlC;IAEI,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA2HtF,aAAa,CAClB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,qBAAqB,GAC9B,aAAa,CAAC,yBAAyB,CAAC;IAsG3C;;;OAGG;IACH,OAAO,CAAC,cAAc;IA0CtB,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO;IAI/C,OAAO,CAAC,SAAS;IAejB,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,iBAAiB;IAyBzB,OAAO,CAAC,eAAe;IA6BvB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAqBpB,OAAO,CAAC,eAAe;CAkExB"}

package/dist/packages/core/src/infrastructure/services/agents/common/executors/claude-code-executor.service.js

@@ -10,6 +10,7 @@
  */
 import { getCurrentPhase, getLogPrefix } from '../../feature-agent/log-context.js';
 import { IS_WINDOWS } from '../../../../platform.js';
+import { validateSecurityConstraints, } from './security-constraint-validator.js';
 /** Features supported by Claude Code CLI */
 const SUPPORTED_FEATURES = new Set([
     'session-resume',
@@ -37,8 +38,16 @@ export class ClaudeCodeExecutorService {
         const ts = new Date().toISOString();
         process.stdout.write(`[${ts}] ${getCurrentPhase()}${getLogPrefix()}${message}\n`);
     }
+    /** Executor capabilities for security constraint validation */
+    static CAPABILITIES = {
+        requiresPermissiveMode: true, // uses --dangerously-skip-permissions
+        executorName: 'claude-code',
+    };
     async execute(prompt, options) {
         this.silent = options?.silent ?? false;
+        const warning = validateSecurityConstraints(options?.securityConstraints, ClaudeCodeExecutorService.CAPABILITIES);
+        if (warning)
+            this.log(warning);
         // Use stream-json so we get real-time events in the worker log
         // instead of zero output for minutes with --output-format json
         const args = this.buildStreamArgs(prompt, options);
@@ -141,6 +150,9 @@ export class ClaudeCodeExecutorService {
         });
     }
     async *executeStream(prompt, options) {
+        const warning = validateSecurityConstraints(options?.securityConstraints, ClaudeCodeExecutorService.CAPABILITIES);
+        if (warning)
+            this.log(warning);
         const args = this.buildStreamArgs(prompt, options);
         const spawnOpts = this.buildSpawnOptions(options);
         const proc = this.spawn('claude', args, spawnOpts);

package/dist/packages/core/src/infrastructure/services/agents/common/executors/security-constraint-validator.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Security Constraint Validator
+ *
+ * Pure function that validates security constraints against executor capabilities.
+ * Reusable across all executor types. Throws SecurityViolationError in Enforce mode
+ * when constraints are incompatible. Logs warnings in Advisory mode.
+ */
+import type { SecurityConstraints } from '../../../../../application/ports/output/agents/agent-executor.interface.js';
+export interface ExecutorCapabilities {
+    /** Whether this executor requires --dangerously-skip-permissions or equivalent */
+    requiresPermissiveMode: boolean;
+    /** Human-readable executor name for error messages */
+    executorName: string;
+}
+/**
+ * Validate security constraints against executor capabilities.
+ *
+ * @returns A warning message if Advisory mode detects an issue, or undefined if clean.
+ * @throws SecurityViolationError in Enforce mode when constraints are incompatible.
+ */
+export declare function validateSecurityConstraints(constraints: SecurityConstraints | undefined, capabilities: ExecutorCapabilities): string | undefined;
+//# sourceMappingURL=security-constraint-validator.d.ts.map

package/dist/packages/core/src/infrastructure/services/agents/common/executors/security-constraint-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-constraint-validator.d.ts","sourceRoot":"","sources":["../../../../../../../../../packages/core/src/infrastructure/services/agents/common/executors/security-constraint-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4EAA4E,CAAC;AAGtH,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,sBAAsB,EAAE,OAAO,CAAC;IAChC,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,mBAAmB,GAAG,SAAS,EAC5C,YAAY,EAAE,oBAAoB,GACjC,MAAM,GAAG,SAAS,CAiBpB"}

package/dist/packages/core/src/infrastructure/services/agents/common/executors/security-constraint-validator.js

@@ -0,0 +1,30 @@
+/**
+ * Security Constraint Validator
+ *
+ * Pure function that validates security constraints against executor capabilities.
+ * Reusable across all executor types. Throws SecurityViolationError in Enforce mode
+ * when constraints are incompatible. Logs warnings in Advisory mode.
+ */
+import { SecurityMode, SecurityActionCategory } from '../../../../../domain/generated/output.js';
+import { SecurityViolationError } from '../../../../../domain/errors/security-violation.error.js';
+/**
+ * Validate security constraints against executor capabilities.
+ *
+ * @returns A warning message if Advisory mode detects an issue, or undefined if clean.
+ * @throws SecurityViolationError in Enforce mode when constraints are incompatible.
+ */
+export function validateSecurityConstraints(constraints, capabilities) {
+    if (!constraints)
+        return undefined;
+    if (constraints.mode === SecurityMode.Disabled)
+        return undefined;
+    if (constraints.sandboxLevel === 'strict' && capabilities.requiresPermissiveMode) {
+        const rule = `Executor "${capabilities.executorName}" requires permissive mode but policy demands strict sandbox`;
+        const remediation = 'Either switch to an executor that supports strict sandboxing, or relax the sandbox policy to permissive.';
+        if (constraints.mode === SecurityMode.Enforce) {
+            throw new SecurityViolationError(rule, SecurityActionCategory.SandboxEscalation, remediation);
+        }
+        return `[security:advisory] ${rule}. ${remediation}`;
+    }
+    return undefined;
+}

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/fast-feature-agent-graph.d.ts

@@ -69,6 +69,8 @@ export declare function createFastFeatureAgentGraph(depsOrExecutor: FastFeatureA
     ciFixAttempts: number;
     ciFixHistory: import("../../../../domain/index.js").CiFixRecord[];
     ciFixStatus: "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted";
+    securityMode: import("../../../../domain/index.js").SecurityMode;
+    securityActionDispositions: Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>;
 }, {
     featureId?: string | undefined;
     repositoryPath?: string | undefined;
@@ -102,6 +104,8 @@ export declare function createFastFeatureAgentGraph(depsOrExecutor: FastFeatureA
     ciFixAttempts?: number | undefined;
     ciFixHistory?: import("../../../../domain/index.js").CiFixRecord[] | undefined;
     ciFixStatus?: "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted" | undefined;
+    securityMode?: import("../../../../domain/index.js").SecurityMode | undefined;
+    securityActionDispositions?: Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>> | undefined;
 }, "__start__" | "fast-implement", {
     featureId: {
         (): import("@langchain/langgraph").LastValue<string>;
@@ -155,6 +159,8 @@ export declare function createFastFeatureAgentGraph(depsOrExecutor: FastFeatureA
     ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
     ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
     ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+    securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+    securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
 }, {
     featureId: {
         (): import("@langchain/langgraph").LastValue<string>;
@@ -208,6 +214,8 @@ export declare function createFastFeatureAgentGraph(depsOrExecutor: FastFeatureA
     ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
     ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
     ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+    securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+    securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
 }, import("@langchain/langgraph").StateDefinition, {
     "fast-implement": Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -262,6 +270,8 @@ export declare function createFastFeatureAgentGraph(depsOrExecutor: FastFeatureA
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
 }, unknown, unknown>;
 //# sourceMappingURL=fast-feature-agent-graph.d.ts.map

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/fast-feature-agent-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fast-feature-agent-graph.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/services/agents/feature-agent/fast-feature-agent-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAA0B,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+DAA+D,CAAC;AAGpG,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGlF,OAAO,EAAE,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE5E;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;CACjD;AAkBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,cAAc,EAAE,yBAAyB,GAAG,cAAc,EAC1D,YAAY,CAAC,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA6BnC"}
+{"version":3,"file":"fast-feature-agent-graph.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/services/agents/feature-agent/fast-feature-agent-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAA0B,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+DAA+D,CAAC;AAGpG,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGlF,OAAO,EAAE,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE5E;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;CACjD;AAkBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,cAAc,EAAE,yBAAyB,GAAG,cAAc,EAC1D,YAAY,CAAC,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA6BnC"}

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-graph.d.ts

@@ -56,6 +56,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
     ciFixAttempts: number;
     ciFixHistory: import("../../../../domain/index.js").CiFixRecord[];
     ciFixStatus: "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted";
+    securityMode: import("../../../../domain/index.js").SecurityMode;
+    securityActionDispositions: Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>;
 }, {
     featureId?: string | undefined;
     repositoryPath?: string | undefined;
@@ -89,6 +91,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
     ciFixAttempts?: number | undefined;
     ciFixHistory?: import("../../../../domain/index.js").CiFixRecord[] | undefined;
     ciFixStatus?: "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted" | undefined;
+    securityMode?: import("../../../../domain/index.js").SecurityMode | undefined;
+    securityActionDispositions?: Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>> | undefined;
 }, "plan" | "implement" | "__start__" | "analyze" | "requirements" | "research" | "validate_spec_analyze" | "validate_spec_requirements" | "validate_research" | "validate_plan_tasks" | "repair_spec_analyze" | "repair_spec_requirements" | "repair_research" | "repair_plan_tasks", {
     featureId: {
         (): import("@langchain/langgraph").LastValue<string>;
@@ -142,6 +146,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
     ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
     ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
     ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+    securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+    securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
 }, {
     featureId: {
         (): import("@langchain/langgraph").LastValue<string>;
@@ -195,6 +201,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
     ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
     ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
     ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+    securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+    securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
 }, import("@langchain/langgraph").StateDefinition, {
     analyze: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -249,6 +257,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
     requirements: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -303,6 +313,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
     research: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -357,6 +369,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
     plan: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -411,6 +425,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
     implement: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -465,6 +481,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
     validate_spec_analyze: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -519,6 +537,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
     validate_spec_requirements: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -573,6 +593,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
     validate_research: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -627,6 +649,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
     validate_plan_tasks: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -681,6 +705,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
     repair_spec_analyze: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -735,6 +761,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
     repair_spec_requirements: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -789,6 +817,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
     repair_research: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -843,6 +873,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
     repair_plan_tasks: Partial<import("@langchain/langgraph").StateType<{
         featureId: {
@@ -897,6 +929,8 @@ export declare function createFeatureAgentGraph(depsOrExecutor: FeatureAgentGrap
         ciFixAttempts: import("@langchain/langgraph").BinaryOperatorAggregate<number, number>;
         ciFixHistory: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").CiFixRecord[], import("../../../../domain/index.js").CiFixRecord[]>;
         ciFixStatus: import("@langchain/langgraph").BinaryOperatorAggregate<"success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted", "success" | "timeout" | "idle" | "watching" | "fixing" | "exhausted">;
+        securityMode: import("@langchain/langgraph").BinaryOperatorAggregate<import("../../../../domain/index.js").SecurityMode, import("../../../../domain/index.js").SecurityMode>;
+        securityActionDispositions: import("@langchain/langgraph").BinaryOperatorAggregate<Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>, Partial<Record<import("../../../../domain/index.js").SecurityActionCategory, import("../../../../domain/index.js").SecurityActionDisposition>>>;
     }>>;
 }, unknown, unknown>;
 //# sourceMappingURL=feature-agent-graph.d.ts.map

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-agent-graph.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+DAA+D,CAAC;AAOpG,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAclF,OAAO,EAAE,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE5E;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;CACjD;AAwID;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,qBAAqB,GAAG,cAAc,EACtD,YAAY,CAAC,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAgFnC"}
+{"version":3,"file":"feature-agent-graph.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+DAA+D,CAAC;AAOpG,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAclF,OAAO,EAAE,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE5E;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;CACjD;AAwID;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,qBAAqB,GAAG,cAAc,EACtD,YAAY,CAAC,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAgFnC"}

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-process.service.d.ts

@@ -7,7 +7,7 @@
  */
 import type { IFeatureAgentProcessService } from '../../../../application/ports/output/agents/feature-agent-process.interface.js';
 import type { IAgentRunRepository } from '../../../../application/ports/output/agents/agent-run-repository.interface.js';
-import { type ApprovalGates, type AgentType } from '../../../../domain/generated/output.js';
+import { type ApprovalGates, type AgentType, type SecurityMode, type SecurityActionCategory, type SecurityActionDisposition } from '../../../../domain/generated/output.js';
 export declare class FeatureAgentProcessService implements IFeatureAgentProcessService {
     private readonly runRepository;
     constructor(runRepository: IAgentRunRepository);
@@ -28,6 +28,8 @@ export declare class FeatureAgentProcessService implements IFeatureAgentProcessS
         fast?: boolean;
         model?: string;
         resumeReason?: string;
+        securityMode?: SecurityMode;
+        securityActionDispositions?: Partial<Record<SecurityActionCategory, SecurityActionDisposition>>;
     }): number;
     isAlive(pid: number): boolean;
     checkAndMarkCrashed(runId: string): Promise<void>;

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-process.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-agent-process.service.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-process.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sEAAsE,CAAC;AACxH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAC/G,OAAO,EAAkB,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAalG,qBAAa,0BAA2B,YAAW,2BAA2B;IAChE,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,mBAAmB;IAE/D,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACA,MAAM;IAsFT,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IASvB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAexD"}
+{"version":3,"file":"feature-agent-process.service.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-process.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sEAAsE,CAAC;AACxH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAC/G,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,8BAA8B,CAAC;AAatC,qBAAa,0BAA2B,YAAW,2BAA2B;IAChE,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,mBAAmB;IAE/D,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,YAAY,CAAC;QAC5B,0BAA0B,CAAC,EAAE,OAAO,CAClC,MAAM,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,CAC1D,CAAC;KACH,GACA,MAAM;IA4FT,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IASvB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAexD"}

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-process.service.js

@@ -12,7 +12,7 @@ import { join } from 'node:path';
 import { openSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { mkdirSync } from 'node:fs';
-import { AgentRunStatus } from '../../../../domain/generated/output.js';
+import { AgentRunStatus, } from '../../../../domain/generated/output.js';
 import { IS_WINDOWS } from '../../../platform.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /** Terminal statuses that should not be updated */
@@ -90,6 +90,12 @@ export class FeatureAgentProcessService {
         if (options?.resumeReason) {
             args.push('--resume-reason', options.resumeReason);
         }
+        if (options?.securityMode) {
+            args.push('--security-mode', options.securityMode);
+        }
+        if (options?.securityActionDispositions) {
+            args.push('--security-dispositions', JSON.stringify(options.securityActionDispositions));
+        }
         // Create log file for worker output (for debugging)
         const logsDir = join(homedir(), '.shep', 'logs');
         mkdirSync(logsDir, { recursive: true });

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-worker.d.ts

@@ -9,7 +9,7 @@
  * CLI Args: --feature-id <id> --run-id <id> --repo <path> --spec-dir <path>
  */
 import 'reflect-metadata';
-import { type AgentType } from '../../../../domain/generated/output.js';
+import { SecurityMode, type AgentType, type SecurityActionCategory, type SecurityActionDisposition } from '../../../../domain/generated/output.js';
 import type { ApprovalGates } from '../../../../domain/generated/output.js';
 export interface WorkerArgs {
     featureId: string;
@@ -33,6 +33,8 @@ export interface WorkerArgs {
     fast?: boolean;
     model?: string;
     resumeReason?: string;
+    securityMode?: SecurityMode;
+    securityActionDispositions?: Partial<Record<SecurityActionCategory, SecurityActionDisposition>>;
 }
 /**
  * Parse CLI arguments into a WorkerArgs object.

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-agent-worker.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-worker.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,kBAAkB,CAAC;AAgB1B,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAW7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAkF1D;AAgCD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAuS/D"}
+{"version":3,"file":"feature-agent-worker.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/services/agents/feature-agent/feature-agent-worker.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,kBAAkB,CAAC;AAgB1B,OAAO,EAGL,YAAY,EACZ,KAAK,SAAS,EACd,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,8BAA8B,CAAC;AAWtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,0BAA0B,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,CAAC,CAAC;CACjG;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CA4G1D;AAgCD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmT/D"}