@strongkeep/watchdog 0.1.1

package/dist/appliers/min-version.js

@@ -0,0 +1,47 @@
+/**
+ * Applier: min_version {tool, version} — require a tool version floor (CVE gate).
+ *
+ * This applier is ADVISORY: it cannot and must not upgrade software on the user's machine.
+ * "apply" here means: check the installed version against the floor and REPORT if below, with
+ * the fix instruction. It writes NOTHING, so its undo inverse is a no-op.
+ *
+ * This is why min_version is safe at low blast radius (it never mutates state) but still can't
+ * silently "fix" anything — surfacing the gap is the action.
+ */
+import { RefusedActionError } from './applier.js';
+/** Compare dotted numeric versions: negative when a < b. Non-numeric parts compare as 0. */
+export function compareVersions(a, b) {
+    const pa = a.split('.').map((n) => Number.parseInt(n, 10) || 0);
+    const pb = b.split('.').map((n) => Number.parseInt(n, 10) || 0);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
+const NOOP_INVERSE = { kind: 'min_version', noop: true };
+export const minVersionApplier = {
+    type: 'min_version',
+    async apply(action, ctx) {
+        const installed = ctx.resolveInstalledVersion?.(action.tool);
+        let summary;
+        if (installed === undefined) {
+            summary = `advisory: could not determine installed ${action.tool} version — required floor is ${action.version}`;
+        }
+        else if (compareVersions(installed, action.version) < 0) {
+            summary = `advisory: ${action.tool} ${installed} is BELOW the safe floor ${action.version} — update ${action.tool} now`;
+        }
+        else {
+            summary = `advisory: ${action.tool} ${installed} meets the safe floor ${action.version}`;
+        }
+        // Never mutates anything, in dryRun or not.
+        return { summary, inverse: NOOP_INVERSE, diffPreview: '(advisory — no change)' };
+    },
+    async revert(inverse, _ctx) {
+        if (inverse.kind !== 'min_version')
+            throw new RefusedActionError('min_version.revert: wrong inverse kind');
+        return { summary: 'min_version is advisory — nothing was changed, nothing to revert' };
+    },
+};
+//# sourceMappingURL=min-version.js.map

package/dist/appliers/min-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"min-version.js","sourceRoot":"","sources":["../../src/appliers/min-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGlD,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,YAAY,GAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAEtE,MAAM,CAAC,MAAM,iBAAiB,GAA8B;IAC1D,IAAI,EAAE,aAAa;IAEnB,KAAK,CAAC,KAAK,CAAC,MAAwB,EAAE,GAAiB;QACrD,MAAM,SAAS,GAAG,GAAG,CAAC,uBAAuB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,OAAe,CAAC;QACpB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,GAAG,2CAA2C,MAAM,CAAC,IAAI,gCAAgC,MAAM,CAAC,OAAO,EAAE,CAAC;QACnH,CAAC;aAAM,IAAI,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,GAAG,aAAa,MAAM,CAAC,IAAI,IAAI,SAAS,4BAA4B,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,IAAI,MAAM,CAAC;QAC1H,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,aAAa,MAAM,CAAC,IAAI,IAAI,SAAS,yBAAyB,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3F,CAAC;QACD,4CAA4C;QAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAoB,EAAE,IAAkB;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa;YAAE,MAAM,IAAI,kBAAkB,CAAC,wCAAwC,CAAC,CAAC;QAC3G,OAAO,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IACzF,CAAC;CACF,CAAC"}

package/dist/appliers/pin-mcp.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Applier: pin_mcp {server, version?} — pin a configured MCP server to a reviewed version
+ * (anti rug-pull). Supports the ALL_CONFIGURED_MCP sentinel = audit every configured server's
+ * pin state (already-pinned specs are untouched; unpinned specs are surfaced for a human —
+ * their current version cannot be known locally without a registry call, and guessing one
+ * would be a lie).
+ *
+ * Least privilege: edits only the MCP server spec(s) in the harness's `.mcp.json`. Never
+ * installs or runs a server. The version is written by rewriting the `package@version` token
+ * in the server's args; undo captures the prior version string + a byte-exact file backup so
+ * a revert restores the exact prior spec.
+ */
+import type { PinMcpAction } from '@strongkeep/core';
+import type { Applier } from './applier.js';
+/** The MCP config file this applier manages, relative to the harness root. */
+export declare const MCP_CONFIG_FILE = ".mcp.json";
+export declare const pinMcpApplier: Applier<PinMcpAction>;

package/dist/appliers/pin-mcp.js

@@ -0,0 +1,99 @@
+/**
+ * Applier: pin_mcp {server, version?} — pin a configured MCP server to a reviewed version
+ * (anti rug-pull). Supports the ALL_CONFIGURED_MCP sentinel = audit every configured server's
+ * pin state (already-pinned specs are untouched; unpinned specs are surfaced for a human —
+ * their current version cannot be known locally without a registry call, and guessing one
+ * would be a lie).
+ *
+ * Least privilege: edits only the MCP server spec(s) in the harness's `.mcp.json`. Never
+ * installs or runs a server. The version is written by rewriting the `package@version` token
+ * in the server's args; undo captures the prior version string + a byte-exact file backup so
+ * a revert restores the exact prior spec.
+ */
+import { ALL_CONFIGURED_MCP } from '@strongkeep/core';
+import { RefusedActionError } from './applier.js';
+import { resolveInsideHarness, readJsonConfig, writeJsonConfig, backupFile, restoreBackup } from './fs-guard.js';
+/** The MCP config file this applier manages, relative to the harness root. */
+export const MCP_CONFIG_FILE = '.mcp.json';
+/** Match a `name@version` / `@scope/name@version` npm spec token. */
+const SPEC_RE = /^(@?[^@\s]+)@([^@\s]+)$/;
+/** Find the index + parsed spec of the versioned package token in a server's args, if any. */
+function findSpecToken(spec) {
+    if (!Array.isArray(spec.args))
+        return undefined;
+    for (let i = 0; i < spec.args.length; i++) {
+        const arg = spec.args[i];
+        if (typeof arg !== 'string' || arg.startsWith('-'))
+            continue;
+        const m = SPEC_RE.exec(arg);
+        if (m !== null)
+            return { index: i, name: m[1], version: m[2] };
+    }
+    return undefined;
+}
+export const pinMcpApplier = {
+    type: 'pin_mcp',
+    async apply(action, ctx) {
+        const absPath = resolveInsideHarness(ctx.harnessRoot, MCP_CONFIG_FILE);
+        const { value: config, existed } = await readJsonConfig(absPath);
+        if (!existed)
+            throw new RefusedActionError(`refused pin_mcp: no ${MCP_CONFIG_FILE} in this harness`);
+        const servers = (config['mcpServers'] ?? {});
+        if (action.server === ALL_CONFIGURED_MCP) {
+            // Audit mode: report pin state of every configured server. No writes → no-op inverse.
+            const pinned = [];
+            const unpinned = [];
+            for (const [name, spec] of Object.entries(servers)) {
+                (findSpecToken(spec) !== undefined ? pinned : unpinned).push(name);
+            }
+            const summary = `pin audit: ${pinned.length} server(s) already version-pinned` +
+                (unpinned.length > 0 ? `; NEEDS ATTENTION — unpinned: ${unpinned.join(', ')}` : '');
+            return {
+                summary,
+                inverse: { kind: 'pin_mcp', server: ALL_CONFIGURED_MCP, priorVersion: undefined },
+                diffPreview: `(audit only) pinned: [${pinned.join(', ')}] unpinned: [${unpinned.join(', ')}]`,
+            };
+        }
+        const spec = servers[action.server];
+        if (spec === undefined) {
+            throw new RefusedActionError(`refused pin_mcp: server "${action.server}" is not configured`);
+        }
+        const token = findSpecToken(spec);
+        if (token === undefined) {
+            throw new RefusedActionError(`refused pin_mcp: server "${action.server}" has no package@version spec to rewrite (pin manually)`);
+        }
+        const targetVersion = action.version ?? token.version; // no version = pin to current
+        const inverse = { kind: 'pin_mcp', server: action.server, priorVersion: token.version };
+        const summary = `pinned MCP server "${action.server}" to ${token.name}@${targetVersion} (was @${token.version})`;
+        const diffPreview = `- ${token.name}@${token.version}\n+ ${token.name}@${targetVersion}`;
+        if (!ctx.dryRun && targetVersion !== token.version) {
+            inverse.backupRef = await backupFile(ctx.harnessRoot, absPath); // backup BEFORE write
+            spec.args[token.index] = `${token.name}@${targetVersion}`;
+            await writeJsonConfig(absPath, config);
+        }
+        return { summary, inverse, diffPreview };
+    },
+    async revert(inverse, ctx) {
+        if (inverse.kind !== 'pin_mcp')
+            throw new RefusedActionError('pin_mcp.revert: wrong inverse kind');
+        if (inverse.server === ALL_CONFIGURED_MCP || inverse.priorVersion === undefined) {
+            return { summary: 'pin audit had no changes to revert' };
+        }
+        const absPath = resolveInsideHarness(ctx.harnessRoot, MCP_CONFIG_FILE);
+        if (inverse.backupRef !== undefined) {
+            await restoreBackup(ctx.harnessRoot, inverse.backupRef, absPath);
+            return { summary: `restored ${MCP_CONFIG_FILE} from backup (server "${inverse.server}" back to @${inverse.priorVersion})` };
+        }
+        const { value: config } = await readJsonConfig(absPath);
+        const servers = (config['mcpServers'] ?? {});
+        const spec = servers[inverse.server];
+        const token = spec === undefined ? undefined : findSpecToken(spec);
+        if (spec === undefined || token === undefined) {
+            return { summary: `server "${inverse.server}" no longer present — nothing to revert` };
+        }
+        spec.args[token.index] = `${token.name}@${inverse.priorVersion}`;
+        await writeJsonConfig(absPath, config);
+        return { summary: `restored server "${inverse.server}" to @${inverse.priorVersion}` };
+    },
+};
+//# sourceMappingURL=pin-mcp.js.map

package/dist/appliers/pin-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-mcp.js","sourceRoot":"","sources":["../../src/appliers/pin-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEjH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,qEAAqE;AACrE,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAO1C,8FAA8F;AAC9F,SAAS,aAAa,CAAC,IAAgB;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7D,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAA0B;IAClD,IAAI,EAAE,SAAS;IAEf,KAAK,CAAC,KAAK,CAAC,MAAoB,EAAE,GAAiB;QACjD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACvE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,eAAe,kBAAkB,CAAC,CAAC;QACrG,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAA+B,CAAC;QAE3E,IAAI,MAAM,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YACzC,sFAAsF;YACtF,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnD,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,OAAO,GACX,cAAc,MAAM,CAAC,MAAM,mCAAmC;gBAC9D,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iCAAiC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACtF,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,SAAS,EAAE;gBACjF,WAAW,EAAE,yBAAyB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC9F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,MAAM,CAAC,MAAM,qBAAqB,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,kBAAkB,CAC1B,4BAA4B,MAAM,CAAC,MAAM,yDAAyD,CACnG,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,8BAA8B;QACrF,MAAM,OAAO,GAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACrG,MAAM,OAAO,GAAG,sBAAsB,MAAM,CAAC,MAAM,QAAQ,KAAK,CAAC,IAAI,IAAI,aAAa,UAAU,KAAK,CAAC,OAAO,GAAG,CAAC;QACjH,MAAM,WAAW,GAAG,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,IAAI,IAAI,aAAa,EAAE,CAAC;QAEzF,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACnD,OAAO,CAAC,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,sBAAsB;YACrF,IAAI,CAAC,IAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,aAAa,EAAE,CAAC;YACzE,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAoB,EAAE,GAAiB;QAClD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,kBAAkB,CAAC,oCAAoC,CAAC,CAAC;QACnG,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAChF,OAAO,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,YAAY,eAAe,yBAAyB,OAAO,CAAC,MAAM,cAAc,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC;QAC9H,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAA+B,CAAC;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,WAAW,OAAO,CAAC,MAAM,yCAAyC,EAAE,CAAC;QACzF,CAAC;QACA,IAAI,CAAC,IAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAChF,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,oBAAoB,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;IACxF,CAAC;CACF,CAAC"}

package/dist/appliers/set-config.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Applier: set_config {file, keypath, value} — set one config keypath to a safe scalar.
+ *
+ * Least privilege: writes ONLY the named keypath in the named file, both resolved INSIDE the
+ * harness root. Refuses paths that escape harnessRoot (no `..`, no absolute paths). Value is a
+ * scalar only (bounded blast radius — the parser already enforces this). Undo captures the
+ * prior scalar AND a byte-exact out-of-log backup of the prior file, so revert restores the
+ * file exactly (formatting included) and no potentially-secret file content sits in the log.
+ */
+import type { SetConfigAction } from '@strongkeep/core';
+import type { Applier } from './applier.js';
+export declare const setConfigApplier: Applier<SetConfigAction>;

package/dist/appliers/set-config.js

@@ -0,0 +1,67 @@
+/**
+ * Applier: set_config {file, keypath, value} — set one config keypath to a safe scalar.
+ *
+ * Least privilege: writes ONLY the named keypath in the named file, both resolved INSIDE the
+ * harness root. Refuses paths that escape harnessRoot (no `..`, no absolute paths). Value is a
+ * scalar only (bounded blast radius — the parser already enforces this). Undo captures the
+ * prior scalar AND a byte-exact out-of-log backup of the prior file, so revert restores the
+ * file exactly (formatting included) and no potentially-secret file content sits in the log.
+ */
+import { RefusedActionError } from './applier.js';
+import { resolveInsideHarness, readJsonConfig, writeJsonConfig, getKeypath, setKeypath, backupFile, restoreBackup, } from './fs-guard.js';
+import { rm } from 'node:fs/promises';
+export const setConfigApplier = {
+    type: 'set_config',
+    async apply(action, ctx) {
+        const absPath = resolveInsideHarness(ctx.harnessRoot, action.file);
+        const { value: config, existed } = await readJsonConfig(absPath);
+        const rawPrior = getKeypath(config, action.keypath);
+        if (rawPrior !== undefined && typeof rawPrior === 'object') {
+            // Refuse to clobber a structured subtree with a scalar — outside this action's mandate.
+            throw new RefusedActionError(`refused set_config: "${action.keypath}" holds a non-scalar value`);
+        }
+        const priorValue = rawPrior;
+        const inverse = {
+            kind: 'set_config',
+            file: action.file,
+            keypath: action.keypath,
+            priorValue,
+            fileExistedBefore: existed,
+        };
+        const diffPreview = [
+            `--- ${action.file}`,
+            `+++ ${action.file}`,
+            `- ${action.keypath}: ${JSON.stringify(priorValue)}`,
+            `+ ${action.keypath}: ${JSON.stringify(action.value)}`,
+        ].join('\n');
+        const summary = `set ${action.keypath} = ${JSON.stringify(action.value)} in ${action.file}`;
+        if (!ctx.dryRun) {
+            if (existed)
+                inverse.backupRef = await backupFile(ctx.harnessRoot, absPath); // backup BEFORE write
+            setKeypath(config, action.keypath, action.value);
+            await writeJsonConfig(absPath, config);
+        }
+        return { summary, inverse, diffPreview };
+    },
+    async revert(inverse, ctx) {
+        if (inverse.kind !== 'set_config')
+            throw new RefusedActionError('set_config.revert: wrong inverse kind');
+        const absPath = resolveInsideHarness(ctx.harnessRoot, inverse.file);
+        if (!inverse.fileExistedBefore) {
+            // The apply created the file; revert removes it entirely.
+            await rm(absPath, { force: true });
+            return { summary: `removed ${inverse.file} (did not exist before apply)` };
+        }
+        if (inverse.backupRef !== undefined) {
+            // Byte-exact restore from the out-of-log backup (T-REV-1).
+            await restoreBackup(ctx.harnessRoot, inverse.backupRef, absPath);
+            return { summary: `restored ${inverse.file} from backup (byte-exact)` };
+        }
+        // No backup (e.g. record from a staged run) — restore the scalar semantically.
+        const { value: config } = await readJsonConfig(absPath);
+        setKeypath(config, inverse.keypath, inverse.priorValue);
+        await writeJsonConfig(absPath, config);
+        return { summary: `restored ${inverse.keypath} = ${JSON.stringify(inverse.priorValue)} in ${inverse.file}` };
+    },
+};
+//# sourceMappingURL=set-config.js.map

package/dist/appliers/set-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-config.js","sourceRoot":"","sources":["../../src/appliers/set-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,UAAU,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAA6B;IACxD,IAAI,EAAE,YAAY;IAElB,KAAK,CAAC,KAAK,CAAC,MAAuB,EAAE,GAAiB;QACpD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3D,wFAAwF;YACxF,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,MAAM,CAAC,OAAO,4BAA4B,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,UAAU,GAAG,QAAiD,CAAC;QAErE,MAAM,OAAO,GAAgB;YAC3B,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU;YACV,iBAAiB,EAAE,OAAO;SAC3B,CAAC;QACF,MAAM,WAAW,GAAG;YAClB,OAAO,MAAM,CAAC,IAAI,EAAE;YACpB,OAAO,MAAM,CAAC,IAAI,EAAE;YACpB,KAAK,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;YACpD,KAAK,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QAE5F,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,OAAO;gBAAE,OAAO,CAAC,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,sBAAsB;YACnG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAoB,EAAE,GAAiB;QAClD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,IAAI,kBAAkB,CAAC,uCAAuC,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC/B,0DAA0D;YAC1D,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,WAAW,OAAO,CAAC,IAAI,+BAA+B,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,2DAA2D;YAC3D,MAAM,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,YAAY,OAAO,CAAC,IAAI,2BAA2B,EAAE,CAAC;QAC1E,CAAC;QACD,+EAA+E;QAC/E,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QACxD,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/G,CAAC;CACF,CAAC"}

package/dist/appliers/update-rule-file.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Applier: update_rule_file {path, content_hash, payloadRef?} — drop/refresh a hash-pinned
+ * rule file inside the harness.
+ *
+ * SECURITY:
+ *  - The written content is resolved out-of-band and VERIFIED against content_hash
+ *    (core.verifyPayloadHash) BEFORE writing. Hash mismatch → refuse, write nothing.
+ *  - `path` is resolved INSIDE harnessRoot; escapes (`..`, absolute) are refused (T-APP-5).
+ *  - The rule file is data read by guard hooks; this applier never executes it.
+ * Undo backs up any prior file (backupRef) so revert restores byte-for-byte, or removes the
+ * file if none existed before.
+ */
+import type { UpdateRuleFileAction } from '@strongkeep/core';
+import type { Applier } from './applier.js';
+export declare const updateRuleFileApplier: Applier<UpdateRuleFileAction>;

package/dist/appliers/update-rule-file.js

@@ -0,0 +1,69 @@
+/**
+ * Applier: update_rule_file {path, content_hash, payloadRef?} — drop/refresh a hash-pinned
+ * rule file inside the harness.
+ *
+ * SECURITY:
+ *  - The written content is resolved out-of-band and VERIFIED against content_hash
+ *    (core.verifyPayloadHash) BEFORE writing. Hash mismatch → refuse, write nothing.
+ *  - `path` is resolved INSIDE harnessRoot; escapes (`..`, absolute) are refused (T-APP-5).
+ *  - The rule file is data read by guard hooks; this applier never executes it.
+ * Undo backs up any prior file (backupRef) so revert restores byte-for-byte, or removes the
+ * file if none existed before.
+ */
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { verifyPayloadHash } from '@strongkeep/core';
+import { RefusedActionError } from './applier.js';
+import { resolveInsideHarness, readIfExists, backupFile, restoreBackup } from './fs-guard.js';
+export const updateRuleFileApplier = {
+    type: 'update_rule_file',
+    async apply(action, ctx) {
+        // Path guard FIRST — a hostile path never reaches any I/O.
+        const absPath = resolveInsideHarness(ctx.harnessRoot, action.path);
+        if (action.payloadRef === undefined) {
+            throw new RefusedActionError(`refused update_rule_file "${action.path}": no payload source to write from`);
+        }
+        if (ctx.resolvePayload === undefined) {
+            throw new RefusedActionError(`refused update_rule_file "${action.path}": no payload resolver available`);
+        }
+        let bytes;
+        try {
+            bytes = await ctx.resolvePayload(action.payloadRef);
+        }
+        catch (err) {
+            // An unavailable payload is a REFUSAL (loud, run continues), never a crash.
+            throw new RefusedActionError(`refused update_rule_file "${action.path}": payload "${action.payloadRef.path}" unavailable (${err instanceof Error ? err.message : String(err)})`);
+        }
+        // The parser guarantees payloadRef.sha256 === content_hash; verify the BYTES against it.
+        const check = verifyPayloadHash(bytes, action.content_hash);
+        if (!check.ok) {
+            throw new RefusedActionError(`refused update_rule_file "${action.path}": ${check.reason} — nothing written`);
+        }
+        const existedBefore = (await readIfExists(absPath)) !== undefined;
+        const inverse = { kind: 'update_rule_file', path: action.path, existedBefore };
+        const summary = `${existedBefore ? 'refreshed' : 'wrote'} rule file ${action.path} (hash-verified)`;
+        const diffPreview = `${existedBefore ? '~' : '+'} ${action.path} (${bytes.byteLength} bytes, sha256 ${action.content_hash.slice(0, 12)}…)`;
+        if (!ctx.dryRun) {
+            if (existedBefore)
+                inverse.backupRef = await backupFile(ctx.harnessRoot, absPath); // backup BEFORE write
+            await mkdir(dirname(absPath), { recursive: true });
+            await writeFile(absPath, bytes);
+        }
+        return { summary, inverse, diffPreview };
+    },
+    async revert(inverse, ctx) {
+        if (inverse.kind !== 'update_rule_file')
+            throw new RefusedActionError('update_rule_file.revert: wrong inverse kind');
+        const absPath = resolveInsideHarness(ctx.harnessRoot, inverse.path);
+        if (!inverse.existedBefore) {
+            await rm(absPath, { force: true });
+            return { summary: `removed ${inverse.path} (did not exist before apply)` };
+        }
+        if (inverse.backupRef !== undefined) {
+            await restoreBackup(ctx.harnessRoot, inverse.backupRef, absPath);
+            return { summary: `restored ${inverse.path} from backup (byte-exact)` };
+        }
+        return { summary: `${inverse.path} left as-is (pre-existing, no backup captured)` };
+    },
+};
+//# sourceMappingURL=update-rule-file.js.map

package/dist/appliers/update-rule-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-rule-file.js","sourceRoot":"","sources":["../../src/appliers/update-rule-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9F,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE,IAAI,EAAE,kBAAkB;IAExB,KAAK,CAAC,KAAK,CAAC,MAA4B,EAAE,GAAiB;QACzD,2DAA2D;QAC3D,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAEnE,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,MAAM,CAAC,IAAI,oCAAoC,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,MAAM,CAAC,IAAI,kCAAkC,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4EAA4E;YAC5E,MAAM,IAAI,kBAAkB,CAC1B,6BAA6B,MAAM,CAAC,IAAI,eAAe,MAAM,CAAC,UAAU,CAAC,IAAI,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CACnJ,CAAC;QACJ,CAAC;QACD,yFAAyF;QACzF,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,oBAAoB,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC;QAClE,MAAM,OAAO,GAAgB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;QAC5F,MAAM,OAAO,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,cAAc,MAAM,CAAC,IAAI,kBAAkB,CAAC;QACpG,MAAM,WAAW,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,kBAAkB,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;QAE3I,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,aAAa;gBAAE,OAAO,CAAC,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,sBAAsB;YACzG,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAoB,EAAE,GAAiB;QAClD,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB;YAAE,MAAM,IAAI,kBAAkB,CAAC,6CAA6C,CAAC,CAAC;QACrH,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,WAAW,OAAO,CAAC,IAAI,+BAA+B,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,YAAY,OAAO,CAAC,IAAI,2BAA2B,EAAE,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,gDAAgD,EAAE,CAAC;IACtF,CAAC;CACF,CAAC"}

package/dist/autonomy.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Autonomy tiers — decide, per action, whether the consumer reports, stages, or applies.
+ *
+ * Tiers (BUILD-PLAN + design-notes; SMB default = propose):
+ *   advise  → report only. Never writes. The entry is surfaced to the human; nothing changes.
+ *   propose → stage a PR-style diff / pending-changes record for human approval. No live write.
+ *   auto    → apply ONLY actions whose LOCAL blast-radius classification is `low`; log + undo.
+ *             Everything else DOWNGRADES to propose (never silently dropped, never force-applied).
+ *
+ * SECURITY:
+ *  - Blast radius is computed LOCALLY (core.blastRadiusOf), NEVER read from the feed, so a
+ *    hostile feed cannot self-declare an action "low blast radius" to force an auto-apply.
+ *  - The consumer's configured tier is a CEILING. An entry's own `autonomy` field can only
+ *    request an EQUAL-OR-LOWER effective tier, never raise the consumer above its setting.
+ */
+import type { ConstrainedAction, AutonomyTier } from '@strongkeep/core';
+/** What the pipeline should do with a single action under the effective tier. */
+export type Disposition = 'report' | 'stage' | 'apply';
+/**
+ * Decide the disposition of an action given the CONSUMER's configured tier and the ENTRY's
+ * requested tier. Effective tier = min(consumerTier, entryTier). Then:
+ *   advise → report; propose → stage; auto → apply iff blastRadiusOf(action)==='low' else stage.
+ */
+export declare function decideDisposition(action: ConstrainedAction, consumerTier: AutonomyTier, entryTier: AutonomyTier): Disposition;

package/dist/autonomy.js

@@ -0,0 +1,35 @@
+/**
+ * Autonomy tiers — decide, per action, whether the consumer reports, stages, or applies.
+ *
+ * Tiers (BUILD-PLAN + design-notes; SMB default = propose):
+ *   advise  → report only. Never writes. The entry is surfaced to the human; nothing changes.
+ *   propose → stage a PR-style diff / pending-changes record for human approval. No live write.
+ *   auto    → apply ONLY actions whose LOCAL blast-radius classification is `low`; log + undo.
+ *             Everything else DOWNGRADES to propose (never silently dropped, never force-applied).
+ *
+ * SECURITY:
+ *  - Blast radius is computed LOCALLY (core.blastRadiusOf), NEVER read from the feed, so a
+ *    hostile feed cannot self-declare an action "low blast radius" to force an auto-apply.
+ *  - The consumer's configured tier is a CEILING. An entry's own `autonomy` field can only
+ *    request an EQUAL-OR-LOWER effective tier, never raise the consumer above its setting.
+ */
+import { blastRadiusOf } from '@strongkeep/core';
+const TIER_RANK = { advise: 0, propose: 1, auto: 2 };
+/**
+ * Decide the disposition of an action given the CONSUMER's configured tier and the ENTRY's
+ * requested tier. Effective tier = min(consumerTier, entryTier). Then:
+ *   advise → report; propose → stage; auto → apply iff blastRadiusOf(action)==='low' else stage.
+ */
+export function decideDisposition(action, consumerTier, entryTier) {
+    const effective = TIER_RANK[entryTier] < TIER_RANK[consumerTier] ? entryTier : consumerTier;
+    switch (effective) {
+        case 'advise':
+            return 'report';
+        case 'propose':
+            return 'stage';
+        case 'auto':
+            // LOCAL blast-radius gate: high-blast actions downgrade to stage, never auto-apply.
+            return blastRadiusOf(action) === 'low' ? 'apply' : 'stage';
+    }
+}
+//# sourceMappingURL=autonomy.js.map

package/dist/autonomy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autonomy.js","sourceRoot":"","sources":["../src/autonomy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAKjD,MAAM,SAAS,GAAiC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEnF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAyB,EACzB,YAA0B,EAC1B,SAAuB;IAEvB,MAAM,SAAS,GAAiB,SAAS,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1G,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,OAAO,CAAC;QACjB,KAAK,MAAM;YACT,oFAAoF;YACpF,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/D,CAAC;AACH,CAAC"}

package/dist/cli/guard-check.d.ts

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+/**
+ * strongkeep-guard-check — the PreToolUse hook entrypoint that evaluates a tool call against
+ * the guard rules, records any fire (metadata only, fires.ndjson), and signals the harness.
+ *
+ * Reads the Claude Code hook payload as JSON on stdin, extracts the candidate command from
+ * tool_input (Bash `command`, or a best-effort string of the input), evaluates it, and:
+ *   - exits 0 when nothing fires or the strongest action is advise/warn (the call proceeds;
+ *     a warn prints a one-line reason to stderr),
+ *   - exits 2 on `block` (Claude Code treats non-zero PreToolUse as "deny the tool call").
+ *
+ * It NEVER prints or logs the command itself. The fire log carries rule ids only.
+ * Installed into the PreToolUse hook by strongkeep-init alongside the poll hook.
+ */
+/** Pull the candidate command out of a Claude Code hook payload. Best-effort, tolerant. */
+export declare function extractCommand(payload: unknown): string;

package/dist/cli/guard-check.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+/**
+ * strongkeep-guard-check — the PreToolUse hook entrypoint that evaluates a tool call against
+ * the guard rules, records any fire (metadata only, fires.ndjson), and signals the harness.
+ *
+ * Reads the Claude Code hook payload as JSON on stdin, extracts the candidate command from
+ * tool_input (Bash `command`, or a best-effort string of the input), evaluates it, and:
+ *   - exits 0 when nothing fires or the strongest action is advise/warn (the call proceeds;
+ *     a warn prints a one-line reason to stderr),
+ *   - exits 2 on `block` (Claude Code treats non-zero PreToolUse as "deny the tool call").
+ *
+ * It NEVER prints or logs the command itself. The fire log carries rule ids only.
+ * Installed into the PreToolUse hook by strongkeep-init alongside the poll hook.
+ */
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { realpathSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { evaluateCommand } from '../guard-check.js';
+import { strongkeepDir } from '../init.js';
+/** Read all of stdin as a string (empty on no input). */
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString('utf8');
+}
+/** Pull the candidate command out of a Claude Code hook payload. Best-effort, tolerant. */
+export function extractCommand(payload) {
+    if (typeof payload !== 'object' || payload === null)
+        return '';
+    const input = payload['tool_input'];
+    if (typeof input === 'object' && input !== null) {
+        const cmd = input['command'];
+        if (typeof cmd === 'string')
+            return cmd;
+        return JSON.stringify(input);
+    }
+    return '';
+}
+async function main() {
+    const harnessRoot = resolve(process.env['STRONGKEEP_HARNESS'] ?? process.cwd());
+    const skDir = join(harnessRoot, strongkeepDir());
+    let payload = {};
+    try {
+        const raw = await readStdin();
+        if (raw.trim() !== '')
+            payload = JSON.parse(raw);
+    }
+    catch {
+        // Unparseable hook input → nothing to evaluate; let the call proceed.
+        return 0;
+    }
+    const command = extractCommand(payload);
+    if (command === '')
+        return 0;
+    const outcome = await evaluateCommand(skDir, command);
+    if (outcome.action === 'block') {
+        process.stderr.write(formatBlockMessage(outcome.fired));
+        return 2;
+    }
+    if (outcome.action === 'warn') {
+        process.stderr.write(formatWarnMessage(outcome.fired));
+    }
+    return 0;
+}
+/** Reason text for a fired rule (falls back to the rule id when no reason is authored). */
+function reasonOf(r) {
+    return r.reason && r.reason.trim() !== '' ? r.reason.trim() : `matched guard rule ${r.id}`;
+}
+/**
+ * The deny message the developer sees when StrongKeep stops the AGENT. Explains WHY (the
+ * security reason), names the rule, and points out that a manual `! <command>` is never
+ * blocked — so the human always keeps control. No emoji, no command echoed.
+ */
+function formatBlockMessage(fired) {
+    const blockers = fired.filter((r) => r.action === 'block');
+    const lines = [];
+    lines.push('StrongKeep blocked this command to keep you safe.');
+    for (const r of blockers)
+        lines.push(`  - ${reasonOf(r)}  [rule ${r.id}]`);
+    lines.push('This guard stops the AI agent, not you: to run it yourself, use manual bash');
+    lines.push('(type "! <command>") — manual commands are never intercepted. Edit or relax the');
+    lines.push('rule any time in .claude/strongkeep/guard-rules.yaml.');
+    return lines.join('\n') + '\n';
+}
+/** The heads-up shown when a warn-level rule fires. The command still proceeds. */
+function formatWarnMessage(fired) {
+    const warners = fired.filter((r) => r.action === 'warn');
+    const first = warners[0];
+    const why = first ? reasonOf(first) : 'a guarded pattern matched';
+    return `StrongKeep heads-up (allowed): ${why}. StrongKeep is watching but let this proceed.\n`;
+}
+function isMainModule() {
+    const entry = process.argv[1];
+    if (entry === undefined)
+        return false;
+    try {
+        return fileURLToPath(import.meta.url) === realpathSync(entry);
+    }
+    catch {
+        return false;
+    }
+}
+if (isMainModule()) {
+    main().then((code) => process.exit(code), () => process.exit(0));
+}
+//# sourceMappingURL=guard-check.js.map

package/dist/cli/guard-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-check.js","sourceRoot":"","sources":["../../src/cli/guard-check.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAEH,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,yDAAyD;AACzD,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAI,OAAmC,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,GAAG,GAAI,KAAiC,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;QACxC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;IAEjD,IAAI,OAAO,GAAY,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IAE7B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2FAA2F;AAC3F,SAAS,QAAQ,CAAC,CAAkC;IAClD,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,EAAE,EAAE,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAA6D;IACvF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IAC1F,KAAK,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC9F,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAA6D;IACtF,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC;IAClE,OAAO,kCAAkC,GAAG,kDAAkD,CAAC;AACjG,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CACtB,CAAC;AACJ,CAAC"}

package/dist/cli/init.d.ts

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+/**
+ * strongkeep-init CLI — write the config pack into the subscriber's harness (D6).
+ *
+ * Usage:
+ *   strongkeep-init [--harness <dir>] [--kind claude-code|cursor]
+ *                   [--tier advise|propose|auto] [--feed-url <url>] [--dry-run]
+ *   strongkeep-init --help
+ *
+ * Token: read from STRONGKEEP_TOKEN or the local login state (~/.strongkeep/token, written by
+ * strongkeep-login). NEVER accepted on argv (would leak into shell history) and NEVER printed.
+ *
+ * Design: arg-parse + orchestration + exit only. All work is in ../init.ts (runInit).
+ */
+import type { AutonomyTier } from '@strongkeep/core';
+import { type HarnessKind } from '../init.js';
+export interface InitCliOptions {
+    harnessRoot: string;
+    kind: HarnessKind;
+    tier: AutonomyTier;
+    feedUrl?: string;
+    dryRun: boolean;
+    showHelp: boolean;
+    error?: string;
+    /** Phase 3 (additive): health-check ingest URL written to local config. */
+    ingestUrl?: string;
+    /** Phase 3 (additive): self-reported staff label written to local config. */
+    staffLabel?: string;
+    /** Phase 3 (additive): skip the auto first health-check at the end of init. */
+    noHealthcheck: boolean;
+    /** Beta 2-command flow: skip the auto first feed poll at the end of init. */
+    noPoll: boolean;
+}
+/**
+ * Parse argv → options. Total; never throws. Token is NOT an argv field (read from env/login state).
+ */
+export declare function parseInitArgs(argv: string[], cwd?: string): InitCliOptions;