@te-river/opencode-team-mode 1.5.15 → 1.6.1

package/dist/host/v2-offload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-offload.js","sourceRoot":"","sources":["../../src/host/v2-offload.ts"],"names":[],"mappings":"AAEA,OAAO,EAAa,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACzH,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH;;;;;;;;;gFASgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IAChE,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,WAAW;IACX,SAAS;IACT,MAAM;IACN,OAAO;IACP,OAAO;IACP,UAAU;IACV;;;;;;;;;;;;;;OAcG;IACH,UAAU;CACX,CAAC,CAAA;AAEF;;;;;yDAKyD;AACzD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACvE,CAAC;AA4CD,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAuC,EAAE,CACnE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAwB,CAAC,IAAI,KAAK,MAAM,IAAI,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ,CAAA;AAEjI;;wEAEwE;AACxE,SAAS,aAAa,CAAC,MAAe;IACpC,MAAM,CAAC,GAAG,MAAkD,CAAA;IAC5D,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,KAAK,GAAG,CAAC,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,SAAQ;QAC1B,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,GAAG,CAAC,CAAA;QACxB,MAAM,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;IAC7E,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACrC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAClD,CAAC;AAED;yDACyD;AACzD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC,CAAA;AACzG,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAA;AAE9C,MAAM,UAAU,mBAAmB,CAAC,GAAmD;IACrF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,6BAA6B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3E,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAA;AAC5G,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,MAAc,EACd,QAAkF;IAElF,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACtF,OAAO,CACL,MAAM;QACN;;MAEE,IAAI,4CAA4C;QAClD,wBAAwB,QAAQ,CAAC,GAAG,oBAAoB,QAAQ,CAAC,YAAY,2BAA2B;QACxG,oBAAoB,QAAQ,CAAC,MAAM,eAAe,QAAQ,CAAC,SAAS,MAAM,IAAI,GAAG,CAClF,CAAA;AACH,CAAC;AAED;;qEAEqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAA;AAE5C,MAAM,UAAU,iBAAiB,CAAC,GAAmD;IACnF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,2BAA2B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACzE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAA;AAC1G,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,MAAc,EACd,QAAkF,EAClF,aAAqB;IAErB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACtF,OAAO,CACL,MAAM;QACN;;MAEE,IAAI,uCAAuC;QAC7C,MAAM,QAAQ,CAAC,MAAM,wBAAwB;QAC7C,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,aAAa,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC;QAC9E,mBAAmB,QAAQ,CAAC,GAAG,oBAAoB,QAAQ,CAAC,YAAY,4BAA4B,QAAQ,CAAC,SAAS,MAAM,IAAI,GAAG,CACpI,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,QAAoH;IAEpH,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,OAAO,IAAI,sBAAsB,QAAQ,CAAC,MAAM,kCAAkC;QAClF,EAAE;QACF,QAAQ,CAAC,OAAO;QAChB,EAAE;QACF,uBAAuB,QAAQ,CAAC,GAAG,oBAAoB,QAAQ,CAAC,YAAY,sCAAsC,QAAQ,CAAC,SAAS,MAAM,IAAI,GAAG;QACjJ,qDAAqD;KACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAY,EACZ,IAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACnC,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAClF,MAAM,MAAM,GAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAClL,MAAM,IAAI,GAAI,GAAqC,EAAE,IAAI,EAAE,IAAI,CAAA;IAC/D,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,wEAAwE;QACxE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IACrD,CAAC;IACD,MAAM,GAAG,GAAI,IAAyE,CAAC,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE;QAC9G,MAAM,KAAK,GAAG,GAAgF,CAAA;QAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;QACtC,8EAA8E;QAC9E,6EAA6E;QAC7E,wEAAwE;QACxE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM;gBAAE,OAAM;YACjE,4EAA4E;YAC5E,6DAA6D;YAC7D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QAChD,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,CAAA;QACb,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,SAAS,EAAE,CAAA;YAClB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAA;YACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;YAC1B,OAAM;QACR,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,CAAA;QACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAA;QACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1B,IAAI,GAAG;YAAE,OAAM;QACf,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,MAAM,CAAC,UAAU,EAAE,CAAA;QACnB,+EAA+E;QAC/E,gFAAgF;QAChF,+EAA+E;QAC/E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3E,IAAI,QAAQ;YAAE,MAAM,CAAC,SAAS,EAAE,CAAA;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAA;QAC1C,2EAA2E;QAC3E,4EAA4E;QAC5E,2BAA2B;QAC3B,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,QAAiB,CAAA;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE;gBACrE,WAAW;gBACX,IAAI,EAAE,MAAM,IAAI,MAAM;aACvB,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,QAAQ,EAAE,CAAA;YACjB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAK,QAAoC,CAAC,SAAS,KAAK,IAAI;YAAE,OAAM;QACjH,MAAM,CAAC,GAAG,QAOT,CAAA;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;QACzB,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,2EAA2E;YAC3E,4EAA4E;YAC5E,uCAAuC;YACvC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC5C,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACpD,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,GACxB,GAAG,CAAC,QAAQ;gBACV,CAAC,CAAC,sHAAsH;gBACxH,CAAC,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC;oBACxB,CAAC,CAAC;;MAER,MAAM,yBAAyB,GAAG,CAAC,gBAAgB,yEAAyE;oBACtH,CAAC,CAAC,EACR,EAAE,CAAA;YACF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YACrD,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;YACrD,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpD,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;YAC/D,CAAC;YACD,MAAM,CAAC,MAAM,EAAE,CAAA;YACf,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAA;YACxF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAA;YAC/B,OAAM;QACR,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,2EAA2E;YAC3E,8EAA8E;YAC9E,8EAA8E;YAC9E,8EAA8E;YAC9E,4DAA4D;YAC5D,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAChD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;YACtE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;YACrD,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpD,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;YAC/D,CAAC;YACD,MAAM,CAAC,YAAY,EAAE,CAAA;YACrB,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAA;YACxF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAA;YAC/B,OAAM;QACR,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QAC5C,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG;YACnB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;SACvG,CAAA;QACD,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;QAC/D,CAAC;QACD,MAAM,CAAC,SAAS,EAAE,CAAA;QAClB,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAA;QAC1E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAA;IACjC,CAAC,CAAC,CAAA;IACF,OAAO,EAAE,aAAa,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,CAAA;AACvD,CAAC"}

package/dist/host/v2-permissions.d.ts

@@ -0,0 +1,123 @@
+/**
+ * v1's flat permission map -> v2's ordered `{action, resource, effect}` rules.
+ *
+ * v1 expressed an agent's whitelist as an object keyed by tool name, with two
+ * tricks the v2 schema cannot hold: a value may be an OBJECT of
+ * pattern->effect (the bash escalation that made the host's official dialog
+ * fire for the R6/R2 faces), and `"tm_*"` was a literal wildcard KEY that
+ * matched our whole tool family.  v2 takes only flat triples, so:
+ *
+ *  - a plain `tool: "allow"|"deny"|"ask"` becomes `{action: tool, resource:"*", effect}`;
+ *  - an escalation object becomes ONE `ask` triple for that action — the object
+ *    existed only to force a dialog, and `ask` is the effect that does it.  The
+ *    per-pattern precision comes back in #94, where the `evaluate` hook can
+ *    classify the actual command line (probed: `action:"shell"` carries the
+ *    whole command in `resources[0]`).
+ *
+ * Anything whose effect is not one of the host's three literals is DROPPED
+ * rather than guessed at: a rule the host cannot parse is worse than no rule,
+ * because it may fail closed on the whole agent.
+ */
+export type PermissionEffect = "allow" | "deny" | "ask";
+export interface PermissionTriple {
+    action: string;
+    resource: string;
+    effect: PermissionEffect;
+}
+/**
+ * v1 named its built-in tools differently.  Measured against the live v2
+ * surface (probed `session.context.tools`: edit glob grep question read shell
+ * skill subagent webfetch websearch write, plus patch/browser_*):
+ *
+ *   bash → shell · task → subagent · apply_patch → patch
+ *
+ * A name with no v2 counterpart (`list`, `todowrite`, `lsp`) is NOT emitted as
+ * a phantom rule — the caller gets it back in `unmapped` so the boot log can
+ * say "this part of the whitelist has no v2 equivalent yet", which is a
+ * reportable fact, unlike a rule the host will never match.
+ */
+export declare const V2_ACTION_NAMES: Readonly<Record<string, string>>;
+/**
+ * Tools the v1 personality registers and the v2 one does NOT — the host's own
+ * `execute` (Code Mode) already covers `tm_ptc_run` on v2 (proved against a live
+ * session: parallel governed calls, results still offloaded through handles).
+ *
+ * This is the single source for that fact: `v2.ts` skips them when registering,
+ * and `scripts/gen-v2-config.mjs` drops their permission triples, because an
+ * `allow` for an action the host has never heard of claims a capability that
+ * does not exist.
+ */
+/**
+ * Tools v1 keeps and v2 does not register.
+ *
+ * `tm_ptc_run` left because the host's own Code Mode does the job.  The other
+ * three left for the opposite reason: on v2 the NATIVE read/grep/shell are the
+ * better tools (paged reads, image/PDF attachment, background shell, and — since
+ * 1.7.0's offload layer — they are now governed too, measured at 12,902 tokens
+ * arriving as a 78-token preview).  Retiring them is only safe in that order,
+ * which is why the governance moved to `execute.after` FIRST and this list is the
+ * step that follows it, not the one that precedes it.
+ *
+ * v1 keeps all three: its `tool.execute.before` can rewrite arguments but not
+ * results, so deleting them there would delete offload itself.
+ */
+export declare const V1_ONLY_TOOLS: ReadonlySet<string>;
+/**
+ * The v2 file/shell ladder runs through the host's own tools, so the triples that
+ * DENY them must not be projected: v2-session.ts deletes every literal-`deny`
+ * action from the request, and denying `read` while `tm_read` is unregistered
+ * would leave a role with no way to open a file at all.  This is a translation
+ * decision, not an edit to src/agents.ts — v1's matrix keeps its denies and the
+ * two personalities' ladders genuinely differ now.
+ *
+ * Both halves have to agree, so the SAME set is consulted by `toolsToRemove()` in
+ * v2-session.ts; this constant is the one source.  Letting the native file tools
+ * back in does not lower a red line: v1's P2 scope ("stay inside the project +
+ * the store dirs") is the host's own `external_directory` permission action on v2,
+ * observed live answering `effect:"ask"` with a `permission.asked` behind it — a
+ * real dialog where our code used to hard-throw.  The two red lines the host does
+ * NOT know about (the address policy under `webfetch`, R6 under `shell`) are the
+ * ones `v2-guard.ts` puts into `permission.hook("evaluate")`, and that happened
+ * BEFORE this fork, which is the ordering AGENTS.md requires.
+ */
+export declare const V2_LADDER_ACTIONS: ReadonlySet<string>;
+export interface TranslateOptions {
+    /**
+     * With R6 on, v1 escalated `bash` to a pattern object so the host's OFFICIAL
+     * dialog fired.  A plugin cannot raise a dialog on v2 (probed) — but the host
+     * does honor an `ask` EFFECT it evaluates itself, so escalating the mapped
+     * `shell` action to `ask` is the closest honest equivalent: the human is
+     * asked, just per command rather than per pattern.  #94 refines the
+     * per-pattern half through `permission.hook("evaluate")`.
+     */
+    escalateShellAsk?: boolean;
+    /**
+     * Which role these triples are for.  Needed for the ONE tool that exists only on this
+     * personality: `tm_ledger` is not in the v1 permission map (v1 has the host's
+     * `todowrite`), so nothing would ever name it, and an unruled action is the host's
+     * default rather than our stated rule.  The lead's list is the lead's: `allow` for it,
+     * `deny` for the five specialists, which also makes the runtime gate
+     * (`onlyAgent: "team"`) visible in the config the user can read.
+     */
+    agentName?: string;
+}
+/** The v1 `permission` block, as loosely as the host hands it to us. */
+export declare function triplesFromAgentPermission(permission: Record<string, unknown> | undefined | null, options?: TranslateOptions): {
+    triples: PermissionTriple[];
+    unmapped: string[];
+};
+/**
+ * Union that keeps the user's unrelated rules and lets OUR matrix decide OUR
+ * actions (the matrix is the whitelist — that is the product's tool-surface
+ * promise, and it must not be silently widened by a config edit half-applying
+ * it).  Idempotent: running it twice changes nothing.
+ *
+ * `drop` is the reclaim path for an upgrade: a rule naming an action this
+ * personality never registers (a v1-only tool) can only have come from us, and
+ * leaving it behind would keep claiming a capability the host does not have.
+ */
+export declare function mergeTriples(existing: ReadonlyArray<PermissionTriple> | undefined | null, ours: ReadonlyArray<PermissionTriple>, drop?: ReadonlySet<string>): {
+    triples: PermissionTriple[];
+    changed: boolean;
+};
+//# sourceMappingURL=v2-permissions.d.ts.map

package/dist/host/v2-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-permissions.d.ts","sourceRoot":"","sources":["../../src/host/v2-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,gBAAgB,CAAA;CACzB;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI5D,CAAA;AAED;;;;;;;;;GASG;AACH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAe5C,CAAA;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAqC,CAAA;AAQvF,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,EACtD,OAAO,GAAE,gBAAqB,GAC7B;IAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA0DrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAAG,SAAS,GAAG,IAAI,EAC5D,IAAI,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACrC,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB;IAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAcnD"}

package/dist/host/v2-permissions.js

@@ -0,0 +1,190 @@
+/**
+ * v1's flat permission map -> v2's ordered `{action, resource, effect}` rules.
+ *
+ * v1 expressed an agent's whitelist as an object keyed by tool name, with two
+ * tricks the v2 schema cannot hold: a value may be an OBJECT of
+ * pattern->effect (the bash escalation that made the host's official dialog
+ * fire for the R6/R2 faces), and `"tm_*"` was a literal wildcard KEY that
+ * matched our whole tool family.  v2 takes only flat triples, so:
+ *
+ *  - a plain `tool: "allow"|"deny"|"ask"` becomes `{action: tool, resource:"*", effect}`;
+ *  - an escalation object becomes ONE `ask` triple for that action — the object
+ *    existed only to force a dialog, and `ask` is the effect that does it.  The
+ *    per-pattern precision comes back in #94, where the `evaluate` hook can
+ *    classify the actual command line (probed: `action:"shell"` carries the
+ *    whole command in `resources[0]`).
+ *
+ * Anything whose effect is not one of the host's three literals is DROPPED
+ * rather than guessed at: a rule the host cannot parse is worse than no rule,
+ * because it may fail closed on the whole agent.
+ */
+const EFFECTS = new Set(["allow", "deny", "ask"]);
+/**
+ * v1 named its built-in tools differently.  Measured against the live v2
+ * surface (probed `session.context.tools`: edit glob grep question read shell
+ * skill subagent webfetch websearch write, plus patch/browser_*):
+ *
+ *   bash → shell · task → subagent · apply_patch → patch
+ *
+ * A name with no v2 counterpart (`list`, `todowrite`, `lsp`) is NOT emitted as
+ * a phantom rule — the caller gets it back in `unmapped` so the boot log can
+ * say "this part of the whitelist has no v2 equivalent yet", which is a
+ * reportable fact, unlike a rule the host will never match.
+ */
+export const V2_ACTION_NAMES = {
+    bash: "shell",
+    task: "subagent",
+    apply_patch: "patch",
+};
+/**
+ * Tools the v1 personality registers and the v2 one does NOT — the host's own
+ * `execute` (Code Mode) already covers `tm_ptc_run` on v2 (proved against a live
+ * session: parallel governed calls, results still offloaded through handles).
+ *
+ * This is the single source for that fact: `v2.ts` skips them when registering,
+ * and `scripts/gen-v2-config.mjs` drops their permission triples, because an
+ * `allow` for an action the host has never heard of claims a capability that
+ * does not exist.
+ */
+/**
+ * Tools v1 keeps and v2 does not register.
+ *
+ * `tm_ptc_run` left because the host's own Code Mode does the job.  The other
+ * three left for the opposite reason: on v2 the NATIVE read/grep/shell are the
+ * better tools (paged reads, image/PDF attachment, background shell, and — since
+ * 1.7.0's offload layer — they are now governed too, measured at 12,902 tokens
+ * arriving as a 78-token preview).  Retiring them is only safe in that order,
+ * which is why the governance moved to `execute.after` FIRST and this list is the
+ * step that follows it, not the one that precedes it.
+ *
+ * v1 keeps all three: its `tool.execute.before` can rewrite arguments but not
+ * results, so deleting them there would delete offload itself.
+ */
+export const V1_ONLY_TOOLS = new Set([
+    "tm_ptc_run",
+    "tm_read",
+    "tm_grep",
+    "tm_bash",
+    /*
+     * `tm_pty` executes on the host's OWN terminal sessions through `client.pty.*`,
+     * and the v2 plugin context has no pty domain at all — so registering it meant
+     * shipping a tool whose every start answers "宿主 pty 接口不可用". A tool that
+     * cannot work is the overstated claim, not the fallback. v1 keeps it.
+     * Revisit only when #28 measures the native `shell` background round-trip
+     (what returns, how output is retrieved, how it is cancelled); if the host's own
+     * background shell covers it, this stays retired and the prompt says `shell`.
+     */
+    "tm_pty",
+]);
+/**
+ * The v2 file/shell ladder runs through the host's own tools, so the triples that
+ * DENY them must not be projected: v2-session.ts deletes every literal-`deny`
+ * action from the request, and denying `read` while `tm_read` is unregistered
+ * would leave a role with no way to open a file at all.  This is a translation
+ * decision, not an edit to src/agents.ts — v1's matrix keeps its denies and the
+ * two personalities' ladders genuinely differ now.
+ *
+ * Both halves have to agree, so the SAME set is consulted by `toolsToRemove()` in
+ * v2-session.ts; this constant is the one source.  Letting the native file tools
+ * back in does not lower a red line: v1's P2 scope ("stay inside the project +
+ * the store dirs") is the host's own `external_directory` permission action on v2,
+ * observed live answering `effect:"ask"` with a `permission.asked` behind it — a
+ * real dialog where our code used to hard-throw.  The two red lines the host does
+ * NOT know about (the address policy under `webfetch`, R6 under `shell`) are the
+ * ones `v2-guard.ts` puts into `permission.hook("evaluate")`, and that happened
+ * BEFORE this fork, which is the ordering AGENTS.md requires.
+ */
+export const V2_LADDER_ACTIONS = new Set(["read", "grep", "glob"]);
+const V2_ONLY_ACTIONS = new Set(["list", "todowrite", "lsp"]);
+function normalizeEffect(value) {
+    return typeof value === "string" && EFFECTS.has(value) ? value : null;
+}
+/** The v1 `permission` block, as loosely as the host hands it to us. */
+export function triplesFromAgentPermission(permission, options = {}) {
+    const triples = [];
+    const unmapped = [];
+    if (!permission || typeof permission !== "object")
+        return { triples, unmapped };
+    for (const [v1Action, value] of Object.entries(permission)) {
+        if (!v1Action)
+            continue;
+        if (V2_ONLY_ACTIONS.has(v1Action)) {
+            unmapped.push(v1Action);
+            continue;
+        }
+        const action = V2_ACTION_NAMES[v1Action] ?? v1Action;
+        // A rule for an action v2 never registers claims a capability that does not
+        // exist, and `permission.evaluate` cannot even see it to enforce it.  One
+        // source for the decision: this is the same set v2.ts skips when registering
+        // and gen-v2-config.mjs uses for the markdown frontmatter.
+        if (V1_ONLY_TOOLS.has(action))
+            continue;
+        const direct = normalizeEffect(value);
+        if (direct) {
+            // The v2 file ladder IS the native read/grep/glob, so a `deny` on them may
+            // not be projected: v2-session.ts deletes every literal-deny action from the
+            // request, and deleting them while tm_read/tm_grep are unregistered would
+            // leave a role with no way to open a file.  An explicit allow still rides.
+            if (V2_LADDER_ACTIONS.has(action) && direct === "deny")
+                continue;
+            const effect = options.escalateShellAsk && action === "shell" && direct === "allow" ? "ask" : direct;
+            triples.push({ action, resource: "*", effect });
+            // The host's 45 `browser_*` tools share ONE permission action named `browser`
+            // (read from the binary), and they are NOT in the direct tool surface — so
+            // deleting `browser_*` from `event.tools` at the request layer removes a
+            // catalog the assembled request never contained, while a role that is denied
+            // `tm_browser` can still reach every one of them from inside `execute`.
+            // Projecting the deny is the only lever that speaks their language.
+            if (action === "tm_browser" && direct === "deny") {
+                triples.push({ action: "browser", resource: "*", effect: "deny" });
+            }
+            continue;
+        }
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+            // pattern -> effect map: one dialog-forcing rule, and `ask` wins over
+            // `allow` because that is what the object was for.
+            const effects = Object.values(value)
+                .map(normalizeEffect)
+                .filter((e) => e !== null);
+            const effect = effects.includes("ask")
+                ? "ask"
+                : effects.includes("deny")
+                    ? "deny"
+                    : effects[0] ?? "ask";
+            triples.push({ action, resource: "*", effect });
+        }
+    }
+    if (options.agentName) {
+        const ledgerEffect = options.agentName === "team" ? "allow" : "deny";
+        if (!triples.some((x) => x.action === "tm_ledger")) {
+            triples.push({ action: "tm_ledger", resource: "*", effect: ledgerEffect });
+        }
+    }
+    return { triples, unmapped };
+}
+/**
+ * Union that keeps the user's unrelated rules and lets OUR matrix decide OUR
+ * actions (the matrix is the whitelist — that is the product's tool-surface
+ * promise, and it must not be silently widened by a config edit half-applying
+ * it).  Idempotent: running it twice changes nothing.
+ *
+ * `drop` is the reclaim path for an upgrade: a rule naming an action this
+ * personality never registers (a v1-only tool) can only have come from us, and
+ * leaving it behind would keep claiming a capability the host does not have.
+ */
+export function mergeTriples(existing, ours, drop) {
+    const base = Array.isArray(existing) ? existing : [];
+    const ourActions = new Set(ours.map((t) => t.action));
+    const kept = base.filter((t) => {
+        if (!t || typeof t !== "object")
+            return false;
+        const action = String(t.action);
+        return !ourActions.has(action) && !drop?.has(action);
+    });
+    const keptClean = kept.filter((t) => t && typeof t.action === "string" && EFFECTS.has(String(t.effect)));
+    const triples = [...keptClean.map((t) => ({ ...t, resource: typeof t.resource === "string" && t.resource ? t.resource : "*" })), ...ours];
+    const changed = triples.length !== base.length ||
+        JSON.stringify(triples) !== JSON.stringify(base);
+    return { triples, changed };
+}
+//# sourceMappingURL=v2-permissions.js.map

package/dist/host/v2-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-permissions.js","sourceRoot":"","sources":["../../src/host/v2-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAUH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AAEzD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqC;IAC/D,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,OAAO;CACrB,CAAA;AAED;;;;;;;;;GASG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IACxD,YAAY;IACZ,SAAS;IACT,SAAS;IACT,SAAS;IACT;;;;;;;;OAQG;IACH,QAAQ;CACT,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAEvF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAA;AAE7D,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA0B,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7F,CAAC;AAuBD,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CACxC,UAAsD,EACtD,UAA4B,EAAE;IAE9B,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAC/E,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,QAAQ;YAAE,SAAQ;QACvB,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACvB,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAA;QACpD,4EAA4E;QAC5E,0EAA0E;QAC1E,6EAA6E;QAC7E,2DAA2D;QAC3D,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAQ;QACvC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,2EAA2E;YAC3E,6EAA6E;YAC7E,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,MAAM;gBAAE,SAAQ;YAChE,MAAM,MAAM,GACV,OAAO,CAAC,gBAAgB,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;YACvF,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;YAC/C,8EAA8E;YAC9E,2EAA2E;YAC3E,yEAAyE;YACzE,6EAA6E;YAC7E,wEAAwE;YACxE,oEAAoE;YACpE,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;YACpE,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,sEAAsE;YACtE,mDAAmD;YACnD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;iBACjC,GAAG,CAAC,eAAe,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;YACnD,MAAM,MAAM,GAAqB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACtD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAA;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;QACpE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,QAA4D,EAC5D,IAAqC,EACrC,IAA0B;IAE1B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;IACpD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC/B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACxG,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;IACzI,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC9B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAC7B,CAAC"}

package/dist/host/v2-probe.d.ts

@@ -0,0 +1,85 @@
+import type { V2Registration } from "./v2-types.js";
+/**
+ * The v2 host's real tool surface — observed, not assumed.
+ *
+ * Why this exists: every decision on the v2 line is currently being made against
+ * a DESCRIPTION of the host (does `permission.evaluate` fire for `shell`?  what are
+ * the native browser tools named, and do their calls reach our hooks at all?  is
+ * the native `read` output reachable from `execute.after`?), and the type package
+ * this repo has installed is 1.18.25 while the host that runs is 2.0.16.  Reading
+ * node_modules cannot answer a question about a different build.
+ *
+ * So this module asks the running host and writes down what it says.  It registers
+ * the same hooks the guards register, mutates NOTHING, and reports only NAMES:
+ * tool ids, agent ids, action ids, the key names of an input object, the COUNT of
+ * resources plus whether any of them parses as a URL.  It never records a resource
+ * VALUE, a command line, a path or an env face — the same privacy red line the R6
+ * audit log holds itself to (tool name + category + verdict, never content).  A
+ * diagnostic that leaked the user's command lines into a probe file would be a
+ * worse bug than the one it was written to answer.
+ *
+ * The file dump is off unless `TM_V2_PROBE` names one.  The name sets fill either
+ * way and a compact snapshot rides the trajectory, because that is what lets
+ * `tm_stats` answer "which half of the plugin is running, and what did it see"
+ * from inside a session — and the snapshot is written WHILE THE PROCESS LIVES, not
+ * only from its cleanup: a first live run proved a hard exit never reaches
+ * `dispose`, so counters that only land at teardown are counters that do not exist.
+ */
+export interface V2ProbeReport {
+    /** agent ids seen in a session context */
+    agentsSeen: string[];
+    toolNames: string[];
+    /** ids reaching tool.execute.before / after */
+    executed: string[];
+    executedAfter: string[];
+    /** actions reaching permission.evaluate */
+    actions: string[];
+    /** shape facts about the message list a request carries: how many messages, how
+     *  many look like the host's injected `<task id=… state="completed">` envelope,
+     *  and how long the biggest one is.  LENGTHS ONLY — the body of a sub-agent reply
+     *  is the most private payload in the product, which is exactly why Plan B keeps
+     *  it off disk.  This is what decides whether the v2 offload has anything to hook
+     *  onto, and it must not be guessed from the v1 shape. */
+    messages: number;
+    taskEnvelopes: number;
+    maxEnvelopeChars: number;
+    /** key names of the first messages the context hook carried (shape, not text) */
+    messageShapes: Array<Record<string, unknown>>;
+    /** which host envelope spellings were seen — "v1-task" vs "v2-subagent" */
+    envelopeForms: Set<string>;
+    /** permission evaluations whose resources carried a URL (count, never the URL) */
+    urlResources: number;
+    evaluations: number;
+    /** hook points the ctx did not expose — a missing entry is a host fact */
+    hooksMissing: string[];
+    /** the ctx domains the host actually handed us.  This is what decides whether an
+     *  event-driven rebuild is even possible: a plugin cannot subscribe to a channel
+     *  that was never given, and "we should rebuild tm_join on ctx.event" is only a
+     *  plan if ctx.event exists. */
+    ctxDomains: string[];
+    /** whether TM_V2_PROBE reached THIS process.  Without this line, "no browser
+     *  tools were seen" and "nobody was listening" are the same answer. */
+    probeTarget: string;
+    lines: number;
+}
+export interface V2Probe {
+    readonly enabled: boolean;
+    readonly report: V2ProbeReport;
+    readonly registrations: V2Registration[];
+    /** Push the current counters to `onSummary`.  Throttled unless `force` — this is
+     *  called from the session context hook, which fires before EVERY model request. */
+    flush: (force?: boolean) => void;
+}
+interface ProbeOptions {
+    env?: Record<string, string | undefined>;
+    /** safety valve: a pathological session must not fill a disk */
+    maxLines?: number;
+    /** where a throttled snapshot goes (the trajectory) */
+    onSummary?: (summary: Record<string, unknown>) => void;
+    flushMs?: number;
+}
+export declare function applyV2Probe(ctx: unknown, opts?: ProbeOptions): Promise<V2Probe>;
+/** Compact form for the trajectory — names are safe, values never are. */
+export declare function probeSummary(report: V2ProbeReport): Record<string, unknown>;
+export {};
+//# sourceMappingURL=v2-probe.d.ts.map

package/dist/host/v2-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-probe.d.ts","sourceRoot":"","sources":["../../src/host/v2-probe.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAGnD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB;;;;;8DAK0D;IAC1D,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,iFAAiF;IACjF,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC7C,2EAA2E;IAC3E,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,kFAAkF;IAClF,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB;;;oCAGgC;IAChC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB;2EACuE;IACvE,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,aAAa,EAAE,cAAc,EAAE,CAAA;IACxC;wFACoF;IACpF,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;CACjC;AAED,UAAU,YAAY;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACxC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uDAAuD;IACvD,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACtD,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAmBD,wBAAsB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAwN1F;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqB3E"}