@te-river/opencode-team-mode 1.6.0 → 1.6.1

package/dist/host/v1.js

@@ -0,0 +1,340 @@
+/**
+ * The v1 personality: everything this plugin does through the OpenCode 1.18.x
+ * `server(input, options)` hook object.  Moved out of `src/index.ts` verbatim
+ * for the v2 port (see docs plan) — no behaviour change is allowed here; a v1
+ * host must observe byte-identical hooks, and the ~1700 assertions in
+ * test-*.mjs are the oracle that keeps that promise.
+ *
+ * v1-only by construction: the single composed `tool.execute.before` slot, the
+ * permission-event approval gate, the `{"*": "ask"}` bash escalation object,
+ * and `tui.showToast` notification.
+ */
+import { agents } from "../agents.js";
+import { commands } from "../commands.js";
+import { startBlackboardMaintenance, resolveTtlMs, DEFAULT_TTL_DAYS, } from "../blackboard.js";
+import { createEnvProtectHook, parseExtraDeny, resolveEnvProtectMode, bashAskPatterns, } from "../envprotect.js";
+import { createApprovalGate, resolveAskTimeoutMs, hasPermissionReplyCapability, } from "../approval-gate.js";
+import { createTmTools } from "../tm/index.js";
+import { createBashTimeoutHook } from "../tm/bash-timeout.js";
+import { createCapabilityProbe } from "../capabilities.js";
+import { createTaskOffload } from "../task-offload.js";
+import { coerceToolArgs } from "../tool-coerce.js";
+import { ASK_GRACE_MS, setAskBridgeObserver, setAskWaitMs } from "../tm/perm-ask.js";
+import { applyToolDefinition, applyChatParams, applySessionCompacting, applyCompactionAutoContinue, applyShellEnv, hookSwitches, TASK_HINT_BACKGROUND, } from "../host-hooks.js";
+import { hostBackgroundSubagentsEnabled } from "../tm/dispatch.js";
+import { blackboardNote } from "./note.js";
+export async function createV1Personality(input, options) {
+    // ---------- blackboard maintenance (code-level TTL sweeper) ----------
+    const directory = typeof input?.directory === "string" && input.directory.length > 0
+        ? input.directory
+        : process.cwd();
+    const ttlMs = resolveTtlMs(options);
+    const ttlDays = Math.round(ttlMs / (24 * 60 * 60 * 1000)) || DEFAULT_TTL_DAYS;
+    const boardRoot = startBlackboardMaintenance(directory, ttlMs);
+    const note = blackboardNote(boardRoot, ttlDays);
+    // ---------- R6 env protection (code-level interception) ----------
+    // Plugin option envProtect (default false): opt-in env protection.
+    // When disabled, R6 hook is not installed at all — no interception,
+    // no approval gate, no audit logging for env reads.
+    // When enabled, TM_ENV_PROTECT / TM_ENV_PROTECT_EXTRA_DENY still apply.
+    const envProtectMode = options?.envProtect
+        ? resolveEnvProtectMode(process.env.TM_ENV_PROTECT)
+        : "off";
+    const envProtectExtra = parseExtraDeny(process.env.TM_ENV_PROTECT_EXTRA_DENY);
+    // ---------- unified approval gate (R6 env face + R2 danger face) ----------
+    // Layer 2: ONE timer that auto-REJECTS unanswered official-dialog requests
+    // after TM_ASK_TIMEOUT_MIN and (Layer 3) fails closed if the SDK reply is
+    // broken.  Armed ONLY when R6 is not off AND the client exposes a
+    // permission-reply path — otherwise there is no live auto-reject and the
+    // R6 hook must keep hard-throwing every env read (fail-closed).
+    // Attention hook for EVERY official dialog the plugin observes (bash R2/R6
+    // asks AND the tm_* ctx.ask web dialogs): the host's `tui.showToast` RPC
+    // (verified 1.18.30 route: payload { title?, message, variant, duration })
+    // surfaces a toast so a user not staring at the screen still learns a
+    // confirmation is waiting.  Best-effort — never breaks the gate.
+    const notifyAsk = (message) => {
+        try {
+            const tui = input?.client
+                ?.tui;
+            if (typeof tui?.showToast === "function") {
+                const r = tui.showToast({
+                    title: "OpenCode TeamMode",
+                    message,
+                    variant: "warning",
+                    duration: 15_000,
+                });
+                if (r && typeof r.catch === "function") {
+                    ;
+                    r.catch(() => { });
+                }
+            }
+        }
+        catch {
+            /* notification is best-effort */
+        }
+    };
+    const approvalGate = envProtectMode !== "off" && hasPermissionReplyCapability(input?.client)
+        ? createApprovalGate({
+            client: input?.client,
+            timeoutMs: resolveAskTimeoutMs(process.env),
+            notify: notifyAsk,
+        })
+        : null;
+    if (approvalGate)
+        approvalGate.start();
+    // Sessions are only allowed to DEFER expressible env reads to the dialog
+    // once the gate registered them as carrying our injected bash ask set
+    // (reviewer C1: a global isArmed() deferral let stock build/plan agents
+    // run printenv silently).  The authoritative source of that fact is the
+    // config hook below: it records exactly which agents got the escalated
+    // ask object, and a `message.updated`/`chat.message` user prompt routed
+    // to one of those agents registers its session (live-proven ordering:
+    // the user message event arrives before the session's first
+    // tool.execute.before, while permission.asked arrives AFTER it).
+    const injectedExecAgents = new Set();
+    const envProtectHook = createEnvProtectHook(input?.client, envProtectMode, envProtectExtra, { deferToApproval: (sessionID) => approvalGate?.canDefer(sessionID) ?? false,
+        envApproved: (sessionID) => approvalGate?.isEnvApproved(sessionID) ?? false });
+    // ---------- JIT layer-2 tools (tm_read / tm_grep / tm_bash / tm_fetch) ----------
+    // T0.4-verified static registration: server() hooks gain a `tool` segment.
+    // The R6 mode/extra resolved above are passed in so the tm_* pipelines
+    // share the SAME interception source as the built-in tools (anti-backdoor:
+    // the global hook ALSO aliases tm_* onto read/grep/bash — see envprotect).
+    // ---------- host-capability probe (see src/capabilities.ts) ----------
+    // The plugin's features degrade quietly when a host surface disappears;
+    // this records what is actually present and says so once, at startup,
+    // instead of letting an OpenCode upgrade surface as an agent working
+    // around something the user never agreed to lose.
+    let capabilityProbe = null;
+    const tmRuntime = await createTmTools(input, {
+        mode: envProtectMode,
+        extra: envProtectExtra,
+        notify: notifyAsk,
+        // The capability probe is built from the tm runtime (it needs the run
+        // store to log into), and tm_stats needs the probe back — a declaration
+        // before construction breaks the cycle without weakening either side.
+        capabilities: () => capabilityProbe?.snapshot() ?? [],
+        // A child session we take over (adopted from the host tree, or named to
+        // tm_join) is registered the moment it is recognised (the message.updated
+        // route below re-confirms it): an exec-role sub-agent whose session were
+        // NOT registered would hard-throw its own protected reads instead of
+        // opening the dialog.
+        onChildSession: (sessionID, agent) => {
+            if (approvalGate && injectedExecAgents.has(agent))
+                approvalGate.registerExecSession(sessionID);
+        },
+    });
+    // ---------- host-hook switches (TM_TOOL_HINTS / TM_COMPACTION_*) ------
+    const hostSwitches = hookSwitches(process.env);
+    capabilityProbe = createCapabilityProbe({
+        client: input?.client,
+        hasShellBridge: typeof input?.$ === "function",
+        hasPermissionReply: hasPermissionReplyCapability(input?.client),
+        trajectory: (event) => tmRuntime.pipelines.store.appendTrajectory(event),
+        notify: notifyAsk,
+    });
+    // ctx.ask is only observable from inside a tool call — perm-ask reports
+    // every lookup it makes, which is how this row ever reaches 已验证.
+    // The tool-side backstop for a dialog nobody answers.  It is deliberately
+    // LONGER than the gate's own auto-reject so the gate stays authoritative when it
+    // is armed; when it is not (R6 off, no reply capability) this is the only thing
+    // that keeps a governed call from hanging until the user interrupts the turn.
+    setAskWaitMs(resolveAskTimeoutMs(process.env) + ASK_GRACE_MS);
+    setAskBridgeObserver((present) => capabilityProbe?.observeAskBridge(present));
+    // Plan B's other half: keep the host's background-task result injection
+    // inside the context budget. Built here because it needs the tm runtime's
+    // thresholds and its trajectory writer.
+    const taskOffloadHook = createTaskOffload({
+        enabled: tmRuntime.config.taskOffload === "on",
+        thresholdTokens: tmRuntime.config.offloadThresholdText,
+        previewLines: tmRuntime.config.previewLines,
+        previewMaxTokens: tmRuntime.config.previewMaxTokens,
+        log: (event) => tmRuntime.pipelines.store.appendTrajectory(event),
+    });
+    // Startup report: one trajectory line always, one toast ONLY when a
+    // required surface is gone (a missing 待观察 row is not an alarm).
+    capabilityProbe.report();
+    // ---------- bash timeout clamp (issue #6, see tm/bash-timeout.ts) ------
+    const bashTimeoutHook = createBashTimeoutHook({
+        probeMs: tmRuntime.config.bashTimeoutProbeMs,
+        maxMs: tmRuntime.config.bashTimeoutMaxMs,
+        readonlyAllowed: tmRuntime.config.bashReadonlyAllowed,
+        onClamp: (info) => {
+            try {
+                tmRuntime.pipelines.store.appendTrajectory({
+                    tool: "bash",
+                    step_id: "timeout-clamp",
+                    event: info.via,
+                    from_ms: info.from,
+                    to_ms: info.to,
+                });
+            }
+            catch {
+                /* observability only */
+            }
+        },
+    });
+    return {
+        // ---------- v1 config hook: inject agents & commands ----------
+        config(cfg) {
+            if (!cfg.agent)
+                cfg.agent = {};
+            // Execution roles carry permission.bash === "allow"; escalate it to a
+            // pattern object so the host opens its official confirmation dialog
+            // for the R6 env face + R2 danger face (default `*` stays allow).  A
+            // shallow copy keeps the module-level `agents` object pristine.  The
+            // R6 env face is only injected while the approval gate can arm: with
+            // no arming client the R6 hook hard-throws env reads BEFORE any
+            // dialog could be satisfied, so those patterns would be dead popups.
+            const bashAsk = bashAskPatterns(envProtectMode, approvalGate !== null);
+            for (const [name, def] of Object.entries(agents)) {
+                // Respect user-defined overrides: never clobber an existing entry.
+                if (cfg.agent[name])
+                    continue;
+                const permission = def.permission
+                    ? {
+                        ...def.permission,
+                        ...(def.permission.bash === "allow" ? { bash: bashAsk } : null),
+                    }
+                    : def.permission;
+                cfg.agent[name] = {
+                    ...def,
+                    permission,
+                    prompt: name === "team" ? (def.prompt ?? "") + note : def.prompt,
+                };
+                // deferral-registry seed: agents that ACTUALLY carry our escalated
+                // bash ask object (user-overridden agents never get added)
+                if (def.permission && def.permission.bash === "allow")
+                    injectedExecAgents.add(name);
+            }
+            if (!cfg.command)
+                cfg.command = {};
+            for (const [name, def] of Object.entries(commands)) {
+                if (cfg.command[name])
+                    continue;
+                cfg.command[name] = def;
+            }
+            // ---------- make Team the default agent (opt-out: defaultAgent:false)
+            const promote = options?.defaultAgent !== false;
+            if (promote && (!cfg.default_agent || cfg.default_agent === "build")) {
+                cfg.default_agent = "team";
+            }
+        },
+        // ---------- R6: block the model's env-var read paths in code ----------
+        // ONE hook, two independent jobs (the host calls the single
+        // `tool.execute.before` slot per plugin): first clamp a wasteful
+        // model-set bash timeout, then run the R6 interception.  The clamp
+        // runs BEFORE R6 so a blocked call is never also a slow one.
+        "tool.execute.before": async (input, output) => {
+            capabilityProbe?.observeHook("tool.execute.before");
+            // First, and narrowest: a built-in boolean the model sent as a string
+            // (the host's schema rejects it — two dead `task {background}` calls
+            // proved the trap). Then the timeout clamp, then R6.
+            const coerced = coerceToolArgs(input, output);
+            if (coerced.length) {
+                tmRuntime.pipelines.store.appendTrajectory({
+                    tool: String(input?.tool ?? "task"),
+                    step_id: "args-coerce",
+                    event: "coerced",
+                    keys: coerced.join(","),
+                });
+            }
+            bashTimeoutHook(input, output);
+            await envProtectHook(input, output);
+        },
+        // ---------- host-hook leverage beyond the tool surface (audit #2) ----
+        // Every one of these rides a published hook and mutates ONLY the
+        // fields whose shape is verified; each is independently switchable,
+        // because this host's d.ts has shipped surfaces the runtime never
+        // fires (permission.ask), so adapters must fail soft, not assume.
+        // The `observeHook` calls are that "not assume" made observable: a row
+        // stays 待观察 until the host actually calls the hook, and tm_stats
+        // reports it either way.
+        "tool.definition": (input, output) => {
+            capabilityProbe?.observeHook("tool.definition");
+            applyToolDefinition(input, output, hostSwitches.toolHints, hostBackgroundSubagentsEnabled() ? TASK_HINT_BACKGROUND : undefined);
+        },
+        "chat.params": (input, output) => {
+            capabilityProbe?.observeHook("chat.params");
+            applyChatParams(input, output, process.env);
+        },
+        "experimental.session.compacting": (input, output) => {
+            capabilityProbe?.observeHook("session.compacting");
+            applySessionCompacting(output, hostSwitches.compactionContext);
+        },
+        "experimental.compaction.autocontinue": (input, output) => {
+            capabilityProbe?.observeHook("compaction.autocontinue");
+            applyCompactionAutoContinue(output, process.env);
+        },
+        "shell.env": (input, output) => {
+            capabilityProbe?.observeHook("shell.env");
+            applyShellEnv(output, process.env);
+        },
+        // ---------- unified approval gate: watch the host permission dialog ---
+        event: ({ event }) => {
+            capabilityProbe?.observeEvent(event?.type ?? "");
+            // Async dispatch bookkeeping runs FIRST and independently of R6:
+            // session.idle / .error are what tell the lead its children settled.
+            tmRuntime.observeDispatchEvent(event);
+            if (!approvalGate)
+                return;
+            // Pre-tool session registration: the live host emits message.updated
+            // with the full UserMessage ({ sessionID, role:"user", agent }) when
+            // a prompt enters a session — BEFORE any tool.execute.before of that
+            // turn, which is exactly when the R6 hook needs to know the session
+            // carries our injected ask set (permission.asked only fires AFTER
+            // the hook, so it can never be the first-command registration).
+            if (event?.type === "message.updated") {
+                const info = event.properties?.info;
+                if (info &&
+                    info.role === "user" &&
+                    typeof info.agent === "string" &&
+                    typeof info.sessionID === "string") {
+                    // UserMessage.agent is a REQUIRED string in the host schema
+                    // (verified in the desktop binary), so a user prompt always names
+                    // its agent.  Deferral stays live only while the CURRENT prompt
+                    // runs an exec-role agent: a prompt routed to any other agent
+                    // revokes the registration (stock agents' sessions would never
+                    // open our dialogs, so a stale registration = silent env reads).
+                    if (injectedExecAgents.has(info.agent)) {
+                        approvalGate.registerExecSession(info.sessionID);
+                    }
+                    else {
+                        approvalGate.revokeExecSession(info.sessionID);
+                    }
+                }
+                return;
+            }
+            approvalGate.handleEvent(event);
+        },
+        // secondary registration channel (official 1.18.x contract; the event
+        // route above is the one verified against the live 1.18.29 bus)
+        "chat.message": (input, output) => {
+            // Plan B: the host's background sub-agent injects the child's FULL
+            // reply here. Governance first, and independent of the approval gate —
+            // it only ever touches synthetic parts carrying the host's own
+            // task envelope (see src/task-offload.ts).
+            taskOffloadHook(input, output ?? { message: undefined, parts: undefined });
+            if (!approvalGate)
+                return;
+            if (input &&
+                typeof input.sessionID === "string" &&
+                typeof input.agent === "string") {
+                if (injectedExecAgents.has(input.agent)) {
+                    approvalGate.registerExecSession(input.sessionID);
+                }
+                else {
+                    approvalGate.revokeExecSession(input.sessionID);
+                }
+            }
+        },
+        dispose: async () => {
+            approvalGate?.dispose();
+            // tm_browser owns a browser child process — kill it on teardown and
+            // WAIT, or the process can exit with the window still on screen.
+            await tmRuntime.dispose();
+        },
+        // ---------- JIT layer-2: tm_read / tm_grep / tm_bash / tm_fetch ----------
+        tool: tmRuntime.tools,
+    };
+}
+//# sourceMappingURL=v1.js.map

package/dist/host/v1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v1.js","sourceRoot":"","sources":["../../src/host/v1.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,gBAAgB,GACjB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,eAAe,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,qBAAqB,EAAwB,MAAM,oBAAoB,CAAA;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACpF,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,2BAA2B,EAC3B,aAAa,EACb,YAAY,EACZ,oBAAoB,GACrB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE1C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAkB,EAClB,OAAiC;IAEjC,wEAAwE;IACxE,MAAM,SAAS,GACb,OAAO,KAAK,EAAE,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAChE,CAAC,CAAC,KAAK,CAAC,SAAS;QACjB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;IACnB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,gBAAgB,CAAA;IAC7E,MAAM,SAAS,GAAG,0BAA0B,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAE/C,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,oDAAoD;IACpD,wEAAwE;IACxE,MAAM,cAAc,GAAG,OAAO,EAAE,UAAU;QACxC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACnD,CAAC,CAAC,KAAK,CAAA;IACT,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;IAE7E,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,kEAAkE;IAClE,yEAAyE;IACzE,gEAAgE;IAChE,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,SAAS,GAAG,CAAC,OAAe,EAAQ,EAAE;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAI,KAAK,EAAE,MAAwF;gBAC1G,EAAE,GAAG,CAAA;YACP,IAAI,OAAO,GAAG,EAAE,SAAS,KAAK,UAAU,EAAE,CAAC;gBACzC,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC;oBACtB,KAAK,EAAE,mBAAmB;oBAC1B,OAAO;oBACP,OAAO,EAAE,SAAS;oBAClB,QAAQ,EAAE,MAAM;iBACjB,CAAC,CAAA;gBACF,IAAI,CAAC,IAAI,OAAQ,CAAsB,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBAC7D,CAAC;oBAAC,CAAsB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAC1C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC,CAAA;IAED,MAAM,YAAY,GAChB,cAAc,KAAK,KAAK,IAAI,4BAA4B,CAAC,KAAK,EAAE,MAAM,CAAC;QACrE,CAAC,CAAC,kBAAkB,CAAC;YACjB,MAAM,EAAE,KAAK,EAAE,MAAM;YACrB,SAAS,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC;YAC3C,MAAM,EAAE,SAAS;SAClB,CAAC;QACJ,CAAC,CAAC,IAAI,CAAA;IACV,IAAI,YAAY;QAAE,YAAY,CAAC,KAAK,EAAE,CAAA;IAEtC,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,4DAA4D;IAC5D,iEAAiE;IACjE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAA;IAE5C,MAAM,cAAc,GAAG,oBAAoB,CACzC,KAAK,EAAE,MAAM,EACb,cAAc,EACd,eAAe,EACf,EAAE,eAAe,EAAE,CAAC,SAAkB,EAAE,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK;QACnF,WAAW,EAAE,CAAC,SAAkB,EAAE,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,KAAK,EAAE,CACzF,CAAA;IAED,mFAAmF;IACnF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,kDAAkD;IAClD,IAAI,eAAe,GAA2B,IAAI,CAAA;IAElD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE;QAC3C,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,SAAS;QACjB,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE;QACrD,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,qEAAqE;QACrE,sBAAsB;QACtB,cAAc,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;YACnC,IAAI,YAAY,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,YAAY,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAA;QAChG,CAAC;KACF,CAAC,CAAA;IAEF,yEAAyE;IACzE,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAE9C,eAAe,GAAG,qBAAqB,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,MAAM;QACrB,cAAc,EAAE,OAAO,KAAK,EAAE,CAAC,KAAK,UAAU;QAC9C,kBAAkB,EAAE,4BAA4B,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC;QACxE,MAAM,EAAE,SAAS;KAClB,CAAC,CAAA;IACF,wEAAwE;IACxE,iEAAiE;IACjE,0EAA0E;IAC1E,iFAAiF;IACjF,gFAAgF;IAChF,8EAA8E;IAC9E,YAAY,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;IAC9D,oBAAoB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,wCAAwC;IACxC,MAAM,eAAe,GAAG,iBAAiB,CAAC;QACxC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI;QAC9C,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,oBAAoB;QACtD,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,YAAY;QAC3C,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,gBAAgB;QACnD,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC;KAClE,CAAC,CAAA;IACF,oEAAoE;IACpE,gEAAgE;IAChE,eAAe,CAAC,MAAM,EAAE,CAAA;IAExB,0EAA0E;IAC1E,MAAM,eAAe,GAAG,qBAAqB,CAAC;QAC5C,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,kBAAkB;QAC5C,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,gBAAgB;QACxC,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,mBAAmB;QACrD,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAChB,IAAI,CAAC;gBACH,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC;oBACzC,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,eAAe;oBACxB,KAAK,EAAE,IAAI,CAAC,GAAG;oBACf,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,KAAK,EAAE,IAAI,CAAC,EAAE;iBACf,CAAC,CAAA;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO;QACL,iEAAiE;QACjE,MAAM,CAAC,GAAmB;YACxB,IAAI,CAAC,GAAG,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,GAAG,EAAE,CAAA;YAC9B,sEAAsE;YACtE,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,gEAAgE;YAChE,qEAAqE;YACrE,MAAM,OAAO,GAAG,eAAe,CAAC,cAAc,EAAE,YAAY,KAAK,IAAI,CAAC,CAAA;YACtE,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,mEAAmE;gBACnE,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU;oBAC/B,CAAC,CAAC;wBACE,GAAG,GAAG,CAAC,UAAU;wBACjB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;qBAChE;oBACH,CAAC,CAAC,GAAG,CAAC,UAAU,CAAA;gBAClB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;oBAChB,GAAG,GAAG;oBACN,UAAU;oBACV,MAAM,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;iBACjE,CAAA;gBACD,mEAAmE;gBACnE,2DAA2D;gBAC3D,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO;oBAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACrF,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,OAAO;gBAAE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;YAClC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnD,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBAC/B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA;YACzB,CAAC;YAED,uEAAuE;YACvE,MAAM,OAAO,GAAG,OAAO,EAAE,YAAY,KAAK,KAAK,CAAA;YAC/C,IAAI,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,KAAK,OAAO,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,aAAa,GAAG,MAAM,CAAA;YAC5B,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,4DAA4D;QAC5D,iEAAiE;QACjE,mEAAmE;QACnE,6DAA6D;QAC7D,qBAAqB,EAAE,KAAK,EAAE,KAAc,EAAE,MAAe,EAAE,EAAE;YAC/D,eAAe,EAAE,WAAW,CAAC,qBAAqB,CAAC,CAAA;YACnD,sEAAsE;YACtE,qEAAqE;YACrE,qDAAqD;YACrD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YAC7C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC;oBACzC,IAAI,EAAE,MAAM,CAAE,KAAmC,EAAE,IAAI,IAAI,MAAM,CAAC;oBAClE,OAAO,EAAE,aAAa;oBACtB,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;iBACxB,CAAC,CAAA;YACJ,CAAC;YACD,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YAC9B,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACrC,CAAC;QAED,wEAAwE;QACxE,iEAAiE;QACjE,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,uEAAuE;QACvE,iEAAiE;QACjE,yBAAyB;QACzB,iBAAiB,EAAE,CAAC,KAAc,EAAE,MAAe,EAAE,EAAE;YACrD,eAAe,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAA;YAC/C,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,SAAS,EAAE,8BAA8B,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACjI,CAAC;QACD,aAAa,EAAE,CAAC,KAAc,EAAE,MAAe,EAAE,EAAE;YACjD,eAAe,EAAE,WAAW,CAAC,aAAa,CAAC,CAAA;YAC3C,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7C,CAAC;QACD,iCAAiC,EAAE,CAAC,KAAc,EAAE,MAAe,EAAE,EAAE;YACrE,eAAe,EAAE,WAAW,CAAC,oBAAoB,CAAC,CAAA;YAClD,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,iBAAiB,CAAC,CAAA;QAChE,CAAC;QACD,sCAAsC,EAAE,CAAC,KAAc,EAAE,MAAe,EAAE,EAAE;YAC1E,eAAe,EAAE,WAAW,CAAC,yBAAyB,CAAC,CAAA;YACvD,2BAA2B,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QAClD,CAAC;QACD,WAAW,EAAE,CAAC,KAAc,EAAE,MAAe,EAAE,EAAE;YAC/C,eAAe,EAAE,WAAW,CAAC,WAAW,CAAC,CAAA;YACzC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QACpC,CAAC;QAED,yEAAyE;QACzE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAwB,EAAE,EAAE;YACzC,eAAe,EAAE,YAAY,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;YAChD,iEAAiE;YACjE,qEAAqE;YACrE,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACrC,IAAI,CAAC,YAAY;gBAAE,OAAM;YACzB,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,oEAAoE;YACpE,kEAAkE;YAClE,gEAAgE;YAChE,IAAI,KAAK,EAAE,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,IAElB,CAAA;gBACb,IACE,IAAI;oBACJ,IAAI,CAAC,IAAI,KAAK,MAAM;oBACpB,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;oBAC9B,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAClC,CAAC;oBACD,4DAA4D;oBAC5D,kEAAkE;oBAClE,gEAAgE;oBAChE,8DAA8D;oBAC9D,+DAA+D;oBAC/D,iEAAiE;oBACjE,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBACvC,YAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBAClD,CAAC;yBAAM,CAAC;wBACN,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBAChD,CAAC;gBACH,CAAC;gBACD,OAAM;YACR,CAAC;YACD,YAAY,CAAC,WAAW,CAAC,KAAwB,CAAC,CAAA;QACpD,CAAC;QACD,sEAAsE;QACtE,gEAAgE;QAChE,cAAc,EAAE,CACd,KAA6C,EAC7C,MAAiF,EACjF,EAAE;YACF,mEAAmE;YACnE,uEAAuE;YACvE,+DAA+D;YAC/D,2CAA2C;YAC3C,eAAe,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;YAC1E,IAAI,CAAC,YAAY;gBAAE,OAAM;YACzB,IACE,KAAK;gBACL,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;gBACnC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAC/B,CAAC;gBACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxC,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;gBACnD,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,YAAY,EAAE,OAAO,EAAE,CAAA;YACvB,oEAAoE;YACpE,iEAAiE;YACjE,MAAM,SAAS,CAAC,OAAO,EAAE,CAAA;QAC3B,CAAC;QAED,4EAA4E;QAC5E,IAAI,EAAE,SAAS,CAAC,KAAK;KACtB,CAAA;AACH,CAAC"}

package/dist/host/v2-browser-gate.d.ts

@@ -0,0 +1,45 @@
+import type { V2Registration } from "./v2-types.js";
+import type { TeamScope } from "./v2-scope.js";
+/** The four host-vs-tm_browser differences that cost rounds in the user's real task log,
+ *  said once per session at the result where each one bites. */
+export declare const NATIVE_BROWSER_NOTE: string;
+export interface BrowserGateReport {
+    /** browser_* execute.before events we looked at (Team sessions only) */
+    seen: number;
+    /** of those, how many carried a URL or local path we could classify */
+    classified: number;
+    /** refusals raised at the door */
+    refused: number;
+    /** of those refusals, how many the host walked past anyway (layer 2 fired) */
+    leaked: number;
+    /** sessions that got the one-time native browser_* reading note */
+    annotated: number;
+    /** refusals that produced no following result within the window — the door held */
+    held: number;
+    /** refusals raised against a Code Mode program (`execute`), which reaches the same
+     *  browser through `tools.browser.*` and would otherwise bypass this file entirely */
+    codeModeRefused: number;
+    /** out-of-scope calls left completely alone, counted rather than invisible */
+    foreignSkipped: number;
+    /** per-tool refusal counts, so "which verb is the hole" is answerable */
+    byTool: Record<string, {
+        seen: number;
+        refused: number;
+        leaked: number;
+    }>;
+}
+export interface BrowserGate {
+    registrations: V2Registration[];
+    report: BrowserGateReport;
+    /** The hook bodies are exported through this seam so a test can drive both halves
+     *  (a host that honours the throw, and one that does not) without a live desktop. */
+    fireBefore: (event: unknown) => void;
+    fireAfter: (event: unknown) => void;
+}
+export declare function applyV2BrowserGate(ctx: unknown, opts: {
+    allowlist: readonly string[];
+    scope?: TeamScope;
+    env?: Record<string, string | undefined>;
+}): BrowserGate;
+export declare function browserGateSummary(r: BrowserGateReport): string;
+//# sourceMappingURL=v2-browser-gate.d.ts.map

package/dist/host/v2-browser-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-browser-gate.d.ts","sourceRoot":"","sources":["../../src/host/v2-browser-gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAyC9C;gEACgE;AAChE,eAAO,MAAM,mBAAmB,QAO8B,CAAA;AAE9D,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAA;IACZ,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAA;IAClB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAA;IACd,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAA;IACjB,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAA;IACZ;0FACsF;IACtF,eAAe,EAAE,MAAM,CAAA;IACvB,8EAA8E;IAC9E,cAAc,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC1E;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,cAAc,EAAE,CAAA;IAC/B,MAAM,EAAE,iBAAiB,CAAA;IACzB;yFACqF;IACrF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IACpC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CACpC;AAyED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE;IACJ,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CACzC,GACA,WAAW,CA0Lb;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAI/D"}