@terminai/core 0.21.0

package/dist/src/safety/approval-ladder/classifyDomain.js

@@ -0,0 +1,81 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import * as path from 'node:path';
+import * as os from 'node:os';
+export function classifyDomain(action, config) {
+    const { touchedPaths } = action;
+    const trustedDomains = config.getTrustedDomains(); // Using the getter we added
+    const criticalPaths = config.getCriticalPaths(); // Using the getter we added
+    // Check for privileged roots
+    if (action.roots.some((r) => ['sudo', 'su', 'doas'].includes(r))) {
+        return 'system';
+    }
+    // Check for system-level paths
+    if (touchedPaths.some((p) => isSystemPath(p, criticalPaths))) {
+        return 'system';
+    }
+    // Check for workspace paths
+    const workspaceRoot = config.getTargetDir();
+    // If no paths touched, and no network, default to workspace (e.g. valid read/UI op)
+    // But wait, if no paths touched, it might be safer to call it 'workspace' or 'trusted' if it's a known non-file tool.
+    // For now, if touchedPaths is empty, we check operations.
+    if (touchedPaths.length > 0 &&
+        touchedPaths.every((p) => isWithinWorkspace(p, workspaceRoot))) {
+        return 'workspace';
+    }
+    // Check network operations
+    if (action.operations.includes('network')) {
+        const target = getNetworkTarget(action);
+        if (!target)
+            return 'untrusted'; // Network op with unknown target
+        if (target.startsWith('localhost') || target.startsWith('127.0.0.1')) {
+            return 'localhost';
+        }
+        if (trustedDomains.some((domain) => target.includes(domain))) {
+            return 'trusted';
+        }
+        return 'untrusted';
+    }
+    // If we have file ops but they are not fully in workspace, and weren't system paths (already checked),
+    // then they are 'untrusted' (random paths outside workspace).
+    if (touchedPaths.length > 0) {
+        return 'untrusted';
+    }
+    // Default fallback for actions touching nothing (e.g. simple calculations, or pure UI)
+    return 'workspace'; // Treat as safe/internal
+}
+function isSystemPath(p, criticalPaths) {
+    const resolved = path.resolve(p);
+    return criticalPaths.some((critical) => {
+        // Exact match or subdirectory
+        // Handle home directory expansion if needed, but criticalPaths normally have full paths or ~ handled elsewhere?
+        // The defaults use ~/... so we might need to expand user home.
+        // For simplicity here, assume p is absolute or resolved.
+        // But config.getCriticalPaths() returns strings like '~/.ssh'.
+        // We should probably expand home dir in the config/getter, but let's handle it here if not.
+        const expandedCritical = critical.replace(/^~/, os.homedir());
+        const resolvedCritical = path.resolve(expandedCritical);
+        return (resolved === resolvedCritical ||
+            resolved.startsWith(resolvedCritical + path.sep));
+    });
+}
+function isWithinWorkspace(p, workspace) {
+    const resolved = path.resolve(p);
+    const workspaceResolved = path.resolve(workspace);
+    return (resolved.startsWith(workspaceResolved + path.sep) ||
+        resolved === workspaceResolved);
+}
+function getNetworkTarget(action) {
+    // Extract URL from action args or rawSummary.
+    // ActionProfile has networkTargets field if we populated it (Task 4).
+    if (action.networkTargets && action.networkTargets.length > 0) {
+        return action.networkTargets[0];
+    }
+    // Fallback to regex on summary if networkTargets missing
+    return action.rawSummary.match(/https?:\/\/([^/\s]+)/)?.[1] || null;
+}
+//# sourceMappingURL=classifyDomain.js.map

package/dist/src/safety/approval-ladder/classifyDomain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifyDomain.js","sourceRoot":"","sources":["../../../../src/safety/approval-ladder/classifyDomain.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,MAAc;IAClE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAChC,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,4BAA4B;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,4BAA4B;IAE7E,6BAA6B;IAC7B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,+BAA+B;IAC/B,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,4BAA4B;IAC5B,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5C,oFAAoF;IACpF,sHAAsH;IACtH,0DAA0D;IAE1D,IACE,YAAY,CAAC,MAAM,GAAG,CAAC;QACvB,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAC9D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,2BAA2B;IAC3B,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,WAAW,CAAC,CAAC,iCAAiC;QAElE,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,uGAAuG;IACvG,8DAA8D;IAC9D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,uFAAuF;IACvF,OAAO,WAAW,CAAC,CAAC,yBAAyB;AAC/C,CAAC;AAED,SAAS,YAAY,CAAC,CAAS,EAAE,aAAuB;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,8BAA8B;QAC9B,gHAAgH;QAChH,+DAA+D;QAC/D,yDAAyD;QACzD,+DAA+D;QAC/D,4FAA4F;QAC5F,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACxD,OAAO,CACL,QAAQ,KAAK,gBAAgB;YAC7B,QAAQ,CAAC,UAAU,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,SAAiB;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC;QACjD,QAAQ,KAAK,iBAAiB,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAqB;IAC7C,8CAA8C;IAC9C,sEAAsE;IACtE,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,yDAAyD;IACzD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACtE,CAAC"}

package/dist/src/safety/approval-ladder/classifyIntention.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { Intention } from './types.js';
+export interface ToolCall {
+    name: string;
+    args: Record<string, unknown>;
+}
+export interface Message {
+    role: 'user' | 'assistant';
+    content: string;
+}
+export declare function classifyIntention(toolCall: ToolCall, conversationHistory: Message[]): Intention;

package/dist/src/safety/approval-ladder/classifyIntention.js

@@ -0,0 +1,64 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export function classifyIntention(toolCall, conversationHistory) {
+    const lastUserMessage = conversationHistory
+        .slice()
+        .reverse()
+        .find((m) => m.role === 'user');
+    if (!lastUserMessage) {
+        return 'autonomous';
+    }
+    const userRequest = lastUserMessage.content.toLowerCase();
+    const toolName = toolCall.name.toLowerCase();
+    const toolArgs = JSON.stringify(toolCall.args).toLowerCase();
+    // Check if user explicitly mentioned the target
+    // e.g., "delete the temp folder" → rm ./temp
+    if (directlyMentioned(userRequest, toolArgs)) {
+        return 'explicit';
+    }
+    // Check if it's necessary for the stated goal
+    // e.g., "clean up project" → rm node_modules
+    if (requiredForGoal(userRequest, toolName, toolArgs)) {
+        return 'task-derived';
+    }
+    return 'autonomous';
+}
+function directlyMentioned(userRequest, toolArgs) {
+    // Extract simple path-like segments or keywords from args
+    // This is a naive heuristic.
+    // We look for segments > 3 chars that appear in user request.
+    // Exclude common json chars.
+    const cleanArgs = toolArgs.replace(/[{}":,[\]]/g, ' ');
+    return cleanArgs
+        .split(/\s+/)
+        .some((part) => part.length > 3 && userRequest.includes(part));
+}
+function requiredForGoal(userRequest, toolName, toolArgs) {
+    // Common patterns linking intents to tools/args
+    const patterns = [
+        {
+            goal: /clean\s*up/,
+            allows: ['delete', 'node_modules', 'cache', 'temp', 'dist'],
+        },
+        {
+            goal: /install|add dependency/,
+            allows: ['npm', 'pip', 'cargo', 'install', 'add'],
+        },
+        { goal: /deploy/, allows: ['build', 'push', 'upload', 'deploy'] },
+        { goal: /test/, allows: ['npm test', 'jest', 'vitest', 'pytest'] },
+        { goal: /lint|format/, allows: ['eslint', 'prettier', 'lint'] },
+    ];
+    for (const { goal, allows } of patterns) {
+        if (goal.test(userRequest)) {
+            if (allows.some((keyword) => toolName.includes(keyword) || toolArgs.includes(keyword))) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=classifyIntention.js.map

package/dist/src/safety/approval-ladder/classifyIntention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifyIntention.js","sourceRoot":"","sources":["../../../../src/safety/approval-ladder/classifyIntention.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAcH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,mBAA8B;IAE9B,MAAM,eAAe,GAAG,mBAAmB;SACxC,KAAK,EAAE;SACP,OAAO,EAAE;SACT,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAElC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAE7D,gDAAgD;IAChD,6CAA6C;IAC7C,IAAI,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,8CAA8C;IAC9C,6CAA6C;IAC7C,IAAI,eAAe,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAmB,EAAE,QAAgB;IAC9D,0DAA0D;IAC1D,6BAA6B;IAC7B,8DAA8D;IAC9D,6BAA6B;IAC7B,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,SAAS;SACb,KAAK,CAAC,KAAK,CAAC;SACZ,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,eAAe,CACtB,WAAmB,EACnB,QAAgB,EAChB,QAAgB;IAEhB,gDAAgD;IAChD,MAAM,QAAQ,GAAG;QACf;YACE,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;SAC5D;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC;SAClD;QACD,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACjE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;QAClE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;KAChE,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3B,IACE,MAAM,CAAC,IAAI,CACT,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CACtE,EACD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/safety/approval-ladder/classifyOutcome.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { ActionProfile } from './types.js';
+import type { Outcome } from './types.js';
+export declare function classifyOutcome(action: ActionProfile, isGitTracked: (path: string) => boolean, isInWorkspace: (path: string) => boolean): Outcome;

package/dist/src/safety/approval-ladder/classifyOutcome.js

@@ -0,0 +1,62 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export function classifyOutcome(action, isGitTracked, isInWorkspace) {
+    const { operations, touchedPaths, hasUnboundedScopeSignals } = action;
+    // Irreversible: Cannot be undone
+    if (hasUnboundedScopeSignals)
+        return 'irreversible';
+    // Specific Git handling
+    if ((action.roots[0] === 'git' && action.roots.includes('commit')) ||
+        (action.roots[0] === 'git' && action.rawSummary.startsWith('git commit'))) {
+        return 'reversible';
+    }
+    // Device operations are irreversible
+    if (operations.includes('device')) {
+        return 'irreversible';
+    }
+    // Privileged operations are at least soft-irreversible
+    // (System state changes are not easily reversible)
+    if (action.roots.some((r) => ['sudo', 'su', 'doas'].includes(r))) {
+        return 'soft-irreversible';
+    }
+    if (operations.includes('write')) {
+        // Write outside workspace is irreversible (can't guarantee safety/git tracking)
+        if (touchedPaths.some((p) => !isInWorkspace(p))) {
+            return 'irreversible';
+        }
+        // Git-tracked writes are reversible
+        if (touchedPaths.length > 0 && touchedPaths.every(isGitTracked)) {
+            return 'reversible';
+        }
+        // New files, untracked files, or unknown paths (empty touchedPaths): soft-irreversible
+        return 'soft-irreversible';
+    }
+    // Network mutations are soft-irreversible
+    // We treat all network ops as potential mutations for now unless we sniff HTTP method
+    if (operations.includes('network')) {
+        return 'soft-irreversible';
+    }
+    // Browser/UI/Process actions are soft-irreversible
+    if (action.toolName === 'browser_action' ||
+        action.toolName === 'computer' ||
+        operations.includes('ui') ||
+        operations.includes('process')) {
+        return 'soft-irreversible';
+    }
+    // Deletes are generally irreversible
+    if (operations.includes('delete')) {
+        if (touchedPaths.length > 0 && touchedPaths.every(isInWorkspace)) {
+            // Workspace delete is soft-irreversible (can be re-downloaded or git checkout)
+            return 'soft-irreversible';
+        }
+        if (touchedPaths.every(isGitTracked))
+            return 'soft-irreversible';
+        return 'irreversible';
+    }
+    return 'reversible';
+}
+//# sourceMappingURL=classifyOutcome.js.map

package/dist/src/safety/approval-ladder/classifyOutcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifyOutcome.js","sourceRoot":"","sources":["../../../../src/safety/approval-ladder/classifyOutcome.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,UAAU,eAAe,CAC7B,MAAqB,EACrB,YAAuC,EACvC,aAAwC;IAExC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,wBAAwB,EAAE,GAAG,MAAM,CAAC;IAEtE,iCAAiC;IACjC,IAAI,wBAAwB;QAAE,OAAO,cAAc,CAAC;IAEpD,wBAAwB;IACxB,IACE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9D,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EACzE,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,qCAAqC;IACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,uDAAuD;IACvD,mDAAmD;IACnD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,gFAAgF;QAChF,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,oCAAoC;QACpC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAChE,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,uFAAuF;QACvF,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,0CAA0C;IAC1C,sFAAsF;IACtF,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,mDAAmD;IACnD,IACE,MAAM,CAAC,QAAQ,KAAK,gBAAgB;QACpC,MAAM,CAAC,QAAQ,KAAK,UAAU;QAC9B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAC9B,CAAC;QACD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,qCAAqC;IACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACjE,+EAA+E;YAC/E,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,IAAI,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,OAAO,mBAAmB,CAAC;QACjE,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/src/safety/approval-ladder/computeBalancedRisk.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { Outcome, Intention, Domain, RiskScore } from './types.js';
+export declare function computeBalancedRisk(outcome: Outcome, intention: Intention, domain: Domain): RiskScore;

package/dist/src/safety/approval-ladder/computeBalancedRisk.js

@@ -0,0 +1,49 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export function computeBalancedRisk(outcome, intention, domain) {
+    // PIN: Irreversible + (Autonomous OR System OR Untrusted)
+    if (outcome === 'irreversible') {
+        // Note: Invariants handle most PIN cases, but we reinforce here
+        if (intention === 'autonomous') {
+            // Exception: Workspace operations are CONFIRM even if irreversible (e.g. delete untracked)
+            if (domain === 'workspace')
+                return 'confirm';
+            return 'pin';
+        }
+        if (domain === 'system')
+            return 'pin';
+        if (domain === 'untrusted')
+            return 'pin';
+        return 'confirm';
+    }
+    // CONFIRM: Deletes or autonomous modifications
+    if (outcome === 'soft-irreversible') {
+        if (intention === 'autonomous')
+            return 'confirm';
+        if (domain === 'workspace' && intention === 'explicit') {
+            // Explicit workspace delete is soft-irreversible.
+            // Balanced Mode logic: "Still confirms: Deletes"
+            return 'confirm';
+        }
+        return 'confirm'; // Safe default
+    }
+    // PASS: Reversible workspace operations
+    if (outcome === 'reversible') {
+        if (domain === 'workspace')
+            return 'pass';
+        if (domain === 'trusted')
+            return 'pass';
+        if (domain === 'localhost')
+            return 'pass';
+        // Reversible but untrusted?
+        if (domain === 'untrusted')
+            return 'log';
+    }
+    // Default fallback
+    return 'confirm';
+}
+//# sourceMappingURL=computeBalancedRisk.js.map

package/dist/src/safety/approval-ladder/computeBalancedRisk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computeBalancedRisk.js","sourceRoot":"","sources":["../../../../src/safety/approval-ladder/computeBalancedRisk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,SAAoB,EACpB,MAAc;IAEd,0DAA0D;IAC1D,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,gEAAgE;QAChE,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;YAC/B,2FAA2F;YAC3F,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,SAAS,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,+CAA+C;IAC/C,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;QACpC,IAAI,SAAS,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACjD,IAAI,MAAM,KAAK,WAAW,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YACvD,kDAAkD;YAClD,iDAAiD;YACjD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,SAAS,CAAC,CAAC,eAAe;IACnC,CAAC;IAED,wCAAwC;IACxC,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,MAAM,CAAC;QAC1C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,MAAM,CAAC;QAC1C,4BAA4B;QAC5B,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;IAC3C,CAAC;IAED,mBAAmB;IACnB,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/safety/approval-ladder/computeMinimalRisk.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { Outcome, Intention, Domain, RiskScore } from './types.js';
+export declare function computeMinimalRisk(outcome: Outcome, intention: Intention, domain: Domain): RiskScore;

package/dist/src/safety/approval-ladder/computeMinimalRisk.js

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export function computeMinimalRisk(outcome, intention, domain) {
+    // PIN: Only catastrophic autonomous actions or system critical
+    // (Handled by invariants, but Minimal profile specifics here)
+    if (outcome === 'irreversible') {
+        if (intention === 'autonomous' && domain === 'system')
+            return 'pin';
+        if (domain === 'system')
+            return 'pin'; // System irreversible should be PIN
+    }
+    // CONFIRM: Autonomous irreversible outside workspace
+    if (outcome === 'irreversible' && intention === 'autonomous') {
+        return 'confirm';
+    }
+    // PASS: Everything else (user takes responsibility)
+    return 'pass';
+}
+//# sourceMappingURL=computeMinimalRisk.js.map

package/dist/src/safety/approval-ladder/computeMinimalRisk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computeMinimalRisk.js","sourceRoot":"","sources":["../../../../src/safety/approval-ladder/computeMinimalRisk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,UAAU,kBAAkB,CAChC,OAAgB,EAChB,SAAoB,EACpB,MAAc;IAEd,+DAA+D;IAC/D,8DAA8D;IAC9D,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,IAAI,SAAS,KAAK,YAAY,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,CAAC,oCAAoC;IAC7E,CAAC;IAED,qDAAqD;IACrD,IAAI,OAAO,KAAK,cAAc,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,oDAAoD;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/safety/approval-ladder/computeMinimumReviewLevel.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { ActionProfile, DeterministicReviewResult } from './types.js';
+import type { Config } from '../../config/config.js';
+/**
+ * Computes the minimum required review level (A/B/C) for an action.
+ * Uses the new three-axis security model (Outcome, Intention, Domain).
+ *
+ * @param profile The action profile to evaluate
+ * @param config The application configuration
+ * @returns Deterministic review result with level and requirements
+ */
+export declare function computeMinimumReviewLevel(profile: ActionProfile, config: Config): DeterministicReviewResult;

package/dist/src/safety/approval-ladder/computeMinimumReviewLevel.js

@@ -0,0 +1,124 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { classifyOutcome } from './classifyOutcome.js';
+import { classifyDomain } from './classifyDomain.js';
+import { computeRisk } from './computeRisk.js';
+import { isGitTracked } from '../../utils/gitHelpers.js';
+/**
+ * Computes the minimum required review level (A/B/C) for an action.
+ * Uses the new three-axis security model (Outcome, Intention, Domain).
+ *
+ * @param profile The action profile to evaluate
+ * @param config The application configuration
+ * @returns Deterministic review result with level and requirements
+ */
+export function computeMinimumReviewLevel(profile, config) {
+    const reasons = [];
+    // Rule: Low parse confidence → C (Safety Invariant)
+    if (profile.parseConfidence === 'low') {
+        return {
+            level: 'C',
+            reasons: ['Parse confidence is low - cannot safely reason about action'],
+            requiresClick: true,
+            requiresPin: true,
+        };
+    }
+    // Rule: Unbounded scope signals -> C (Safety Invariant)
+    if (profile.hasUnboundedScopeSignals) {
+        // We continue to full classification to get all reasons, but ensure C + specific message
+        reasons.push('Delete operation with unbounded scope (/, ~, wildcards)');
+    }
+    // Helper functions for classifiers
+    const _isGitTracked = (p) => isGitTracked(p, config.getTargetDir());
+    const _isInWorkspace = (p) => {
+        const ws = config.getWorkspaceContext();
+        return ws ? ws.isPathWithinWorkspace(p) : false; // fallback or logic
+    };
+    // Run Classifiers
+    const outcome = classifyOutcome(profile, _isGitTracked, _isInWorkspace);
+    const domain = classifyDomain(profile, config);
+    // Derive intention from provenance (I-2 fix: classifyIntention requires conversation
+    // history which is not available here, so we use provenance as a proxy)
+    let intention = 'autonomous';
+    if (profile.provenance.includes('local_user') ||
+        profile.provenance.includes('web_remote_user')) {
+        intention = 'explicit';
+    }
+    else if (profile.provenance.includes('tool_output')) {
+        // Chained tool calls are considered task-derived
+        intention = 'task-derived';
+    }
+    // Compute Risk
+    const securityProfile = config.getSecurityProfile();
+    const risk = computeRisk(outcome, intention, domain, securityProfile, profile.hasUnboundedScopeSignals);
+    // Map Risk to ReviewLevel
+    let level = 'A';
+    if (risk === 'pin') {
+        level = 'C';
+        reasons.push(`High risk action (${securityProfile} profile)`);
+    }
+    else if (risk === 'confirm') {
+        level = 'B';
+        reasons.push(`Medium risk action (${securityProfile} profile)`);
+    }
+    else if (risk === 'log') {
+        level = 'A';
+        reasons.push('Logged action');
+    }
+    else {
+        level = 'A';
+    }
+    // Add specific reasons (Run before invariants to ensure complete reasoning)
+    if (level === 'A' && outcome === 'reversible' && domain === 'workspace') {
+        reasons.push('Action is read-only, bounded, and reversible');
+    }
+    if (domain === 'system') {
+        reasons.push('Privileged operation (sudo/doas/su)');
+    }
+    if (profile.operations.includes('ui')) {
+        reasons.push('UI automation requires user review');
+    }
+    if (profile.operations.includes('delete')) {
+        reasons.push('Delete operation detected');
+    }
+    if (profile.outsideWorkspace) {
+        reasons.push('Action touches paths outside workspace');
+        if (domain === 'system' || profile.operations.includes('privileged')) {
+            reasons.push('Privileged operation outside workspace');
+        }
+    }
+    if (profile.operations.includes('device')) {
+        reasons.push('Action involves device-level operations');
+    }
+    if (profile.provenance.includes('web_remote_user') &&
+        profile.operations.some((op) => op !== 'read')) {
+        level = 'C';
+        reasons.push('Action from web remote user (non-read)');
+    }
+    if (domain === 'untrusted' && profile.operations.includes('network')) {
+        reasons.push('Network operation with untrusted provenance');
+    }
+    // Rule: Outside workspace operations -> C (Safety Invariant)
+    // Applied AFTER reason generation so we include all reasons
+    if (profile.outsideWorkspace) {
+        return {
+            level: 'C',
+            reasons: reasons.length > 0
+                ? reasons
+                : ['Action touches paths outside workspace'],
+            requiresClick: true,
+            requiresPin: true,
+        };
+    }
+    return {
+        level,
+        reasons,
+        requiresClick: level === 'B' || level === 'C',
+        requiresPin: level === 'C',
+    };
+}
+//# sourceMappingURL=computeMinimumReviewLevel.js.map

package/dist/src/safety/approval-ladder/computeMinimumReviewLevel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computeMinimumReviewLevel.js","sourceRoot":"","sources":["../../../../src/safety/approval-ladder/computeMinimumReviewLevel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAsB,EACtB,MAAc;IAEd,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,oDAAoD;IACpD,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;QACtC,OAAO;YACL,KAAK,EAAE,GAAG;YACV,OAAO,EAAE,CAAC,6DAA6D,CAAC;YACxE,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;QACrC,yFAAyF;QACzF,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC1E,CAAC;IAED,mCAAmC;IACnC,MAAM,aAAa,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5E,MAAM,cAAc,GAAG,CAAC,CAAS,EAAE,EAAE;QACnC,MAAM,EAAE,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,oBAAoB;IACvE,CAAC,CAAC;IAEF,kBAAkB;IAClB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE/C,qFAAqF;IACrF,wEAAwE;IACxE,IAAI,SAAS,GAA+C,YAAY,CAAC;IACzE,IACE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACzC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAC9C,CAAC;QACD,SAAS,GAAG,UAAU,CAAC;IACzB,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACtD,iDAAiD;QACjD,SAAS,GAAG,cAAc,CAAC;IAC7B,CAAC;IAED,eAAe;IACf,MAAM,eAAe,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,WAAW,CACtB,OAAO,EACP,SAAS,EACT,MAAM,EACN,eAAe,EACf,OAAO,CAAC,wBAAwB,CACjC,CAAC;IAEF,0BAA0B;IAC1B,IAAI,KAAK,GAAgB,GAAG,CAAC;IAC7B,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,KAAK,GAAG,GAAG,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,qBAAqB,eAAe,WAAW,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,GAAG,GAAG,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,uBAAuB,eAAe,WAAW,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,KAAK,GAAG,GAAG,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,IAAI,KAAK,KAAK,GAAG,IAAI,OAAO,KAAK,YAAY,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IAC1D,CAAC;IACD,IACE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC9C,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC,EAC9C,CAAC;QACD,KAAK,GAAG,GAAG,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC9D,CAAC;IAED,6DAA6D;IAC7D,4DAA4D;IAC5D,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,GAAG;YACV,OAAO,EACL,OAAO,CAAC,MAAM,GAAG,CAAC;gBAChB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,CAAC,wCAAwC,CAAC;YAChD,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK;QACL,OAAO;QACP,aAAa,EAAE,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG;QAC7C,WAAW,EAAE,KAAK,KAAK,GAAG;KAC3B,CAAC;AACJ,CAAC"}

package/dist/src/safety/approval-ladder/computeRisk.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { Outcome, Intention, Domain, SecurityProfile, RiskScore } from './types.js';
+export declare function computeRisk(outcome: Outcome, intention: Intention, domain: Domain, profile: SecurityProfile, hasUnboundedScope: boolean): RiskScore;

package/dist/src/safety/approval-ladder/computeRisk.js

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { computeStrictRisk } from './computeStrictRisk.js';
+import { computeBalancedRisk } from './computeBalancedRisk.js';
+import { computeMinimalRisk } from './computeMinimalRisk.js';
+import { checkSafetyInvariants } from './safetyInvariants.js';
+export function computeRisk(outcome, intention, domain, profile, hasUnboundedScope) {
+    // Safety invariants override all profiles
+    const invariantLevel = checkSafetyInvariants(outcome, intention, domain, hasUnboundedScope);
+    if (invariantLevel)
+        return invariantLevel;
+    // Route to profile-specific logic
+    switch (profile) {
+        case 'strict':
+            return computeStrictRisk(outcome, intention, domain);
+        case 'balanced':
+            return computeBalancedRisk(outcome, intention, domain);
+        case 'minimal':
+            return computeMinimalRisk(outcome, intention, domain);
+        default:
+            // Unknown profile, fail closed
+            return 'confirm';
+    }
+}
+//# sourceMappingURL=computeRisk.js.map

package/dist/src/safety/approval-ladder/computeRisk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computeRisk.js","sourceRoot":"","sources":["../../../../src/safety/approval-ladder/computeRisk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,UAAU,WAAW,CACzB,OAAgB,EAChB,SAAoB,EACpB,MAAc,EACd,OAAwB,EACxB,iBAA0B;IAE1B,0CAA0C;IAC1C,MAAM,cAAc,GAAG,qBAAqB,CAC1C,OAAO,EACP,SAAS,EACT,MAAM,EACN,iBAAiB,CAClB,CAAC;IACF,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,kCAAkC;IAClC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACvD,KAAK,UAAU;YACb,OAAO,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACzD,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACxD;YACE,+BAA+B;YAC/B,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/src/safety/approval-ladder/computeStrictRisk.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { Outcome, Intention, Domain, RiskScore } from './types.js';
+export declare function computeStrictRisk(outcome: Outcome, intention: Intention, domain: Domain): RiskScore;

package/dist/src/safety/approval-ladder/computeStrictRisk.js

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export function computeStrictRisk(outcome, intention, domain) {
+    // PIN: Irreversible + (Autonomous OR System OR Untrusted)
+    if (outcome === 'irreversible') {
+        if (intention === 'autonomous')
+            return 'pin';
+        if (domain === 'system')
+            return 'pin';
+        if (domain === 'untrusted')
+            return 'pin';
+        return 'confirm'; // Explicit irreversible in workspace
+    }
+    // CONFIRM: Any modification or external access
+    if (outcome === 'soft-irreversible')
+        return 'confirm';
+    if (domain === 'untrusted')
+        return 'confirm';
+    if (intention === 'autonomous' && outcome !== 'reversible')
+        return 'confirm';
+    // LOG: Trusted network operations (even if reversible)
+    // Assuming network ops are classified as trusted by domain.
+    if (domain === 'trusted' || domain === 'localhost')
+        return 'log';
+    // PASS: Pure reads in workspace
+    return 'pass';
+}
+//# sourceMappingURL=computeStrictRisk.js.map

package/dist/src/safety/approval-ladder/computeStrictRisk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computeStrictRisk.js","sourceRoot":"","sources":["../../../../src/safety/approval-ladder/computeStrictRisk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,UAAU,iBAAiB,CAC/B,OAAgB,EAChB,SAAoB,EACpB,MAAc;IAEd,0DAA0D;IAC1D,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,IAAI,SAAS,KAAK,YAAY;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,SAAS,CAAC,CAAC,qCAAqC;IACzD,CAAC;IAED,+CAA+C;IAC/C,IAAI,OAAO,KAAK,mBAAmB;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,SAAS,KAAK,YAAY,IAAI,OAAO,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IAE7E,uDAAuD;IACvD,4DAA4D;IAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAEjE,gCAAgC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/safety/approval-ladder/safetyInvariants.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * Portions Copyright 2025 TerminaI Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Critical system paths that always require PIN
+ */
+export declare const SYSTEM_CRITICAL_PATHS: readonly ["/", "/etc", "/usr", "/bin", "/sbin", "/var", "/boot"];
+/**
+ * User-level critical paths
+ */
+export declare const USER_CRITICAL_PATHS: readonly ["~/.ssh", "~/.aws", "~/.gnupg", "~/.config"];
+/**
+ * Patterns indicating unbounded scope
+ */
+export declare const UNBOUNDED_SCOPE_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp];
+import type { Outcome, Intention, Domain } from './types.js';
+export type RiskScore = 'pass' | 'log' | 'confirm' | 'pin';
+/**
+ * Checks immutable safety invariants that must always trigger high security.
+ */
+export declare function checkSafetyInvariants(outcome: Outcome, intention: Intention, domain: Domain, hasUnboundedScope: boolean): RiskScore | null;
+/**
+ * Checks if any touched paths are critical paths (immutable Rule 3 variant).
+ * @returns 'pin' if critical path is touched, null otherwise
+ */
+export declare function checkCriticalPaths(touchedPaths: string[]): RiskScore | null;