@xeno-corporation/xeno-agent-sdk 0.6.8 → 0.7.0

package/README.md

@@ -2,6 +2,12 @@
 
 Core runtime for XENO agent-enabled products. It provides the agent loop, tool execution, permissions, sessions, memory, audit logging, and provider integration used across the XENO platform.
 
+## Runtime Ownership
+
+The ownership program targets P2 feature parity, but this checkout must be described by its generated audit rather than by the target. Run `npm run build && npm run compliance:ownership:artifacts` or inspect `docs/compliance/ownership-inventory.md`. Node remains an explicitly external host through P2, and development/build packages remain third-party build inputs. Do not claim that a release is fully proprietary, entirely Xeno-owned, or free of third-party runtime code unless the packaged release smoke prints the corresponding achieved level and the required provenance/counsel gates are complete.
+
+The canonical policy and engineering clean-room controls are under `ownership/`.
+
 ## Vision
 
 Every XENO creative app (Pixel, Motion, Sound) has an AI agent embedded directly into the interface. Users open a sidebar, type what they want ("remove the background from this layer", "cut the silence from this podcast", "match-cut these two clips"), and the agent translates that into tool calls against the app's engine. One request can span multiple apps: "Create a product video from these photos with background music" triggers coordinated work across Pixel, Motion, and Sound simultaneously.
@@ -25,8 +31,16 @@ With agent SDK:     User says "Create a product video" -> agents in all 3 apps c
 - **Session persistence** with checkpoints, transcript writing, and crash recovery
 - **Audit logging** in JSON-lines format (who, what, when, result)
 - **Delegation system**: planner/executor/reviewer sub-agent workflows
-- ESM-only, TypeScript 5.7.3, tsup build
-- Dependencies: chalk, glob, gray-matter
+- ESM-only, TypeScript 7 native typechecking, TypeScript 6 compiler-API compatibility, tsup build
+- Production dependencies: none
+
+### Agent Profiles
+
+The SDK includes versioned specialist contracts that bind prompts to
+enforceable tool, permission, skill, hook, memory, Soul, isolation,
+external-action, and completion policies. Profiles compile through monotonic
+capability intersection, so organization and host boundaries can narrow but
+never widen authority. See [docs/agent-profiles.md](docs/agent-profiles.md).
 
 ## Automation
 
@@ -65,7 +79,7 @@ src/
 |-----------|---------|-------------|
 | **Core Loop** | Agentic turn loop with tool dispatch, streaming, reducer | `AgentLoop`, `AgentLoopConfig` |
 | **Tools** | Registry pattern for tool registration + 6 built-in tools | `ToolRegistry`, `registry` |
-| **Security** | Permission engine with 4 modes, path sandboxing | `PermissionEngine`, `PermissionConfig` |
+| **Security** | Permission engine, filesystem/shell policy, optional OS containment | `PermissionEngine`, `PolicyEnforcerConfig` |
 | **Session** | Persistence, checkpoints, transcripts, locks, recovery | `SessionManager`, `CheckpointManager` |
 | **Identity** | Persona loading and resolution across 4 levels | `IdentityLoader`, `IdentityResolver` |
 | **Memory** | Hierarchical memory with budget management | `MemoryManager`, `MemoryBudget` |
@@ -173,12 +187,71 @@ Messages are JSON-serializable for cross-process IPC. Timeout and retry are buil
 
 ### Safety Features
 
-- **Path sandboxing**: agents cannot access files outside configured boundaries
+- **Policy enforcement**: canonical physical-path checks reject traversal through symlinks/junctions, UNC/device, extended-length, drive-relative, root-relative, alternate-data-stream, reserved-device, and ambiguous paths
+- **Shell policy**: parsed PowerShell/Bash file operands, redirections, and path parameters enforce read/write capabilities; unresolved dynamic filesystem operands fail closed
+- **Execution security levels**: `policy-only`, `process-hardened`, and `contained` are separate API contracts. The legacy `requireOsContainment: true` flag now means strict `contained` and never accepts process hardening as a substitute.
+- **Windows process hardening**: `executionLevel: "process-hardened"` uses a reduced primary token, low integrity for read-only execution, an explicit inherited-handle allowlist, a minimized environment, and a kill-on-close Job Object. It does not isolate filesystem reads or network access and is for trusted workspaces only.
+- **Fail-closed containment**: no platform currently advertises release-certified `contained` execution. A contained or untrusted request fails with `CONTAINMENT_UNAVAILABLE`; executable discovery is not treated as certification.
 - **Destructive action gates**: delete, overwrite, and shell commands require explicit approval
 - **Audit trail**: every tool call logged in JSON-lines format with trace IDs
 - **Risk classification**: each tool call classified as low/medium/high risk
 - **Permission rules**: per-tool, per-path override rules
 
+The policy layer and Windows process hardening are defense in depth, not a claim that arbitrary untrusted code is contained. See [Security Boundaries](docs/SECURITY_BOUNDARIES.md) for the capability matrix and migration contract.
+
+### Managed Shell Processes
+
+`UnifiedExecManager` is the canonical owner for pipe and PTY process lifecycles. `BackgroundProcessManager` remains the task-oriented compatibility facade and adds owner scoping, bounded file-backed output, same-process foreground-to-background promotion, completion events, input, resize, and human-writer leases.
+
+- `Bash` accepts `tty: true` only with `run_in_background: true`.
+- `TaskInput` writes to or waits on an interactive task. Input text is projected to byte-count/task metadata before audit, permission, callback, and transcript sinks.
+- PTY support is adapter based. Hosts register an optional `XenoPtyAdapter`; missing capability returns `PTY_UNAVAILABLE` and never silently falls back to a pipe.
+- App-server `exec.start` accepts `tty`, `cols`, and `rows`; `exec.resize` is owner scoped alongside write, output, list, and terminate.
+- `SessionManager.recordDirectShellResult` persists bounded local-command output as user-role untrusted context with semantic metadata, not as a fabricated model tool call.
+
+### Managed Tool Operations
+
+Tool calls now receive a stable operation ID, deadline, completion policy (`await`, `observe`, or `detach`), progress counters, terminal reason, and artifact evidence. Recovery snapshots are written atomically under the user control-plane directory, while redacted operation transitions are appended to a private JSONL ledger. Raw command text is not copied into operation lists or the ledger.
+
+- A promotable foreground `Bash` command moves to the background by changing presentation on the same process. PID, task/process IDs, output cursor, and deadline are retained; the command is never re-executed.
+- `TaskOutput({ task_id, offset })` remains a nonblocking compatibility read. `wait: true` adds an event-driven wait capped at 30 seconds and always reports explicit `Operation terminal: yes|no`, state, runtime, idle time, output delta, UTF-8-safe next offset, and suggested action.
+- Finite model-created background work defaults to `await`. The parent turn suspends without another provider request and resumes from a durable continuation notification after terminal output arrives. User stop, detach, clear, interrupt, or rewind cancels stale automatic continuation.
+- `expected_outputs` on `Bash` records generic file postconditions. Missing or unstable outputs fail the logical operation even after exit code 0; partial artifacts are still reported after timeout/failure.
+- `ReadImage` preflights format, dimensions, and bytes. The dependency-free `xeno-owned-raster` path performs owned PNG/DEFLATE decode and encode, JPEG, GIF, VP8/VP8L WebP decode, bounded SVG software rasterization, and resizing; BMP and Netpbm inputs normalize through the same owned PNG path. Oversized supported inputs become owner-private bounded PNG previews without an ambient decoder or canvas fallback. Private previews are removed during session cleanup and originals stay unchanged. The exact approved profiles and explicit rejections are documented in [`docs/owned-media-matrix.md`](docs/owned-media-matrix.md).
+
+Temporary rollback controls default to enabled: `XENO_TOOL_OPERATION_RUNTIME`, `XENO_AUTO_BACKGROUND_FOREGROUND_BASH`, `XENO_TASK_OUTPUT_WAIT`, `XENO_AUTO_TOOL_CONTINUATION`, and `XENO_READ_IMAGE_AUTO_PREVIEW`. Setting a control to `0` disables its optional behavior without deleting active tasks or persisted operation records.
+
+On Windows, ordinary managed pipe tasks use the existing kill-on-close Job Object launcher when available and report `windows-job-object`; the explicit `windows-tree-fallback` uses tree termination but is not reported as verified Job ownership. Persistent PowerShell defaults to Windows PowerShell 5.1. Set `XENO_POWERSHELL_EXECUTABLE=pwsh.exe` to use PowerShell 7. Process ownership and cleanup are not claims of untrusted-code containment.
+
+See [docs/managed-tool-operations.md](docs/managed-tool-operations.md) for the runtime and troubleshooting contract.
+
+### Agent Harness Reliability
+
+- Tool inputs are JSON-schema validated by default; malformed calls are returned to the model as typed errors.
+- Interrupted or orphaned tool exchanges are repaired before resumable history is sent back to a provider.
+- Repeated identical failing tool calls are circuit-broken before they can loop indefinitely.
+- Query lifecycle transitions are emitted as typed runtime events and guarded by idle, active-operation lease, and hard timeouts.
+- Context overflow triggers one semantic compact-and-retry path. Old tool payloads are compacted before conversation history is dropped, message count has a hard cap, and preflight token estimates are model-aware with an injectable exact-tokenizer seam.
+- The default tool registry demand-loads optional schemas through `ToolSearch` instead of advertising every full schema on every request.
+
+### Direct Provider Adapters
+
+Provider-normalized deployments can continue using the default Xeno API transport. Direct integrations are available from the provider subpath:
+
+```typescript
+import { createDirectProvider } from '@xeno-corporation/xeno-agent-sdk/providers'
+import { createXenoAgent } from '@xeno-corporation/xeno-agent-sdk'
+
+const provider = createDirectProvider({
+  kind: 'openai-responses', // 'anthropic' | 'openai-responses' | 'google' | 'openai-compatible'
+  apiKey: process.env.PROVIDER_API_KEY!,
+})
+
+const { agent } = await createXenoAgent({ provider })
+```
+
+The adapters translate streaming text, images, parallel tool calls/results, usage, cancellation, and typed failures for Messages, Responses, Gemini, and explicitly profiled chat-compatible endpoints. Generic endpoints require a capability profile and local HTTP requires an explicit local-network endpoint profile. See [docs/PROVIDER_CONFORMANCE.md](docs/PROVIDER_CONFORMANCE.md).
+
 ## Session Persistence
 
 - Sessions have unique IDs with embedded timestamps
@@ -209,7 +282,7 @@ Memory is injected into the system prompt with configurable token budgets to avo
 | **xeno-rt** (local) | OpenAI-compatible API on localhost | Offline, privacy, no cost |
 | **Ollama** (local) | OpenAI-compatible API | Alternative local provider |
 
-The SDK is provider-agnostic. Any OpenAI-compatible endpoint works. Provider selection and fallback logic are handled by the config subsystem.
+The SDK is provider-agnostic. OpenAI-compatible endpoints are supported through an explicit capability and endpoint-security profile; compatibility is verified by conformance fixtures rather than inferred from the endpoint label. Provider selection and fallback logic are handled by the config subsystem.
 
 ## Consumers
 
@@ -221,18 +294,30 @@ The SDK is provider-agnostic. Any OpenAI-compatible endpoint works. Provider sel
 | **xeno-sound** | Audio editing agent sidebar | "Master this podcast to -16 LUFS" |
 | **xeno-hub** | Orchestrator routing tasks between apps | "Create marketing materials" dispatches to Pixel + Motion + Sound |
 
-## Planned: React Component Library
+## Xeno-Owned UI
 
-A separate `/react` or `/ui` export will provide pre-built React components for embedding the agent interface in Electron-based XENO apps:
+The `/ui` subpath provides a framework-neutral controller, semantic accessibility view, and optional owned DOM renderer. It has no React runtime or peer dependency and remains isolated from the Node-only core entry point.
 
-- **ChatPanel** -- full agent sidebar with message history
-- **MessageBubble** -- individual messages (user, agent, system)
-- **ToolCallIndicator** -- real-time display of tool execution with status
-- **ThinkingState** -- streaming thinking/reasoning indicator
-- **PermissionPrompt** -- inline approval UI for destructive actions
-- **SessionSwitcher** -- switch between conversation sessions
+```ts
+import {
+  createAgentUiController,
+  mountAgentUi,
+} from "@xeno-corporation/xeno-agent-sdk/ui";
+
+const controller = createAgentUiController({
+  agent: myAgentLoop,
+  enablePermissionRequests: true,
+});
+const view = mountAgentUi(document.querySelector("#agent")!, controller, {
+  agentName: "Xeno Agent",
+});
+
+// App shutdown:
+view.dispose();
+controller.dispose();
+```
 
-These components will NOT live in the core SDK (no DOM dependencies in core). They will be a separate package entry point that apps can import independently.
+Framework integrations can subscribe to immutable controller snapshots and call `createAgentUiView` instead of mounting the DOM renderer. Renderer contract version `1` includes message streaming, tool state, token usage, cancellation, retry, permission decisions, safe markdown segments, keyboard submission, and accessible roles/live regions. See [the UI v1 migration guide](docs/migrations/sdk-ui-v1.md).
 
 ## Ecosystem Position
 
@@ -254,7 +339,8 @@ See [Full Ecosystem Report](../XENO%20CORPORATION%20-%20Full%20Ecosystem%20Repor
 ```bash
 npm install
 npm run build      # tsup -> ESM output
-npm run typecheck   # TypeScript 5.7.3 strict mode
+npm run typecheck   # TypeScript 7 native strict-mode check
+npm run typecheck:compat # TypeScript 6 compatibility check for API-based tooling
 ```
 
 ## License

package/dist/agents/index.d.ts

@@ -111,4 +111,134 @@ declare function createAgentDefinitionFile(input: {
     prompt?: string;
     force?: boolean;
 }): string;
-export { type AgentDefinition, type AgentDefinitionIsolation, type AgentDefinitionIssue, AgentDefinitionLoader, type AgentDefinitionLoaderOptions, type AgentDefinitionMetadata, AgentDefinitionResolver, type AgentDefinitionScanResult, type AgentDefinitionScope, type AgentDefinitionShadowRef, type AgentToolPolicy, createAgentDefinitionFile, createAgentDefinitionPromptSection, getProjectAgentDefinitionDirs, getProjectAgentDefinitionsDir, getUserAgentDefinitionsDir, isValidAgentDefinitionName, renderAgentDefinition, renderAgentDefinitions, resolveAgentDefinition, resolveAgentToolPolicy, scanAgentDefinitions, toAgentDefinitionMetadata, validateAgentDefinition };
+type PermissionProfileName = "default" | "read-only" | "trusted-dev";
+declare const XENO_AGENT_PROFILE_SCHEMA_VERSION: 2;
+type AgentProfileKind = "primary" | "subagent" | "service";
+type AgentProfileCollaborationMode = "chat" | "plan" | "execute" | "review";
+type AgentProfileMemoryScope = "none" | "session" | "project" | "user";
+type AgentProfileSoulMode = "disabled" | "read" | "learn";
+type AgentProfileIsolation = AgentDefinitionIsolation | "container";
+type AgentProfileExternalAction = "publish" | "deploy" | "push" | "send" | "purchase" | "sign" | "file-legal" | "change-infrastructure";
+type AgentProfileActionDecision = "allow" | "ask" | "deny";
+type AgentProfileEvidenceKind = "sources" | "file-references" | "tests" | "typecheck" | "build" | "diff" | "deployment-proof" | "human-review";
+interface AgentProfileSkillPolicy {
+    preload: string[];
+    allow?: string[];
+    deny: string[];
+}
+interface AgentProfileExternalActionPolicy {
+    default: AgentProfileActionDecision;
+    overrides?: Partial<Record<AgentProfileExternalAction, AgentProfileActionDecision>>;
+    requireCurrentTurnApproval: AgentProfileExternalAction[];
+}
+interface AgentProfileCapabilities {
+    tools: AgentToolPolicy;
+    skills: AgentProfileSkillPolicy;
+    hooks: string[];
+    mcpServers?: string[];
+    delegatedAgents?: string[];
+    permissionProfile: PermissionProfileName;
+    externalActions: AgentProfileExternalActionPolicy;
+}
+interface AgentProfileMemoryPolicy {
+    scope: AgentProfileMemoryScope;
+    role: string;
+    soul: AgentProfileSoulMode;
+}
+interface AgentProfileExecutionPolicy {
+    defaultMode: AgentProfileCollaborationMode;
+    allowedModes: AgentProfileCollaborationMode[];
+    isolation: AgentProfileIsolation;
+    allowBackground: boolean;
+    planForComplexTasks: boolean;
+    defaultDryRun: boolean;
+    maxTurns?: number;
+}
+interface AgentProfileCompletionPolicy {
+    evidence: AgentProfileEvidenceKind[];
+    requirePrimarySources: boolean;
+    requireCurrentInformation: boolean;
+    requireHumanReview: boolean;
+    stopConditions: string[];
+}
+interface AgentProfilePresentation {
+    label: string;
+    color: string;
+    glyph: string;
+}
+interface AgentProfileV2 {
+    schemaVersion: typeof XENO_AGENT_PROFILE_SCHEMA_VERSION;
+    id: string;
+    version: string;
+    displayName: string;
+    description: string;
+    kind: AgentProfileKind;
+    prompt: string;
+    model?: {
+        preferred?: string;
+        effort?: "low" | "medium" | "high";
+    };
+    capabilities: AgentProfileCapabilities;
+    memory: AgentProfileMemoryPolicy;
+    execution: AgentProfileExecutionPolicy;
+    completion: AgentProfileCompletionPolicy;
+    presentation: AgentProfilePresentation;
+    tags: string[];
+}
+interface AgentProfileCapabilityBoundary {
+    source: string;
+    tools?: AgentToolPolicy;
+    skills?: {
+        allow?: string[];
+        deny?: string[];
+    };
+    hooks?: {
+        allow?: string[];
+        require?: string[];
+    };
+    mcpServers?: {
+        allow?: string[];
+        deny?: string[];
+    };
+    delegatedAgents?: {
+        allow?: string[];
+        deny?: string[];
+    };
+    permissionProfile?: PermissionProfileName;
+    externalActions?: {
+        default?: AgentProfileActionDecision;
+        overrides?: Partial<Record<AgentProfileExternalAction, AgentProfileActionDecision>>;
+        requireCurrentTurnApproval?: AgentProfileExternalAction[];
+    };
+    maximumMemoryScope?: AgentProfileMemoryScope;
+    maximumSoulMode?: AgentProfileSoulMode;
+    requiredIsolation?: AgentProfileIsolation;
+}
+interface CompileAgentProfileOptions {
+    boundaries?: AgentProfileCapabilityBoundary[];
+}
+interface CompiledAgentProfile {
+    schemaVersion: typeof XENO_AGENT_PROFILE_SCHEMA_VERSION;
+    profile: AgentProfileV2;
+    fingerprint: string;
+    boundarySources: string[];
+    capabilities: AgentProfileCapabilities;
+    memory: AgentProfileMemoryPolicy;
+    execution: AgentProfileExecutionPolicy;
+    completion: AgentProfileCompletionPolicy;
+    promptSection: PromptSectionProvider;
+}
+declare class AgentProfileValidationError extends Error {
+    constructor(message: string);
+}
+declare function compileAgentProfile(sourceProfile: AgentProfileV2, options?: CompileAgentProfileOptions): CompiledAgentProfile;
+declare function listBuiltInAgentProfiles(): AgentProfileV2[];
+declare function resolveBuiltInAgentProfile(id: string): AgentProfileV2 | null;
+declare function agentProfileFromDefinition(definition: AgentDefinition): AgentProfileV2;
+declare function agentDefinitionFromProfile(profile: AgentProfileV2): AgentDefinition;
+declare function resolveAgentProfile(input: {
+    name: string;
+    definition?: AgentDefinition | null;
+    boundaries?: AgentProfileCapabilityBoundary[];
+}): CompiledAgentProfile | null;
+export { type AgentDefinition, type AgentDefinitionIsolation, type AgentDefinitionIssue, AgentDefinitionLoader, type AgentDefinitionLoaderOptions, type AgentDefinitionMetadata, AgentDefinitionResolver, type AgentDefinitionScanResult, type AgentDefinitionScope, type AgentDefinitionShadowRef, type AgentProfileActionDecision, type AgentProfileCapabilities, type AgentProfileCapabilityBoundary, type AgentProfileCollaborationMode, type AgentProfileCompletionPolicy, type AgentProfileEvidenceKind, type AgentProfileExecutionPolicy, type AgentProfileExternalAction, type AgentProfileExternalActionPolicy, type AgentProfileIsolation, type AgentProfileKind, type AgentProfileMemoryPolicy, type AgentProfileMemoryScope, type AgentProfilePresentation, type AgentProfileSkillPolicy, type AgentProfileSoulMode, type AgentProfileV2, AgentProfileValidationError, type AgentToolPolicy, type CompileAgentProfileOptions, type CompiledAgentProfile, XENO_AGENT_PROFILE_SCHEMA_VERSION, agentDefinitionFromProfile, agentProfileFromDefinition, compileAgentProfile, createAgentDefinitionFile, createAgentDefinitionPromptSection, getProjectAgentDefinitionDirs, getProjectAgentDefinitionsDir, getUserAgentDefinitionsDir, isValidAgentDefinitionName, listBuiltInAgentProfiles, renderAgentDefinition, renderAgentDefinitions, resolveAgentDefinition, resolveAgentProfile, resolveAgentToolPolicy, resolveBuiltInAgentProfile, scanAgentDefinitions, toAgentDefinitionMetadata, validateAgentDefinition };

package/dist/agents/index.js

@@ -1,7 +1,17 @@
-import{existsSync as k,mkdirSync as B,readFileSync as C,readdirSync as F,writeFileSync as J}from"fs";import{homedir as W}from"os";import{basename as Y,dirname as U,join as m,parse as _,resolve as z}from"path";function S(t){let n=L(t);return{frontmatter:n.frontmatter,content:n.content.trim()}}function L(t){let n=t.replace(/^\uFEFF/,"");if(!n.startsWith("---"))return{frontmatter:{},content:t};let e=n.search(/\r?\n/);if(e<0||n.slice(0,e).trim()!=="---")return{frontmatter:{},content:t};let o=n.slice(e+(n[e]==="\r"?2:1)),i=o.match(/(?:^|\r?\n)---[ \t]*(?:\r?\n|$)/);if(!i||i.index===void 0)throw new Error("YAML frontmatter is not closed.");let r=o.slice(0,i.index),s=i[0],a=i.index+s.length;return{frontmatter:b(r),content:o.slice(a)}}function b(t){let n={},e=t.split(/\r?\n/);for(let o=0;o<e.length;o+=1){let i=e[o];if(!i.trim()||i.trimStart().startsWith("#"))continue;if(/^\s/.test(i))throw new Error(`Unexpected indentation at line ${o+1}.`);let r=M(i,o+1);if(r.key==="<<")throw new Error("YAML merge keys are not supported.");if(r.value!==""){n[r.key]=j(r.value,o+1);continue}let s=R(e,o+1);n[r.key]=s.value,o=s.nextIndex-1}return n}function R(t,n){let e=[],o=n;for(;o<t.length;o+=1){let r=t[o];if(!r.trim()){e.push(r);continue}if(!/^\s/.test(r))break;e.push(r.replace(/^ {2}/,""))}let i=e.filter(r=>r.trim()&&!r.trimStart().startsWith("#"));return i.length===0?{value:{},nextIndex:o}:i.every(r=>r.trimStart().startsWith("- "))?{value:i.map((r,s)=>j(r.trimStart().slice(2),n+s+1)),nextIndex:o}:{value:b(e.join(`
-`)),nextIndex:o}}function M(t,n){let e=t.indexOf(":");if(e<=0)throw new Error(`Invalid YAML line ${n}.`);let o=t.slice(0,e).trim(),i=t.slice(e+1).trim();if(!o)throw new Error(`Invalid YAML key at line ${n}.`);return{key:o,value:i}}function j(t,n){if(t==="")return"";if(t==="[]")return[];if(t==="{}")return{};if(t==="true")return!0;if(t==="false")return!1;if(t==="null"||t==="~")return null;if(/^-?\d+(?:\.\d+)?$/.test(t))return Number(t);if(t.startsWith('"'))return x(t,n);if(t.startsWith("'")){if(!t.endsWith("'"))throw new Error(`Unclosed quoted scalar at line ${n}.`);return t.slice(1,-1).replace(/''/g,"'")}if(t.startsWith("[")||t.startsWith("{"))return x(t,n);if(t.includes("[")||t.includes("]")||t.includes("{")||t.includes("}"))throw new Error(`Unsupported YAML scalar at line ${n}.`);return t}function x(t,n){try{return JSON.parse(t)}catch{throw new Error(`Invalid YAML scalar at line ${n}.`)}}var H=/^[a-z][a-z0-9_-]{0,63}$/;function v(){return process.env.XENO_AGENT_HOME?.trim()||m(W(),".xeno-agent")}function O(t=v()){return m(t,"agents")}function T(t){return z(t)}function q(t){let n=U(t);return n===t?t:n}function G(t=process.cwd()){let n=T(t),e=[],o=n;for(;;){let i=m(o,".xeno","agents");k(i)&&e.push(i);let r=q(o);if(r===o)break;o=r}return e.reverse()}function V(t=process.cwd()){return m(T(t),".xeno","agents")}function K(t){return k(t)?F(t,{withFileTypes:!0}).filter(n=>n.isFile()&&n.name.toLowerCase().endsWith(".md")).map(n=>m(t,n.name)).sort((n,e)=>n.localeCompare(e)):[]}function u(t){if(typeof t!="string")return;let n=t.trim();return n.length>0?n:void 0}function d(t){return Array.isArray(t)?t.map(n=>String(n).trim()).filter(Boolean):typeof t=="string"?t.split(",").map(n=>n.trim()).filter(Boolean):[]}function X(t){if(typeof t=="boolean")return t;if(typeof t!="string")return;let n=t.trim().toLowerCase();if(["1","true","yes","on"].includes(n))return!0;if(["0","false","no","off"].includes(n))return!1}function Q(t){return _(Y(t)).name.toLowerCase()}function E(t){return H.test(t)}function Z(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function tt(t){if(typeof t!="string")return;let n=t.trim().toLowerCase();if(n==="inherit")return"inherit";if(n==="none"||n==="off"||n==="disabled")return"none";if(n==="read"||n==="readonly"||n==="read-only")return"readOnly";if(n==="default"||n==="standard")return"default";if(n==="full"||n==="fullaccess"||n==="full-access")return"fullAccess"}function nt(t){if(t===void 0)return;if(typeof t=="string"||Array.isArray(t)){let r=d(t);return r.length>0?{allow:r}:void 0}if(!Z(t))return;let n=d(t.allow),e=d(t.deny),o=tt(t.mode),i={};return o&&(i.mode=o),n.length>0&&(i.allow=n),e.length>0&&(i.deny=e),Object.keys(i).length>0?i:void 0}function et(t){let n=X(t.worktree??t.defaultWorktreeIsolation);if(n===!0)return"worktree";if(n===!1)return"none";let e=u(t.isolation)?.toLowerCase();if(e==="worktree")return"worktree";if(e==="none"||e==="off"||e==="disabled")return"none"}function ot(t){let n=[];return E(t.name)||n.push(`Invalid agent name "${t.name}". Use 1-64 lowercase letters, digits, hyphens, or underscores, starting with a letter.`),t.prompt.trim().length===0&&n.push("Agent definition body is empty."),n}function rt(t,n,e){let o=C(t,"utf8"),i=S(o),r=i.frontmatter,s=Q(t),a=u(r.name)?.toLowerCase()??s,f=i.content.trim(),y=ot({name:a,prompt:f});if(y.length>0)throw new Error(y.join(" "));let p=u(r.description),c=u(r.model),l=u(r.color),h=u(r.memory??r.memoryScope),$=et(r),P=nt(r.tools);return{name:a,scope:n,path:t,...p?{description:p}:{},...c?{model:c}:{},...l?{color:l}:{},...h?{memory:h}:{},...$?{isolation:$}:{},tags:d(r.tags),skills:d(r.skills),hooks:d(r.hooks),prompt:f,active:!0,priority:e,...P?{toolPolicy:P}:{}}}function w(t,n,e,o,i){for(let r of K(t))try{o.push(rt(r,n,e))}catch(s){i.push({path:r,scope:n,message:s instanceof Error?s.message:String(s)})}}function it(t){let n=new Map;for(let e of t){let o=n.get(e.name);(!o||e.priority>o.priority)&&n.set(e.name,e)}return n}function st(t,n){let e=n.get(t.name),o=e?.path===t.path;return{name:t.name,scope:t.scope,path:t.path,...t.description?{description:t.description}:{},...t.model?{model:t.model}:{},...t.color?{color:t.color}:{},...t.memory?{memory:t.memory}:{},...t.isolation?{isolation:t.isolation}:{},tags:t.tags,skills:t.skills,hooks:t.hooks,prompt:t.prompt,active:o,...t.toolPolicy?{toolPolicy:t.toolPolicy}:{},...!o&&e?{shadowedBy:{name:e.name,scope:e.scope,path:e.path}}:{}}}function N(t=process.cwd(),n={}){let e=n.cwd??t,o=n.userDir??O(n.agentHome),i=n.projectDirs??G(e),r=n.pluginDirs??[],s=n.builtInDirs??[],a=[],f=[];n.includeUser!==!1&&w(o,"user",0,a,f),n.includeProject!==!1&&i.forEach((c,l)=>w(c,"project",100+l,a,f)),n.includePlugins&&r.forEach((c,l)=>w(c,"plugin",1e3+l,a,f)),n.includeBuiltIns&&s.forEach((c,l)=>w(c,"built-in",2e3+l,a,f));let y=it(a),p=a.map(c=>st(c,y));return p.sort((c,l)=>{if(c.active!==l.active)return c.active?-1:1;let h=c.name.localeCompare(l.name);return h!==0?h:c.path.localeCompare(l.path)}),{definitions:p,issues:f,searchPaths:{...n.includeUser!==!1?{user:o}:{},project:n.includeProject===!1?[]:i,plugin:n.includePlugins?r:[],builtIn:n.includeBuiltIns?s:[]}}}function mt(t,n=process.cwd(),e={}){let o=t.trim().toLowerCase(),i=N(n,e);return{definition:i.definitions.find(r=>r.active&&r.name===o)??null,scan:i}}var D=class{constructor(n={}){this.options=n}options;scan(n=this.options.cwd??process.cwd()){return N(n,this.options)}},I=class{constructor(n=new D){this.loader=n}loader;resolve(n,e=process.cwd()){let o=this.loader.scan(e),i=n.trim().toLowerCase();return{definition:o.definitions.find(r=>r.active&&r.name===i)??null,scan:o}}};function A(t){if(!t||t.length===0)return;let n=Array.from(new Set(t.map(e=>e.trim()).filter(Boolean)));return n.length>0?n:void 0}function ct(t,n){if(!t&&!n)return;if(!t)return A(n);if(!n)return A(t);let e=new Set(n);return A(t.filter(o=>e.has(o)))}function at(t,n){let e={none:0,readOnly:1,default:2,fullAccess:3,inherit:4},o=n??"inherit",i=t??"inherit";return e[o]<=e[i]?o:i}function pt(t,n={}){let e=t.toolPolicy??{},o={mode:at(e.mode,n.mode)},i=ct(n.allow,e.allow),r=A([...n.deny??[],...e.deny??[]]);return i&&(o.allow=i),r&&(o.deny=r),o}function ht(t){return{name:`custom-agent:${t.name}`,order:20,provide(){let n=["","","# Custom Agent",`Active agent: ${t.name}`,`Definition scope: ${t.scope}`,`Definition path: ${t.path}`];return t.description&&n.push(`Description: ${t.description}`),n.push("",t.prompt),n.join(`
-`)}}}function yt(t){return{name:t.name,scope:t.scope,path:t.path,...t.description?{description:t.description}:{},...t.model?{model:t.model}:{},...t.color?{color:t.color}:{},...t.memory?{memory:t.memory}:{},...t.isolation?{isolation:t.isolation}:{},tags:t.tags,skills:t.skills,hooks:t.hooks,active:t.active,...t.toolPolicy?{toolPolicy:t.toolPolicy}:{},...t.shadowedBy?{shadowedBy:t.shadowedBy}:{}}}function g(t,n){return t.length>=n?t:t+" ".repeat(n-t.length)}function wt(t,n){let e=[];if(t.length===0)e.push("No custom agent definitions found.");else{e.push(`${g("name",22)} ${g("scope",8)} ${g("status",9)} description`),e.push(`${"-".repeat(22)} ${"-".repeat(8)} ${"-".repeat(9)} ${"-".repeat(32)}`);for(let o of t){let i=o.active?"active":"shadowed";e.push(`${g(o.name,22)} ${g(o.scope,8)} ${g(i,9)} ${o.description??""}`)}}if(n.length>0){e.push("","Invalid definitions:");for(let o of n)e.push(`- ${o.path}: ${o.message}`)}return e.join(`
+import{existsSync as I,mkdirSync as le,readFileSync as ae,readdirSync as ce,writeFileSync as de}from"fs";import{homedir as ue}from"os";import{basename as fe,dirname as pe,join as k,parse as ge,resolve as me}from"path";function W(e){let n=te(e);return{frontmatter:n.frontmatter,content:n.content.trim()}}function te(e){let n=e.replace(/^\uFEFF/,"");if(!n.startsWith("---"))return{frontmatter:{},content:e};let r=n.search(/\r?\n/);if(r<0||n.slice(0,r).trim()!=="---")return{frontmatter:{},content:e};let o=n.slice(r+(n[r]==="\r"?2:1)),t=o.match(/(?:^|\r?\n)---[ \t]*(?:\r?\n|$)/);if(!t||t.index===void 0)throw new Error("YAML frontmatter is not closed.");let i=o.slice(0,t.index),l=t[0],s=t.index+l.length;return{frontmatter:U(i),content:o.slice(s)}}function U(e){let n={},r=e.split(/\r?\n/);for(let o=0;o<r.length;o+=1){let t=r[o];if(!t.trim()||t.trimStart().startsWith("#"))continue;if(/^\s/.test(t))throw new Error(`Unexpected indentation at line ${o+1}.`);let i=se(t,o+1);if(i.key==="<<")throw new Error("YAML merge keys are not supported.");if(i.value!==""){n[i.key]=H(i.value,o+1);continue}let l=ie(r,o+1);n[i.key]=l.value,o=l.nextIndex-1}return n}function ie(e,n){let r=[],o=n;for(;o<e.length;o+=1){let i=e[o];if(!i.trim()){r.push(i);continue}if(!/^\s/.test(i))break;r.push(i.replace(/^ {2}/,""))}let t=r.filter(i=>i.trim()&&!i.trimStart().startsWith("#"));return t.length===0?{value:{},nextIndex:o}:t.every(i=>i.trimStart().startsWith("- "))?{value:t.map((i,l)=>H(i.trimStart().slice(2),n+l+1)),nextIndex:o}:{value:U(r.join(`
+`)),nextIndex:o}}function se(e,n){let r=e.indexOf(":");if(r<=0)throw new Error(`Invalid YAML line ${n}.`);let o=e.slice(0,r).trim(),t=e.slice(r+1).trim();if(!o)throw new Error(`Invalid YAML key at line ${n}.`);return{key:o,value:t}}function H(e,n){if(e==="")return"";if(e==="[]")return[];if(e==="{}")return{};if(e==="true")return!0;if(e==="false")return!1;if(e==="null"||e==="~")return null;if(/^-?\d+(?:\.\d+)?$/.test(e))return Number(e);if(e.startsWith('"'))return V(e,n);if(e.startsWith("'")){if(!e.endsWith("'"))throw new Error(`Unclosed quoted scalar at line ${n}.`);return e.slice(1,-1).replace(/''/g,"'")}if(e.startsWith("[")||e.startsWith("{"))return V(e,n);if(e.includes("[")||e.includes("]")||e.includes("{")||e.includes("}"))throw new Error(`Unsupported YAML scalar at line ${n}.`);return e}function V(e,n){try{return JSON.parse(e)}catch{throw new Error(`Invalid YAML scalar at line ${n}.`)}}var ye=/^[a-z][a-z0-9_-]{0,63}$/;function he(){return process.env.XENO_AGENT_HOME?.trim()||k(ue(),".xeno-agent")}function z(e=he()){return k(e,"agents")}function G(e){return me(e)}function Ae(e){let n=pe(e);return n===e?e:n}function Pe(e=process.cwd()){let n=G(e),r=[],o=n;for(;;){let t=k(o,".xeno","agents");I(t)&&r.push(t);let i=Ae(o);if(i===o)break;o=i}return r.reverse()}function we(e=process.cwd()){return k(G(e),".xeno","agents")}function be(e){return I(e)?ce(e,{withFileTypes:!0}).filter(n=>n.isFile()&&n.name.toLowerCase().endsWith(".md")).map(n=>k(e,n.name)).sort((n,r)=>n.localeCompare(r)):[]}function w(e){if(typeof e!="string")return;let n=e.trim();return n.length>0?n:void 0}function b(e){return Array.isArray(e)?e.map(n=>String(n).trim()).filter(Boolean):typeof e=="string"?e.split(",").map(n=>n.trim()).filter(Boolean):[]}function ke(e){if(typeof e=="boolean")return e;if(typeof e!="string")return;let n=e.trim().toLowerCase();if(["1","true","yes","on"].includes(n))return!0;if(["0","false","no","off"].includes(n))return!1}function xe(e){return ge(fe(e)).name.toLowerCase()}function Y(e){return ye.test(e)}function ve(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function De(e){if(typeof e!="string")return;let n=e.trim().toLowerCase();if(n==="inherit")return"inherit";if(n==="none"||n==="off"||n==="disabled")return"none";if(n==="read"||n==="readonly"||n==="read-only")return"readOnly";if(n==="default"||n==="standard")return"default";if(n==="full"||n==="fullaccess"||n==="full-access")return"fullAccess"}function Se(e){if(e===void 0)return;if(typeof e=="string"||Array.isArray(e)){let i=b(e);return i.length>0?{allow:i}:void 0}if(!ve(e))return;let n=b(e.allow),r=b(e.deny),o=De(e.mode),t={};return o&&(t.mode=o),n.length>0&&(t.allow=n),r.length>0&&(t.deny=r),Object.keys(t).length>0?t:void 0}function $e(e){let n=ke(e.worktree??e.defaultWorktreeIsolation);if(n===!0)return"worktree";if(n===!1)return"none";let r=w(e.isolation)?.toLowerCase();if(r==="worktree")return"worktree";if(r==="none"||r==="off"||r==="disabled")return"none"}function Ee(e){let n=[];return Y(e.name)||n.push(`Invalid agent name "${e.name}". Use 1-64 lowercase letters, digits, hyphens, or underscores, starting with a letter.`),e.prompt.trim().length===0&&n.push("Agent definition body is empty."),n}function Te(e,n,r){let o=ae(e,"utf8"),t=W(o),i=t.frontmatter,l=xe(e),s=w(i.name)?.toLowerCase()??l,d=t.content.trim(),p=Ee({name:s,prompt:d});if(p.length>0)throw new Error(p.join(" "));let u=w(i.description),c=w(i.model),f=w(i.color),y=w(i.memory??i.memoryScope),A=$e(i),v=Se(i.tools);return{name:s,scope:n,path:e,...u?{description:u}:{},...c?{model:c}:{},...f?{color:f}:{},...y?{memory:y}:{},...A?{isolation:A}:{},tags:b(i.tags),skills:b(i.skills),hooks:b(i.hooks),prompt:d,active:!0,priority:r,...v?{toolPolicy:v}:{}}}function D(e,n,r,o,t){for(let i of be(e))try{o.push(Te(i,n,r))}catch(l){t.push({path:i,scope:n,message:l instanceof Error?l.message:String(l)})}}function Ce(e){let n=new Map;for(let r of e){let o=n.get(r.name);(!o||r.priority>o.priority)&&n.set(r.name,r)}return n}function Ie(e,n){let r=n.get(e.name),o=r?.path===e.path;return{name:e.name,scope:e.scope,path:e.path,...e.description?{description:e.description}:{},...e.model?{model:e.model}:{},...e.color?{color:e.color}:{},...e.memory?{memory:e.memory}:{},...e.isolation?{isolation:e.isolation}:{},tags:e.tags,skills:e.skills,hooks:e.hooks,prompt:e.prompt,active:o,...e.toolPolicy?{toolPolicy:e.toolPolicy}:{},...!o&&r?{shadowedBy:{name:r.name,scope:r.scope,path:r.path}}:{}}}function K(e=process.cwd(),n={}){let r=n.cwd??e,o=n.userDir??z(n.agentHome),t=n.projectDirs??Pe(r),i=n.pluginDirs??[],l=n.builtInDirs??[],s=[],d=[];n.includeUser!==!1&&D(o,"user",0,s,d),n.includeProject!==!1&&t.forEach((c,f)=>D(c,"project",100+f,s,d)),n.includePlugins&&i.forEach((c,f)=>D(c,"plugin",1e3+f,s,d)),n.includeBuiltIns&&l.forEach((c,f)=>D(c,"built-in",2e3+f,s,d));let p=Ce(s),u=s.map(c=>Ie(c,p));return u.sort((c,f)=>{if(c.active!==f.active)return c.active?-1:1;let y=c.name.localeCompare(f.name);return y!==0?y:c.path.localeCompare(f.path)}),{definitions:u,issues:d,searchPaths:{...n.includeUser!==!1?{user:o}:{},project:n.includeProject===!1?[]:t,plugin:n.includePlugins?i:[],builtIn:n.includeBuiltIns?l:[]}}}function Xe(e,n=process.cwd(),r={}){let o=e.trim().toLowerCase(),t=K(n,r);return{definition:t.definitions.find(i=>i.active&&i.name===o)??null,scan:t}}var C=class{constructor(n={}){this.options=n}options;scan(n=this.options.cwd??process.cwd()){return K(n,this.options)}},J=class{constructor(n=new C){this.loader=n}loader;resolve(n,r=process.cwd()){let o=this.loader.scan(r),t=n.trim().toLowerCase();return{definition:o.definitions.find(i=>i.active&&i.name===t)??null,scan:o}}};function S(e){if(!e||e.length===0)return;let n=Array.from(new Set(e.map(r=>r.trim()).filter(Boolean)));return n.length>0?n:void 0}function Re(e,n){if(!e&&!n)return;if(!e)return S(n);if(!n)return S(e);let r=new Set(n);return S(e.filter(o=>r.has(o)))}function Me(e,n){let r={none:0,readOnly:1,default:2,fullAccess:3,inherit:4},o=n??"inherit",t=e??"inherit";return r[o]<=r[t]?o:t}function R(e,n={}){let r=e.toolPolicy??{},o={mode:Me(r.mode,n.mode)},t=Re(n.allow,r.allow),i=S([...n.deny??[],...r.deny??[]]);return t&&(o.allow=t),i&&(o.deny=i),o}function Qe(e){return{name:`custom-agent:${e.name}`,order:20,provide(){let n=["","","# Custom Agent",`Active agent: ${e.name}`,`Definition scope: ${e.scope}`,`Definition path: ${e.path}`];return e.description&&n.push(`Description: ${e.description}`),n.push("",e.prompt),n.join(`
+`)}}}function Ze(e){return{name:e.name,scope:e.scope,path:e.path,...e.description?{description:e.description}:{},...e.model?{model:e.model}:{},...e.color?{color:e.color}:{},...e.memory?{memory:e.memory}:{},...e.isolation?{isolation:e.isolation}:{},tags:e.tags,skills:e.skills,hooks:e.hooks,active:e.active,...e.toolPolicy?{toolPolicy:e.toolPolicy}:{},...e.shadowedBy?{shadowedBy:e.shadowedBy}:{}}}function P(e,n){return e.length>=n?e:e+" ".repeat(n-e.length)}function en(e,n){let r=[];if(e.length===0)r.push("No custom agent definitions found.");else{r.push(`${P("name",22)} ${P("scope",8)} ${P("status",9)} description`),r.push(`${"-".repeat(22)} ${"-".repeat(8)} ${"-".repeat(9)} ${"-".repeat(32)}`);for(let o of e){let t=o.active?"active":"shadowed";r.push(`${P(o.name,22)} ${P(o.scope,8)} ${P(t,9)} ${o.description??""}`)}}if(n.length>0){r.push("","Invalid definitions:");for(let o of n)r.push(`- ${o.path}: ${o.message}`)}return r.join(`
 `)+`
-`}function At(t){let n=[`Agent: ${t.name}`,`Scope: ${t.scope}`,`Path: ${t.path}`,`Status: ${t.active?"active":"shadowed"}`];return t.description&&n.push(`Description: ${t.description}`),t.model&&n.push(`Model: ${t.model}`),t.color&&n.push(`Color: ${t.color}`),t.memory&&n.push(`Memory: ${t.memory}`),t.isolation&&n.push(`Isolation: ${t.isolation}`),t.tags.length>0&&n.push(`Tags: ${t.tags.join(", ")}`),t.skills.length>0&&n.push(`Skills: ${t.skills.join(", ")}`),t.hooks.length>0&&n.push(`Hooks: ${t.hooks.join(", ")}`),t.toolPolicy&&n.push(`Tools: ${JSON.stringify(t.toolPolicy)}`),t.shadowedBy&&n.push(`Shadowed by: ${t.shadowedBy.scope} ${t.shadowedBy.path}`),n.push("",t.prompt,""),n.join(`
-`)}function Dt(t){let n=t.name.trim().toLowerCase();if(!E(n))throw new Error(`Invalid agent name "${t.name}". Use 1-64 lowercase letters, digits, hyphens, or underscores, starting with a letter.`);let e=t.scope==="user"?O(t.agentHome):V(t.cwd??process.cwd());B(e,{recursive:!0});let o=m(e,`${n}.md`);if(k(o)&&!t.force)throw new Error(`Agent definition already exists: ${o}`);let i=t.description?.trim()||`${n} custom agent`,r=t.prompt?.trim()||`You are ${n}. Replace this paragraph with precise operating instructions, constraints, tools policy, verification expectations, and the kind of work this agent should own.`,a=[...["---",`name: ${n}`,`description: ${JSON.stringify(i)}`,...t.model?.trim()?[`model: ${JSON.stringify(t.model.trim())}`]:[],...t.color?.trim()?[`color: ${JSON.stringify(t.color.trim())}`]:[],...t.memory?.trim()?[`memory: ${JSON.stringify(t.memory.trim())}`]:[],...t.isolation?[`isolation: ${t.isolation}`]:[],"tags: []",...t.skills&&t.skills.length>0?[`skills: ${JSON.stringify(t.skills)}`]:[],...t.hooks&&t.hooks.length>0?[`hooks: ${JSON.stringify(t.hooks)}`]:[],...t.toolPolicy?["tools:",...t.toolPolicy.mode?[`  mode: ${t.toolPolicy.mode}`]:[],...t.toolPolicy.allow&&t.toolPolicy.allow.length>0?[`  allow: ${JSON.stringify(t.toolPolicy.allow)}`]:[],...t.toolPolicy.deny&&t.toolPolicy.deny.length>0?[`  deny: ${JSON.stringify(t.toolPolicy.deny)}`]:[]]:[],"---"],"",r,""].join(`
-`);return J(o,a,"utf8"),o}export{D as AgentDefinitionLoader,I as AgentDefinitionResolver,Dt as createAgentDefinitionFile,ht as createAgentDefinitionPromptSection,G as getProjectAgentDefinitionDirs,V as getProjectAgentDefinitionsDir,O as getUserAgentDefinitionsDir,E as isValidAgentDefinitionName,At as renderAgentDefinition,wt as renderAgentDefinitions,mt as resolveAgentDefinition,pt as resolveAgentToolPolicy,N as scanAgentDefinitions,yt as toAgentDefinitionMetadata,ot as validateAgentDefinition};
+`}function nn(e){let n=[`Agent: ${e.name}`,`Scope: ${e.scope}`,`Path: ${e.path}`,`Status: ${e.active?"active":"shadowed"}`];return e.description&&n.push(`Description: ${e.description}`),e.model&&n.push(`Model: ${e.model}`),e.color&&n.push(`Color: ${e.color}`),e.memory&&n.push(`Memory: ${e.memory}`),e.isolation&&n.push(`Isolation: ${e.isolation}`),e.tags.length>0&&n.push(`Tags: ${e.tags.join(", ")}`),e.skills.length>0&&n.push(`Skills: ${e.skills.join(", ")}`),e.hooks.length>0&&n.push(`Hooks: ${e.hooks.join(", ")}`),e.toolPolicy&&n.push(`Tools: ${JSON.stringify(e.toolPolicy)}`),e.shadowedBy&&n.push(`Shadowed by: ${e.shadowedBy.scope} ${e.shadowedBy.path}`),n.push("",e.prompt,""),n.join(`
+`)}function rn(e){let n=e.name.trim().toLowerCase();if(!Y(n))throw new Error(`Invalid agent name "${e.name}". Use 1-64 lowercase letters, digits, hyphens, or underscores, starting with a letter.`);let r=e.scope==="user"?z(e.agentHome):we(e.cwd??process.cwd());le(r,{recursive:!0});let o=k(r,`${n}.md`);if(I(o)&&!e.force)throw new Error(`Agent definition already exists: ${o}`);let t=e.description?.trim()||`${n} custom agent`,i=e.prompt?.trim()||`You are ${n}. Replace this paragraph with precise operating instructions, constraints, tools policy, verification expectations, and the kind of work this agent should own.`,s=[...["---",`name: ${n}`,`description: ${JSON.stringify(t)}`,...e.model?.trim()?[`model: ${JSON.stringify(e.model.trim())}`]:[],...e.color?.trim()?[`color: ${JSON.stringify(e.color.trim())}`]:[],...e.memory?.trim()?[`memory: ${JSON.stringify(e.memory.trim())}`]:[],...e.isolation?[`isolation: ${e.isolation}`]:[],"tags: []",...e.skills&&e.skills.length>0?[`skills: ${JSON.stringify(e.skills)}`]:[],...e.hooks&&e.hooks.length>0?[`hooks: ${JSON.stringify(e.hooks)}`]:[],...e.toolPolicy?["tools:",...e.toolPolicy.mode?[`  mode: ${e.toolPolicy.mode}`]:[],...e.toolPolicy.allow&&e.toolPolicy.allow.length>0?[`  allow: ${JSON.stringify(e.toolPolicy.allow)}`]:[],...e.toolPolicy.deny&&e.toolPolicy.deny.length>0?[`  deny: ${JSON.stringify(e.toolPolicy.deny)}`]:[]]:[],"---"],"",i,""].join(`
+`);return de(o,s,"utf8"),o}import{createHash as Ne}from"crypto";var j=2,h=class extends Error{constructor(n){super(n),this.name="AgentProfileValidationError"}},je=/^[a-z][a-z0-9_-]{0,63}$/,$=["publish","deploy","push","send","purchase","sign","file-legal","change-infrastructure"];function g(e){return Array.from(new Set((e??[]).map(n=>n.trim()).filter(Boolean)))}function Oe(e,n){if(e===void 0)return n===void 0?void 0:g(n);if(n===void 0)return g(e);let r=new Set(n);return g(e.filter(o=>r.has(o)))}function qe(e,n){if(e===void 0)return;let r=new Set(n);return e.filter(o=>!r.has(o))}function M(e,n,r){let o=n===void 0?null:new Set(n),t=new Set(r??[]);return e===void 0?n===void 0?void 0:g(n).filter(i=>!t.has(i)):g(e).filter(i=>(o===null||o.has(i))&&!t.has(i))}function E(e,n,r){return r[e]<=r[n]?e:n}function Le(e,n,r){return r[e]>=r[n]?e:n}function N(e){return Array.isArray(e)?e.map(N):!e||typeof e!="object"?e:Object.fromEntries(Object.entries(e).sort(([n],[r])=>n.localeCompare(r)).map(([n,r])=>[n,N(r)]))}function Be(e){return Ne("sha256").update(JSON.stringify(N(e))).digest("hex")}function x(e){return structuredClone(e)}function X(e,n){return e.overrides?.[n]??e.default}function Fe(e,n){let r={deny:0,ask:1,allow:2},o=new Set(e.requireCurrentTurnApproval),t=Object.fromEntries($.map(d=>[d,X(e,d)]));for(let d of n){let p=d.externalActions;if(p){for(let u of $){let c=p.overrides?.[u]??p.default;c&&(t[u]=E(t[u],c,r))}for(let u of p.requireCurrentTurnApproval??[])o.add(u)}}let l=new Set(Object.values(t)).size===1?t.publish:"deny",s={};for(let d of $)t[d]!==l&&(s[d]=t[d]);return{default:l,...Object.keys(s).length>0?{overrides:s}:{},requireCurrentTurnApproval:[...o].filter(d=>t[d]!=="deny").sort()}}function Q(e){if(e.schemaVersion!==j)throw new h(`Unsupported agent profile schema: ${String(e.schemaVersion)}.`);if(!je.test(e.id))throw new h(`Invalid agent profile id: ${e.id}.`);if(!e.version.trim())throw new h(`Agent profile ${e.id} has no version.`);if(!e.displayName.trim()||!e.description.trim()||!e.prompt.trim())throw new h(`Agent profile ${e.id} requires displayName, description, and prompt.`);if(e.execution.allowedModes.length===0)throw new h(`Agent profile ${e.id} allows no collaboration modes.`);if(!e.execution.allowedModes.includes(e.execution.defaultMode))throw new h(`Agent profile ${e.id} default mode must be included in allowedModes.`)}function _e(e,n,r,o,t,i){return{name:`agent-profile:${e.id}`,order:20,provide(){let l=$.map(s=>`${s}=${X(n.externalActions,s)}`).join(", ");return["","","# XENO Agent Profile",`Profile: ${e.displayName} (${e.id}@${e.version})`,`Profile fingerprint: ${i}`,`Role: ${e.description}`,`Collaboration mode: ${o.defaultMode}`,`Isolation: ${o.isolation}`,`Memory: ${r.scope}; soul=${r.soul}`,`Permission profile ceiling: ${n.permissionProfile}`,`External actions: ${l}`,n.externalActions.requireCurrentTurnApproval.length>0?`Current-turn approval required for: ${n.externalActions.requireCurrentTurnApproval.join(", ")}`:"Current-turn approval required for: none",t.evidence.length>0?`Completion evidence: ${t.evidence.join(", ")}`:"Completion evidence: task-dependent",t.requirePrimarySources?"Use primary sources for factual claims and cite them near the claim.":"",t.requireCurrentInformation?"Verify time-sensitive claims against current authoritative information.":"",t.requireHumanReview?"Do not represent the result as professional approval; require human review before consequential use.":"",o.defaultDryRun?"Default to preview or dry-run. Do not perform external state changes without the required approval.":"","",e.prompt,"","Stop conditions:",...t.stopConditions.map(s=>`- ${s}`)].filter(s=>s!=="").join(`
+`)}}}function Ve(e,n={}){Q(e);let r=x(e),o=n.boundaries??[],t=x(r.capabilities.tools),i=r.capabilities.skills.allow?g(r.capabilities.skills.allow):void 0,l=new Set(g(r.capabilities.skills.deny)),s=g(r.capabilities.hooks),d=new Set,p=r.capabilities.mcpServers?g(r.capabilities.mcpServers):void 0,u=r.capabilities.delegatedAgents?g(r.capabilities.delegatedAgents):void 0,c=r.capabilities.permissionProfile,f=r.memory.scope,y=r.memory.soul,A=r.execution.isolation,v={"read-only":0,default:1,"trusted-dev":2},ee={none:0,session:1,project:2,user:3},ne={disabled:0,read:1,learn:2},re={none:0,worktree:1,container:2};for(let a of o){a.tools&&(t=R({toolPolicy:t},a.tools)),i=Oe(i,a.skills?.allow);for(let T of a.skills?.deny??[])l.add(T);s=M(s,a.hooks?.allow,void 0)??[];for(let T of a.hooks?.require??[])d.add(T);p=M(p,a.mcpServers?.allow,a.mcpServers?.deny),u=M(u,a.delegatedAgents?.allow,a.delegatedAgents?.deny),a.permissionProfile&&(c=E(c,a.permissionProfile,v)),a.maximumMemoryScope&&(f=E(f,a.maximumMemoryScope,ee)),a.maximumSoulMode&&(y=E(y,a.maximumSoulMode,ne)),a.requiredIsolation&&(A=Le(A,a.requiredIsolation,re))}let O=[...l].sort();c==="read-only"&&(t=R({toolPolicy:t},{mode:"readOnly",deny:["WebSearch","WebFetch"]})),i=qe(i,O);let oe=g(r.capabilities.skills.preload).filter(a=>!l.has(a)).filter(a=>i===void 0||i.includes(a));s=g([...s,...d]);let q={tools:t,skills:{preload:oe,...i!==void 0?{allow:i}:{},deny:O},hooks:s,...p!==void 0?{mcpServers:p}:{},...u!==void 0?{delegatedAgents:u}:{},permissionProfile:c,externalActions:Fe(r.capabilities.externalActions,o)},L={...r.memory,scope:f,soul:y},B={...r.execution,isolation:A},F={schemaVersion:j,profile:r,boundarySources:o.map(a=>a.source),capabilities:q,memory:L,execution:B,completion:r.completion},_=Be(F);return{...F,fingerprint:_,promptSection:_e(r,q,L,B,r.completion,_)}}function m(e){return{schemaVersion:j,id:e.id,version:"1.0.0",displayName:e.displayName,description:e.description,kind:e.kind??"primary",prompt:e.prompt,capabilities:{tools:e.toolPolicy??{mode:"inherit"},skills:{preload:e.skills??[],...e.skillAllow?{allow:e.skillAllow}:{},deny:[]},hooks:[],permissionProfile:e.permissionProfile??"default",externalActions:{default:e.externalDefault??"ask",...e.externalOverrides?{overrides:e.externalOverrides}:{},requireCurrentTurnApproval:e.currentTurnApproval??[]}},memory:{scope:e.memoryScope??"project",role:e.id,soul:e.soul??"read"},execution:{defaultMode:e.defaultMode??"chat",allowedModes:e.allowedModes??["chat","plan","execute","review"],isolation:e.isolation??"none",allowBackground:e.allowBackground??!0,planForComplexTasks:e.planForComplexTasks??!0,defaultDryRun:e.defaultDryRun??!1},completion:{evidence:e.evidence??[],requirePrimarySources:e.primarySources??!1,requireCurrentInformation:e.currentInformation??!1,requireHumanReview:e.humanReview??!1,stopConditions:e.stopConditions??["The requested outcome is complete and required evidence has been reported.","A real authorization, information, or external-state blocker prevents safe progress."]},presentation:{label:e.displayName,color:e.color,glyph:e.glyph},tags:g(e.tags)}}var Z=[m({id:"assistant",displayName:"Assistant",description:"General-purpose XENO collaborator for mixed research, planning, and implementation work.",prompt:["Work as a thoughtful generalist. Establish the user's actual outcome, inspect relevant context, and take scoped action.","Escalate into a narrower specialist profile when domain risk or task depth warrants it."].join(`
+`),toolPolicy:{mode:"inherit"},skills:[],memoryScope:"user",evidence:["file-references"],currentTurnApproval:["publish","deploy","push","send","purchase","sign","file-legal","change-infrastructure"],color:"cyan",glyph:"\u25A0",tags:["general","primary"]}),m({id:"swe",displayName:"Software Engineer",description:"Repository-aware software engineer for careful implementation, debugging, refactoring, and verification.",prompt:["Inspect the repository before editing. Follow project instructions and preserve unrelated work.","Trace the smallest root cause, implement the narrowest coherent change, and verify from focused checks outward.","Do not claim completion without concrete test, typecheck, build, or runtime evidence appropriate to the risk."].join(`
+`),toolPolicy:{mode:"default"},skills:["debug","run","verify"],permissionProfile:"trusted-dev",soul:"learn",evidence:["file-references","tests","typecheck","build","diff"],currentTurnApproval:["publish","deploy","push","change-infrastructure"],color:"green",glyph:"\u25C6",tags:["engineering","implementation"]}),m({id:"reviewer",displayName:"Code Reviewer",description:"Read-only reviewer focused on correctness, regressions, safety, tests, and maintainability.",prompt:["Lead with concrete findings ordered by severity. Cite exact file locations and explain impact.","Do not edit code. Distinguish confirmed defects from risks and questions. State when no material finding is present."].join(`
+`),kind:"subagent",toolPolicy:{mode:"readOnly"},skills:["code-review","verify"],permissionProfile:"read-only",memoryScope:"session",soul:"read",allowedModes:["chat","review"],defaultMode:"review",evidence:["file-references","diff"],externalDefault:"deny",color:"yellow",glyph:"\u25C7",tags:["engineering","review","read-only"]}),m({id:"writer",displayName:"Writer",description:"Audience-aware writer and editor for clear, accurate, structurally coherent content.",prompt:["Determine audience, purpose, voice, format, and source constraints before drafting.","Preserve factual meaning, avoid invented claims, and revise for clarity, rhythm, consistency, and usefulness."].join(`
+`),toolPolicy:{mode:"default",allow:["Read","Glob","Grep","LS","Write","Edit","WebSearch","WebFetch","Think","AskUser"]},skills:["verify"],evidence:["sources","file-references","diff"],currentTurnApproval:["send","publish"],color:"magenta",glyph:"\u2726",tags:["writing","editing"]}),m({id:"research",displayName:"Researcher",description:"Evidence-first researcher for questions, comparisons, synthesis, and source-backed analysis.",prompt:["Break the question into verifiable claims. Prefer primary and authoritative sources, compare dates, and cite near each claim.","Separate sourced fact, inference, uncertainty, and recommendation. Do not make changes unless the user explicitly expands scope."].join(`
+`),toolPolicy:{mode:"readOnly"},skills:["verify"],permissionProfile:"default",memoryScope:"session",soul:"read",allowedModes:["chat","plan","review"],evidence:["sources","file-references"],primarySources:!0,currentInformation:!0,externalDefault:"deny",color:"blue",glyph:"\u25C8",tags:["research","qa","read-only"]}),m({id:"product",displayName:"Product",description:"Product strategist for problem framing, requirements, sequencing, metrics, and trade-off decisions.",prompt:["Start from the user problem and observable outcome. Distinguish evidence, assumptions, constraints, and open decisions.","Translate strategy into testable requirements, acceptance criteria, telemetry, risks, and a sequenced delivery path."].join(`
+`),toolPolicy:{mode:"default",allow:["Read","Glob","Grep","LS","Write","Edit","WebSearch","WebFetch","Think","AskUser"]},skills:["verify"],evidence:["sources","file-references","diff"],currentTurnApproval:["send","publish","change-infrastructure"],color:"cyan",glyph:"\u25A3",tags:["product","planning"]}),m({id:"ci",displayName:"CI Engineer",description:"Continuous-integration specialist for reproducing, repairing, and hardening automated gates.",prompt:["Identify the exact failing job and command. Reproduce it locally or in an equivalent immutable environment before patching.","Fix only the underlying failure, retain logs as evidence, and rerun the matching gate before broader validation."].join(`
+`),toolPolicy:{mode:"default"},skills:["ci-repair","debug","run","verify"],permissionProfile:"trusted-dev",soul:"learn",evidence:["tests","typecheck","build","diff"],currentTurnApproval:["push","deploy","change-infrastructure"],color:"green",glyph:"\u25A4",tags:["engineering","ci","automation"]}),m({id:"devops",displayName:"DevOps and Release",description:"Dry-run-first infrastructure and release specialist with explicit external-action gates.",prompt:["Inspect the release or infrastructure contract first. Build an immutable candidate and produce reproducible evidence.","Default to plan, preview, dry-run, and local verification. Never publish, deploy, push, sign, purchase, or mutate infrastructure unless the current user turn explicitly authorizes that exact action and target.","For releases, preserve SDK-before-CLI dependency order and verify the public artifact after publication."].join(`
+`),toolPolicy:{mode:"default"},skills:["release","run","verify"],permissionProfile:"default",memoryScope:"project",soul:"learn",isolation:"worktree",defaultMode:"plan",defaultDryRun:!0,evidence:["tests","build","diff","deployment-proof","human-review"],humanReview:!0,currentTurnApproval:["publish","deploy","push","purchase","sign","change-infrastructure"],color:"yellow",glyph:"\u2B22",tags:["devops","release","infrastructure"]}),m({id:"legal-research",displayName:"Legal Research",description:"Restricted legal-information researcher that produces sourced analysis for qualified human review.",prompt:["Identify jurisdiction, effective date, parties, and the precise legal question before analyzing it.","Use current primary legal sources wherever possible. Cite each material proposition and distinguish law, interpretation, uncertainty, and practical next steps.","Provide legal information, not professional representation. Never sign, file, submit, contact a party, accept terms, or make a payment."].join(`
+`),toolPolicy:{mode:"readOnly"},skills:["verify"],permissionProfile:"default",memoryScope:"session",soul:"disabled",allowedModes:["chat","plan","review"],defaultMode:"review",evidence:["sources","human-review"],primarySources:!0,currentInformation:!0,humanReview:!0,externalDefault:"deny",color:"red",glyph:"\xA7",tags:["legal","research","restricted","read-only"],stopConditions:["The jurisdiction or effective date is unknown and materially changes the answer.","The task requires legal representation, filing, signature, payment, or contact with a third party.","The sourced analysis is complete and clearly marked for qualified human review."]})],We={general:"assistant",software:"swe",engineer:"swe","software-engineer":"swe",review:"reviewer","code-reviewer":"reviewer",qa:"research","q-and-a":"research",researcher:"research","product-manager":"product","ci-cd":"ci",cicd:"ci",release:"devops","devops-release":"devops",legal:"legal-research"};function ln(){return Z.map(x)}function Ue(e){let n=e.trim().toLowerCase(),r=We[n]??n,o=Z.find(t=>t.id===r);return o?x(o):null}function He(e){let n=e.memory?.trim().toLowerCase(),r=n==="none"||n==="session"||n==="project"||n==="user"?n:"project",o=m({id:e.name,displayName:e.name,description:e.description??`Custom XENO agent ${e.name}.`,prompt:e.prompt,toolPolicy:e.toolPolicy??{mode:"inherit"},skills:e.skills,memoryScope:r,isolation:e.isolation??"none",color:e.color??"cyan",glyph:"\u25A0",tags:["custom",...e.tags]});return e.model&&(o.model={preferred:e.model}),o.capabilities.hooks=[...e.hooks],o}function an(e){return Q(e),{name:e.id,scope:"built-in",path:`builtin:xeno-agent-profile/${e.id}@${e.version}`,description:e.description,...e.model?.preferred?{model:e.model.preferred}:{},color:e.presentation.color,memory:e.memory.scope,isolation:e.execution.isolation==="container"?"worktree":e.execution.isolation,tags:[...e.tags],skills:[...e.capabilities.skills.preload],hooks:[...e.capabilities.hooks],active:!0,toolPolicy:x(e.capabilities.tools),prompt:e.prompt}}function cn(e){let n=e.definition?He(e.definition):Ue(e.name);return n?Ve(n,{boundaries:e.boundaries}):null}export{C as AgentDefinitionLoader,J as AgentDefinitionResolver,h as AgentProfileValidationError,j as XENO_AGENT_PROFILE_SCHEMA_VERSION,an as agentDefinitionFromProfile,He as agentProfileFromDefinition,Ve as compileAgentProfile,rn as createAgentDefinitionFile,Qe as createAgentDefinitionPromptSection,Pe as getProjectAgentDefinitionDirs,we as getProjectAgentDefinitionsDir,z as getUserAgentDefinitionsDir,Y as isValidAgentDefinitionName,ln as listBuiltInAgentProfiles,nn as renderAgentDefinition,en as renderAgentDefinitions,Xe as resolveAgentDefinition,cn as resolveAgentProfile,R as resolveAgentToolPolicy,Ue as resolveBuiltInAgentProfile,K as scanAgentDefinitions,Ze as toAgentDefinitionMetadata,Ee as validateAgentDefinition};

package/dist/agents/metafile-esm.json

@@ -0,0 +1 @@
+{"inputs":{"src/utils/yaml.ts":{"bytes":5506,"imports":[],"format":"esm"},"src/agents/definitions.ts":{"bytes":20613,"imports":[{"path":"fs","kind":"import-statement","external":true},{"path":"os","kind":"import-statement","external":true},{"path":"path","kind":"import-statement","external":true},{"path":"src/utils/yaml.ts","kind":"import-statement","original":"../utils/yaml.js"}],"format":"esm"},"src/agents/profiles.ts":{"bytes":32438,"imports":[{"path":"crypto","kind":"import-statement","external":true},{"path":"src/agents/definitions.ts","kind":"import-statement","original":"./definitions.js"}],"format":"esm"},"src/agents/index.ts":{"bytes":65,"imports":[{"path":"src/agents/definitions.ts","kind":"import-statement","original":"./definitions.js"},{"path":"src/agents/profiles.ts","kind":"import-statement","original":"./profiles.js"}],"format":"esm"}},"outputs":{"dist/agents/index.js":{"imports":[{"path":"fs","kind":"import-statement","external":true},{"path":"os","kind":"import-statement","external":true},{"path":"path","kind":"import-statement","external":true},{"path":"crypto","kind":"import-statement","external":true}],"exports":["AgentDefinitionLoader","AgentDefinitionResolver","AgentProfileValidationError","XENO_AGENT_PROFILE_SCHEMA_VERSION","agentDefinitionFromProfile","agentProfileFromDefinition","compileAgentProfile","createAgentDefinitionFile","createAgentDefinitionPromptSection","getProjectAgentDefinitionDirs","getProjectAgentDefinitionsDir","getUserAgentDefinitionsDir","isValidAgentDefinitionName","listBuiltInAgentProfiles","renderAgentDefinition","renderAgentDefinitions","resolveAgentDefinition","resolveAgentProfile","resolveAgentToolPolicy","resolveBuiltInAgentProfile","scanAgentDefinitions","toAgentDefinitionMetadata","validateAgentDefinition"],"entryPoint":"src/agents/index.ts","inputs":{"src/agents/definitions.ts":{"bytesInOutput":8860},"src/utils/yaml.ts":{"bytesInOutput":2217},"src/agents/index.ts":{"bytesInOutput":0},"src/agents/profiles.ts":{"bytesInOutput":15468}},"bytes":27275}}}