@zaip-ai/cli 5.5.0 → 5.6.0

package/dist/services/adapters.d.ts

@@ -1,6 +1,6 @@
 import { type PublicAgentCatalog } from "./agent-adapters.js";
 export { isManagedAdapter } from "./managed-adapter.js";
-export declare const ADAPTERS_VERSION = "5.5.0";
+export declare const ADAPTERS_VERSION = "5.6.0";
 export interface AdapterFile {
     path: string;
     content: string;

package/dist/services/adapters.js

@@ -11,7 +11,7 @@ export { isManagedAdapter } from "./managed-adapter.js";
 import { CODEX_GITHUB_DEPLOY_RULES, CODEX_SECURITY_RULES } from "./codex-rules.js";
 import { codexWindowsHookCommand } from "./codex-windows-hook-command.js";
 import { applyTransactionalChanges, assertSafeDestination } from "./transactional-files.js";
-export const ADAPTERS_VERSION = "5.5.0";
+export const ADAPTERS_VERSION = "5.6.0";
 const ROOT_GUIDANCE = `# ZAIP-AIOS
 
 Read \`.agents/config/project.yaml\` first. Apply ZAIP only for literal boolean \`zaip.enabled: true\`, except framework maintenance or \`zaip enable\`. \`AGENTS.md\` is a bootstrap; canonical guidance lives in \`.agents/\`.

package/dist/services/codex-pre-tool-hook-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mBAAmB,QAspB/B,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,mBAAmB,QAod/B,CAAC"}

package/dist/services/codex-pre-tool-hook-template.js

@@ -1,139 +1,6 @@
+import { CODEX_PRE_TOOL_POLICY_HEADER } from "./codex-pre-tool-policy-template.js";
 import { CODEX_STALE_GIT_LOCK_HELPER } from "./codex-stale-git-lock-template.js";
-export const CODEX_PRE_TOOL_HOOK = String.raw `import { execFile } from "node:child_process";
-import { writeSync } from "node:fs";
-import { lstat, readFile, realpath } from "node:fs/promises";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { promisify } from "node:util";
-import { captureCliTurn, createHookBudget, checkDestructivePatterns, configuredDeploymentBranches, configuredPermissionProfile, gitInvocation, inside, isLiteralReadSequence, readBoundedCanonicalText, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, selectHookRepositoryRoot, shellSyntax, tokenizeLiteralCommand, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
-import { createCloudValidators } from "./zaip-pre-tool-cloud.mjs";
-const { execute, parseEvent } = createHookBudget(promisify(execFile));
-const nativeAuthority = await import("./zaip-native-tool-authority.mjs").catch(() => null);
-const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
-const installedRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
-let repositoryRoot = installedRoot;
-let principalFullAccess = false;
-let principalFullNetwork = false;
-const deletionCommandPattern = /\b(?:Remove-Item|ri|rm|rmdir|rd|del|erase)\b/i;
-const allowedExplicitNetworkHosts = new Set([
-  "127.0.0.1", "api.github.com", "github.com", "localhost", "objects.githubusercontent.com", "releases.hashicorp.com", "::1",
-]);
-const networkClientPattern = /\b(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod|iwr|irm)\b/i;
-const cloudRunnerScript = ".agents/tools/cloud-runner.mjs";
-const cloudContractPath = ".agents/config/autonomous-cloud-contract.json";
-const cloudOperationProviders = new Map([
-  ["cloudflare:dns:read", "cloudflare"], ["cloudflare:dns:create", "cloudflare"], ["cloudflare:dns:edit", "cloudflare"],
-  ["hostinger:vps:read", "hostinger"],
-  ["hostinger:ssh:read", "hostinger"],
-  ["hostinger:ssh:configure", "hostinger"],
-  ["hostinger:ssh:test", "hostinger"],
-  ["terraform:plan", "terraform"],
-  ["terraform:apply", "terraform"],
-  ["terraform:import", "terraform"],
-]);
-const homeReferencePattern = /(?:\$HOME\b|\$env:(?:USERPROFILE|HOMEDRIVE|HOMEPATH)\b|%(?:USERPROFILE|HOMEDRIVE|HOMEPATH)%|(?:^|[\s"'=])~[\\/])/i;
-const credentialReferencePattern = /(?:^|[\\/\s"'=])(?:\.ssh|\.aws|\.azure|\.kube|\.docker|\.gnupg|\.git-credentials|\.npmrc|\.pypirc|id_(?:rsa|ed25519)|[^\\/\s"']+\.(?:pem|key|p12|pfx))(?:[\\/\s"'=]|$)|(?:^|[\\/\s"'=])\.env(?:\.[A-Za-z0-9_-]+)*(?:[\\/\s"']|$)/i;
-const sensitiveEnvironmentPattern = /(?:\$env:|%|\$)[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY|CREDENTIAL)[A-Z0-9_]*%?/i;
-const destructivePatterns = [
-  {
-    pattern: /\b(?:Restart-Computer|Stop-Computer|Restart-Host|shutdown(?:\.exe)?|reboot|poweroff|halt|Suspend-Computer|hibernate|logoff|Win32Shutdown)\b/i,
-    reason: "Local computer restart, shutdown, suspension, hibernation and session termination are blocked.",
-  },
-  {
-    pattern: /\b(?:Clear-Content|shred)\b/i,
-    reason: "Unbounded content destruction is blocked.",
-  },
-  {
-    pattern: /\bgit\s+(?:clean\b|reset\s+--hard\b|checkout\s+--\b|restore\b|branch\s+-d\b|tag\s+-d\b)/i,
-    reason: "Destructive Git state changes are blocked.",
-  },
-  {
-    pattern: /\bgit\s+push\b[\s\S]*(?:--force(?:-with-lease|-if-includes)?\b|-f\b|--mirror\b|--delete\b|--all\b|(?:^|\s):\S+)/i,
-    reason: "Force, mirror, bulk, and deletion pushes are blocked.",
-  },
-  {
-    pattern: /\bgit\s+commit\b[\s\S]*(?:--amend\b|--no-verify\b|-n\b)/i,
-    reason: "Commit history rewrites and hook bypasses are blocked.",
-  },
-  {
-    pattern: /\bgit\s+(?:-c\b|--config(?:-env)?\b|--git-dir\b|--work-tree\b|--namespace\b)/,
-    reason: "Git global configuration and repository-routing overrides are blocked.",
-  },
-  {
-    pattern: /\bgit\s+fetch\b[\s\S]*(?:--all\b|--prune\b|--prune-tags\b)/i,
-    reason: "Bulk or pruning fetches are outside the bounded deploy flow.",
-  },
-  {
-    pattern: /\bgit\s+add\b[\s\S]*(?:--force\b|-f\b|(?:^|[\\/\s])(?:\.env(?:\.|\s|$)|[^\s]*\.(?:pem|key|p12|pfx)\b|id_(?:rsa|ed25519)\b))/i,
-    reason: "Force-adding or explicitly staging credential-like files is blocked.",
-  },
-  {
-    pattern: /\bgit\s+add\b[\s\S]*(?:\s-A\b|--all\b|(?:^|\s)\.(?:\s|$)|\s-u\b)/i,
-    reason: "Broad Git staging is blocked; authorized deploy commits require explicit pathspecs.",
-  },
-  {
-    pattern: /\bgit\s+(?:remote\s+(?:add|set-url|remove|rename)|config\b[\s\S]*(?:sshCommand|credential|url\.))/i,
-    reason: "Remote, SSH, and credential configuration changes are blocked.",
-  },
-  {
-    pattern: /\bgh(?:\.exe)?\b[\s\S]*\s(?:--repo|-R)(?:=|\s|(?=[A-Za-z0-9]))/i,
-    reason: "GitHub CLI commands must target the current repository.",
-  },
-  {
-    pattern: /\b(?:drop\s+(?:database|schema|table)|truncate\s+table|supabase\s+db\s+reset)\b/i,
-    reason: "Destructive database operations are blocked.",
-  },
-  {
-    pattern: /\b(?:rmSync|rmdirSync|unlinkSync|rmtree|remove|unlink|Directory\.Delete|File\.Delete)\s*\(/i,
-    reason: "Inline deletion APIs are blocked.",
-  },
-  {
-    pattern: /(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod|\biwr\b|\birm\b)[\s\S]*\|[\s&]*(?:bash|sh|zsh|pwsh|powershell|cmd|node|python|iex|Invoke-Expression)\b/i,
-    reason: "Downloaded content cannot be piped into an interpreter.",
-  },
-  {
-    pattern: /(?:-(?:EncodedCommand|enc)\b|FromBase64String\s*\(|certutil\s+-(?:decode|urlcache)\b|mshta\s+https?:|rundll32\s+javascript:)/i,
-    reason: "Encoded or evasive command execution is blocked.",
-  },
-  {
-    pattern: /\b(?:Set-MpPreference|Add-MpPreference|Remove-MpPreference|Set-NetFirewallProfile|New-NetFirewallRule|Remove-NetFirewallRule|Disable-NetFirewallRule|Enable-PSRemoting|Set-WSManQuickConfig)\b|\bnetsh\s+advfirewall[\s\S]*(?:\boff\b|\badd\b|\bdelete\b|\bset\b)/i,
-    reason: "Firewall, antivirus, and remote-management changes are blocked.",
-  },
-  {
-    pattern: /\b(?:reg(?:\.exe)?\s+(?:add|delete)|schtasks(?:\.exe)?\s+\/(?:create|delete|change)|sc(?:\.exe)?\s+(?:create|delete|stop|config)|New-Service|Set-Service|Stop-Service)\b/i,
-    reason: "OS persistence and service changes are blocked.",
-  },
-  {
-    pattern: /\b(?:diskpart|bcdedit|fsutil|takeown|icacls|Set-Acl|chmod|chown)\b|(?:^|[;&|({\r\n])\s*(?:&\s*)?["']?format(?:\.(?:com|exe))?["']?(?=\s|$)|\bcipher\s+\/w\b/i,
-    reason: "Disk, boot, ownership, and access-control changes are blocked.",
-  },
-  {
-    pattern: /\b(?:runas|sudo|gsudo)\b|Start-Process[\s\S]*-Verb\s+RunAs|\bSet-ExecutionPolicy\b/i,
-    reason: "Privilege escalation and persistent execution-policy changes are blocked.",
-  },
-  {
-    pattern: /\b(?:Start-Process|saps)\b[^\r\n;|]*(?:[$(]|\b(?:-FilePath\s+)?['"]?git(?:\.exe)?['"]?(?:\s|$))/i,
-    reason: "Dynamic or indirect Git process launch is blocked; use a reviewed repository script.",
-  },
-  {
-    pattern: /\b(?:winget|choco|scoop)\s+(?:install|uninstall|upgrade)\b|\b(?:npm|pnpm|yarn)\s+(?:install|add|remove|uninstall)[\s\S]*(?:--global|-g)\b/i,
-    reason: "System-wide package changes are blocked.",
-  },
-  {
-    pattern: /(?:--host|--hostname|--listen(?:-address)?)\s+(?:0\.0\.0\.0|\*|::)\b/i,
-    reason: "Non-loopback listeners are blocked.",
-  },
-  {
-    pattern: /\bgh(?:\.exe)?\s+(?:pr\s+(?:create|merge|close|reopen)|issue\s+(?:create|close|reopen|delete)|release\s+(?:create|delete|upload)|repo\s+(?:create|delete|archive)|api\b[\s\S]*(?:(?:--method|-X)(?:=|\s*)(?:POST|PUT|PATCH|DELETE)\b|(?:--field|--raw-field|--input)(?:=|\s+)|(?:^|\s)-[fF](?:=|\s+)))/i,
-    reason: "Unreviewed GitHub mutations are blocked; use the bounded deploy workflow.",
-  },
-  {
-    pattern: /\b(?:npm|pnpm|yarn)\s+(?:publish|login|logout|token|owner|deprecate)\b/i,
-    reason: "Package-registry publication and credential changes are blocked.",
-  },
-];
-
-function deny(reason, record = true) {
+export const CODEX_PRE_TOOL_HOOK = String.raw `${CODEX_PRE_TOOL_POLICY_HEADER}function deny(reason, record = true) {
   if (record) activation?.recordActivation(repositoryRoot, event, "denied");
   writeSync(
     1,
@@ -305,67 +172,7 @@ async function validateGitPublication(command) {
   }
 }
 
-// These CLI values are data, never shell programs. Only one literal invocation of
-// the canonical runtime qualifies; interpolation, pipelines and other scripts do not.
-function executionPolicyCommand(command) {
-  const tokens = tokenizeLiteralCommand(command);
-  if (!tokens || !/^(?:.*[\\/])?node(?:\.exe)?$/i.test(tokens[0] ?? "") ||
-      resolve(event.cwd, tokens[1] ?? "") !== resolve(repositoryRoot, ".agents/runtime/bin/zaip.mjs") ||
-      tokens[2] !== "conversation" || tokens[3] !== "finish") return command;
-  const result = [...tokens];
-  for (let index = 4; index < result.length; index++) {
-    if (result[index] === "--summary" && index + 1 < result.length) result[++index] = "literal-summary";
-    else if (result[index].startsWith("--summary=")) result[index] = "--summary=literal-summary";
-  }
-  return result.map(token => JSON.stringify(token)).join(" ");
-}
-
-async function isCurrentRepositoryRead(command) {
-  const tokens = tokenizeLiteralCommand(command);
-  if (!tokens || !/^gh(?:\.exe)?$/i.test(tokens[0] ?? "")) return false;
-  const rest = [], repositories = [];
-  for (let index = 0; index < tokens.length; index++) {
-    const token = tokens[index];
-    if (token === "--repo" || token === "-R") repositories.push(tokens[++index]);
-    else if (token.startsWith("--repo=")) repositories.push(token.slice(7));
-    else if (token.startsWith("-R") && token.length > 2) repositories.push(token.slice(2));
-    else rest.push(token);
-  }
-  if (repositories.length !== 1 || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repositories[0] ?? "") ||
-      rest.some(token => token.includes("'")) || !isLiteralReadSequence(rest.map(token => "'" + token + "'").join(" "))) return false;
-  try {
-    const origin = (await execute("git", ["remote", "get-url", "origin"], { cwd: repositoryRoot, encoding: "utf8", windowsHide: true })).stdout.trim();
-    const match = /^(?:git@github\.com:|https:\/\/github\.com\/|ssh:\/\/git@github\.com\/)([^/]+\/[^/]+?)\.git$|^(?:git@github\.com:|https:\/\/github\.com\/|ssh:\/\/git@github\.com\/)([^/]+\/[^/]+?)\/?$/.exec(origin);
-    return !!match && (match[1] ?? match[2]).toLowerCase() === repositories[0].toLowerCase();
-  } catch { return false; }
-}
 
-function validateHashicorpRead(command) {
-  const tokens = tokenizeLiteralCommand(command);
-  if (!tokens || !/^(?:curl(?:\.exe)?|Invoke-WebRequest|Invoke-RestMethod|iwr|irm)$/i.test(tokens[0]))
-    deny("HashiCorp releases require a literal supported read command.");
-  let urlCount = 0;
-  for (let i = 1; i < tokens.length; i++) {
-    const token = tokens[i];
-    if (/^https:\/\//i.test(token)) {
-      const url = new URL(token);
-      if (url.hostname !== "releases.hashicorp.com" || url.username || url.password || url.port)
-        deny("HashiCorp reads require one exact HTTPS destination.");
-      urlCount++; continue;
-    }
-    if (["-I", "--head", "-s", "-S", "-sS", "--silent", "--show-error", "--fail", "-q", "--disable"].includes(token)) continue;
-    const namedMethod = /^(?:--request|--method|-Method)(?:=(.*))?$/i.exec(token);
-    const curlMethod = /^-X(.*)$/.exec(token);
-    if (namedMethod || curlMethod) {
-      const value = namedMethod ? (namedMethod[1] ?? tokens[++i]) : (curlMethod[1] || tokens[++i]);
-      if (!/^(?:GET|HEAD)$/i.test(value ?? "")) deny("HashiCorp releases permit only GET or HEAD requests.");
-      continue;
-    }
-    if (/^(?:-Uri|--url)$/i.test(token) && /^https:\/\//i.test(tokens[i + 1] ?? "")) continue;
-    deny("Unsupported option in the bounded HashiCorp read command.");
-  }
-  if (urlCount !== 1) deny("HashiCorp reads require exactly one HTTPS URL.");
-}
 
 function validateExplicitNetwork(command) {
   if (/(?:^|[;&|]\s*)\b(?:ssh|scp|sftp|rsync|ftp|telnet|nc|ncat)\b/i.test(command)) {
@@ -393,7 +200,7 @@ function validateExplicitNetwork(command) {
     if (host === "releases.hashicorp.com") {
       if (target.protocol !== "https:" || target.username || target.password)
         deny("HashiCorp releases require an exact HTTPS read target.");
-      validateHashicorpRead(command);
+      validateHashicorpRead(command, deny);
     }
   }
 }
@@ -647,9 +454,9 @@ else {
     ...await reviewedContextReadPaths(command, credentialReferencePattern, installedRoot), ...await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand, repositoryRoot) ?? []),
   ];
   await validateExplicitFilesystemReferences(command, event.cwd, reviewedPaths);
-  const policyCommand = executionPolicyCommand(command);
+  const policyCommand = executionPolicyCommand(command, event.cwd, repositoryRoot);
   validateInlineExecution(policyCommand, deny);
-  if (!isLiteralReadSequence(policyCommand) && !await isCurrentRepositoryRead(policyCommand)) {
+  if (!isLiteralReadSequence(policyCommand) && !await isCurrentRepositoryRead(policyCommand, repositoryRoot, execute)) {
   await validateGitPublication(policyCommand);
   await validateCloudRunner(policyCommand);
   validateDirectCloudProviderMutation(policyCommand);

package/dist/services/codex-pre-tool-hook-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgZ3C,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsQ5B,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA,GAAG,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8M1E,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsQ5B,CAAC"}

package/dist/services/codex-pre-tool-policy-template.d.ts

@@ -0,0 +1,2 @@
+export declare const CODEX_PRE_TOOL_POLICY_HEADER: string;
+//# sourceMappingURL=codex-pre-tool-policy-template.d.ts.map

package/dist/services/codex-pre-tool-policy-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-pre-tool-policy-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-policy-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,QAsIxC,CAAC"}

package/dist/services/codex-pre-tool-policy-template.js

@@ -0,0 +1,136 @@
+export const CODEX_PRE_TOOL_POLICY_HEADER = String.raw `import { execFile } from "node:child_process";
+import { writeSync } from "node:fs";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { captureCliTurn, createHookBudget, checkDestructivePatterns, configuredDeploymentBranches, configuredPermissionProfile, executionPolicyCommand, gitInvocation, inside, isCurrentRepositoryRead, isLiteralReadSequence, readBoundedCanonicalText, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, selectHookRepositoryRoot, shellSyntax, tokenizeLiteralCommand, validateHashicorpRead, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
+import { createCloudValidators } from "./zaip-pre-tool-cloud.mjs";
+const { execute, parseEvent } = createHookBudget(promisify(execFile));
+const nativeAuthority = await import("./zaip-native-tool-authority.mjs").catch(() => null);
+const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
+const installedRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+let repositoryRoot = installedRoot;
+let principalFullAccess = false;
+let principalFullNetwork = false;
+const deletionCommandPattern = /\b(?:Remove-Item|ri|rm|rmdir|rd|del|erase)\b/i;
+const allowedExplicitNetworkHosts = new Set([
+  "127.0.0.1", "api.github.com", "github.com", "localhost", "objects.githubusercontent.com", "releases.hashicorp.com", "::1",
+]);
+const networkClientPattern = /\b(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod|iwr|irm)\b/i;
+const cloudRunnerScript = ".agents/tools/cloud-runner.mjs";
+const cloudContractPath = ".agents/config/autonomous-cloud-contract.json";
+const cloudOperationProviders = new Map([
+  ["cloudflare:dns:read", "cloudflare"], ["cloudflare:dns:create", "cloudflare"], ["cloudflare:dns:edit", "cloudflare"],
+  ["hostinger:vps:read", "hostinger"],
+  ["hostinger:ssh:read", "hostinger"],
+  ["hostinger:ssh:configure", "hostinger"],
+  ["hostinger:ssh:test", "hostinger"],
+  ["terraform:plan", "terraform"],
+  ["terraform:apply", "terraform"],
+  ["terraform:import", "terraform"],
+]);
+const homeReferencePattern = /(?:\$HOME\b|\$env:(?:USERPROFILE|HOMEDRIVE|HOMEPATH)\b|%(?:USERPROFILE|HOMEDRIVE|HOMEPATH)%|(?:^|[\s"'=])~[\\/])/i;
+const credentialReferencePattern = /(?:^|[\\/\s"'=])(?:\.ssh|\.aws|\.azure|\.kube|\.docker|\.gnupg|\.git-credentials|\.npmrc|\.pypirc|id_(?:rsa|ed25519)|[^\\/\s"']+\.(?:pem|key|p12|pfx))(?:[\\/\s"'=]|$)|(?:^|[\\/\s"'=])\.env(?:\.[A-Za-z0-9_-]+)*(?:[\\/\s"']|$)/i;
+const sensitiveEnvironmentPattern = /(?:\$env:|%|\$)[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY|CREDENTIAL)[A-Z0-9_]*%?/i;
+const destructivePatterns = [
+  {
+    pattern: /\b(?:Restart-Computer|Stop-Computer|Restart-Host|shutdown(?:\.exe)?|reboot|poweroff|halt|Suspend-Computer|hibernate|logoff|Win32Shutdown)\b/i,
+    reason: "Local computer restart, shutdown, suspension, hibernation and session termination are blocked.",
+  },
+  {
+    pattern: /\b(?:Clear-Content|shred)\b/i,
+    reason: "Unbounded content destruction is blocked.",
+  },
+  {
+    pattern: /\bgit\s+(?:clean\b|reset\s+--hard\b|checkout\s+--\b|restore\b|branch\s+-d\b|tag\s+-d\b)/i,
+    reason: "Destructive Git state changes are blocked.",
+  },
+  {
+    pattern: /\bgit\s+push\b[\s\S]*(?:--force(?:-with-lease|-if-includes)?\b|-f\b|--mirror\b|--delete\b|--all\b|(?:^|\s):\S+)/i,
+    reason: "Force, mirror, bulk, and deletion pushes are blocked.",
+  },
+  {
+    pattern: /\bgit\s+commit\b[\s\S]*(?:--amend\b|--no-verify\b|-n\b)/i,
+    reason: "Commit history rewrites and hook bypasses are blocked.",
+  },
+  {
+    pattern: /\bgit\s+(?:-c\b|--config(?:-env)?\b|--git-dir\b|--work-tree\b|--namespace\b)/,
+    reason: "Git global configuration and repository-routing overrides are blocked.",
+  },
+  {
+    pattern: /\bgit\s+fetch\b[\s\S]*(?:--all\b|--prune\b|--prune-tags\b)/i,
+    reason: "Bulk or pruning fetches are outside the bounded deploy flow.",
+  },
+  {
+    pattern: /\bgit\s+add\b[\s\S]*(?:--force\b|-f\b|(?:^|[\\/\s])(?:\.env(?:\.|\s|$)|[^\s]*\.(?:pem|key|p12|pfx)\b|id_(?:rsa|ed25519)\b))/i,
+    reason: "Force-adding or explicitly staging credential-like files is blocked.",
+  },
+  {
+    pattern: /\bgit\s+add\b[\s\S]*(?:\s-A\b|--all\b|(?:^|\s)\.(?:\s|$)|\s-u\b)/i,
+    reason: "Broad Git staging is blocked; authorized deploy commits require explicit pathspecs.",
+  },
+  {
+    pattern: /\bgit\s+(?:remote\s+(?:add|set-url|remove|rename)|config\b[\s\S]*(?:sshCommand|credential|url\.))/i,
+    reason: "Remote, SSH, and credential configuration changes are blocked.",
+  },
+  {
+    pattern: /\bgh(?:\.exe)?\b[\s\S]*\s(?:--repo|-R)(?:=|\s|(?=[A-Za-z0-9]))/i,
+    reason: "GitHub CLI commands must target the current repository.",
+  },
+  {
+    pattern: /\b(?:drop\s+(?:database|schema|table)|truncate\s+table|supabase\s+db\s+reset)\b/i,
+    reason: "Destructive database operations are blocked.",
+  },
+  {
+    pattern: /\b(?:rmSync|rmdirSync|unlinkSync|rmtree|remove|unlink|Directory\.Delete|File\.Delete)\s*\(/i,
+    reason: "Inline deletion APIs are blocked.",
+  },
+  {
+    pattern: /(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod|\biwr\b|\birm\b)[\s\S]*\|[\s&]*(?:bash|sh|zsh|pwsh|powershell|cmd|node|python|iex|Invoke-Expression)\b/i,
+    reason: "Downloaded content cannot be piped into an interpreter.",
+  },
+  {
+    pattern: /(?:-(?:EncodedCommand|enc)\b|FromBase64String\s*\(|certutil\s+-(?:decode|urlcache)\b|mshta\s+https?:|rundll32\s+javascript:)/i,
+    reason: "Encoded or evasive command execution is blocked.",
+  },
+  {
+    pattern: /\b(?:Set-MpPreference|Add-MpPreference|Remove-MpPreference|Set-NetFirewallProfile|New-NetFirewallRule|Remove-NetFirewallRule|Disable-NetFirewallRule|Enable-PSRemoting|Set-WSManQuickConfig)\b|\bnetsh\s+advfirewall[\s\S]*(?:\boff\b|\badd\b|\bdelete\b|\bset\b)/i,
+    reason: "Firewall, antivirus, and remote-management changes are blocked.",
+  },
+  {
+    pattern: /\b(?:reg(?:\.exe)?\s+(?:add|delete)|schtasks(?:\.exe)?\s+\/(?:create|delete|change)|sc(?:\.exe)?\s+(?:create|delete|stop|config)|New-Service|Set-Service|Stop-Service)\b/i,
+    reason: "OS persistence and service changes are blocked.",
+  },
+  {
+    pattern: /\b(?:diskpart|bcdedit|fsutil|takeown|icacls|Set-Acl|chmod|chown)\b|(?:^|[;&|({\r\n])\s*(?:&\s*)?["']?format(?:\.(?:com|exe))?["']?(?=\s|$)|\bcipher\s+\/w\b/i,
+    reason: "Disk, boot, ownership, and access-control changes are blocked.",
+  },
+  {
+    pattern: /\b(?:runas|sudo|gsudo)\b|Start-Process[\s\S]*-Verb\s+RunAs|\bSet-ExecutionPolicy\b/i,
+    reason: "Privilege escalation and persistent execution-policy changes are blocked.",
+  },
+  {
+    pattern: /\b(?:Start-Process|saps)\b[^\r\n;|]*(?:[$(]|\b(?:-FilePath\s+)?['"]?git(?:\.exe)?['"]?(?:\s|$))/i,
+    reason: "Dynamic or indirect Git process launch is blocked; use a reviewed repository script.",
+  },
+  {
+    pattern: /\b(?:winget|choco|scoop)\s+(?:install|uninstall|upgrade)\b|\b(?:npm|pnpm|yarn)\s+(?:install|add|remove|uninstall)[\s\S]*(?:--global|-g)\b/i,
+    reason: "System-wide package changes are blocked.",
+  },
+  {
+    pattern: /(?:--host|--hostname|--listen(?:-address)?)\s+(?:0\.0\.0\.0|\*|::)\b/i,
+    reason: "Non-loopback listeners are blocked.",
+  },
+  {
+    pattern: /\bgh(?:\.exe)?\s+(?:pr\s+(?:create|merge|close|reopen)|issue\s+(?:create|close|reopen|delete)|release\s+(?:create|delete|upload)|repo\s+(?:create|delete|archive)|api\b[\s\S]*(?:(?:--method|-X)(?:=|\s*)(?:POST|PUT|PATCH|DELETE)\b|(?:--field|--raw-field|--input)(?:=|\s+)|(?:^|\s)-[fF](?:=|\s+)))/i,
+    reason: "Unreviewed GitHub mutations are blocked; use the bounded deploy workflow.",
+  },
+  {
+    pattern: /\b(?:npm|pnpm|yarn)\s+(?:publish|login|logout|token|owner|deprecate)\b/i,
+    reason: "Package-registry publication and credential changes are blocked.",
+  },
+];
+
+`;
+//# sourceMappingURL=codex-pre-tool-policy-template.js.map

package/dist/services/codex-pre-tool-policy-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-pre-tool-policy-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-policy-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsIrD,CAAC"}

package/dist/services/codex-pre-tool-support-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-support-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,QA8UvC,CAAC"}
+{"version":3,"file":"codex-pre-tool-support-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,QA4YvC,CAAC"}

package/dist/services/codex-pre-tool-support-template.js

@@ -326,6 +326,68 @@ export function validateInlineExecution(command, deny) {
   }
 }
 
+// These CLI values are data, never shell programs. Only one literal invocation of
+// the canonical runtime qualifies; interpolation, pipelines and other scripts do not.
+export function executionPolicyCommand(command, cwd, repositoryRoot) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (!tokens || !/^(?:.*[\\/])?node(?:\.exe)?$/i.test(tokens[0] ?? "") ||
+      resolve(cwd, tokens[1] ?? "") !== resolve(repositoryRoot, ".agents/runtime/bin/zaip.mjs") ||
+      tokens[2] !== "conversation" || tokens[3] !== "finish") return command;
+  const result = [...tokens];
+  for (let index = 4; index < result.length; index++) {
+    if (result[index] === "--summary" && index + 1 < result.length) result[++index] = "literal-summary";
+    else if (result[index].startsWith("--summary=")) result[index] = "--summary=literal-summary";
+  }
+  return result.map(token => JSON.stringify(token)).join(" ");
+}
+
+export async function isCurrentRepositoryRead(command, repositoryRoot, execute) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (!tokens || !/^gh(?:\.exe)?$/i.test(tokens[0] ?? "")) return false;
+  const rest = [], repositories = [];
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index];
+    if (token === "--repo" || token === "-R") repositories.push(tokens[++index]);
+    else if (token.startsWith("--repo=")) repositories.push(token.slice(7));
+    else if (token.startsWith("-R") && token.length > 2) repositories.push(token.slice(2));
+    else rest.push(token);
+  }
+  if (repositories.length !== 1 || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repositories[0] ?? "") ||
+      rest.some(token => token.includes("'")) || !isLiteralReadSequence(rest.map(token => "'" + token + "'").join(" "))) return false;
+  try {
+    const origin = (await execute("git", ["remote", "get-url", "origin"], { cwd: repositoryRoot, encoding: "utf8", windowsHide: true })).stdout.trim();
+    const match = /^(?:git@github\.com:|https:\/\/github\.com\/|ssh:\/\/git@github\.com\/)([^/]+\/[^/]+?)\.git$|^(?:git@github\.com:|https:\/\/github\.com\/|ssh:\/\/git@github\.com\/)([^/]+\/[^/]+?)\/?$/.exec(origin);
+    return !!match && (match[1] ?? match[2]).toLowerCase() === repositories[0].toLowerCase();
+  } catch { return false; }
+}
+
+export function validateHashicorpRead(command, deny) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (!tokens || !/^(?:curl(?:\.exe)?|Invoke-WebRequest|Invoke-RestMethod|iwr|irm)$/i.test(tokens[0]))
+    deny("HashiCorp releases require a literal supported read command.");
+  let urlCount = 0;
+  for (let i = 1; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (/^https:\/\//i.test(token)) {
+      const url = new URL(token);
+      if (url.hostname !== "releases.hashicorp.com" || url.username || url.password || url.port)
+        deny("HashiCorp reads require one exact HTTPS destination.");
+      urlCount++; continue;
+    }
+    if (["-I", "--head", "-s", "-S", "-sS", "--silent", "--show-error", "--fail", "-q", "--disable"].includes(token)) continue;
+    const namedMethod = /^(?:--request|--method|-Method)(?:=(.*))?$/i.exec(token);
+    const curlMethod = /^-X(.*)$/.exec(token);
+    if (namedMethod || curlMethod) {
+      const value = namedMethod ? (namedMethod[1] ?? tokens[++i]) : (curlMethod[1] || tokens[++i]);
+      if (!/^(?:GET|HEAD)$/i.test(value ?? "")) deny("HashiCorp releases permit only GET or HEAD requests.");
+      continue;
+    }
+    if (/^(?:-Uri|--url)$/i.test(token) && /^https:\/\//i.test(tokens[i + 1] ?? "")) continue;
+    deny("Unsupported option in the bounded HashiCorp read command.");
+  }
+  if (urlCount !== 1) deny("HashiCorp reads require exactly one HTTPS URL.");
+}
+
 export function rewriteCliInput(toolInput, command, commandFromCmd) {
   return { hookSpecificOutput: {
     hookEventName: "PreToolUse", permissionDecision: "allow",

package/dist/services/codex-pre-tool-support-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-support-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8UpD,CAAC"}
+{"version":3,"file":"codex-pre-tool-support-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4YpD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaip-ai/cli",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",

package/templates/.agents/README-ENG.md

@@ -6,6 +6,8 @@ English | [Português](README.md)
 
 ## Quick overview
 
+The [v5.6 guide](https://github.com/zaip-ai/zaip-aios/blob/main/docs/quality/v56-publicacao-reproduzivel.md) describes the reproducible release runtime, immutable candidate review, and early impact-based validation. Reused coverage requires proof for the same candidate; functional changes and missing evidence retain the applicable gates.
+
 The [v5.5 guide](https://github.com/zaip-ai/zaip-aios/blob/main/docs/quality/v55-eficiencia-operacional.md) describes evidence
 obligations exposed at intake, direct replay of completed lifecycle closure,
 bounded journal segments, and impact-based test selection. Timing diagnostics
@@ -632,10 +634,10 @@ already-terminal Gui while the responsible Run is open. No decision means no
 approval. A trusted fallback must persist `blocked` with a reason when the
 finalizer cannot run; the current CLI does not yet prove that path for every
 native Stop or interruption. Direct standalone work with explicit direct
-authorization is a legacy route, not the v4 default. See
+authorization is a legacy compatibility route, not the default for new installations. See
 [closure and recovery](zaip-aios/guides/16-lifecycle-e-reconciliacao.md).
 
-Proof depth is adaptive: a standalone `lite` Task requires at least one typed validation and one Evidence, normally one of each, but accepts legitimate additional proof. `standard` requires two or three validations according to `verification_scope` and at least one consolidated Evidence; `critical` requires three or more, independent review, and persisted risk signals determining additional controls. SPEC and PRD deliveries add a parent matrix, at least three validations and three Evidences, real integration, and independent review. Current templates use managed PRDs/SPECs and direct standalone Tasks; after implementation and installer qualification, v4 targets Codex-native as the operational default. Worktrees, write scopes, budgets, commits, and typed gates still apply where relevant. See [Adaptive assurance and opt-in autonomy](zaip-aios/guides/19-assurance-e-autonomia.md).
+Proof depth is adaptive: a standalone `lite` Task requires at least one typed validation and one Evidence, normally one of each, but accepts legitimate additional proof. `standard` requires two or three validations according to `verification_scope` and at least one consolidated Evidence; `critical` requires three or more, independent review, and persisted risk signals determining additional controls. SPEC and PRD deliveries add a parent matrix, at least three validations and three Evidences, real integration, and independent review. New installations use Codex-native by default. Existing installations retain their effective configuration and must be checked against the installed version; publication does not prove client hook activation. Worktrees, write scopes, budgets, commits, and typed gates still apply where relevant. See [Adaptive assurance and opt-in autonomy](zaip-aios/guides/19-assurance-e-autonomia.md).
 
 ## Autonomous engineering principles
 

package/templates/.agents/README.md

@@ -6,6 +6,8 @@
 
 ## Visão rápida
 
+O [guia da v5.6](https://github.com/zaip-ai/zaip-aios/blob/main/docs/quality/v56-publicacao-reproduzivel.md) apresenta o runtime reproduzível de publicação, a revisão do candidato imutável e a validação antecipada por impacto. Cobertura reutilizada exige prova do mesmo candidato; alterações funcionais e provas ausentes mantêm os gates aplicáveis.
+
 O [guia da v5.5](https://github.com/zaip-ai/zaip-aios/blob/main/docs/quality/v55-eficiencia-operacional.md) descreve as obrigações
 de prova apresentadas no início da entrega, o replay direto de fechamento já
 concluído, os segmentos limitados dos journals e a seleção de testes por impacto.
@@ -636,7 +638,7 @@ avulsa direta antiga usa uma raiz observada com `--direct-authorization REFERÊN
 explícita; não é o caminho padrão novo, não cria executor fictício nem dispensa Evidence e Gui. Veja
 [fechamento e recuperação](zaip-aios/guides/16-lifecycle-e-reconciliacao.md).
 
-A profundidade de prova é adaptativa: Task standalone `lite` exige no mínimo uma validação tipada e uma Evidence, normalmente uma de cada, mas aceita provas adicionais legítimas. `standard` exige duas ou três validações conforme `verification_scope` e pelo menos uma Evidence consolidada; `critical` exige três ou mais, revisão independente e os sinais de risco persistidos que determinam controles adicionais. Entregas de SPEC e PRD acrescentam matriz parental, pelo menos três validações e três Evidences, integração real e revisão independente. O candidato local v4 usa Codex-native como modo padrão; o npm publicado anteriormente mantém o contrato da sua versão e exige validação separada. Worktrees, write scopes, commits, budgets e gates tipados continuam exigidos onde aplicáveis. Compatibilidade de outros hosts não equivale à garantia Codex-native. Consulte [Assurance adaptativa e autonomia opt-in](zaip-aios/guides/19-assurance-e-autonomia.md).
+A profundidade de prova é adaptativa: Task standalone `lite` exige no mínimo uma validação tipada e uma Evidence, normalmente uma de cada, mas aceita provas adicionais legítimas. `standard` exige duas ou três validações conforme `verification_scope` e pelo menos uma Evidence consolidada; `critical` exige três ou mais, revisão independente e os sinais de risco persistidos que determinam controles adicionais. Entregas de SPEC e PRD acrescentam matriz parental, pelo menos três validações e três Evidences, integração real e revisão independente. Novas instalações usam Codex-native como modo padrão. Instalações existentes conservam sua configuração efetiva e devem ser verificadas na versão instalada; publicação não comprova ativação dos hooks no cliente. Worktrees, write scopes, commits, budgets e gates tipados continuam exigidos onde aplicáveis. Compatibilidade de outros hosts não equivale à garantia Codex-native. Consulte [Assurance adaptativa e autonomia opt-in](zaip-aios/guides/19-assurance-e-autonomia.md).
 
 
 ## Princípios de engenharia autônoma

package/templates/.agents/config/agents/discovery.json

@@ -1,5 +1,5 @@
 {
-  "_zaip_managed": "zaip-managed generated-do-not-edit source=agent-discovery version=5.5.0 sha256=3def7a2b43c1a751f8e68754ef94cb107a80b5d26e11f065af2b4cc145fc8897",
+  "_zaip_managed": "zaip-managed generated-do-not-edit source=agent-discovery version=5.6.0 sha256=3def7a2b43c1a751f8e68754ef94cb107a80b5d26e11f065af2b4cc145fc8897",
   "schema_version": 1,
   "source": {
     "path": ".agents/config/agents/catalog.yaml",