aegis-mcp-server 0.1.7 → 0.1.9

package/dist/services/enforcement-engine.d.ts

@@ -7,11 +7,28 @@
  * Two-layer enforcement:
  * Layer 1 (skeleton): permissions.boundaries, scope paths, override_protocol
  * Layer 2 (extensions): sensitive_patterns, cross_domain_rules, sensitivity_tiers
+ *
+ * Override protocol:
+ * When the governance behavior is "warn_confirm_and_log", blocked actions return
+ * an override_token. The agent surfaces the violation to the human, and if the
+ * human confirms, the agent calls aegis_request_override with the token. The
+ * override is single-use, time-limited (60s), and logged with human_confirmed: true.
+ * Immutable policies cannot be overridden regardless.
  */
 import type { PolicyState, ResolvedRole, EnforcementVerdict, OverrideLogEntry } from '../types.js';
+interface PendingOverride {
+    token: string;
+    operation: 'write' | 'read' | 'delete';
+    path: string;
+    content?: string;
+    reason: string;
+    policy_ref: string;
+    created_at: number;
+}
 export declare class EnforcementEngine {
     private state;
     private activeRole;
+    private pendingOverrides;
     constructor(state: PolicyState, activeRole: ResolvedRole);
     /**
      * Update references when policy reloads.
@@ -28,12 +45,10 @@ export declare class EnforcementEngine {
     validateRead(targetPath: string): EnforcementVerdict;
     /**
      * Scan proposed file content for sensitive patterns.
-     * Uses governance.permissions.sensitive_patterns when present.
      */
     scanContent(content: string, targetPath: string): EnforcementVerdict;
     /**
      * Validate that a cross-domain import respects boundaries.
-     * Uses governance.cross_domain_rules when present (extension field).
      */
     validateCrossDomain(sourcePath: string, importPath: string): EnforcementVerdict;
     /**
@@ -43,13 +58,24 @@ export declare class EnforcementEngine {
         behavior: 'block_and_log' | 'warn_confirm_and_log' | 'log_only';
         isImmutable: boolean;
     };
+    /**
+     * Create a pending override token for a blocked action.
+     * The token is single-use and expires after 60 seconds.
+     * Returns null if the policy is immutable or override behavior is block_and_log.
+     */
+    createOverrideToken(operation: 'write' | 'read' | 'delete', path: string, reason: string, policyRef: string, content?: string): string | null;
+    /**
+     * Validate and consume an override token.
+     * Returns the pending override if the token is valid and not expired.
+     * The token is consumed (deleted) after use — single-use only.
+     */
+    consumeOverrideToken(token: string): PendingOverride | null;
     /**
      * Log an override to the append-only overrides.jsonl file.
      */
     logOverride(entry: OverrideLogEntry): Promise<void>;
     /**
      * Build the list of commands to run for quality gate validation.
-     * Maps pre_commit booleans to build_commands from constitution or governance.
      */
     getQualityGateCommands(): Array<{
         name: string;
@@ -57,13 +83,14 @@ export declare class EnforcementEngine {
     }>;
     /**
      * Safely access permissions.boundaries — returns empty object if missing.
-     * Handles governance files that don't have the skeleton boundaries field.
      */
     private get boundaries();
+    private cleanExpiredTokens;
     private matchesAny;
     private toRelativePath;
     private getDomain;
     private compilePattern;
     private log;
 }
+export {};
 //# sourceMappingURL=enforcement-engine.d.ts.map

package/dist/services/enforcement-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enforcement-engine.d.ts","sourceRoot":"","sources":["../../src/services/enforcement-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAEjB,MAAM,aAAa,CAAC;AAErB,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,UAAU;gBADV,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,YAAY;IAGlC;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI;IAOzD;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB;IAwErD;;OAEG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB;IAyCpD;;;OAGG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,kBAAkB;IAuBpE;;;OAGG;IACH,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,kBAAkB;IA8B/E;;OAEG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG;QACtC,QAAQ,EAAE,eAAe,GAAG,sBAAsB,GAAG,UAAU,CAAC;QAChE,WAAW,EAAE,OAAO,CAAC;KACtB;IAaD;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IASzD;;;OAGG;IACH,sBAAsB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAgClE;;;OAGG;IACH,OAAO,KAAK,UAAU,GAErB;IAED,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,SAAS;IAajB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,GAAG;CAGZ"}
+{"version":3,"file":"enforcement-engine.d.ts","sourceRoot":"","sources":["../../src/services/enforcement-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAEjB,MAAM,aAAa,CAAC;AAIrB,UAAU,eAAe;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,qBAAa,iBAAiB;IAI1B,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,UAAU;IAJpB,OAAO,CAAC,gBAAgB,CAAsC;gBAGpD,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,YAAY;IAGlC;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI;IAOzD;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB;IAuErD;;OAEG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB;IAyCpD;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,kBAAkB;IAuBpE;;OAEG;IACH,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,kBAAkB;IA4B/E;;OAEG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG;QACtC,QAAQ,EAAE,eAAe,GAAG,sBAAsB,GAAG,UAAU,CAAC;QAChE,WAAW,EAAE,OAAO,CAAC;KACtB;IAaD;;;;OAIG;IACH,mBAAmB,CACjB,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,EACtC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,GAAG,IAAI;IAyBhB;;;;OAIG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAe3D;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IASzD;;OAEG;IACH,sBAAsB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA+BlE;;OAEG;IACH,OAAO,KAAK,UAAU,GAErB;IAED,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,SAAS;IAajB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,GAAG;CAGZ"}

package/dist/services/enforcement-engine.js

@@ -7,13 +7,23 @@
  * Two-layer enforcement:
  * Layer 1 (skeleton): permissions.boundaries, scope paths, override_protocol
  * Layer 2 (extensions): sensitive_patterns, cross_domain_rules, sensitivity_tiers
+ *
+ * Override protocol:
+ * When the governance behavior is "warn_confirm_and_log", blocked actions return
+ * an override_token. The agent surfaces the violation to the human, and if the
+ * human confirms, the agent calls aegis_request_override with the token. The
+ * override is single-use, time-limited (60s), and logged with human_confirmed: true.
+ * Immutable policies cannot be overridden regardless.
  */
+import { randomBytes } from 'node:crypto';
 import { appendFile, mkdir } from 'node:fs/promises';
 import { dirname, join, relative, isAbsolute } from 'node:path';
 import { minimatch } from 'minimatch';
+const OVERRIDE_TTL_MS = 300_000; // 5 minutes
 export class EnforcementEngine {
     state;
     activeRole;
+    pendingOverrides = new Map();
     constructor(state, activeRole) {
         this.state = state;
         this.activeRole = activeRole;
@@ -47,7 +57,6 @@ export class EnforcementEngine {
         const readOnly = this.boundaries.read_only;
         const writable = this.boundaries.writable;
         if (readOnly && this.matchesAny(relPath, readOnly)) {
-            // If the path is also in the writable list, writable wins
             if (!writable || !this.matchesAny(relPath, writable)) {
                 return {
                     allowed: false,
@@ -133,7 +142,6 @@ export class EnforcementEngine {
     // ─── Content Scanning ─────────────────────────────────────────────────────
     /**
      * Scan proposed file content for sensitive patterns.
-     * Uses governance.permissions.sensitive_patterns when present.
      */
     scanContent(content, targetPath) {
         const patterns = this.state.governance.permissions?.sensitive_patterns;
@@ -157,7 +165,6 @@ export class EnforcementEngine {
     // ─── Cross-Domain Validation ──────────────────────────────────────────────
     /**
      * Validate that a cross-domain import respects boundaries.
-     * Uses governance.cross_domain_rules when present (extension field).
      */
     validateCrossDomain(sourcePath, importPath) {
         const rules = this.state.governance.cross_domain_rules;
@@ -168,11 +175,9 @@ export class EnforcementEngine {
             return { allowed: true };
         const sourceDomain = this.getDomain(sourcePath, domains);
         const importDomain = this.getDomain(importPath, domains);
-        // Same domain or can't determine — allow
         if (!sourceDomain || !importDomain || sourceDomain === importDomain) {
             return { allowed: true };
         }
-        // Cross-domain — must go through shared interfaces
         if (!importPath.includes(rules.shared_interfaces_path)) {
             return {
                 allowed: false,
@@ -197,6 +202,49 @@ export class EnforcementEngine {
             isImmutable,
         };
     }
+    /**
+     * Create a pending override token for a blocked action.
+     * The token is single-use and expires after 60 seconds.
+     * Returns null if the policy is immutable or override behavior is block_and_log.
+     */
+    createOverrideToken(operation, path, reason, policyRef, content) {
+        const { behavior, isImmutable } = this.getOverrideBehavior(policyRef);
+        // Immutable policies and block_and_log cannot be overridden
+        if (isImmutable || behavior === 'block_and_log') {
+            return null;
+        }
+        // Clean up expired tokens
+        this.cleanExpiredTokens();
+        const token = randomBytes(16).toString('hex');
+        this.pendingOverrides.set(token, {
+            token,
+            operation,
+            path,
+            content,
+            reason,
+            policy_ref: policyRef,
+            created_at: Date.now(),
+        });
+        return token;
+    }
+    /**
+     * Validate and consume an override token.
+     * Returns the pending override if the token is valid and not expired.
+     * The token is consumed (deleted) after use — single-use only.
+     */
+    consumeOverrideToken(token) {
+        const pending = this.pendingOverrides.get(token);
+        if (!pending)
+            return null;
+        // Check expiration
+        if (Date.now() - pending.created_at > OVERRIDE_TTL_MS) {
+            this.pendingOverrides.delete(token);
+            return null;
+        }
+        // Consume — single use
+        this.pendingOverrides.delete(token);
+        return pending;
+    }
     /**
      * Log an override to the append-only overrides.jsonl file.
      */
@@ -209,7 +257,6 @@ export class EnforcementEngine {
     // ─── Quality Gates ────────────────────────────────────────────────────────
     /**
      * Build the list of commands to run for quality gate validation.
-     * Maps pre_commit booleans to build_commands from constitution or governance.
      */
     getQualityGateCommands() {
         const gates = this.state.governance.quality_gate?.pre_commit;
@@ -228,7 +275,6 @@ export class EnforcementEngine {
         if (gates.must_pass_typecheck && commands.typecheck) {
             result.push({ name: 'typecheck', command: commands.typecheck });
         }
-        // Custom checks from quality gate
         if (gates.custom_checks) {
             for (const check of gates.custom_checks) {
                 result.push({ name: check.name, command: check.command });
@@ -239,14 +285,20 @@ export class EnforcementEngine {
     // ─── Private Helpers ──────────────────────────────────────────────────────
     /**
      * Safely access permissions.boundaries — returns empty object if missing.
-     * Handles governance files that don't have the skeleton boundaries field.
      */
     get boundaries() {
         return this.state.governance.permissions?.boundaries ?? {};
     }
+    cleanExpiredTokens() {
+        const now = Date.now();
+        for (const [token, pending] of this.pendingOverrides) {
+            if (now - pending.created_at > OVERRIDE_TTL_MS) {
+                this.pendingOverrides.delete(token);
+            }
+        }
+    }
     matchesAny(path, patterns) {
         return patterns.some((pattern) => {
-            // Normalize: "compliance/" should match "compliance/src/index.ts"
             const normalized = pattern.endsWith('/')
                 ? pattern + '**'
                 : pattern;

package/dist/services/enforcement-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"enforcement-engine.js","sourceRoot":"","sources":["../../src/services/enforcement-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAStC,MAAM,OAAO,iBAAiB;IAElB;IACA;IAFV,YACU,KAAkB,EAClB,UAAwB;QADxB,UAAK,GAAL,KAAK,CAAa;QAClB,eAAU,GAAV,UAAU,CAAc;IAC/B,CAAC;IAEJ;;OAEG;IACH,WAAW,CAAC,KAAkB,EAAE,IAAkB;QAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,aAAa,CAAC,UAAkB;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAEhD,yDAAyD;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAC5C,IAAI,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,uEAAuE;gBAC/F,UAAU,EAAE,wDAAwD;gBACpE,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1C,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnD,0DAA0D;YAC1D,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACrD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS,OAAO,uCAAuC;oBAC/D,UAAU,EAAE,wDAAwD;oBACpE,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,2BAA2B,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI;gBACzE,UAAU,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,EAAE,gCAAgC;gBACvE,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBAC5D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAE5D,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;gBAChC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS,OAAO,4CAA4C,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI;oBAC1F,UAAU,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,EAAE,eAAe;oBACtD,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC3E,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,2CAA2C;gBACnE,UAAU,EAAE,uDAAuD;gBACnE,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAE7E;;OAEG;IACH,YAAY,CAAC,UAAkB;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAEhD,6BAA6B;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAC5C,IAAI,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,2DAA2D;gBACnF,UAAU,EAAE,wDAAwD;gBACpE,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,2BAA2B,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI;gBACzE,UAAU,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,EAAE,gCAAgC;gBACvE,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACzC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,4CAA4C,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI;gBAC1F,UAAU,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,EAAE,sBAAsB;gBAC7D,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,WAAW,CAAC,OAAe,EAAE,UAAkB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,kBAAkB,CAAC;QACvE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEjE,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,gBAAgB,UAAU,mCAAmC,EAAE,CAAC,MAAM,EAAE;oBAChF,UAAU,EAAE,oDAAoD;oBAChE,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,mBAAmB,CAAC,UAAkB,EAAE,UAAkB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACvD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,sBAAsB;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;QACxD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAE/D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEzD,yCAAyC;QACzC,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC;YACvD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,6BAA6B,YAAY,SAAS,YAAY,sBAAsB,KAAK,CAAC,sBAAsB,wBAAwB,UAAU,mBAAmB;gBAC7K,UAAU,EAAE,sCAAsC;gBAClD,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAE7E;;OAEG;IACH,mBAAmB,CAAC,SAAiB;QAInC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACzD,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,IAAI,sBAAsB,CAAC;QAC9D,MAAM,SAAS,GAAG,QAAQ,EAAE,kBAAkB,IAAI,EAAE,CAAC;QAErD,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjE,OAAO;YACL,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ;YAClD,WAAW;SACZ,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1C,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,sBAAsB;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc;YACtC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc;YACpC,EAAE,CAAC;QAEpB,MAAM,MAAM,GAA6C,EAAE,CAAC;QAE5D,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC;QAE1B,IAAI,KAAK,CAAC,eAAe,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,KAAK,CAAC,mBAAmB,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,kCAAkC;QAClC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,IAAI,EAAE,CAAC;IAC7D,CAAC;IAEO,UAAU,CAAC,IAAY,EAAE,QAAkB;QACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC/B,kEAAkE;YAClE,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACtC,CAAC,CAAC,OAAO,GAAG,IAAI;gBAChB,CAAC,CAAC,OAAO,CAAC;YACZ,OAAO,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,UAAkB;QACvC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,SAAS,CACf,QAAgB,EAChB,OAA8C;QAE9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAClD,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7E,OAAO,MAAM,CAAC,IAAI,CAAC;YACrB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,OAAe;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,GAAG,CAAC,OAAe;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,OAAO,IAAI,CAAC,CAAC;IACvD,CAAC;CACF"}
+{"version":3,"file":"enforcement-engine.js","sourceRoot":"","sources":["../../src/services/enforcement-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAqBtC,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,YAAY;AAE7C,MAAM,OAAO,iBAAiB;IAIlB;IACA;IAJF,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE9D,YACU,KAAkB,EAClB,UAAwB;QADxB,UAAK,GAAL,KAAK,CAAa;QAClB,eAAU,GAAV,UAAU,CAAc;IAC/B,CAAC;IAEJ;;OAEG;IACH,WAAW,CAAC,KAAkB,EAAE,IAAkB;QAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,aAAa,CAAC,UAAkB;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAEhD,yDAAyD;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAC5C,IAAI,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,uEAAuE;gBAC/F,UAAU,EAAE,wDAAwD;gBACpE,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1C,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACrD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS,OAAO,uCAAuC;oBAC/D,UAAU,EAAE,wDAAwD;oBACpE,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,2BAA2B,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI;gBACzE,UAAU,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,EAAE,gCAAgC;gBACvE,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBAC5D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAE5D,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;gBAChC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS,OAAO,4CAA4C,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI;oBAC1F,UAAU,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,EAAE,eAAe;oBACtD,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC3E,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,2CAA2C;gBACnE,UAAU,EAAE,uDAAuD;gBACnE,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAE7E;;OAEG;IACH,YAAY,CAAC,UAAkB;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAEhD,6BAA6B;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAC5C,IAAI,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,2DAA2D;gBACnF,UAAU,EAAE,wDAAwD;gBACpE,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,2BAA2B,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI;gBACzE,UAAU,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,EAAE,gCAAgC;gBACvE,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACzC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,4CAA4C,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI;gBAC1F,UAAU,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,EAAE,sBAAsB;gBAC7D,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAE7E;;OAEG;IACH,WAAW,CAAC,OAAe,EAAE,UAAkB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,kBAAkB,CAAC;QACvE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEjE,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,gBAAgB,UAAU,mCAAmC,EAAE,CAAC,MAAM,EAAE;oBAChF,UAAU,EAAE,oDAAoD;oBAChE,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAE7E;;OAEG;IACH,mBAAmB,CAAC,UAAkB,EAAE,UAAkB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACvD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,sBAAsB;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;QACxD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAE/D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEzD,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC;YACvD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,6BAA6B,YAAY,SAAS,YAAY,sBAAsB,KAAK,CAAC,sBAAsB,wBAAwB,UAAU,mBAAmB;gBAC7K,UAAU,EAAE,sCAAsC;gBAClD,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAE7E;;OAEG;IACH,mBAAmB,CAAC,SAAiB;QAInC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACzD,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,IAAI,sBAAsB,CAAC;QAC9D,MAAM,SAAS,GAAG,QAAQ,EAAE,kBAAkB,IAAI,EAAE,CAAC;QAErD,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjE,OAAO;YACL,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ;YAClD,WAAW;SACZ,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CACjB,SAAsC,EACtC,IAAY,EACZ,MAAc,EACd,SAAiB,EACjB,OAAgB;QAEhB,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAEtE,4DAA4D;QAC5D,IAAI,WAAW,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE;YAC/B,KAAK;YACL,SAAS;YACT,IAAI;YACJ,OAAO;YACP,MAAM;YACN,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,KAAa;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,mBAAmB;QACnB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,eAAe,EAAE,CAAC;YACtD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1C,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,6EAA6E;IAE7E;;OAEG;IACH,sBAAsB;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc;YACtC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc;YACpC,EAAE,CAAC;QAEpB,MAAM,MAAM,GAA6C,EAAE,CAAC;QAE5D,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC;QAE1B,IAAI,KAAK,CAAC,eAAe,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,KAAK,CAAC,mBAAmB,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6EAA6E;IAE7E;;OAEG;IACH,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,IAAI,EAAE,CAAC;IAC7D,CAAC;IAEO,kBAAkB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACrD,IAAI,GAAG,GAAG,OAAO,CAAC,UAAU,GAAG,eAAe,EAAE,CAAC;gBAC/C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAY,EAAE,QAAkB;QACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACtC,CAAC,CAAC,OAAO,GAAG,IAAI;gBAChB,CAAC,CAAC,OAAO,CAAC;YACZ,OAAO,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,UAAkB;QACvC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,SAAS,CACf,QAAgB,EAChB,OAA8C;QAE9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAClD,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7E,OAAO,MAAM,CAAC,IAAI,CAAC;YACrB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,OAAe;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,GAAG,CAAC,OAAe;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,OAAO,IAAI,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/tools/file-tools.d.ts

@@ -1,27 +1,32 @@
 /**
  * Governed File Tools — MCP tool registrations for file operations.
  *
- * These are the tools agents call instead of raw file system access.
- * Every call is validated against the loaded policy before execution.
- * The agent never sees the policy — only the verdict.
- *
  * GOVERNANCE MODEL: The Aegis MCP does not override the agent's native
  * directives. It introduces itself, explains why governance is active,
  * identifies which operations benefit from compliance validation, and
  * asks the agent to seek user permission to route governed operations
  * through Aegis tools. The user's authority is the enforcement mechanism.
  *
+ * OVERRIDE HANDSHAKE: When a write/delete is blocked and the override
+ * protocol allows overrides (warn_confirm_and_log), the blocked response
+ * includes an override_token. The agent presents the violation to the
+ * human. If the human confirms, the agent calls aegis_request_override
+ * with the token. The action proceeds and is logged with human_confirmed: true.
+ * The token is single-use and expires after 5 minutes.
+ * Immutable policies cannot be overridden.
+ *
  * LOGGING: Every denied action is logged to overrides.jsonl by the server
  * process — no agent involvement required.
  *
  * Tools:
- *   aegis_check_permissions  — Pre-check before writing (saves wasted generation)
- *   aegis_write_file         — Governed write with path + content validation
- *   aegis_read_file          — Governed read with path validation
- *   aegis_delete_file        — Governed delete (uses write permissions)
- *   aegis_execute            — Governed command execution
- *   aegis_complete_task      — Task completion with quality gate validation
- *   aegis_policy_summary     — Minimal role/permissions summary (~200 tokens)
+ *   aegis_check_permissions   — Pre-check before writing
+ *   aegis_write_file          — Governed write with path + content validation
+ *   aegis_read_file           — Governed read with path validation
+ *   aegis_delete_file         — Governed delete (uses write permissions)
+ *   aegis_execute             — Governed command execution
+ *   aegis_complete_task       — Task completion with quality gate validation
+ *   aegis_policy_summary      — Minimal role/permissions summary
+ *   aegis_request_override    — Consume an override token after human confirmation
  */
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { EnforcementEngine } from '../services/enforcement-engine.js';

package/dist/tools/file-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-tools.d.ts","sourceRoot":"","sources":["../../src/tools/file-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAe7D,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,iBAAiB,EAClC,QAAQ,EAAE,MAAM,WAAW,EAC3B,OAAO,EAAE,MAAM,YAAY,GAC1B,IAAI,CA0YN"}
+{"version":3,"file":"file-tools.d.ts","sourceRoot":"","sources":["../../src/tools/file-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM7D,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,iBAAiB,EAClC,QAAQ,EAAE,MAAM,WAAW,EAC3B,OAAO,EAAE,MAAM,YAAY,GAC1B,IAAI,CA4hBN"}

package/dist/tools/file-tools.js

@@ -1,42 +1,38 @@
 /**
  * Governed File Tools — MCP tool registrations for file operations.
  *
- * These are the tools agents call instead of raw file system access.
- * Every call is validated against the loaded policy before execution.
- * The agent never sees the policy — only the verdict.
- *
  * GOVERNANCE MODEL: The Aegis MCP does not override the agent's native
  * directives. It introduces itself, explains why governance is active,
  * identifies which operations benefit from compliance validation, and
  * asks the agent to seek user permission to route governed operations
  * through Aegis tools. The user's authority is the enforcement mechanism.
  *
+ * OVERRIDE HANDSHAKE: When a write/delete is blocked and the override
+ * protocol allows overrides (warn_confirm_and_log), the blocked response
+ * includes an override_token. The agent presents the violation to the
+ * human. If the human confirms, the agent calls aegis_request_override
+ * with the token. The action proceeds and is logged with human_confirmed: true.
+ * The token is single-use and expires after 5 minutes.
+ * Immutable policies cannot be overridden.
+ *
  * LOGGING: Every denied action is logged to overrides.jsonl by the server
  * process — no agent involvement required.
  *
  * Tools:
- *   aegis_check_permissions  — Pre-check before writing (saves wasted generation)
- *   aegis_write_file         — Governed write with path + content validation
- *   aegis_read_file          — Governed read with path validation
- *   aegis_delete_file        — Governed delete (uses write permissions)
- *   aegis_execute            — Governed command execution
- *   aegis_complete_task      — Task completion with quality gate validation
- *   aegis_policy_summary     — Minimal role/permissions summary (~200 tokens)
+ *   aegis_check_permissions   — Pre-check before writing
+ *   aegis_write_file          — Governed write with path + content validation
+ *   aegis_read_file           — Governed read with path validation
+ *   aegis_delete_file         — Governed delete (uses write permissions)
+ *   aegis_execute             — Governed command execution
+ *   aegis_complete_task       — Task completion with quality gate validation
+ *   aegis_policy_summary      — Minimal role/permissions summary
+ *   aegis_request_override    — Consume an override token after human confirmation
  */
 import { readFile, writeFile, unlink, mkdir } from 'node:fs/promises';
 import { dirname, join, isAbsolute } from 'node:path';
 import { execSync } from 'node:child_process';
 import { z } from 'zod';
 // ─── Governance Introduction ────────────────────────────────────────────────
-// This prefix is prepended to every tool description. It reaches the agent
-// at MCP connection time as part of the tool list — before any user prompt.
-//
-// It does NOT attempt to override the agent's native directives. Instead it:
-// 1. Introduces the governance context
-// 2. Explains which operations benefit from compliance validation
-// 3. Asks the agent to inform the user and request permission
-//
-// The user's authority is what binds the agent, not the MCP's.
 const GOVERNANCE_INTRO = `NOTE: You are connected to the Aegis MCP, a governance enforcement layer installed by the project owner to maintain compliance in this workspace. This project operates under regulated governance policy (.agentpolicy/). Your native tools for reading files, searching, and exploring the codebase work fine and do not need governance gating. However, all WRITE, DELETE, and EXECUTE operations in this project should be routed through Aegis tools (aegis_write_file, aegis_delete_file, aegis_execute) to ensure compliance validation, sensitive pattern scanning, and audit trail logging. Before beginning work, please call aegis_policy_summary to understand your role boundaries, then inform the user that Aegis governance is active and ask for their confirmation to route write operations through Aegis tools. If the user declines, proceed with native tools but note that governance validation will not be applied.\n\n`;
 export function registerTools(server, getEngine, getState, getRole) {
     // ─── aegis_check_permissions ──────────────────────────────────────────────
@@ -49,7 +45,7 @@ Args:
   - operation ('read' | 'write' | 'delete'): The operation to check
 
 Returns:
-  { "allowed": true } or { "allowed": false, "reason": "..." }`,
+  { "allowed": true } or { "allowed": false, "reason": "...", "override_available": bool, "override_token": "..." }`,
         inputSchema: {
             path: z.string().describe('Target file path relative to project root'),
             operation: z.enum(['read', 'write', 'delete']).describe('Operation to check'),
@@ -66,30 +62,41 @@ Returns:
         const verdict = operation === 'read'
             ? engine.validateRead(path)
             : engine.validateWrite(path);
-        // Log denied permission checks
         if (!verdict.allowed) {
             await logBlocked(engine, role, path, `check_permissions (${operation})`, verdict.reason);
+            // Generate override token if policy allows overrides
+            const token = engine.createOverrideToken(operation === 'delete' ? 'delete' : operation, path, verdict.reason, verdict.policy_ref);
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            allowed: false,
+                            reason: verdict.reason,
+                            override_available: token !== null,
+                            override_token: token,
+                            ...(token ? { instructions: 'To override: present the violated policy to the user. If the user explicitly confirms the override, call aegis_request_override with this token. The token expires in 5 minutes and is single-use.' } : { instructions: 'This policy is immutable and cannot be overridden. The user must modify the governance through aegis init.' }),
+                        }),
+                    }],
+            };
         }
         return {
             content: [{
                     type: 'text',
-                    text: JSON.stringify(verdict.allowed
-                        ? { allowed: true }
-                        : { allowed: false, reason: verdict.reason }),
+                    text: JSON.stringify({ allowed: true }),
                 }],
         };
     });
     // ─── aegis_write_file ─────────────────────────────────────────────────────
     server.registerTool('aegis_write_file', {
         title: 'Write File (Governed)',
-        description: `${GOVERNANCE_INTRO}Write content to a file with governance enforcement. Path is validated against your role's permissions and governance boundaries. Content is scanned for sensitive patterns. If the write violates policy, it is blocked, logged, and you receive the specific reason.
+        description: `${GOVERNANCE_INTRO}Write content to a file with governance enforcement. Path is validated against your role's permissions and governance boundaries. Content is scanned for sensitive patterns. If the write violates policy, it is blocked, logged, and you receive an override_token if the policy allows overrides. Present the violation to the user — if they confirm, call aegis_request_override with the token to proceed.
 
 Args:
   - path (string): File path relative to project root
   - content (string): File content to write
 
 Returns:
-  { "status": "success", "path": "..." } or { "status": "blocked", "reason": "..." }`,
+  { "status": "success", "path": "..." } or { "status": "blocked", "reason": "...", "override_available": bool, "override_token": "..." }`,
         inputSchema: {
             path: z.string().describe('File path relative to project root'),
             content: z.string().describe('File content to write'),
@@ -108,13 +115,15 @@ Returns:
         const pathVerdict = engine.validateWrite(path);
         if (!pathVerdict.allowed) {
             await logBlocked(engine, role, path, 'write', pathVerdict.reason);
-            return blocked(pathVerdict.reason);
+            const token = engine.createOverrideToken('write', path, pathVerdict.reason, pathVerdict.policy_ref, content);
+            return blockedWithOverride(pathVerdict.reason, token);
         }
         // Scan content for sensitive patterns
         const contentVerdict = engine.scanContent(content, path);
         if (!contentVerdict.allowed) {
             await logBlocked(engine, role, path, 'write (sensitive content)', contentVerdict.reason);
-            return blocked(contentVerdict.reason);
+            const token = engine.createOverrideToken('write', path, contentVerdict.reason, contentVerdict.policy_ref, content);
+            return blockedWithOverride(contentVerdict.reason, token);
         }
         // Write the file
         const absPath = toAbsolute(path, state.projectRoot);
@@ -130,13 +139,13 @@ Returns:
     // ─── aegis_read_file ──────────────────────────────────────────────────────
     server.registerTool('aegis_read_file', {
         title: 'Read File (Governed)',
-        description: `${GOVERNANCE_INTRO}Read the contents of a file with governance enforcement. Path is validated against your role's read permissions. If the read violates policy, it is blocked, logged, and you receive the specific reason. Note: Native read tools are acceptable for general file exploration. Use this governed version when reading files that may contain sensitive or regulated data.
+        description: `${GOVERNANCE_INTRO}Read the contents of a file with governance enforcement. Path is validated against your role's read permissions. If the read violates policy, it is blocked and logged. Note: Native read tools are acceptable for general file exploration. Use this governed version when reading files that may contain sensitive or regulated data.
 
 Args:
   - path (string): File path relative to project root
 
 Returns:
-  File content as text, or { "status": "blocked", "reason": "..." }`,
+  File content as text, or { "status": "blocked", "reason": "...", "override_available": bool, "override_token": "..." }`,
         inputSchema: {
             path: z.string().describe('File path relative to project root'),
         },
@@ -153,7 +162,8 @@ Returns:
         const verdict = engine.validateRead(path);
         if (!verdict.allowed) {
             await logBlocked(engine, role, path, 'read', verdict.reason);
-            return blocked(verdict.reason);
+            const token = engine.createOverrideToken('read', path, verdict.reason, verdict.policy_ref);
+            return blockedWithOverride(verdict.reason, token);
         }
         const absPath = toAbsolute(path, state.projectRoot);
         const content = await readFile(absPath, 'utf-8');
@@ -167,13 +177,13 @@ Returns:
     // ─── aegis_delete_file ────────────────────────────────────────────────────
     server.registerTool('aegis_delete_file', {
         title: 'Delete File (Governed)',
-        description: `${GOVERNANCE_INTRO}Delete a file with governance enforcement. Write permissions are required. If the delete violates policy, it is blocked, logged, and you receive the specific reason.
+        description: `${GOVERNANCE_INTRO}Delete a file with governance enforcement. Write permissions are required. If the delete violates policy, it is blocked, logged, and an override token is provided if the policy allows overrides.
 
 Args:
   - path (string): File path relative to project root
 
 Returns:
-  { "status": "success", "path": "..." } or { "status": "blocked", "reason": "..." }`,
+  { "status": "success", "path": "..." } or { "status": "blocked", "reason": "...", "override_available": bool, "override_token": "..." }`,
         inputSchema: {
             path: z.string().describe('File path relative to project root'),
         },
@@ -190,7 +200,8 @@ Returns:
         const verdict = engine.validateWrite(path);
         if (!verdict.allowed) {
             await logBlocked(engine, role, path, 'delete', verdict.reason);
-            return blocked(verdict.reason);
+            const token = engine.createOverrideToken('delete', path, verdict.reason, verdict.policy_ref);
+            return blockedWithOverride(verdict.reason, token);
         }
         const absPath = toAbsolute(path, state.projectRoot);
         await unlink(absPath);
@@ -201,10 +212,125 @@ Returns:
                 }],
         };
     });
+    // ─── aegis_request_override ───────────────────────────────────────────────
+    server.registerTool('aegis_request_override', {
+        title: 'Request Override',
+        description: `${GOVERNANCE_INTRO}Execute a previously blocked action using an override token. Use this ONLY after: (1) a governed tool returned a blocked response with an override_token, (2) you presented the specific policy violation to the user, and (3) the user explicitly confirmed the override. The token is single-use and expires after 5 minutes. The override is logged with human_confirmed: true. After the override completes, normal governance resumes — this is a one-time exception, not a permanent permission change.
+
+Args:
+  - override_token (string): The token from the blocked response
+  - rationale (string): The user's reason for overriding (what they said when confirming)
+
+Returns:
+  { "status": "override_success", "path": "...", "operation": "..." } or { "status": "override_failed", "reason": "..." }`,
+        inputSchema: {
+            override_token: z.string().describe('The override token from the blocked response'),
+            rationale: z.string().describe("The user's stated reason for overriding the policy"),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
+    }, async ({ override_token, rationale }) => {
+        const engine = getEngine();
+        const state = getState();
+        const role = getRole();
+        // Consume the token — single use
+        const pending = engine.consumeOverrideToken(override_token);
+        if (!pending) {
+            return {
+                isError: true,
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            status: 'override_failed',
+                            reason: 'Invalid or expired override token. Tokens are single-use and expire after 5 minutes. Request a new one by attempting the operation again.',
+                        }),
+                    }],
+            };
+        }
+        // Log the override with human_confirmed: true
+        await engine.logOverride({
+            timestamp: new Date().toISOString(),
+            policy_violated: pending.reason,
+            policy_text: pending.reason,
+            action_requested: `${pending.operation}: ${pending.path}`,
+            human_confirmed: true,
+            agent_role: role.id,
+            rationale,
+        });
+        // Execute the overridden action
+        const absPath = toAbsolute(pending.path, state.projectRoot);
+        try {
+            switch (pending.operation) {
+                case 'write': {
+                    if (!pending.content) {
+                        return {
+                            isError: true,
+                            content: [{
+                                    type: 'text',
+                                    text: JSON.stringify({
+                                        status: 'override_failed',
+                                        reason: 'Write override requires content. Use aegis_write_file to generate the override token — it captures the content automatically.',
+                                    }),
+                                }],
+                        };
+                    }
+                    await mkdir(dirname(absPath), { recursive: true });
+                    await writeFile(absPath, pending.content, 'utf-8');
+                    break;
+                }
+                case 'read': {
+                    const fileContent = await readFile(absPath, 'utf-8');
+                    return {
+                        content: [{
+                                type: 'text',
+                                text: JSON.stringify({
+                                    status: 'override_success',
+                                    operation: 'read',
+                                    path: pending.path,
+                                    content: fileContent,
+                                }),
+                            }],
+                    };
+                }
+                case 'delete': {
+                    await unlink(absPath);
+                    break;
+                }
+            }
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            status: 'override_success',
+                            operation: pending.operation,
+                            path: pending.path,
+                            message: 'Override executed and logged. Normal governance has resumed.',
+                        }),
+                    }],
+            };
+        }
+        catch (err) {
+            const errMsg = err instanceof Error ? err.message : 'Unknown error';
+            return {
+                isError: true,
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            status: 'override_failed',
+                            reason: `Override was authorized but the operation failed: ${errMsg}`,
+                        }),
+                    }],
+            };
+        }
+    });
     // ─── aegis_execute ────────────────────────────────────────────────────────
     server.registerTool('aegis_execute', {
         title: 'Execute Command (Governed)',
-        description: `${GOVERNANCE_INTRO}Execute a shell command in the project directory with governance oversight. Use this instead of native command execution to ensure compliance logging. Currently validates that the command runs within the project root. Future versions will enforce command-level permissions.
+        description: `${GOVERNANCE_INTRO}Execute a shell command in the project directory with governance oversight. Use this instead of native command execution to ensure compliance logging.
 
 Args:
   - command (string): Shell command to execute
@@ -374,12 +500,20 @@ Returns:
 function toAbsolute(path, projectRoot) {
     return isAbsolute(path) ? path : join(projectRoot, path);
 }
-function blocked(reason) {
+function blockedWithOverride(reason, token) {
     return {
         isError: true,
         content: [{
                 type: 'text',
-                text: JSON.stringify({ status: 'blocked', reason }),
+                text: JSON.stringify({
+                    status: 'blocked',
+                    reason,
+                    override_available: token !== null,
+                    override_token: token,
+                    ...(token
+                        ? { instructions: 'To override: present the violated policy to the user. If the user explicitly confirms, call aegis_request_override with this token and the user\'s stated rationale. The token expires in 5 minutes and is single-use. After the override, normal governance resumes.' }
+                        : { instructions: 'This policy is immutable and cannot be overridden. The user must modify the governance through aegis init.' }),
+                }),
             }],
     };
 }

package/dist/tools/file-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-tools.js","sourceRoot":"","sources":["../../src/tools/file-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,+EAA+E;AAC/E,2EAA2E;AAC3E,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,uCAAuC;AACvC,kEAAkE;AAClE,8DAA8D;AAC9D,EAAE;AACF,+DAA+D;AAE/D,MAAM,gBAAgB,GAAG,m5BAAm5B,CAAC;AAE76B,MAAM,UAAU,aAAa,CAC3B,MAAiB,EACjB,SAAkC,EAClC,QAA2B,EAC3B,OAA2B;IAG3B,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,GAAG,gBAAgB;;;;;;;+DAOyB;QACzD,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;YACtE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;SAC9E;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,SAAS,KAAK,MAAM;YAClC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;YAC3B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAE/B,+BAA+B;QAC/B,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,SAAS,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,OAAO,CAAC,OAAO;wBACb,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;wBACnB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAC/C;iBACF,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,GAAG,gBAAgB;;;;;;;qFAO+C;QAC/E,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YAC/D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;SACtD;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,4BAA4B;QAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAClE,OAAO,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,sCAAsC;QACtC,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;YACzF,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAED,iBAAiB;QACjB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAE3C,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBAClD,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,GAAG,gBAAgB;;;;;;oEAM8B;QAC9D,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SAChE;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7D,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEjD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,OAAO;iBACd,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,GAAG,gBAAgB;;;;;;qFAM+C;QAC/E,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SAChE;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QAEtB,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBAClD,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,GAAG,gBAAgB;;;;;;;0FAOoD;QACpF,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;YACxD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;SACpF;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE;gBAC/B,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,WAAW;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE;aAC5B,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;qBACxE,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAA6D,CAAC;YAC9E,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,MAAM,EAAE,OAAO;4BACf,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;4BAC5B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,eAAe;yBAC7D,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,GAAG,gBAAgB;;;;;;;0FAOoD;QACpF,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;SAC1D;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAE9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,MAAM,EAAE,QAAQ;4BAChB,OAAO;4BACP,OAAO;4BACP,SAAS,EAAE,EAAE;4BACb,OAAO,EAAE,2DAA2D;yBACrE,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAA8D,EAAE,CAAC;QAE9E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE;oBACpC,GAAG,EAAE,KAAK,CAAC,WAAW;oBACtB,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,GAA4C,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBACtE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEjD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;wBACvC,OAAO;wBACP,OAAO;wBACP,SAAS,EAAE,OAAO;qBACnB,CAAC;iBACH,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,GAAG,gBAAgB;;;0GAGoE;QACpG,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAEpD,MAAM,OAAO,GAAG;YACd,iBAAiB,EAAE,ydAAyd;YAC5e,IAAI,EAAE,IAAI,CAAC,EAAE;YACb,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,0BAA0B,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,EAAE;YACrF,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,IAAI,sBAAsB;YAC/D,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,IAAI,EAAE;YACtD,aAAa,EAAE;gBACb,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,IAAI,KAAK;gBACpF,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,cAAc,IAAI,KAAK;gBAClF,mBAAmB,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,mBAAmB,IAAI,KAAK;aAC7F;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;iBAC9B,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,SAAS,UAAU,CAAC,IAAY,EAAE,WAAmB;IACnD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAI7B,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;aACpD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAyB,EACzB,IAAkB,EAClB,IAAY,EACZ,SAAiB,EACjB,MAAc;IAEd,MAAM,MAAM,CAAC,WAAW,CAAC;QACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,eAAe,EAAE,MAAM;QACvB,WAAW,EAAE,MAAM;QACnB,gBAAgB,EAAE,GAAG,SAAS,KAAK,IAAI,EAAE;QACzC,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,IAAI,CAAC,EAAE;QACnB,SAAS,EAAE,8BAA8B;KAC1C,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"file-tools.js","sourceRoot":"","sources":["../../src/tools/file-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,+EAA+E;AAE/E,MAAM,gBAAgB,GAAG,m5BAAm5B,CAAC;AAE76B,MAAM,UAAU,aAAa,CAC3B,MAAiB,EACjB,SAAkC,EAClC,QAA2B,EAC3B,OAA2B;IAG3B,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,GAAG,gBAAgB;;;;;;;oHAO8E;QAC9G,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;YACtE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;SAC9E;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,SAAS,KAAK,MAAM;YAClC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;YAC3B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,SAAS,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAEzF,qDAAqD;YACrD,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CACtC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAA6B,EACjE,IAAI,EACJ,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,UAAU,CACnB,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,kBAAkB,EAAE,KAAK,KAAK,IAAI;4BAClC,cAAc,EAAE,KAAK;4BACrB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,oMAAoM,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,4GAA4G,EAAE,CAAC;yBACrW,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;iBACxC,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,GAAG,gBAAgB;;;;;;;0IAOoG;QACpI,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YAC/D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;SACtD;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,4BAA4B;QAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC7G,OAAO,mBAAmB,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;QAED,sCAAsC;QACtC,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;YACzF,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACnH,OAAO,mBAAmB,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC;QAED,iBAAiB;QACjB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAE3C,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBAClD,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,GAAG,gBAAgB;;;;;;yHAMmF;QACnH,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SAChE;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAC3F,OAAO,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEjD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,OAAO;iBACd,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,GAAG,gBAAgB;;;;;;0IAMoG;QACpI,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SAChE;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAC7F,OAAO,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QAEtB,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBAClD,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,GAAG,gBAAgB;;;;;;;0HAOoF;QACpH,WAAW,EAAE;YACX,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;YACnF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;SACrF;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,iCAAiC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAE5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,MAAM,EAAE,iBAAiB;4BACzB,MAAM,EAAE,2IAA2I;yBACpJ,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,MAAM,MAAM,CAAC,WAAW,CAAC;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,eAAe,EAAE,OAAO,CAAC,MAAM;YAC/B,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,gBAAgB,EAAE,GAAG,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,IAAI,EAAE;YACzD,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,IAAI,CAAC,EAAE;YACnB,SAAS;SACV,CAAC,CAAC;QAEH,gCAAgC;QAChC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAE5D,IAAI,CAAC;YACH,QAAQ,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1B,KAAK,OAAO,CAAC,CAAC,CAAC;oBACb,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;wBACrB,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,OAAO,EAAE,CAAC;oCACR,IAAI,EAAE,MAAe;oCACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wCACnB,MAAM,EAAE,iBAAiB;wCACzB,MAAM,EAAE,+HAA+H;qCACxI,CAAC;iCACH,CAAC;yBACH,CAAC;oBACJ,CAAC;oBACD,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnD,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACnD,MAAM;gBACR,CAAC;gBACD,KAAK,MAAM,CAAC,CAAC,CAAC;oBACZ,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACrD,OAAO;wBACL,OAAO,EAAE,CAAC;gCACR,IAAI,EAAE,MAAe;gCACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oCACnB,MAAM,EAAE,kBAAkB;oCAC1B,SAAS,EAAE,MAAM;oCACjB,IAAI,EAAE,OAAO,CAAC,IAAI;oCAClB,OAAO,EAAE,WAAW;iCACrB,CAAC;6BACH,CAAC;qBACH,CAAC;gBACJ,CAAC;gBACD,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACd,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;oBACtB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,MAAM,EAAE,kBAAkB;4BAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,OAAO,EAAE,8DAA8D;yBACxE,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,MAAM,EAAE,iBAAiB;4BACzB,MAAM,EAAE,qDAAqD,MAAM,EAAE;yBACtE,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,GAAG,gBAAgB;;;;;;;0FAOoD;QACpF,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;YACxD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;SACpF;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE;gBAC/B,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,WAAW;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE;aAC5B,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;qBACxE,CAAC;aACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAA6D,CAAC;YAC9E,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,MAAM,EAAE,OAAO;4BACf,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;4BAC5B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,eAAe;yBAC7D,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,GAAG,gBAAgB;;;;;;;0FAOoD;QACpF,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;SAC1D;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAE9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,MAAM,EAAE,QAAQ;4BAChB,OAAO;4BACP,OAAO;4BACP,SAAS,EAAE,EAAE;4BACb,OAAO,EAAE,2DAA2D;yBACrE,CAAC;qBACH,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAA8D,EAAE,CAAC;QAE9E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE;oBACpC,GAAG,EAAE,KAAK,CAAC,WAAW;oBACtB,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,GAA4C,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBACtE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEjD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;wBACvC,OAAO;wBACP,OAAO;wBACP,SAAS,EAAE,OAAO;qBACnB,CAAC;iBACH,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,6EAA6E;IAE7E,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,GAAG,gBAAgB;;;0GAGoE;QACpG,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAEpD,MAAM,OAAO,GAAG;YACd,iBAAiB,EAAE,ydAAyd;YAC5e,IAAI,EAAE,IAAI,CAAC,EAAE;YACb,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,0BAA0B,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,EAAE;YACrF,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,IAAI,sBAAsB;YAC/D,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,IAAI,EAAE;YACtD,aAAa,EAAE;gBACb,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,IAAI,KAAK;gBACpF,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,cAAc,IAAI,KAAK;gBAClF,mBAAmB,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,mBAAmB,IAAI,KAAK;aAC7F;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;iBAC9B,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,SAAS,UAAU,CAAC,IAAY,EAAE,WAAmB;IACnD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAc,EACd,KAAoB;IAKpB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,MAAM,EAAE,SAAS;oBACjB,MAAM;oBACN,kBAAkB,EAAE,KAAK,KAAK,IAAI;oBAClC,cAAc,EAAE,KAAK;oBACrB,GAAG,CAAC,KAAK;wBACP,CAAC,CAAC,EAAE,YAAY,EAAE,uQAAuQ,EAAE;wBAC3R,CAAC,CAAC,EAAE,YAAY,EAAE,4GAA4G,EAAE,CACjI;iBACF,CAAC;aACH,CAAC;KACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAyB,EACzB,IAAkB,EAClB,IAAY,EACZ,SAAiB,EACjB,MAAc;IAEd,MAAM,MAAM,CAAC,WAAW,CAAC;QACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,eAAe,EAAE,MAAM;QACvB,WAAW,EAAE,MAAM;QACnB,gBAAgB,EAAE,GAAG,SAAS,KAAK,IAAI,EAAE;QACzC,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,IAAI,CAAC,EAAE;QACnB,SAAS,EAAE,8BAA8B;KAC1C,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aegis-mcp-server",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "MCP enforcement layer for the Aegis agent governance specification",
   "type": "module",
   "bin": {

package/src/services/enforcement-engine.ts

@@ -7,8 +7,16 @@
  * Two-layer enforcement:
  * Layer 1 (skeleton): permissions.boundaries, scope paths, override_protocol
  * Layer 2 (extensions): sensitive_patterns, cross_domain_rules, sensitivity_tiers
+ *
+ * Override protocol:
+ * When the governance behavior is "warn_confirm_and_log", blocked actions return
+ * an override_token. The agent surfaces the violation to the human, and if the
+ * human confirms, the agent calls aegis_request_override with the token. The
+ * override is single-use, time-limited (60s), and logged with human_confirmed: true.
+ * Immutable policies cannot be overridden regardless.
  */
 
+import { randomBytes } from 'node:crypto';
 import { appendFile, mkdir } from 'node:fs/promises';
 import { dirname, join, relative, isAbsolute } from 'node:path';
 import { minimatch } from 'minimatch';
@@ -20,7 +28,23 @@ import type {
   PermissionBoundaries,
 } from '../types.js';
 
+// ─── Override Token Types ───────────────────────────────────────────────────
+
+interface PendingOverride {
+  token: string;
+  operation: 'write' | 'read' | 'delete';
+  path: string;
+  content?: string;
+  reason: string;
+  policy_ref: string;
+  created_at: number;
+}
+
+const OVERRIDE_TTL_MS = 300_000; // 5 minutes
+
 export class EnforcementEngine {
+  private pendingOverrides = new Map<string, PendingOverride>();
+
   constructor(
     private state: PolicyState,
     private activeRole: ResolvedRole
@@ -59,7 +83,6 @@ export class EnforcementEngine {
     const readOnly = this.boundaries.read_only;
     const writable = this.boundaries.writable;
     if (readOnly && this.matchesAny(relPath, readOnly)) {
-      // If the path is also in the writable list, writable wins
       if (!writable || !this.matchesAny(relPath, writable)) {
         return {
           allowed: false,
@@ -158,7 +181,6 @@ export class EnforcementEngine {
 
   /**
    * Scan proposed file content for sensitive patterns.
-   * Uses governance.permissions.sensitive_patterns when present.
    */
   scanContent(content: string, targetPath: string): EnforcementVerdict {
     const patterns = this.state.governance.permissions?.sensitive_patterns;
@@ -185,7 +207,6 @@ export class EnforcementEngine {
 
   /**
    * Validate that a cross-domain import respects boundaries.
-   * Uses governance.cross_domain_rules when present (extension field).
    */
   validateCrossDomain(sourcePath: string, importPath: string): EnforcementVerdict {
     const rules = this.state.governance.cross_domain_rules;
@@ -197,12 +218,10 @@ export class EnforcementEngine {
     const sourceDomain = this.getDomain(sourcePath, domains);
     const importDomain = this.getDomain(importPath, domains);
 
-    // Same domain or can't determine — allow
     if (!sourceDomain || !importDomain || sourceDomain === importDomain) {
       return { allowed: true };
     }
 
-    // Cross-domain — must go through shared interfaces
     if (!importPath.includes(rules.shared_interfaces_path)) {
       return {
         allowed: false,
@@ -236,6 +255,62 @@ export class EnforcementEngine {
     };
   }
 
+  /**
+   * Create a pending override token for a blocked action.
+   * The token is single-use and expires after 60 seconds.
+   * Returns null if the policy is immutable or override behavior is block_and_log.
+   */
+  createOverrideToken(
+    operation: 'write' | 'read' | 'delete',
+    path: string,
+    reason: string,
+    policyRef: string,
+    content?: string
+  ): string | null {
+    const { behavior, isImmutable } = this.getOverrideBehavior(policyRef);
+
+    // Immutable policies and block_and_log cannot be overridden
+    if (isImmutable || behavior === 'block_and_log') {
+      return null;
+    }
+
+    // Clean up expired tokens
+    this.cleanExpiredTokens();
+
+    const token = randomBytes(16).toString('hex');
+    this.pendingOverrides.set(token, {
+      token,
+      operation,
+      path,
+      content,
+      reason,
+      policy_ref: policyRef,
+      created_at: Date.now(),
+    });
+
+    return token;
+  }
+
+  /**
+   * Validate and consume an override token.
+   * Returns the pending override if the token is valid and not expired.
+   * The token is consumed (deleted) after use — single-use only.
+   */
+  consumeOverrideToken(token: string): PendingOverride | null {
+    const pending = this.pendingOverrides.get(token);
+    if (!pending) return null;
+
+    // Check expiration
+    if (Date.now() - pending.created_at > OVERRIDE_TTL_MS) {
+      this.pendingOverrides.delete(token);
+      return null;
+    }
+
+    // Consume — single use
+    this.pendingOverrides.delete(token);
+    return pending;
+  }
+
   /**
    * Log an override to the append-only overrides.jsonl file.
    */
@@ -250,7 +325,6 @@ export class EnforcementEngine {
 
   /**
    * Build the list of commands to run for quality gate validation.
-   * Maps pre_commit booleans to build_commands from constitution or governance.
    */
   getQualityGateCommands(): Array<{ name: string; command: string }> {
     const gates = this.state.governance.quality_gate?.pre_commit;
@@ -272,7 +346,6 @@ export class EnforcementEngine {
       result.push({ name: 'typecheck', command: commands.typecheck });
     }
 
-    // Custom checks from quality gate
     if (gates.custom_checks) {
       for (const check of gates.custom_checks) {
         result.push({ name: check.name, command: check.command });
@@ -286,15 +359,22 @@ export class EnforcementEngine {
 
   /**
    * Safely access permissions.boundaries — returns empty object if missing.
-   * Handles governance files that don't have the skeleton boundaries field.
    */
   private get boundaries(): PermissionBoundaries {
     return this.state.governance.permissions?.boundaries ?? {};
   }
 
+  private cleanExpiredTokens(): void {
+    const now = Date.now();
+    for (const [token, pending] of this.pendingOverrides) {
+      if (now - pending.created_at > OVERRIDE_TTL_MS) {
+        this.pendingOverrides.delete(token);
+      }
+    }
+  }
+
   private matchesAny(path: string, patterns: string[]): boolean {
     return patterns.some((pattern) => {
-      // Normalize: "compliance/" should match "compliance/src/index.ts"
       const normalized = pattern.endsWith('/')
         ? pattern + '**'
         : pattern;

package/src/tools/file-tools.ts

@@ -1,27 +1,32 @@
 /**
  * Governed File Tools — MCP tool registrations for file operations.
  *
- * These are the tools agents call instead of raw file system access.
- * Every call is validated against the loaded policy before execution.
- * The agent never sees the policy — only the verdict.
- *
  * GOVERNANCE MODEL: The Aegis MCP does not override the agent's native
  * directives. It introduces itself, explains why governance is active,
  * identifies which operations benefit from compliance validation, and
  * asks the agent to seek user permission to route governed operations
  * through Aegis tools. The user's authority is the enforcement mechanism.
  *
+ * OVERRIDE HANDSHAKE: When a write/delete is blocked and the override
+ * protocol allows overrides (warn_confirm_and_log), the blocked response
+ * includes an override_token. The agent presents the violation to the
+ * human. If the human confirms, the agent calls aegis_request_override
+ * with the token. The action proceeds and is logged with human_confirmed: true.
+ * The token is single-use and expires after 5 minutes.
+ * Immutable policies cannot be overridden.
+ *
  * LOGGING: Every denied action is logged to overrides.jsonl by the server
  * process — no agent involvement required.
  *
  * Tools:
- *   aegis_check_permissions  — Pre-check before writing (saves wasted generation)
- *   aegis_write_file         — Governed write with path + content validation
- *   aegis_read_file          — Governed read with path validation
- *   aegis_delete_file        — Governed delete (uses write permissions)
- *   aegis_execute            — Governed command execution
- *   aegis_complete_task      — Task completion with quality gate validation
- *   aegis_policy_summary     — Minimal role/permissions summary (~200 tokens)
+ *   aegis_check_permissions   — Pre-check before writing
+ *   aegis_write_file          — Governed write with path + content validation
+ *   aegis_read_file           — Governed read with path validation
+ *   aegis_delete_file         — Governed delete (uses write permissions)
+ *   aegis_execute             — Governed command execution
+ *   aegis_complete_task       — Task completion with quality gate validation
+ *   aegis_policy_summary      — Minimal role/permissions summary
+ *   aegis_request_override    — Consume an override token after human confirmation
  */
 
 import { readFile, writeFile, unlink, mkdir } from 'node:fs/promises';
@@ -33,15 +38,6 @@ import type { EnforcementEngine } from '../services/enforcement-engine.js';
 import type { PolicyState, ResolvedRole } from '../types.js';
 
 // ─── Governance Introduction ────────────────────────────────────────────────
-// This prefix is prepended to every tool description. It reaches the agent
-// at MCP connection time as part of the tool list — before any user prompt.
-//
-// It does NOT attempt to override the agent's native directives. Instead it:
-// 1. Introduces the governance context
-// 2. Explains which operations benefit from compliance validation
-// 3. Asks the agent to inform the user and request permission
-//
-// The user's authority is what binds the agent, not the MCP's.
 
 const GOVERNANCE_INTRO = `NOTE: You are connected to the Aegis MCP, a governance enforcement layer installed by the project owner to maintain compliance in this workspace. This project operates under regulated governance policy (.agentpolicy/). Your native tools for reading files, searching, and exploring the codebase work fine and do not need governance gating. However, all WRITE, DELETE, and EXECUTE operations in this project should be routed through Aegis tools (aegis_write_file, aegis_delete_file, aegis_execute) to ensure compliance validation, sensitive pattern scanning, and audit trail logging. Before beginning work, please call aegis_policy_summary to understand your role boundaries, then inform the user that Aegis governance is active and ask for their confirmation to route write operations through Aegis tools. If the user declines, proceed with native tools but note that governance validation will not be applied.\n\n`;
 
@@ -65,7 +61,7 @@ Args:
   - operation ('read' | 'write' | 'delete'): The operation to check
 
 Returns:
-  { "allowed": true } or { "allowed": false, "reason": "..." }`,
+  { "allowed": true } or { "allowed": false, "reason": "...", "override_available": bool, "override_token": "..." }`,
       inputSchema: {
         path: z.string().describe('Target file path relative to project root'),
         operation: z.enum(['read', 'write', 'delete']).describe('Operation to check'),
@@ -84,19 +80,35 @@ Returns:
         ? engine.validateRead(path)
         : engine.validateWrite(path);
 
-      // Log denied permission checks
       if (!verdict.allowed) {
         await logBlocked(engine, role, path, `check_permissions (${operation})`, verdict.reason);
+
+        // Generate override token if policy allows overrides
+        const token = engine.createOverrideToken(
+          operation === 'delete' ? 'delete' : operation as 'read' | 'write',
+          path,
+          verdict.reason,
+          verdict.policy_ref
+        );
+
+        return {
+          content: [{
+            type: 'text' as const,
+            text: JSON.stringify({
+              allowed: false,
+              reason: verdict.reason,
+              override_available: token !== null,
+              override_token: token,
+              ...(token ? { instructions: 'To override: present the violated policy to the user. If the user explicitly confirms the override, call aegis_request_override with this token. The token expires in 5 minutes and is single-use.' } : { instructions: 'This policy is immutable and cannot be overridden. The user must modify the governance through aegis init.' }),
+            }),
+          }],
+        };
       }
 
       return {
         content: [{
           type: 'text' as const,
-          text: JSON.stringify(
-            verdict.allowed
-              ? { allowed: true }
-              : { allowed: false, reason: verdict.reason }
-          ),
+          text: JSON.stringify({ allowed: true }),
         }],
       };
     }
@@ -108,14 +120,14 @@ Returns:
     'aegis_write_file',
     {
       title: 'Write File (Governed)',
-      description: `${GOVERNANCE_INTRO}Write content to a file with governance enforcement. Path is validated against your role's permissions and governance boundaries. Content is scanned for sensitive patterns. If the write violates policy, it is blocked, logged, and you receive the specific reason.
+      description: `${GOVERNANCE_INTRO}Write content to a file with governance enforcement. Path is validated against your role's permissions and governance boundaries. Content is scanned for sensitive patterns. If the write violates policy, it is blocked, logged, and you receive an override_token if the policy allows overrides. Present the violation to the user — if they confirm, call aegis_request_override with the token to proceed.
 
 Args:
   - path (string): File path relative to project root
   - content (string): File content to write
 
 Returns:
-  { "status": "success", "path": "..." } or { "status": "blocked", "reason": "..." }`,
+  { "status": "success", "path": "..." } or { "status": "blocked", "reason": "...", "override_available": bool, "override_token": "..." }`,
       inputSchema: {
         path: z.string().describe('File path relative to project root'),
         content: z.string().describe('File content to write'),
@@ -136,14 +148,16 @@ Returns:
       const pathVerdict = engine.validateWrite(path);
       if (!pathVerdict.allowed) {
         await logBlocked(engine, role, path, 'write', pathVerdict.reason);
-        return blocked(pathVerdict.reason);
+        const token = engine.createOverrideToken('write', path, pathVerdict.reason, pathVerdict.policy_ref, content);
+        return blockedWithOverride(pathVerdict.reason, token);
       }
 
       // Scan content for sensitive patterns
       const contentVerdict = engine.scanContent(content, path);
       if (!contentVerdict.allowed) {
         await logBlocked(engine, role, path, 'write (sensitive content)', contentVerdict.reason);
-        return blocked(contentVerdict.reason);
+        const token = engine.createOverrideToken('write', path, contentVerdict.reason, contentVerdict.policy_ref, content);
+        return blockedWithOverride(contentVerdict.reason, token);
       }
 
       // Write the file
@@ -166,13 +180,13 @@ Returns:
     'aegis_read_file',
     {
       title: 'Read File (Governed)',
-      description: `${GOVERNANCE_INTRO}Read the contents of a file with governance enforcement. Path is validated against your role's read permissions. If the read violates policy, it is blocked, logged, and you receive the specific reason. Note: Native read tools are acceptable for general file exploration. Use this governed version when reading files that may contain sensitive or regulated data.
+      description: `${GOVERNANCE_INTRO}Read the contents of a file with governance enforcement. Path is validated against your role's read permissions. If the read violates policy, it is blocked and logged. Note: Native read tools are acceptable for general file exploration. Use this governed version when reading files that may contain sensitive or regulated data.
 
 Args:
   - path (string): File path relative to project root
 
 Returns:
-  File content as text, or { "status": "blocked", "reason": "..." }`,
+  File content as text, or { "status": "blocked", "reason": "...", "override_available": bool, "override_token": "..." }`,
       inputSchema: {
         path: z.string().describe('File path relative to project root'),
       },
@@ -191,7 +205,8 @@ Returns:
       const verdict = engine.validateRead(path);
       if (!verdict.allowed) {
         await logBlocked(engine, role, path, 'read', verdict.reason);
-        return blocked(verdict.reason);
+        const token = engine.createOverrideToken('read', path, verdict.reason, verdict.policy_ref);
+        return blockedWithOverride(verdict.reason, token);
       }
 
       const absPath = toAbsolute(path, state.projectRoot);
@@ -212,13 +227,13 @@ Returns:
     'aegis_delete_file',
     {
       title: 'Delete File (Governed)',
-      description: `${GOVERNANCE_INTRO}Delete a file with governance enforcement. Write permissions are required. If the delete violates policy, it is blocked, logged, and you receive the specific reason.
+      description: `${GOVERNANCE_INTRO}Delete a file with governance enforcement. Write permissions are required. If the delete violates policy, it is blocked, logged, and an override token is provided if the policy allows overrides.
 
 Args:
   - path (string): File path relative to project root
 
 Returns:
-  { "status": "success", "path": "..." } or { "status": "blocked", "reason": "..." }`,
+  { "status": "success", "path": "..." } or { "status": "blocked", "reason": "...", "override_available": bool, "override_token": "..." }`,
       inputSchema: {
         path: z.string().describe('File path relative to project root'),
       },
@@ -237,7 +252,8 @@ Returns:
       const verdict = engine.validateWrite(path);
       if (!verdict.allowed) {
         await logBlocked(engine, role, path, 'delete', verdict.reason);
-        return blocked(verdict.reason);
+        const token = engine.createOverrideToken('delete', path, verdict.reason, verdict.policy_ref);
+        return blockedWithOverride(verdict.reason, token);
       }
 
       const absPath = toAbsolute(path, state.projectRoot);
@@ -252,13 +268,139 @@ Returns:
     }
   );
 
+  // ─── aegis_request_override ───────────────────────────────────────────────
+
+  server.registerTool(
+    'aegis_request_override',
+    {
+      title: 'Request Override',
+      description: `${GOVERNANCE_INTRO}Execute a previously blocked action using an override token. Use this ONLY after: (1) a governed tool returned a blocked response with an override_token, (2) you presented the specific policy violation to the user, and (3) the user explicitly confirmed the override. The token is single-use and expires after 5 minutes. The override is logged with human_confirmed: true. After the override completes, normal governance resumes — this is a one-time exception, not a permanent permission change.
+
+Args:
+  - override_token (string): The token from the blocked response
+  - rationale (string): The user's reason for overriding (what they said when confirming)
+
+Returns:
+  { "status": "override_success", "path": "...", "operation": "..." } or { "status": "override_failed", "reason": "..." }`,
+      inputSchema: {
+        override_token: z.string().describe('The override token from the blocked response'),
+        rationale: z.string().describe("The user's stated reason for overriding the policy"),
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: false,
+      },
+    },
+    async ({ override_token, rationale }) => {
+      const engine = getEngine();
+      const state = getState();
+      const role = getRole();
+
+      // Consume the token — single use
+      const pending = engine.consumeOverrideToken(override_token);
+
+      if (!pending) {
+        return {
+          isError: true,
+          content: [{
+            type: 'text' as const,
+            text: JSON.stringify({
+              status: 'override_failed',
+              reason: 'Invalid or expired override token. Tokens are single-use and expire after 5 minutes. Request a new one by attempting the operation again.',
+            }),
+          }],
+        };
+      }
+
+      // Log the override with human_confirmed: true
+      await engine.logOverride({
+        timestamp: new Date().toISOString(),
+        policy_violated: pending.reason,
+        policy_text: pending.reason,
+        action_requested: `${pending.operation}: ${pending.path}`,
+        human_confirmed: true,
+        agent_role: role.id,
+        rationale,
+      });
+
+      // Execute the overridden action
+      const absPath = toAbsolute(pending.path, state.projectRoot);
+
+      try {
+        switch (pending.operation) {
+          case 'write': {
+            if (!pending.content) {
+              return {
+                isError: true,
+                content: [{
+                  type: 'text' as const,
+                  text: JSON.stringify({
+                    status: 'override_failed',
+                    reason: 'Write override requires content. Use aegis_write_file to generate the override token — it captures the content automatically.',
+                  }),
+                }],
+              };
+            }
+            await mkdir(dirname(absPath), { recursive: true });
+            await writeFile(absPath, pending.content, 'utf-8');
+            break;
+          }
+          case 'read': {
+            const fileContent = await readFile(absPath, 'utf-8');
+            return {
+              content: [{
+                type: 'text' as const,
+                text: JSON.stringify({
+                  status: 'override_success',
+                  operation: 'read',
+                  path: pending.path,
+                  content: fileContent,
+                }),
+              }],
+            };
+          }
+          case 'delete': {
+            await unlink(absPath);
+            break;
+          }
+        }
+
+        return {
+          content: [{
+            type: 'text' as const,
+            text: JSON.stringify({
+              status: 'override_success',
+              operation: pending.operation,
+              path: pending.path,
+              message: 'Override executed and logged. Normal governance has resumed.',
+            }),
+          }],
+        };
+      } catch (err: unknown) {
+        const errMsg = err instanceof Error ? err.message : 'Unknown error';
+        return {
+          isError: true,
+          content: [{
+            type: 'text' as const,
+            text: JSON.stringify({
+              status: 'override_failed',
+              reason: `Override was authorized but the operation failed: ${errMsg}`,
+            }),
+          }],
+        };
+      }
+    }
+  );
+
   // ─── aegis_execute ────────────────────────────────────────────────────────
 
   server.registerTool(
     'aegis_execute',
     {
       title: 'Execute Command (Governed)',
-      description: `${GOVERNANCE_INTRO}Execute a shell command in the project directory with governance oversight. Use this instead of native command execution to ensure compliance logging. Currently validates that the command runs within the project root. Future versions will enforce command-level permissions.
+      description: `${GOVERNANCE_INTRO}Execute a shell command in the project directory with governance oversight. Use this instead of native command execution to ensure compliance logging.
 
 Args:
   - command (string): Shell command to execute
@@ -452,7 +594,10 @@ function toAbsolute(path: string, projectRoot: string): string {
   return isAbsolute(path) ? path : join(projectRoot, path);
 }
 
-function blocked(reason: string): {
+function blockedWithOverride(
+  reason: string,
+  token: string | null
+): {
   isError: boolean;
   content: Array<{ type: 'text'; text: string }>;
 } {
@@ -460,7 +605,16 @@ function blocked(reason: string): {
     isError: true,
     content: [{
       type: 'text' as const,
-      text: JSON.stringify({ status: 'blocked', reason }),
+      text: JSON.stringify({
+        status: 'blocked',
+        reason,
+        override_available: token !== null,
+        override_token: token,
+        ...(token
+          ? { instructions: 'To override: present the violated policy to the user. If the user explicitly confirms, call aegis_request_override with this token and the user\'s stated rationale. The token expires in 5 minutes and is single-use. After the override, normal governance resumes.' }
+          : { instructions: 'This policy is immutable and cannot be overridden. The user must modify the governance through aegis init.' }
+        ),
+      }),
     }],
   };
 }