agen-vektor 0.1.0

package/dist/providers/ollama.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OllamaProvider = void 0;
+/**
+ * Ollama provider — local models via http://localhost:11434/api/chat
+ * (or OLLAMA_HOST). No API key required.
+ */
+const provider_1 = require("./provider");
+const models_1 = require("../config/models");
+function baseUrl() {
+    return (process.env.OLLAMA_HOST || 'http://localhost:11434').replace(/\/+$/, '');
+}
+function toOllamaMessages(messages) {
+    return messages
+        .filter((m) => m.role !== 'tool')
+        .map((m) => {
+        if (m.toolCalls && m.toolCalls.length > 0) {
+            return {
+                role: 'assistant',
+                content: m.content || '',
+                tool_calls: m.toolCalls.map((tc) => ({
+                    function: { name: tc.name, arguments: safeParse(tc.arguments) },
+                })),
+            };
+        }
+        return { role: m.role, content: m.content };
+    });
+}
+function safeParse(s) {
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        return { _raw: s };
+    }
+}
+function toToolDefs(tools) {
+    return tools.map((t) => ({
+        type: 'function',
+        function: {
+            name: t.name,
+            description: t.description,
+            parameters: t.parameters,
+        },
+    }));
+}
+class OllamaProvider {
+    id = 'ollama';
+    name = 'Ollama';
+    capabilities() {
+        return { streaming: true, tools: true, contextWindow: 128000 };
+    }
+    async post(body, params) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 180_000);
+        const onOuterAbort = () => controller.abort();
+        if (params.signal) {
+            if (params.signal.aborted)
+                controller.abort();
+            else
+                params.signal.addEventListener('abort', onOuterAbort);
+        }
+        const res = await fetch(`${baseUrl()}/api/chat`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+            signal: controller.signal,
+        });
+        clearTimeout(timer);
+        if (params.signal)
+            params.signal.removeEventListener('abort', onOuterAbort);
+        return { res };
+    }
+    async chat(params) {
+        const body = {
+            model: params.model,
+            messages: toOllamaMessages(params.messages),
+            stream: false,
+        };
+        if (params.tools && params.tools.length > 0)
+            body.tools = toToolDefs(params.tools);
+        const { res } = await this.post(body, params);
+        const text = await res.text();
+        if (!res.ok) {
+            throw new provider_1.ProviderError(`Ollama HTTP ${res.status}: ${text.slice(0, 300)}`, res.status, res.status >= 500);
+        }
+        const data = JSON.parse(text);
+        const message = (data.message || {});
+        const toolCalls = (message.tool_calls || []).map((tc, i) => {
+            const fn = (tc.function || {});
+            return {
+                id: `ollama_${i}`,
+                name: String(fn.name || ''),
+                arguments: typeof fn.arguments === 'string' ? fn.arguments : JSON.stringify(fn.arguments ?? {}),
+            };
+        });
+        return {
+            content: String(message.content || ''),
+            toolCalls,
+            stopReason: toolCalls.length > 0 ? 'tool_calls' : 'stop',
+            model: String(data.model || params.model),
+        };
+    }
+    async *stream(params) {
+        const body = {
+            model: params.model,
+            messages: toOllamaMessages(params.messages),
+            stream: true,
+        };
+        if (params.tools && params.tools.length > 0)
+            body.tools = toToolDefs(params.tools);
+        const { res } = await this.post(body, params);
+        if (!res.ok || !res.body) {
+            const text = await res.text().catch(() => '');
+            throw new provider_1.ProviderError(`Ollama HTTP ${res.status}: ${text.slice(0, 200)}`, res.status, res.status >= 500);
+        }
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        let content = '';
+        const toolCalls = [];
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            const lines = buffer.split('\n');
+            buffer = lines.pop() || '';
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                const json = safeJson(trimmed);
+                if (!json)
+                    continue;
+                if (json.done) {
+                    yield {
+                        type: 'done',
+                        result: {
+                            content,
+                            toolCalls,
+                            stopReason: toolCalls.length > 0 ? 'tool_calls' : 'stop',
+                            model: params.model,
+                        },
+                    };
+                    return;
+                }
+                const message = (json.message || {});
+                if (typeof message.content === 'string' && message.content) {
+                    content += message.content;
+                    yield { type: 'delta', delta: message.content };
+                }
+                const tcs = message.tool_calls || [];
+                for (const tc of tcs) {
+                    const fn = (tc.function || {});
+                    const call = {
+                        id: `ollama_${toolCalls.length}`,
+                        name: String(fn.name || ''),
+                        arguments: typeof fn.arguments === 'string' ? fn.arguments : JSON.stringify(fn.arguments ?? {}),
+                    };
+                    toolCalls.push(call);
+                    yield { type: 'tool_call', toolCall: call };
+                }
+            }
+        }
+        yield {
+            type: 'done',
+            result: { content, toolCalls, stopReason: 'stop', model: params.model },
+        };
+    }
+    async models() {
+        try {
+            const res = await fetch(`${baseUrl()}/api/tags`);
+            if (res.ok) {
+                const data = (await res.json());
+                if (Array.isArray(data.models)) {
+                    return data.models.map((m) => String(m.name)).slice(0, 100);
+                }
+            }
+        }
+        catch {
+            /* offline */
+        }
+        return (0, models_1.modelsForProvider)(this.id).map((m) => m.id);
+    }
+}
+exports.OllamaProvider = OllamaProvider;
+function safeJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/providers/openai-compat.js

@@ -0,0 +1,296 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenAICompatProvider = void 0;
+/**
+ * OpenAI-compatible provider — used by OpenAI, OpenRouter and Custom.
+ * Speaks /v1/chat/completions (and /models) with tool calling + streaming.
+ */
+const provider_1 = require("./provider");
+const credentials_1 = require("../config/credentials");
+const models_1 = require("../config/models");
+function toOpenAIMessages(messages) {
+    const out = [];
+    for (const m of messages) {
+        if (m.role === 'tool') {
+            out.push({
+                role: 'tool',
+                tool_call_id: m.toolCallId,
+                content: m.content,
+            });
+            continue;
+        }
+        const base = { role: m.role, content: m.content };
+        if (m.toolCalls && m.toolCalls.length > 0) {
+            base.tool_calls = m.toolCalls.map((tc) => ({
+                id: tc.id,
+                type: 'function',
+                function: { name: tc.name, arguments: tc.arguments },
+            }));
+        }
+        if (m.name)
+            base.name = m.name;
+        out.push(base);
+    }
+    return out;
+}
+function toToolDefs(tools) {
+    return tools.map((t) => ({
+        type: 'function',
+        function: {
+            name: t.name,
+            description: t.description,
+            parameters: t.parameters,
+        },
+    }));
+}
+function parseToolCalls(raw) {
+    const calls = [];
+    if (!Array.isArray(raw))
+        return calls;
+    for (const item of raw) {
+        const fn = item.function;
+        if (!fn)
+            continue;
+        calls.push({
+            id: String(item.id || `call_${Math.random().toString(36).slice(2)}`),
+            name: String(fn.name || 'unknown'),
+            arguments: typeof fn.arguments === 'string' ? fn.arguments : JSON.stringify(fn.arguments),
+        });
+    }
+    return calls;
+}
+class OpenAICompatProvider {
+    id;
+    name;
+    baseUrl;
+    apiKey;
+    defaultModel;
+    contextWindow;
+    constructor(opts) {
+        this.id = opts.id;
+        this.name = opts.name;
+        this.baseUrl = opts.baseUrl.replace(/\/+$/, '');
+        this.apiKey = opts.apiKey !== undefined ? opts.apiKey : (0, credentials_1.getApiKey)(opts.id);
+        this.defaultModel = opts.defaultModel || 'gpt-4o-mini';
+        this.contextWindow = opts.contextWindow || 128000;
+    }
+    capabilities() {
+        return {
+            streaming: true,
+            tools: true,
+            contextWindow: this.contextWindow,
+        };
+    }
+    endpoint(path) {
+        return `${this.baseUrl}${path}`;
+    }
+    headers() {
+        const h = {
+            'Content-Type': 'application/json',
+        };
+        if (this.apiKey)
+            h.Authorization = `Bearer ${this.apiKey}`;
+        return h;
+    }
+    buildBody(params, stream) {
+        const body = {
+            model: params.model || this.defaultModel,
+            messages: toOpenAIMessages(params.messages),
+            stream,
+        };
+        if (params.tools && params.tools.length > 0) {
+            body.tools = toToolDefs(params.tools);
+        }
+        if (params.temperature !== undefined)
+            body.temperature = params.temperature;
+        if (params.maxTokens)
+            body.max_tokens = params.maxTokens;
+        return body;
+    }
+    async postJson(path, body, signal, timeoutMs = 120_000) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        const onOuterAbort = () => controller.abort();
+        if (signal) {
+            if (signal.aborted)
+                controller.abort();
+            else
+                signal.addEventListener('abort', onOuterAbort);
+        }
+        try {
+            const res = await fetch(this.endpoint(path), {
+                method: 'POST',
+                headers: this.headers(),
+                body: JSON.stringify(body),
+                signal: controller.signal,
+            });
+            const text = await res.text();
+            if (!res.ok) {
+                const detail = safeJson(text);
+                const errObj = (detail && detail.error);
+                const msg = errObj?.message || text.slice(0, 300);
+                throw new provider_1.ProviderError(msg, res.status, res.status >= 500 || res.status === 429);
+            }
+            return safeJson(text) || {};
+        }
+        finally {
+            clearTimeout(timer);
+            if (signal)
+                signal.removeEventListener('abort', onOuterAbort);
+        }
+    }
+    async chat(params) {
+        const data = await this.postJson('/chat/completions', this.buildBody(params, false), params.signal, params.maxTokens ? 180_000 : undefined);
+        const choice = data.choices?.[0];
+        const msg = (choice?.message || {});
+        const finish = String(choice?.finish_reason || 'stop');
+        const usage = data.usage;
+        return {
+            content: typeof msg.content === 'string' ? msg.content : '',
+            toolCalls: parseToolCalls(msg.tool_calls),
+            stopReason: finish,
+            usage: usage
+                ? {
+                    inputTokens: usage.prompt_tokens,
+                    outputTokens: usage.completion_tokens,
+                    totalTokens: usage.total_tokens,
+                }
+                : undefined,
+            model: String(data.model || params.model),
+        };
+    }
+    async *stream(params) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 180_000);
+        const onOuterAbort = () => controller.abort();
+        if (params.signal) {
+            if (params.signal.aborted)
+                controller.abort();
+            else
+                params.signal.addEventListener('abort', onOuterAbort);
+        }
+        try {
+            const res = await fetch(this.endpoint('/chat/completions'), {
+                method: 'POST',
+                headers: this.headers(),
+                body: JSON.stringify(this.buildBody(params, true)),
+                signal: controller.signal,
+            });
+            if (!res.ok || !res.body) {
+                const text = await res.text().catch(() => '');
+                const detail = safeJson(text);
+                const errObj = (detail && detail.error);
+                throw new provider_1.ProviderError(errObj?.message || `HTTP ${res.status}: ${text.slice(0, 200)}`, res.status, res.status >= 500 || res.status === 429);
+            }
+            const reader = res.body.getReader();
+            const decoder = new TextDecoder();
+            let buffer = '';
+            let content = '';
+            const toolCalls = [];
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                buffer += decoder.decode(value, { stream: true });
+                const lines = buffer.split('\n');
+                buffer = lines.pop() || '';
+                for (const line of lines) {
+                    const trimmed = line.trim();
+                    if (!trimmed.startsWith('data:'))
+                        continue;
+                    const payload = trimmed.slice(5).trim();
+                    if (payload === '[DONE]') {
+                        yield {
+                            type: 'done',
+                            result: {
+                                content,
+                                toolCalls,
+                                stopReason: toolCalls.length > 0 ? 'tool_calls' : 'stop',
+                                model: params.model,
+                            },
+                        };
+                        return;
+                    }
+                    const json = safeJson(payload);
+                    if (!json)
+                        continue;
+                    const choice = json.choices?.[0];
+                    if (!choice)
+                        continue;
+                    const delta = (choice.delta || {});
+                    if (typeof delta.content === 'string' && delta.content) {
+                        content += delta.content;
+                        yield { type: 'delta', delta: delta.content };
+                    }
+                    const tc = delta.tool_calls;
+                    if (Array.isArray(tc)) {
+                        for (const part of tc) {
+                            const idx = Number(part.index || 0);
+                            const fn = (part.function || {});
+                            const existing = toolCalls[idx];
+                            if (!existing) {
+                                toolCalls[idx] = {
+                                    id: String(part.id || `call_${idx}_${Math.random().toString(36).slice(2)}`),
+                                    name: String(fn.name || ''),
+                                    arguments: String(fn.arguments || ''),
+                                };
+                            }
+                            else {
+                                if (part.id)
+                                    existing.id = String(part.id);
+                                if (fn.name)
+                                    existing.name = String(fn.name);
+                                if (fn.arguments)
+                                    existing.arguments += String(fn.arguments);
+                            }
+                        }
+                        const finished = toolCalls.filter((t) => t.name).map((t) => ({
+                            ...t,
+                            arguments: t.arguments || '{}',
+                        }));
+                        if (finished.length > 0) {
+                            yield { type: 'tool_call', toolCall: finished[finished.length - 1] };
+                        }
+                    }
+                }
+            }
+            // Stream ended without [DONE]
+            yield {
+                type: 'done',
+                result: {
+                    content,
+                    toolCalls: toolCalls.filter((t) => t.name),
+                    stopReason: 'stop',
+                    model: params.model,
+                },
+            };
+        }
+        finally {
+            clearTimeout(timer);
+            if (params.signal)
+                params.signal.removeEventListener('abort', onOuterAbort);
+        }
+    }
+    async models() {
+        try {
+            const data = await this.postJson('/models', {});
+            const list = data.data;
+            if (Array.isArray(list) && list.length > 0) {
+                return list.map((m) => String(m.id)).slice(0, 100);
+            }
+        }
+        catch {
+            /* fall back to known list */
+        }
+        return (0, models_1.modelsForProvider)(this.id).map((m) => m.id);
+    }
+}
+exports.OpenAICompatProvider = OpenAICompatProvider;
+function safeJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/providers/openai.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenAIProvider = void 0;
+const openai_compat_1 = require("./openai-compat");
+class OpenAIProvider extends openai_compat_1.OpenAICompatProvider {
+    constructor(apiKey) {
+        super({
+            id: 'openai',
+            name: 'OpenAI',
+            baseUrl: process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1',
+            apiKey,
+            defaultModel: 'gpt-4o-mini',
+            contextWindow: 128000,
+        });
+    }
+}
+exports.OpenAIProvider = OpenAIProvider;

package/dist/providers/openrouter.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenRouterProvider = void 0;
+const openai_compat_1 = require("./openai-compat");
+class OpenRouterProvider extends openai_compat_1.OpenAICompatProvider {
+    constructor(apiKey) {
+        super({
+            id: 'openrouter',
+            name: 'OpenRouter',
+            baseUrl: 'https://openrouter.ai/api/v1',
+            apiKey,
+            defaultModel: 'deepseek/deepseek-chat',
+            contextWindow: 128000,
+        });
+    }
+    headers() {
+        const h = super.headers();
+        h['HTTP-Referer'] = 'https://github.com/clickmamaheti-prog/vector-agent';
+        h['X-Title'] = 'VECTOR AI Coding Agent';
+        return h;
+    }
+}
+exports.OpenRouterProvider = OpenRouterProvider;

package/dist/providers/provider.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderError = void 0;
+exports.withRetry = withRetry;
+/** Error thrown by providers for user-facing issues. */
+class ProviderError extends Error {
+    status;
+    retryable;
+    constructor(message, status, retryable = false) {
+        super(message);
+        this.status = status;
+        this.retryable = retryable;
+        this.name = 'ProviderError';
+    }
+}
+exports.ProviderError = ProviderError;
+/** Simple retry wrapper for provider calls. */
+async function withRetry(fn, { retries = 3, delayMs = 1000, signal } = {}) {
+    let attempt = 0;
+    for (;;) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            attempt++;
+            const retryable = err instanceof ProviderError
+                ? err.retryable
+                : err.name === 'AbortError'
+                    ? false
+                    : true;
+            if (!retryable || attempt > retries)
+                throw err;
+            const wait = delayMs * Math.pow(2, attempt - 1);
+            await new Promise((r) => setTimeout(r, wait));
+            if (signal?.aborted)
+                throw new Error('aborted');
+        }
+    }
+}

package/dist/security/command-policy.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyCommand = classifyCommand;
+const BLOCKED_PATTERNS = [
+    /(^|[;&|]\s*)\s*rm\s+(-[a-z]*[rf][a-z]*\s+)*\/\s*($|[^a-zA-Z])/,
+    /(^|[;&|]\s*)\s*rm\s+(-[a-z]*[rf][a-z]*\s+)*~(\/|$)/,
+    /(^|[;&|]\s*)\s*rm\s+(-[a-z]*[rf][a-z]*\s+)*\/home(\/|$)/,
+    /(^|[;&|]\s*)\s*mkfs/,
+    /(^|[;&|]\s*)\s*dd\s+if=.*of=\/dev\/(sd|nvme|vd|mmcblk)/,
+    /(^|[;&|]\s*)\s*shutdown/,
+    /(^|[;&|]\s*)\s*reboot/,
+    /(^|[;&|]\s*)\s*halt/,
+    /(^|[;&|]\s*)\s*poweroff/,
+    /(^|[;&|]\s*)\s*:\(\)\s*{\s*:\|:&\s*}\s*;/,
+    /(^|[;&|]\s*)\s*chmod\s+(-R\s+)?[0-7]{3,4}\s*\/\s*($| )/,
+    /(^|[;&|]\s*)\s*chown\s+(-R\s+)?[^\s]+\s*\/\s*($| )/,
+    /(^|[;&|]\s*)\s*sudo\s+rm\s+-rf\s+\//,
+    /(^|[;&|]\s*)\s*git\s+push\s+(-f|--force)/,
+    /(^|[;&|]\s*)\s*git\s+reset\s+--hard\s+HEAD~?[0-9]*.*(--)?$/,
+];
+const DANGEROUS_PATTERNS = [
+    /(^|[;&|]\s*)\s*rm\s+(-[a-z]*[rf][a-z]*\s+)*/,
+    /(^|[;&|]\s*)\s*mv\s+.*\/\.?git/,
+    /(^|[;&|]\s*)\s*git\s+(push|reset|rebase|clean|gc|prune)/,
+    /(^|[;&|]\s*)\s*drop\s+(table|database)/,
+    /(^|[;&|]\s*)\s*DELETE\s+FROM/i,
+    /(^|[;&|]\s*)\s*TRUNCATE\s/i,
+    /(^|[;&|]\s*)\s*curl\s+.*\|\s*(sudo\s+)?(sh|bash)/,
+    /(^|[;&|]\s*)\s*wget\s+.*\|\s*(sudo\s+)?(sh|bash)/,
+    /(^|[;&|]\s*)\s*chmod\s+[0-7]{3,4}/,
+    /(^|[;&|]\s*)\s*chown\s+/,
+    /(^|[;&|]\s*)\s*sudo\s+(apt|apt-get|dnf|yum|pacman)\s+(install|remove|purge|autoremove)/,
+    /(^|[;&|]\s*)\s*npm\s+(uninstall|remove|rm)\s+/,
+    /(^|[;&|]\s*)\s*pip(\d)?\s+uninstall\s+/,
+    /(^|[;&|]\s*)\s*killall\s+/,
+    /(^|[;&|]\s*)\s*pkill\s+/,
+    /(^|[;&|]\s*)\s*rmdir\s+/,
+];
+const ASK_PATTERNS = [
+    /(^|[;&|]\s*)\s*npm\s+(install|i|add)\s+/,
+    /(^|[;&|]\s*)\s*npm\s+run\s+(build|test|dev|start|preview)/,
+    /(^|[;&|]\s*)\s*npx\s+/,
+    /(^|[;&|]\s*)\s*pnpm\s+/,
+    /(^|[;&|]\s*)\s*yarn\s+/,
+    /(^|[;&|]\s*)\s*pip(\d)?\s+install\s+/,
+    /(^|[;&|]\s*)\s*poetry\s+install/,
+    /(^|[;&|]\s*)\s*go\s+(mod\s+download|get\s+)/,
+    /(^|[;&|]\s*)\s*cargo\s+(install|add)\s+/,
+    /(^|[;&|]\s*)\s*sudo\s+/,
+    /(^|[;&|]\s*)\s*git\s+commit\s+/,
+    /(^|[;&|]\s*)\s*make\s+(install|deploy)/,
+    /(^|[;&|]\s*)\s*docker\s+/,
+    /(^|[;&|]\s*)\s*curl\s+/,
+    /(^|[;&|]\s*)\s*wget\s+/,
+    /(^|[;&|]\s*)\s*ssh\s+/,
+    /(^|[;&|]\s*)\s*scp\s+/,
+    /(^|[;&|]\s*)\s*rsync\s+/,
+];
+/** Commands that are safe to run without asking. */
+const SAFE_PATTERNS = [
+    /(^|[;&|]\s*)\s*(ls|cat|head|tail|less|more|wc|grep|find|locate|which|type|file|stat|du|df|tree)\s/,
+    /(^|[;&|]\s*)\s*echo\s/,
+    /(^|[;&|]\s*)\s*node\s+(-v|--version)/,
+    /(^|[;&|]\s*)\s*npm\s+(-v|--version|ls|list)\s*/,
+    /(^|[;&|]\s*)\s*git\s+(status|diff|log|branch|show|remote|rev-parse|config)\s*/,
+    /(^|[;&|]\s*)\s*tsc\s+--noEmit/,
+    /(^|[;&|]\s*)\s*python3?\s+(-V|--version)/,
+    /(^|[;&|]\s*)\s*date\s*/,
+    /(^|[;&|]\s*)\s*pwd\s*/,
+    /(^|[;&|]\s*)\s*env\s*/,
+    /(^|[;&|]\s*)\s*uname\s*/,
+    /(^|[;&|]\s*)\s*whoami\s*/,
+];
+function classifyCommand(command) {
+    // Blocked patterns take priority
+    for (const re of BLOCKED_PATTERNS) {
+        if (re.test(command)) {
+            return { level: 'blocked', reason: `command matches blocked pattern: ${re.source}` };
+        }
+    }
+    for (const re of DANGEROUS_PATTERNS) {
+        if (re.test(command)) {
+            return { level: 'dangerous', reason: `command matches dangerous pattern: ${re.source}` };
+        }
+    }
+    for (const re of ASK_PATTERNS) {
+        if (re.test(command)) {
+            return { level: 'ask', reason: `command matches ask pattern: ${re.source}` };
+        }
+    }
+    // Default safe classification for read-only style commands
+    for (const re of SAFE_PATTERNS) {
+        if (re.test(command)) {
+            return { level: 'safe', reason: 'command matches safe pattern' };
+        }
+    }
+    // Unknown commands: ask by default (safe by default philosophy)
+    return { level: 'ask', reason: 'unknown command — asking by default' };
+}