agentic-workflow-manager 9.7.1 → 9.9.0

package/dist/src/core/model-policy/validate.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_IDENTIFIER = exports.MAX_MAPPINGS = exports.MAX_POLICY_BYTES = void 0;
+exports.canonicalUtcTimestamp = canonicalUtcTimestamp;
+exports.validatePolicyContent = validatePolicyContent;
+exports.validateApprovedPolicy = validateApprovedPolicy;
+exports.assertDigest = assertDigest;
+const providers_1 = require("../../providers");
+exports.MAX_POLICY_BYTES = 256 * 1024;
+exports.MAX_MAPPINGS = 64;
+exports.MAX_IDENTIFIER = 128;
+const SHA256 = /^[0-9a-f]{64}$/;
+const RUNTIME_KIND = /^[a-z0-9][a-z0-9_-]{0,127}$/;
+const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+const CANONICAL_UTC_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+const profiles = ['mechanical', 'integration', 'judgment'];
+function record(value, label) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new Error(`${label} must be an object`);
+    return value;
+}
+function exact(object, keys, label) {
+    const actual = Object.keys(object);
+    if (actual.length !== keys.length || actual.some(key => !keys.includes(key)))
+        throw new Error(`${label} has unknown or missing fields`);
+}
+function text(value, label, pattern) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > exports.MAX_IDENTIFIER || CONTROL.test(value) || (pattern && !pattern.test(value)))
+        throw new Error(`${label} is invalid`);
+    return value;
+}
+function canonicalUtcTimestamp(value, label) {
+    if (typeof value !== 'string' || !CANONICAL_UTC_TIMESTAMP.test(value))
+        throw new Error(`${label} must be a canonical UTC ISO-8601 timestamp`);
+    const parsed = new Date(value);
+    if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value)
+        throw new Error(`${label} must be a canonical UTC ISO-8601 timestamp`);
+    return value;
+}
+function bool(value, label) { if (typeof value !== 'boolean')
+    throw new Error(`${label} must be boolean`); return value; }
+function agent(value) { if (typeof value !== 'string' || !providers_1.AGENT_TARGETS.includes(value))
+    throw new Error('mapping target is invalid'); return value; }
+function selection(value, label) {
+    const item = record(value, label);
+    exact(item, ['selector', 'effort'], label);
+    const selector = record(item.selector, `${label}.selector`);
+    exact(selector, ['kind', 'id'], `${label}.selector`);
+    if (selector.kind !== 'model' && selector.kind !== 'tier')
+        throw new Error(`${label}.selector.kind is invalid`);
+    const effort = record(item.effort, `${label}.effort`);
+    if (effort.kind === 'explicit') {
+        exact(effort, ['kind', 'value'], `${label}.effort`);
+        return { selector: { kind: selector.kind, id: text(selector.id, `${label}.selector.id`) }, effort: { kind: 'explicit', value: text(effort.value, `${label}.effort.value`) } };
+    }
+    if (effort.kind === 'runtime-default') {
+        exact(effort, ['kind'], `${label}.effort`);
+        return { selector: { kind: selector.kind, id: text(selector.id, `${label}.selector.id`) }, effort: { kind: 'runtime-default' } };
+    }
+    throw new Error(`${label}.effort.kind is invalid`);
+}
+function mapping(value) {
+    const item = record(value, 'mapping');
+    exact(item, ['target', 'runtimeKind', 'profiles', 'fullCapability', 'degradation'], 'mapping');
+    const rawProfiles = record(item.profiles, 'mapping.profiles');
+    exact(rawProfiles, profiles, 'mapping.profiles');
+    const degradation = record(item.degradation, 'mapping.degradation');
+    exact(degradation, ['allowMissingModelOverride', 'allowMissingEffortOverride', 'allowMissingObservedIdentity'], 'mapping.degradation');
+    return { target: agent(item.target), runtimeKind: text(item.runtimeKind, 'mapping.runtimeKind', RUNTIME_KIND), profiles: {
+            mechanical: selection(rawProfiles.mechanical, 'mapping.profiles.mechanical'), integration: selection(rawProfiles.integration, 'mapping.profiles.integration'), judgment: selection(rawProfiles.judgment, 'mapping.profiles.judgment'),
+        }, fullCapability: selection(item.fullCapability, 'mapping.fullCapability'), degradation: {
+            allowMissingModelOverride: bool(degradation.allowMissingModelOverride, 'mapping.degradation.allowMissingModelOverride'), allowMissingEffortOverride: bool(degradation.allowMissingEffortOverride, 'mapping.degradation.allowMissingEffortOverride'), allowMissingObservedIdentity: bool(degradation.allowMissingObservedIdentity, 'mapping.degradation.allowMissingObservedIdentity'),
+        } };
+}
+function validatePolicyContent(value) {
+    const item = record(value, 'policy content');
+    exact(item, ['schema', 'mappings', 'implementationBudget'], 'policy content');
+    if (item.schema !== 'model-policy/v1')
+        throw new Error('policy schema is invalid');
+    if (!Array.isArray(item.mappings) || item.mappings.length > exports.MAX_MAPPINGS)
+        throw new Error('policy mappings are invalid');
+    const mappings = item.mappings.map(mapping);
+    const unique = new Set();
+    for (const row of mappings) {
+        const key = `${row.target}\0${row.runtimeKind}`;
+        if (unique.has(key))
+            throw new Error('duplicate policy target/runtime mapping');
+        unique.add(key);
+    }
+    const budget = record(item.implementationBudget, 'implementationBudget');
+    exact(budget, ['maxAttempts', 'escalation', 'judgmentEfforts'], 'implementationBudget');
+    if (budget.maxAttempts !== 3 || !Array.isArray(budget.escalation) || budget.escalation.length !== 3 || budget.escalation.join(',') !== 'mechanical,integration,judgment' || !Array.isArray(budget.judgmentEfforts) || budget.judgmentEfforts.join(',') !== 'medium,high')
+        throw new Error('implementation budget is invalid');
+    return { schema: 'model-policy/v1', mappings, implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] } };
+}
+function validateApprovedPolicy(value) {
+    const item = record(value, 'approved policy');
+    exact(item, ['schema', 'content', 'contentDigest', 'approval', 'lineage'], 'approved policy');
+    if (item.schema !== 'approved-model-policy/v1')
+        throw new Error('approved policy schema is invalid');
+    const approval = record(item.approval, 'approval');
+    exact(approval, ['approvedAt', 'approvalId'], 'approval');
+    const lineage = record(item.lineage, 'lineage');
+    exact(lineage, ['previousDigest'], 'lineage');
+    const contentDigest = text(item.contentDigest, 'contentDigest', SHA256);
+    if (typeof approval.approvalId !== 'string' || approval.approvalId.length === 0 || approval.approvalId.length > exports.MAX_IDENTIFIER || CONTROL.test(approval.approvalId) || (lineage.previousDigest !== null && (typeof lineage.previousDigest !== 'string' || !SHA256.test(lineage.previousDigest))))
+        throw new Error('approved policy metadata is invalid');
+    const approvedAt = canonicalUtcTimestamp(approval.approvedAt, 'approval.approvedAt');
+    return { schema: 'approved-model-policy/v1', content: validatePolicyContent(item.content), contentDigest, approval: { approvedAt, approvalId: approval.approvalId }, lineage: { previousDigest: lineage.previousDigest } };
+}
+function assertDigest(value, label) { if (typeof value !== 'string' || !SHA256.test(value))
+    throw new Error(`${label} must be a 64-character lowercase SHA-256 digest`); }

package/dist/src/core/plan/identity.js

@@ -0,0 +1,77 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXECUTION_IDENTITY_SCHEMA = exports.MAX_PLAN_SNAPSHOT_BYTES = void 0;
+exports.normalizedPlanSnapshot = normalizedPlanSnapshot;
+exports.fullPlanDigest = fullPlanDigest;
+exports.executionPlanDigest = executionPlanDigest;
+const crypto_1 = __importDefault(require("crypto"));
+exports.MAX_PLAN_SNAPSHOT_BYTES = 1024 * 1024;
+exports.EXECUTION_IDENTITY_SCHEMA = 'awm-plan-execution/v1';
+const START = '<!-- AWM:COMPACT-SLICES:START v1 -->';
+const END = '<!-- AWM:COMPACT-SLICES:END v1 -->';
+const START_V2 = '<!-- AWM:COMPACT-SLICES:START v2 -->';
+const END_V2 = '<!-- AWM:COMPACT-SLICES:END v2 -->';
+/** Only lifecycle syntax actually emitted by the skills is non-executable.
+ * Unknown metadata, prose, inline comments and code remain identity-bearing. */
+function lifecycleMarker(line) {
+    const match = /^ {0,3}<!-- (awm-(?:qa|docs|retro)-complete)(?:: (\d{4}-\d{2}-\d{2}|Release [A-Za-z0-9][A-Za-z0-9_-]*))? -->$/.exec(line);
+    if (!match)
+        return undefined;
+    const metadata = match[2];
+    if (metadata && !metadata.startsWith('Release ')) {
+        const parsed = new Date(`${metadata}T00:00:00.000Z`);
+        if (!Number.isFinite(parsed.getTime()) || parsed.toISOString().slice(0, 10) !== metadata)
+            return undefined;
+    }
+    return `${match[1]}:${metadata?.startsWith('Release ') ? metadata : ''}`;
+}
+function normalizedPlanSnapshot(text) {
+    if (typeof text !== 'string' || text.length === 0 || Buffer.byteLength(text, 'utf8') > exports.MAX_PLAN_SNAPSHOT_BYTES || text.includes('\0')) {
+        throw new Error('plan snapshot must be nonempty bounded text without NUL');
+    }
+    return text.replace(/\r\n?/g, '\n');
+}
+function fullPlanDigest(text) {
+    return crypto_1.default.createHash('sha256').update(normalizedPlanSnapshot(text), 'utf8').digest('hex');
+}
+/** This versioned identity preserves ALL plan bytes except recognized progress
+ * status bytes and unique standalone lifecycle marker lines outside code/JSON.
+ * It is never a replacement for the full validated-plan digest. */
+function executionPlanDigest(text) {
+    const lines = normalizedPlanSnapshot(text).split('\n');
+    let fence;
+    let manifest = false;
+    const candidates = lines.map(line => {
+        const matched = /^(?: {0,3})(`{3,}|~{3,})(.*)$/.exec(line);
+        const marker = matched?.[1];
+        if (marker && (fence
+            ? marker[0] === fence.character && marker.length >= fence.length && /^[ \t]*$/.test(matched[2])
+            : marker[0] !== '`' || !matched[2].includes('`'))) {
+            fence = fence ? undefined : { character: marker[0], length: marker.length };
+            return { line };
+        }
+        if (fence)
+            return { line };
+        if (line === START || line === START_V2) {
+            manifest = true;
+            return { line };
+        }
+        if (line === END || line === END_V2) {
+            manifest = false;
+            return { line };
+        }
+        if (manifest)
+            return { line };
+        const lifecycle = lifecycleMarker(line);
+        return { line: line.replace(/^( {0,3}[-*+] +)\[[ xX]\]( +\S.*)$/, '$1[ ]$2'), lifecycle };
+    });
+    const counts = new Map();
+    for (const { lifecycle } of candidates)
+        if (lifecycle)
+            counts.set(lifecycle, (counts.get(lifecycle) ?? 0) + 1);
+    const canonical = candidates.filter(({ lifecycle }) => !lifecycle || counts.get(lifecycle) !== 1).map(({ line }) => line).join('\n');
+    return crypto_1.default.createHash('sha256').update(`${exports.EXECUTION_IDENTITY_SCHEMA}\0`).update(canonical, 'utf8').digest('hex');
+}

package/dist/src/core/plan/validate.js

@@ -3,22 +3,53 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertVerifiedValidPlanReport = assertVerifiedValidPlanReport;
+exports.verifiedPlanSnapshot = verifiedPlanSnapshot;
 exports.validatePlanFile = validatePlanFile;
+exports.validatePlanSnapshot = validatePlanSnapshot;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
 const json_1 = require("./json");
+const identity_1 = require("./identity");
 const START = '<!-- AWM:COMPACT-SLICES:START v1 -->';
 const END = '<!-- AWM:COMPACT-SLICES:END v1 -->';
+const START_V2 = '<!-- AWM:COMPACT-SLICES:START v2 -->';
+const END_V2 = '<!-- AWM:COMPACT-SLICES:END v2 -->';
 const MAX_PLAN = 1024 * 1024;
 const MAX_MANIFEST = 256 * 1024;
 const MAX_SOURCE = 1024 * 1024;
 const MAX_STRING = 4096;
-const ID = /^[A-Z][A-Z0-9-]{0,63}$/;
+const ENTITY_ID = /^[A-Z][A-Z0-9-]{0,63}$/;
+const REQUIREMENT_ID = /^[A-Z][A-Z0-9]*(?:-[A-Z0-9]+)*(?:\.[A-Z0-9]+(?:-[A-Z0-9]+)*)*$/;
 const PLAN_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const SHELL = new Set([
     'sh', 'bash', 'zsh', 'dash', 'ksh', 'fish', 'cmd', 'powershell', 'pwsh',
     'env', 'busybox', 'node', 'nodejs', 'deno', 'bun', 'python', 'python3', 'ruby', 'perl', 'php', 'lua',
 ]);
+const verifiedValidReports = new WeakSet();
+const verifiedSnapshots = new WeakMap();
+function freezeJson(value) {
+    if (value === null || typeof value !== 'object')
+        return;
+    for (const child of Object.values(value))
+        freezeJson(child);
+    Object.freeze(value);
+}
+/** Require a process-local, immutable report issued by successful core validation. */
+function assertVerifiedValidPlanReport(report) {
+    if (!report || typeof report !== 'object' || report.state !== 'valid' || !verifiedValidReports.has(report)) {
+        throw new Error('plan validator returned an invalid valid report');
+    }
+}
+/** The exact immutable validator snapshot, never a later reopen of the path. */
+function verifiedPlanSnapshot(report) {
+    assertVerifiedValidPlanReport(report);
+    const snapshot = verifiedSnapshots.get(report);
+    if (snapshot === undefined)
+        throw new Error('verified plan snapshot unavailable');
+    return snapshot;
+}
 function isLauncher(program) {
     const base = path_1.default.posix.basename(program).toLowerCase();
     return SHELL.has(base.replace(/\.exe$/, '')) || /^(?:node(?:js)?|py(?:thon(?:w)?\d*(?:\.\d+)?)?|deno|bun|ruby(?:\d+(?:\.\d+)*)?|perl(?:\d+(?:\.\d+)*)?|(?:a|ba|c|tc|z|da|k)?sh|busybox|cmd|powershell|pwsh|wscript|cscript)(?:\.exe)?(?:[-.][a-z0-9][a-z0-9.-]*)?$/i.test(base);
@@ -37,39 +68,49 @@ function schemaClassification(candidate) {
     return diagnostic('PLAN_MARKERS', 'compact markers must occur once in order');
 }
 function embeddedJsonObjects(text) {
-    const objects = [];
-    for (let start = 0; start < text.length && objects.length < 64; start += 1) {
-        if (text[start] !== '{')
-            continue;
-        let depth = 0;
-        let quoted = false;
-        let escaped = false;
-        let end = start;
-        for (; end < text.length && end - start <= MAX_MANIFEST; end += 1) {
-            const character = text[end];
-            if (quoted) {
-                if (escaped)
-                    escaped = false;
-                else if (character === '\\')
-                    escaped = true;
-                else if (character === '"')
-                    quoted = false;
-                continue;
-            }
-            if (character === '"') {
-                quoted = true;
-                continue;
-            }
+    const outer = [];
+    const nested = [];
+    const starts = [];
+    let quoted = false;
+    let escaped = false;
+    for (let index = 0; index < text.length; index += 1) {
+        const character = text[index];
+        if (starts.length === 0) {
             if (character === '{')
-                depth += 1;
-            if (character === '}' && --depth === 0) {
-                objects.push(text.slice(start, end + 1));
-                start = end;
-                break;
+                starts.push(index);
+            continue;
+        }
+        if (quoted) {
+            if (character === '\n') {
+                quoted = false;
+                escaped = false;
             }
+            else if (escaped)
+                escaped = false;
+            else if (character === '\\')
+                escaped = true;
+            else if (character === '"')
+                quoted = false;
+            continue;
+        }
+        if (character === '"') {
+            quoted = true;
+            continue;
         }
+        if (character === '{') {
+            starts.push(index);
+            continue;
+        }
+        if (character !== '}')
+            continue;
+        const start = starts.pop();
+        if (start === undefined || index - start > MAX_MANIFEST)
+            continue;
+        const found = starts.length === 0 ? outer : nested;
+        if (found.length < 64)
+            found.push(text.slice(start, index + 1));
     }
-    return objects;
+    return [...outer, ...nested].slice(0, 64);
 }
 function markerlessSchemaClassification(text) {
     const candidates = [text.trim(), ...embeddedJsonObjects(text)];
@@ -123,11 +164,18 @@ function compactSchemaSignal(text) {
     }
     return false;
 }
+function executionModeFromValidatedText(text) {
+    const raw = /^\s*\*\*Modo de ejecución:\*\*\s*([^\r\n]+)\s*$/mi.exec(text)?.[1]?.trim().replace(/^`|`$/g, '');
+    return raw === 'desatendido' ? 'desatendido' : 'interactivo';
+}
 function exact(value, fields) {
     return object(value) && Object.keys(value).length === fields.length && fields.every((field) => Object.prototype.hasOwnProperty.call(value, field));
 }
 function allStrings(value, max = MAX_STRING) { return Array.isArray(value) && value.every((item) => typeof item === 'string' && Buffer.byteLength(item, 'utf8') <= max); }
-function validId(value) { return typeof value === 'string' && ID.test(value); }
+function validId(value) { return typeof value === 'string' && ENTITY_ID.test(value); }
+function validRequirementId(value) {
+    return typeof value === 'string' && Buffer.byteLength(value, 'utf8') <= 64 && REQUIREMENT_ID.test(value);
+}
 function inside(root, candidate) { const relative = path_1.default.relative(root, candidate); return relative === '' || (!relative.startsWith(`..${path_1.default.sep}`) && relative !== '..' && !path_1.default.isAbsolute(relative)); }
 function validRelative(value) {
     return typeof value === 'string' && value.length > 0 && Buffer.byteLength(value, 'utf8') <= MAX_STRING && !path_1.default.isAbsolute(value) && !path_1.default.win32.isAbsolute(value) && !value.includes('\\') && value.split('/').every((part) => part !== '' && part !== '.' && part !== '..') && path_1.default.posix.normalize(value) === value;
@@ -140,30 +188,74 @@ function regularInside(root, relative) {
         return undefined;
     const parts = relative.split('/');
     let current = root;
+    let stat;
     try {
         for (const part of parts) {
             current = path_1.default.join(current, part);
-            if (fs_1.default.lstatSync(current).isSymbolicLink())
+            stat = fs_1.default.lstatSync(current, { bigint: true });
+            if (stat.isSymbolicLink())
                 return undefined;
         }
-        if (!fs_1.default.lstatSync(candidate).isFile())
+        if (!stat?.isFile())
             return undefined;
         const real = fs_1.default.realpathSync(candidate);
-        return inside(root, real) ? real : undefined;
+        return inside(root, real) ? { path: real, stat } : undefined;
     }
     catch {
         return undefined;
     }
 }
-function executableInside(root, relative) {
-    const file = regularInside(root, relative);
+function sameIdentity(inspected, opened) {
+    return typeof inspected.dev === 'bigint' && typeof inspected.ino === 'bigint' && inspected.ino !== 0n
+        && opened.isFile() && inspected.dev === opened.dev && inspected.ino === opened.ino;
+}
+function readInspected(file, max) {
+    if (file.stat.size > BigInt(max))
+        return { state: 'limit' };
+    let descriptor;
     try {
-        return file && (process.platform === 'win32' ? /\.(?:exe|cmd|bat)$/i.test(file) : (fs_1.default.statSync(file).mode & 0o111) !== 0) ? file : undefined;
+        descriptor = fs_1.default.openSync(file.path, fs_1.default.constants.O_RDONLY | (fs_1.default.constants.O_NOFOLLOW ?? 0));
+        const opened = fs_1.default.fstatSync(descriptor, { bigint: true });
+        if (!sameIdentity(file.stat, opened))
+            return { state: 'unsafe' };
+        if (opened.size > BigInt(max))
+            return { state: 'limit' };
+        if (opened.size !== file.stat.size)
+            return { state: 'unsafe' };
+        const bytes = Buffer.alloc(Number(opened.size));
+        let offset = 0;
+        while (offset < bytes.length) {
+            const read = fs_1.default.readSync(descriptor, bytes, offset, bytes.length - offset, offset);
+            if (read <= 0)
+                return { state: 'read' };
+            offset += read;
+        }
+        const after = fs_1.default.fstatSync(descriptor, { bigint: true });
+        if (!sameIdentity(file.stat, after))
+            return { state: 'unsafe' };
+        if (after.size > BigInt(max) || bytes.length > max)
+            return { state: 'limit' };
+        if (after.size !== opened.size)
+            return { state: 'unsafe' };
+        return { state: 'ok', bytes };
     }
-    catch {
-        return undefined;
+    catch (error) {
+        const code = error.code;
+        return { state: code === 'ELOOP' || code === 'ENOENT' || code === 'ENOTDIR' ? 'unsafe' : 'read' };
+    }
+    finally {
+        if (descriptor !== undefined) {
+            try {
+                fs_1.default.closeSync(descriptor);
+            }
+            catch { /* best-effort close after a failed inspected read */ }
+        }
     }
 }
+function executableInside(root, relative) {
+    const file = regularInside(root, relative);
+    return file && (process.platform === 'win32' ? /\.(?:exe|cmd|bat)$/i.test(file.path) : (file.stat.mode & 73n) !== 0n) ? file.path : undefined;
+}
 function refs(value, known) { return allStrings(value) && value.every((id) => known.has(id)); }
 function uniqueRefs(value, known) { return refs(value, known) && new Set(value).size === value.length; }
 function unsafeCommand(value) { return /[\0\r\n]|[`$]|\$\(|\$\{|[;&|<>*?\[\]{}()]/.test(value); }
@@ -219,8 +311,8 @@ function checkMarkdown(text, slices) {
     }
     return undefined;
 }
-/** Read-only validator for a bounded compact-slices/v1 Markdown plan. */
-function validatePlanFile(planPath, cwd = process.cwd()) {
+/** Shared parser. A supplied snapshot is already descriptor-anchored by its caller. */
+function validatePlan(planPath, cwd, snapshot) {
     if (typeof planPath !== 'string' || planPath.length === 0)
         throw new Error('planPath must be a non-empty path');
     if (typeof cwd !== 'string' || cwd.length === 0)
@@ -238,43 +330,46 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
     if (!inside(root, candidate))
         return diagnostic('PLAN_PATH_UNSAFE', 'plan path must be inside cwd');
     const relativePlan = path_1.default.relative(root, candidate).replace(/\\/g, '/');
-    const planFile = regularInside(root, relativePlan);
-    if (!planFile)
-        return diagnostic('PLAN_PATH_UNSAFE', 'plan path must be a contained regular non-symlink file');
     let bytes;
-    try {
-        if (fs_1.default.statSync(planFile).size > MAX_PLAN)
+    if (snapshot) {
+        if (snapshot.length > MAX_PLAN)
             return diagnostic('PLAN_LIMIT', 'plan exceeds maximum size');
-        bytes = fs_1.default.readFileSync(planFile);
+        bytes = Buffer.from(snapshot);
     }
-    catch {
-        return diagnostic('PLAN_READ', 'plan cannot be read');
+    else {
+        const planFile = regularInside(root, relativePlan);
+        if (!planFile)
+            return diagnostic('PLAN_PATH_UNSAFE', 'plan path must be a contained regular non-symlink file');
+        const planRead = readInspected(planFile, MAX_PLAN);
+        if (planRead.state === 'unsafe')
+            return diagnostic('PLAN_PATH_UNSAFE', 'plan path changed after inspection');
+        if (planRead.state === 'limit')
+            return diagnostic('PLAN_LIMIT', 'plan exceeds maximum size');
+        if (planRead.state === 'read')
+            return diagnostic('PLAN_READ', 'plan cannot be read');
+        bytes = planRead.bytes;
     }
     let text;
     try {
-        text = normalizeLineEndings(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        text = normalizeLineEndings(new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes));
     }
     catch {
         return diagnostic('PLAN_ENCODING', 'plan must be valid UTF-8');
     }
     const starts = count(text, START);
     const ends = count(text, END);
-    const signaled = starts > 0 || ends > 0 || compactSchemaSignal(text);
+    const signaled = starts > 0 || ends > 0 || count(text, START_V2) > 0 || count(text, END_V2) > 0 || compactSchemaSignal(text);
     if (!signaled)
-        return markerlessSchemaClassification(text) ?? { state: 'legacy' };
-    if (starts === 0 && ends === 0)
+        return markerlessSchemaClassification(text) ?? { state: 'migration-required', reason: 'unmarked-plan' };
+    const start = text.includes(START_V2) ? START_V2 : START;
+    const end = start === START_V2 ? END_V2 : END;
+    const startsForSchema = count(text, start);
+    const endsForSchema = count(text, end);
+    if (starts === 0 && ends === 0 && startsForSchema === 0 && endsForSchema === 0)
         return markerlessSchemaClassification(text) ?? diagnostic('PLAN_MARKERS', 'compact markers must occur once in order');
-    if (starts !== 1 || ends !== 1 || text.indexOf(START) > text.indexOf(END)) {
-        const partial = starts === 1 ? text.slice(text.indexOf(START) + START.length, ends ? text.indexOf(END) : undefined).trim() : '';
-        try {
-            const candidate = (0, json_1.parseJsonNoDuplicate)(partial);
-            if (object(candidate) && typeof candidate.schema === 'string' && Buffer.byteLength(candidate.schema, 'utf8') <= MAX_STRING && candidate.schema.startsWith('compact-slices/') && candidate.schema !== 'compact-slices/v1')
-                return unsupported(candidate.schema);
-        }
-        catch { /* invalid below */ }
+    if (startsForSchema !== 1 || endsForSchema !== 1 || text.indexOf(start) > text.indexOf(end) || (start === START && (count(text, START_V2) !== 0 || count(text, END_V2) !== 0)) || (start === START_V2 && (starts !== 0 || ends !== 0)))
         return diagnostic('PLAN_MARKERS', 'compact markers must occur once in order');
-    }
-    const body = text.slice(text.indexOf(START) + START.length, text.indexOf(END));
+    const body = text.slice(text.indexOf(start) + start.length, text.indexOf(end));
     if (Buffer.byteLength(body, 'utf8') > MAX_MANIFEST)
         return diagnostic('PLAN_LIMIT', 'manifest exceeds maximum size');
     let raw;
@@ -288,7 +383,7 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
         return diagnostic('PLAN_SHAPE', 'manifest must be an object');
     if (typeof raw.schema === 'string' && Buffer.byteLength(raw.schema, 'utf8') > MAX_STRING)
         return diagnostic('PLAN_LIMIT', 'schema exceeds maximum string size');
-    if (typeof raw.schema === 'string' && raw.schema.startsWith('compact-slices/') && raw.schema !== 'compact-slices/v1')
+    if (typeof raw.schema === 'string' && raw.schema.startsWith('compact-slices/') && raw.schema !== 'compact-slices/v1' && !(raw.schema === 'compact-slices/v2' && start === START_V2))
         return unsupported(raw.schema);
     if (!exact(raw, ['schema', 'planId', 'requirements', 'sources', 'commands', 'slices', 'closureCommands']))
         return diagnostic(Object.keys(raw).some((key) => !['schema', 'planId', 'requirements', 'sources', 'commands', 'slices', 'closureCommands'].includes(key)) ? 'PLAN_UNKNOWN_FIELD' : 'PLAN_MISSING_FIELD', 'manifest fields must exactly match the contract');
@@ -298,9 +393,9 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
         return diagnostic('PLAN_LIMIT', 'manifest exceeds collection limits');
     if (typeof raw.planId === 'string' && Buffer.byteLength(raw.planId, 'utf8') > MAX_STRING)
         return diagnostic('PLAN_LIMIT', 'plan id exceeds maximum string size');
-    if (raw.schema !== 'compact-slices/v1' || typeof raw.planId !== 'string' || !PLAN_ID.test(raw.planId) || !allStrings(raw.requirements) || new Set(raw.requirements).size !== raw.requirements.length)
+    if ((raw.schema !== 'compact-slices/v1' && raw.schema !== 'compact-slices/v2') || (raw.schema === 'compact-slices/v1' && start !== START) || (raw.schema === 'compact-slices/v2' && start !== START_V2) || typeof raw.planId !== 'string' || !PLAN_ID.test(raw.planId) || !allStrings(raw.requirements) || new Set(raw.requirements).size !== raw.requirements.length)
         return diagnostic('PLAN_SHAPE', 'manifest scalar fields are invalid');
-    if (raw.requirements.some((id) => !ID.test(id)) || !allStrings(raw.closureCommands) || new Set(raw.closureCommands).size !== raw.closureCommands.length)
+    if (raw.requirements.some((id) => !validRequirementId(id)) || !allStrings(raw.closureCommands) || new Set(raw.closureCommands).size !== raw.closureCommands.length)
         return diagnostic('PLAN_SHAPE', 'manifest arrays or identifiers are invalid');
     const sourceIds = new Set();
     for (const source of raw.sources) {
@@ -310,18 +405,16 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
         const file = regularInside(root, source.path);
         if (!file)
             return diagnostic('PLAN_SOURCE_UNSAFE', 'source path must be a contained regular non-symlink file');
-        let bytes;
-        try {
-            if (fs_1.default.statSync(file).size > MAX_SOURCE)
-                return diagnostic('PLAN_SOURCE_LIMIT', 'source exceeds maximum size');
-            bytes = fs_1.default.readFileSync(file);
-        }
-        catch {
+        const sourceRead = readInspected(file, MAX_SOURCE);
+        if (sourceRead.state === 'unsafe')
+            return diagnostic('PLAN_SOURCE_UNSAFE', 'source path changed after inspection');
+        if (sourceRead.state === 'limit')
+            return diagnostic('PLAN_SOURCE_LIMIT', 'source exceeds maximum size');
+        if (sourceRead.state === 'read')
             return diagnostic('PLAN_SOURCE_UNSAFE', 'source cannot be read');
-        }
         let contents;
         try {
-            contents = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+            contents = new TextDecoder('utf-8', { fatal: true }).decode(sourceRead.bytes);
         }
         catch {
             return diagnostic('PLAN_SOURCE_ENCODING', 'source must be valid UTF-8');
@@ -332,7 +425,7 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
     const commandIds = new Set();
     const closureIds = new Set(raw.closureCommands);
     for (const command of raw.commands) {
-        if (!exact(command, ['id', 'program', 'args', 'covers']) || !validId(command.id) || commandIds.has(command.id) || typeof command.program !== 'string' || command.program.length === 0 || Buffer.byteLength(command.program, 'utf8') > MAX_STRING || !allStrings(command.args) || command.args.length > 128 || !allStrings(command.covers) || new Set(command.covers).size !== command.covers.length || (command.covers.length === 0 && !closureIds.has(command.id)) || command.covers.some((id) => !raw.requirements.includes(id)))
+        if (!exact(command, ['id', 'program', 'args', 'covers']) || !validId(command.id) || commandIds.has(command.id) || typeof command.program !== 'string' || command.program.length === 0 || Buffer.byteLength(command.program, 'utf8') > MAX_STRING || !allStrings(command.args) || command.args.length > 128 || !allStrings(command.covers) || new Set(command.covers).size !== command.covers.length || (command.covers.length === 0 && !closureIds.has(command.id)) || command.covers.some((id) => !validRequirementId(id) || !raw.requirements.includes(id)))
             return diagnostic('PLAN_COMMAND_SHAPE', 'command fields are invalid');
         commandIds.add(command.id);
         const program = command.program;
@@ -343,8 +436,9 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
     }
     const sliceIds = new Set();
     const owners = new Map();
+    const sliceFields = ['id', 'title', 'requirements', 'dependsOn', 'sectionAnchor', 'sources', 'redCommands', 'greenCommands', 'reviewEvidence', 'risk', 'fallback'];
     for (const slice of raw.slices) {
-        if (!exact(slice, ['id', 'title', 'requirements', 'dependsOn', 'sectionAnchor', 'sources', 'redCommands', 'greenCommands', 'reviewEvidence', 'risk', 'fallback']) || !validId(slice.id) || sliceIds.has(slice.id) || typeof slice.title !== 'string' || slice.title.length === 0 || Buffer.byteLength(slice.title, 'utf8') > MAX_STRING || !allStrings(slice.requirements) || slice.requirements.length === 0 || slice.requirements.some((id) => !raw.requirements.includes(id)) || !allStrings(slice.dependsOn) || typeof slice.sectionAnchor !== 'string' || slice.sectionAnchor.length === 0 || Buffer.byteLength(slice.sectionAnchor, 'utf8') > MAX_STRING || !uniqueRefs(slice.sources, sourceIds) || !uniqueRefs(slice.redCommands, commandIds) || slice.redCommands.length === 0 || !uniqueRefs(slice.greenCommands, commandIds) || slice.greenCommands.length === 0 || !allStrings(slice.fallback) || slice.fallback.length === 0 || slice.fallback.some((item) => item.trim().length === 0) || slice.risk !== 'bounded' && slice.risk !== 'full-context')
+        if (!exact(slice, raw.schema === 'compact-slices/v2' ? [...sliceFields, 'implementerProfile'] : sliceFields) || (raw.schema === 'compact-slices/v2' && !['mechanical', 'integration', 'judgment'].includes(slice.implementerProfile)) || !validId(slice.id) || sliceIds.has(slice.id) || typeof slice.title !== 'string' || slice.title.length === 0 || Buffer.byteLength(slice.title, 'utf8') > MAX_STRING || !allStrings(slice.requirements) || slice.requirements.length === 0 || slice.requirements.some((id) => !validRequirementId(id) || !raw.requirements.includes(id)) || !allStrings(slice.dependsOn) || typeof slice.sectionAnchor !== 'string' || slice.sectionAnchor.length === 0 || Buffer.byteLength(slice.sectionAnchor, 'utf8') > MAX_STRING || !uniqueRefs(slice.sources, sourceIds) || !uniqueRefs(slice.redCommands, commandIds) || slice.redCommands.length === 0 || !uniqueRefs(slice.greenCommands, commandIds) || slice.greenCommands.length === 0 || !allStrings(slice.fallback) || slice.fallback.length === 0 || slice.fallback.some((item) => item.trim().length === 0) || slice.risk !== 'bounded' && slice.risk !== 'full-context')
             return diagnostic('PLAN_SLICE_SHAPE', 'slice fields are invalid');
         sliceIds.add(slice.id);
         if (!Array.isArray(slice.reviewEvidence) || slice.reviewEvidence.length !== 2 || new Set(slice.reviewEvidence).size !== 2 || !slice.reviewEvidence.includes('specification') || !slice.reviewEvidence.includes('code-quality'))
@@ -389,5 +483,24 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
     const markdown = checkMarkdown(text, slices);
     if (markdown)
         return markdown;
-    return { state: 'valid', schema: 'compact-slices/v1', manifest: raw };
+    const report = {
+        state: 'valid', schema: raw.schema,
+        planDigest: crypto_1.default.createHash('sha256').update(text, 'utf8').digest('hex'),
+        executionDigest: (0, identity_1.executionPlanDigest)(text),
+        manifest: raw, executionMode: executionModeFromValidatedText(text),
+    };
+    freezeJson(report);
+    verifiedValidReports.add(report);
+    verifiedSnapshots.set(report, text);
+    return report;
+}
+/** Read-only validator for a bounded compact-slices/v1 Markdown plan. */
+function validatePlanFile(planPath, cwd = process.cwd()) {
+    return validatePlan(planPath, cwd);
+}
+/** Validate an already-authenticated plan snapshot without reopening planPath. */
+function validatePlanSnapshot(planPath, cwd, text) {
+    if (typeof text !== 'string')
+        throw new Error('plan snapshot must be text');
+    return validatePlan(planPath, cwd, Buffer.from(text, 'utf8'));
 }

package/dist/src/index.js

@@ -46,6 +46,7 @@ const track_1 = require("./commands/track");
 const evidence_1 = require("./commands/evidence");
 const process_1 = require("./commands/process");
 const context_1 = require("./commands/context");
+const model_policy_1 = require("./commands/model-policy");
 const add_1 = require("./commands/add");
 const sync_1 = require("./commands/sync");
 const update_1 = require("./commands/update");
@@ -54,6 +55,7 @@ const update_check_1 = require("./core/update-check");
 const cli_version_1 = require("./core/cli-version");
 exports.program = new commander_1.Command();
 exports.program.name('awm').description('Agentic Workflow Manager').version((0, cli_version_1.cliVersion)());
+(0, model_policy_1.registerModelPolicyCommand)(exports.program);
 exports.program.hook('postAction', (_command, actionCommand) => {
     if (actionCommand.name() === 'preflight')
         return;

package/dist/tests/commands/job/exec-wrapper.test.js

@@ -17,6 +17,22 @@ describe('exec-wrapper', () => {
     let dir;
     beforeEach(() => { dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-wrap-')); });
     afterEach(() => { fs_1.default.rmSync(dir, { recursive: true, force: true }); });
+    test.each(['../escape', '..\\escape', '/escape', 'C:\\escape', '', '.', '..', 'sentinel\n', 'x'.repeat(129)])('rejects unsafe sidecar components before writes (%#)', async (value) => {
+        for (const helper of [exec_wrapper_1.claimPath, exec_wrapper_1.identityPath, exec_wrapper_1.resultPath, exec_wrapper_1.logPath, exec_wrapper_1.replayVerdict]) {
+            expect(() => helper(dir, value, 'nonce')).toThrow(/sidecar/);
+            expect(() => helper(dir, 'job', value)).toThrow(/sidecar/);
+        }
+        await expect((0, exec_wrapper_1.runExecWrapper)({ logsRoot: path_1.default.join(dir, 'unused'), jobId: value, nonce: 'nonce', argv: ['node', '-e', 'process.exit(0)'], cwd: '.' })).rejects.toThrow(/sidecar/);
+        expect(fs_1.default.readdirSync(dir)).toEqual([]);
+    });
+    test.each([
+        { argv: ['node'], cwd: '../escape' },
+        { argv: [undefined], cwd: '.' },
+        { argv: ['node', 'sentinel\u0000'], cwd: '.' },
+    ])('rejects invalid execution inputs before sidecar writes (%#)', async (inputs) => {
+        await expect((0, exec_wrapper_1.runExecWrapper)({ logsRoot: path_1.default.join(dir, 'unused'), jobId: 'job', nonce: 'nonce', repoRoot: dir, ...inputs })).rejects.toThrow();
+        expect(fs_1.default.readdirSync(dir)).toEqual([]);
+    });
     test('claim + identity sidecar + resultado terminal atomico (R1.8)', async () => {
         const out = await (0, exec_wrapper_1.runExecWrapper)({ logsRoot: dir, jobId: 'job1', nonce: 'nonceA', argv: ['node', '-e', 'setTimeout(()=>process.exit(0), 300)'], cwd: '.' });
         expect(out.exitCode).toBe(0);