agy-worker-mcp 0.3.1

package/dist/gate/bind.js

@@ -0,0 +1,154 @@
+import { closeSync, existsSync, openSync, readSync } from 'node:fs';
+import { jobPaths, readJsonIfExists } from '../contract/paths.js';
+import { listJobs, tryGetJob } from '../store/jobs.js';
+import { bindConversationId, findSessionByConversation } from '../store/sessions.js';
+/**
+ * Map a hook payload's `conversationId` onto one of our jobs (see docs/permissions.md).
+ *
+ * With no daemon there is nobody to build the mapping ahead of time, so the gate
+ * builds it itself: take the live jobs, read the **first line only** of each
+ * candidate's `events.ndjson`, and compare `conversation_id`. That line exists
+ * before any tool call because `init` is always first, so there is no guess
+ * and no race.
+ *
+ * `workspacePaths` alone is not enough — several jobs can share a workspace.
+ */
+/**
+ * Binding candidates (`starting`/`running`; `queued` and
+ * `canceling` are included defensively). The runner only ever reaches the DB's
+ * `jobs.lifecycle` through `reconcile`'s absorption of `state.json` (finding 1/9),
+ * which can lag the gate hook firing for a job the server has not touched again
+ * since `agy_start` — `queued` covers that lag. `canceling` keeps a job bound
+ * (so its policy keeps applying) after `on_denial: 'abort'` marks it (finding 13).
+ */
+const BIND_LIFECYCLES = ['queued', 'starting', 'running', 'canceling'];
+/**
+ * Null means "not one of ours" — a user's own interactive agy session.
+ *
+ * ⚠ That case must produce `{"decision":"ask"}`, never `{}`. `{}` is a denial
+ * (§9) and would break every interactive session on the machine.
+ */
+export function bindConversation(store, conversationId) {
+    const cached = lookupBoundJob(store, conversationId);
+    if (cached) {
+        const policy = loadJobPolicy(store, cached.job_id);
+        if (policy)
+            return { job: cached, policy, conversationId };
+        // policy.json missing for a job we thought was bound: fall through and
+        // re-scan rather than reporting a broken binding as "not ours".
+    }
+    const candidates = listJobs(store, { lifecycle: [...BIND_LIFECYCLES], limit: 10000 });
+    for (const job of candidates) {
+        const seen = readInitConversationId(store, job.job_id);
+        if (seen !== null && seen === conversationId) {
+            recordBinding(store, job.job_id, conversationId);
+            const policy = loadJobPolicy(store, job.job_id);
+            if (!policy)
+                return null;
+            return { job, policy, conversationId };
+        }
+    }
+    return null;
+}
+/**
+ * Persist the mapping so later calls skip the file scan. Also fills in
+ * `sessions.conversation_id` when it was still NULL.
+ */
+export function recordBinding(store, jobId, conversationId) {
+    const job = tryGetJob(store, jobId);
+    if (!job || !job.session_id)
+        return;
+    try {
+        bindConversationId(store, job.session_id, conversationId);
+    }
+    catch {
+        // Best effort. A lost race here just means the next hook call scans again.
+    }
+}
+/** Cached lookup for a conversation already bound in a previous hook invocation. */
+export function lookupBoundJob(store, conversationId) {
+    const session = findSessionByConversation(store, conversationId);
+    if (!session)
+        return null;
+    const jobs = listJobs(store, {
+        sessionId: session.session_id,
+        lifecycle: [...BIND_LIFECYCLES],
+        limit: 1,
+    });
+    return jobs[0] ?? null;
+}
+/**
+ * Load `jobs/<id>/policy.json`. Null when it is missing or unreadable.
+ *
+ * Defaults bypass_sandbox to false if missing (fail closed).
+ */
+export function loadJobPolicy(store, jobId) {
+    const paths = jobPaths(store.paths, jobId);
+    const raw = readJsonIfExists(paths.policy);
+    if (!raw)
+        return null;
+    return {
+        ...raw,
+        max_denials: typeof raw.max_denials === 'number' ? raw.max_denials : null,
+        bypass_sandbox: typeof raw.bypass_sandbox === 'boolean' ? raw.bypass_sandbox : false,
+        sandbox_forced_by: raw.sandbox_forced_by ?? null,
+        // Fail closed the same way bypass_sandbox does: a policy file without
+        // `sandbox` (pre-0.3.0) reads as agy's sandbox unless it said bypass.
+        sandbox: raw.sandbox === 'none' || raw.sandbox === 'seatbelt' || raw.sandbox === 'agy'
+            ? raw.sandbox
+            : raw.bypass_sandbox === true
+                ? 'none'
+                : 'agy',
+        sandbox_source: raw.sandbox_source ?? 'default',
+        seatbelt_write_roots: Array.isArray(raw.seatbelt_write_roots) ? raw.seatbelt_write_roots : [raw.workspace],
+        add_dirs: Array.isArray(raw.add_dirs) ? raw.add_dirs : Array.isArray(raw.additional_dirs) ? raw.additional_dirs : [],
+        add_dirs_source: raw.add_dirs_source ?? 'none',
+        command_policy: raw.command_policy === 'denylist' ? 'denylist' : 'allowlist',
+        lifted: Array.isArray(raw.lifted) ? raw.lifted : [],
+        ceiling_present: typeof raw.ceiling_present === 'boolean' ? raw.ceiling_present : true,
+        ceiling_path: typeof raw.ceiling_path === 'string' ? raw.ceiling_path : null,
+        policy_version: 3,
+    };
+}
+/**
+ * Reads only the first line of `events.ndjson` (well, the first ~8KB, which is
+ * always enough — `init` is a small fixed-shape object) and pulls
+ * `conversation_id` out of it. Never throws; a job whose events file does not
+ * exist yet simply is not a binding candidate this call.
+ */
+function readInitConversationId(store, jobId) {
+    const path = jobPaths(store.paths, jobId).events;
+    if (!existsSync(path))
+        return null;
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+    }
+    catch {
+        return null;
+    }
+    try {
+        const chunkSize = 8192;
+        const buf = Buffer.alloc(chunkSize);
+        const bytesRead = readSync(fd, buf, 0, chunkSize, 0);
+        if (bytesRead <= 0)
+            return null;
+        const text = buf.toString('utf8', 0, bytesRead);
+        const newlineIdx = text.indexOf('\n');
+        const line = newlineIdx >= 0 ? text.slice(0, newlineIdx) : text;
+        if (!line.trim())
+            return null;
+        const parsed = JSON.parse(line);
+        if (parsed.event === 'init' && typeof parsed.conversation_id === 'string') {
+            return parsed.conversation_id;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+//# sourceMappingURL=bind.js.map

package/dist/gate/bind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bind.js","sourceRoot":"","sources":["../../src/gate/bind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEnE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAGjE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAEpF;;;;;;;;;;GAUG;AAEH;;;;;;;GAOG;AACH,MAAM,eAAe,GAAyB,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;AAQ5F;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAY,EAAE,cAAsB;IACnE,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,CAAA;IACpD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QAC1D,uEAAuE;QACvE,gEAAgE;IAClE,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACrF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QACtD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC7C,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;YAChD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAC/C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QACxC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAY,EAAE,KAAa,EAAE,cAAsB;IAC/E,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACnC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAM;IACnC,IAAI,CAAC;QACH,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,KAAY,EAAE,cAAsB;IACjE,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAA;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE;QAC3B,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,SAAS,EAAE,CAAC,GAAG,eAAe,CAAC;QAC/B,KAAK,EAAE,CAAC;KACT,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAY,EAAE,KAAa;IACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,gBAAgB,CAAmD,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5F,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,OAAO;QACL,GAAG,GAAG;QACN,WAAW,EAAE,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACzE,cAAc,EAAE,OAAO,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK;QACpF,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI;QAChD,sEAAsE;QACtE,sEAAsE;QACtE,OAAO,EACL,GAAG,CAAC,OAAO,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,UAAU,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;YAC3E,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI;gBAC3B,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,KAAK;QACb,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;QAC/C,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QAC1G,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;QACpH,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,MAAM;QAC9C,cAAc,EAAE,GAAG,CAAC,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;QAC5E,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACnD,eAAe,EAAE,OAAO,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI;QACtF,YAAY,EAAE,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QAC5E,cAAc,EAAE,CAAC;KAClB,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,KAAY,EAAE,KAAa;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,CAAA;IAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,IAAI,EAAU,CAAA;IACd,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAA;QACtB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;QACpD,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAE/B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiD,CAAA;QAC/E,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;YAC1E,OAAO,MAAM,CAAC,eAAe,CAAA;QAC/B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAA;IACf,CAAC;AACH,CAAC"}

package/dist/gate/gate.d.ts

@@ -0,0 +1,139 @@
+import type { EffectivePolicy, GateDecision, GateLogEntry, GatePayload } from '../contract/types.js';
+import type { BoundJob } from './bind.js';
+/**
+ * The PreToolUse hook. Spawned fresh for every single tool call, so it must stay
+ * cheap — no warm caches, no heavy imports, no network.
+ *
+ * ⚠⚠ The one absolute rule of this file: **something with a `decision` field must
+ * reach stdout on every path.** `{}` and empty output are denials (§9). A crash,
+ * a JSON parse failure, a locked database, a missing job — all of them must still
+ * print a `decision`. This is the only code in the package that can affect
+ * anything outside our own jobs; getting it wrong breaks the user's interactive
+ * agy sessions machine-wide.
+ *
+ * That decision is not always `ask` any more (0.2.0, I1/I3). A *bound* job's gate never answers
+ * `ask` — every tool call is either allowed or denied, and any failure once we
+ * know a call is ours becomes `deny`, not a silent pass-through. `ask` survives
+ * only for the two cases where we genuinely cannot tell whose call this is: a
+ * payload we could not parse at all, and a `conversationId` that binds to none
+ * of our jobs (someone's own interactive agy session, which this package must
+ * never touch). Failing `ask` there is still correct because agy itself fails
+ * closed on anything else a hook can produce — a non-zero exit or output that
+ * does not parse as JSON is a *denial*, not a pass-through (measured against
+ * 1.1.23, §9) — so `ask` in print mode is the one output that reliably reaches
+ * agy's own built-in engine and, for a job we cannot identify, that engine's
+ * ordinary confirmation-under-`--dangerously-skip-permissions` behaviour is
+ * exactly what the user asked for by running their own session (M3-C:
+ * with no `overwrite.BypassSandbox`, the model's own value wins).
+ */
+/** The safe pass-through. Delegates to agy's built-in engine. Never `{}`. */
+export declare const PASSTHROUGH: GateDecision;
+export interface GateDecideInput {
+    payload: GatePayload;
+    /** Null when the conversation is not one of ours. */
+    bound: BoundJob | null;
+}
+export interface GateOutcome {
+    decision: GateDecision;
+    /** Row to append to `gate-log.jsonl`; null when we are not logging (unbound). */
+    log: GateLogEntry | null;
+    /** True when `on_denial === 'abort'` and this call was denied. */
+    requestsAbort: boolean;
+}
+/**
+ * Pure decision function — no I/O, so it is exhaustively testable.
+ *
+ * Order is fixed (see docs/permissions.md) and each step matters:
+ *
+ * 1. `bound === null` → `ask`, return immediately. Not our job (§1.3 step 1).
+ * 2. `unsupported` (unclassifiable tool, or a subagent tool — M2) → `deny`,
+ *    `required_rule: null`.
+ * 3. `control` (`manage_task`) → `allow`, no overwrite.
+ * 4. containment (write outside `write_roots` or into `{workspace}/.agents`
+ *    — I6; read outside `read_roots`) → `deny`, ahead of every rule list.
+ * 5. deny list matches → `deny`.
+ * 6. allow list matches → `allow`; `run_command` additionally pins
+ *    `overwrite.Cwd` and sets `overwrite.BypassSandbox` from `policy.bypass_sandbox`
+ *    (I2) — every allow explicitly decides sandboxing, never leaves it to the
+ *    model (M3 variant C: an unset overwrite lets the model's own value win).
+ * 7. otherwise → `deny`, `required_rule` filled in. I1: a bound job's gate
+ *    never answers `ask` — `default_decision` is gone.
+ *
+ * A `deny` reason is an instruction channel, not an explanation: agy hands the
+ * string to the model verbatim (§10), so it should name the permitted alternative
+ * and carry a parsable `GATE_DENIAL_MARKER` payload for the broker.
+ */
+export declare function decide(input: GateDecideInput): GateOutcome;
+/**
+ * The `overwrite` every allowed `run_command` carries. `Cwd` is pinned to the
+ * workspace and `BypassSandbox` is always explicit (I2, M3 variant C). Under
+ * `sandbox: 'seatbelt'` the command itself is rewritten to run inside our own
+ * write-only profile (M9: `overwrite.CommandLine` is honoured by agy; the
+ * model and the event stream still see the original) with agy's sandbox off.
+ */
+export declare function commandOverwrite(policy: EffectivePolicy, commandLine: string): {
+    Cwd: string;
+    BypassSandbox: boolean;
+    CommandLine?: string;
+};
+/**
+ * Count the number of 'deny' decisions in a gate-log.jsonl content string.
+ * Tolerates empty strings, trailing newlines, and malformed lines.
+ */
+export declare function countDeniesInGateLog(text: string): number;
+/** Read stdin to EOF. Returns null on any failure — the caller then passes through. */
+export declare function readStdin(): string | null;
+/** Tolerant payload parse. Null when the shape is unusable; never throws. */
+export declare function parsePayload(raw: string | null): GatePayload | null;
+/**
+ * Make stdout write-once and pollution-proof.
+ *
+ * Measured against agy 1.1.23: a hook that exits 0 but whose stdout does not
+ * parse is a DENIAL, not a passthrough —
+ *   failed to unmarshal result from hook ... via protojson: not json at all
+ * and this process always exits 0 (see `src/gate.ts`), so the
+ * `|| printf '{"decision":"ask"}'` fallback in `hooks.json` — which only fires
+ * on a non-zero exit — cannot cover it. One stray `console.log` from anywhere
+ * in the import graph would therefore deny every tool call in the workspace,
+ * including the user's own interactive agy sessions.
+ *
+ * So: everything except {@link emit} is swallowed, and only the first decision
+ * is written.
+ */
+export declare function guardStdout(): void;
+export declare function emit(decision: GateDecision): void;
+/** Test seam: `emitted` is module state and every test needs a clean one. */
+export declare function resetEmitForTests(): void;
+/** Append to `gate-log.jsonl`. Every verdict is recorded, allows included (§1.8). */
+export declare function logDecision(jobDir: string, entry: GateLogEntry): void;
+/**
+ * `dist/gate.js` entry point.
+ *
+ * Always resolves 0 — a non-zero exit from a hook is not a documented signal,
+ * and we must not find out what agy does with one. Emits exactly once: the
+ * decision is computed and everything that can fail (DB access, binding,
+ * logging, the `on_denial: 'abort'` mark) is contained in a try/catch that
+ * runs *before* `emit`, and everything after `emit` is itself wrapped so a
+ * failure there can never produce a second line on stdout.
+ *
+ * Failure paths (not all of them are
+ * `ask` any more, since I1 only protects a *bound* job's decision, not the
+ * gate process's own health):
+ *   - unparsable payload → `ask` (we cannot even tell whose call this is —
+ *     handled above, before this function's own try/catch begins).
+ *   - the store cannot be opened at all → `deny`, `state unavailable`. A
+ *     broken `AGY_WORKER_HOME`/project dir means we cannot tell bound from
+ *     unbound either, but unlike a parse failure this is *our* infrastructure
+ *     breaking, not a payload shape we cannot read — failing open here would
+ *     mean every tool call in every workspace runs unguarded the moment our
+ *     own state directory has a problem.
+ *   - `bindConversation` resolves and the conversation is not one of ours →
+ *     `ask` (unchanged; `decide()` returns `PASSTHROUGH` for `bound === null`
+ *     without throwing, so this falls out of the ordinary call below).
+ *   - the store opened and anything after that throws → `deny`, `internal
+ *     error`. By this point we hold a real, open connection; failing closed
+ *     is strictly safer than guessing `ask` and letting agy's own engine (or
+ *     the model, per M3-C) decide unsupervised.
+ */
+export declare function main(): Promise<number>;
+//# sourceMappingURL=gate.d.ts.map

package/dist/gate/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/gate/gate.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,eAAe,EACf,YAAY,EAGZ,YAAY,EACZ,WAAW,EAEZ,MAAM,sBAAsB,CAAA;AAM7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAKzC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,WAAW,EAAE,YAAkC,CAAA;AAE5D,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,WAAW,CAAA;IACpB,qDAAqD;IACrD,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,YAAY,CAAA;IACtB,iFAAiF;IACjF,GAAG,EAAE,YAAY,GAAG,IAAI,CAAA;IACxB,kEAAkE;IAClE,aAAa,EAAE,OAAO,CAAA;CACvB;AAeD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,WAAW,CAwO1D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,EACvB,WAAW,EAAE,MAAM,GAClB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAS/D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiBzD;AAED,uFAAuF;AACvF,wBAAgB,SAAS,IAAI,MAAM,GAAG,IAAI,CAMzC;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,GAAG,IAAI,CAkCnE;AAWD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAUlC;AAED,wBAAgB,IAAI,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAIjD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAErE;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAkG5C"}