apex-code 0.0.1-alpha.9 → 0.0.4

package/dist/core/policy-executor.js

@@ -0,0 +1,228 @@
+/**
+ * VF.3: the bounded argv command executor (spec
+ * 2026-09-01-configured-verification-and-formatting.md § 2). Runs a
+ * `CommandPolicy` from the VF.2 loader verbatim: executable + argv spawn
+ * with no shell, under the policy's numeric bounds, with process-tree
+ * termination on timeout and cancellation. Outcomes are structured values;
+ * a command that merely fails is data, never a throw.
+ *
+ * Trusting the loader: this module does NOT re-validate policy fields the
+ * loader already guarantees (numeric bounds, shell:false, argv shapes). The
+ * one defensive re-check is the cwd confinement, because a resolved path is
+ * cheap to verify and the worst failure here is running outside the
+ * workspace.
+ */
+import { spawn } from "node:child_process";
+import { isAbsolute, relative, resolve } from "node:path";
+import { killProcessTree, sanitizeBinaryOutput } from "../utils/shell.js";
+/** Hard retention ceiling for artifact bytes, independent of policy caps. */
+const MAX_RETENTION_BYTES = 8 * 1024 * 1024;
+function newStream() {
+    return { chunks: [], bytes: 0, window: [], truncated: false };
+}
+function capture(stream, chunk, capBytes) {
+    stream.bytes += chunk.byteLength;
+    if (stream.bytes > capBytes) {
+        stream.truncated = true;
+    }
+    const retentionTotal = stream.chunks.reduce((sum, part) => sum + part.byteLength, 0);
+    if (retentionTotal < MAX_RETENTION_BYTES) {
+        stream.chunks.push(chunk);
+    }
+    // Keep the excerpt window bounded to the last capBytes so it shows the
+    // most recent output, not the start.
+    stream.window.push(chunk);
+    const windowTotal = stream.window.reduce((sum, part) => sum + part.byteLength, 0);
+    if (windowTotal > capBytes) {
+        stream.truncated = true;
+        let drop = windowTotal - capBytes;
+        while (drop > 0 && stream.window.length > 0) {
+            const first = stream.window[0];
+            if (first.byteLength <= drop) {
+                drop -= first.byteLength;
+                stream.window.shift();
+            }
+            else {
+                stream.window[0] = first.subarray(drop);
+                drop = 0;
+            }
+        }
+    }
+}
+function decode(stream) {
+    return sanitizeBinaryOutput(Buffer.concat(stream.window).toString("utf-8"));
+}
+function excerptFor(stdout, stderr, policy) {
+    const sections = [];
+    const stdoutText = decode(stdout);
+    const stderrText = decode(stderr);
+    if (stdoutText.length > 0) {
+        sections.push(stdoutText);
+    }
+    if (stderrText.length > 0) {
+        sections.push(stderrText);
+    }
+    const combined = sections.join("\n");
+    const lines = combined.split("\n");
+    if (lines.length > policy.maxOutputLines) {
+        // The notice lives INSIDE the budget: the excerpt never exceeds
+        // maxOutputLines lines in total.
+        return [
+            ...lines.slice(0, policy.maxOutputLines - 1),
+            `<${lines.length - policy.maxOutputLines + 1} more lines truncated>`,
+        ].join("\n");
+    }
+    return combined;
+}
+export async function runPolicyCommand(command, options) {
+    const started = Date.now();
+    const base = {
+        policyId: command.id,
+        executable: command.executable,
+        argv: command.argv,
+    };
+    if (options.signal?.aborted) {
+        return {
+            ...base,
+            argv: base.argv,
+            cwd: options.workspaceRoot,
+            durationMs: 0,
+            status: "cancelled",
+            truncated: false,
+            stdoutBytes: 0,
+            stderrBytes: 0,
+            outputExcerpt: "",
+            refusalReason: "cancelled before the command started",
+        };
+    }
+    // Defense in depth against a cwd escaping the workspace. The loader
+    // already rejects absolute paths and ".." segments; resolve() here is the
+    // second gate, on the computed path rather than the configured string.
+    const cwd = command.cwd === "workspace" ? options.workspaceRoot : resolve(options.workspaceRoot, command.cwd);
+    // The containment check uses relative() — a startsWith string comparison
+    // breaks on Windows, where resolve() switches to backslash separators.
+    const containmentRoot = resolve(options.workspaceRoot);
+    const containmentRel = relative(containmentRoot, cwd);
+    const insideWorkspace = containmentRel === "" || (!containmentRel.startsWith("..") && !isAbsolute(containmentRel));
+    if (!insideWorkspace) {
+        return {
+            ...base,
+            cwd,
+            durationMs: 0,
+            status: "refused",
+            truncated: false,
+            stdoutBytes: 0,
+            stderrBytes: 0,
+            outputExcerpt: "",
+            refusalReason: `cwd ${command.cwd} resolves outside the workspace`,
+        };
+    }
+    return await new Promise((resolveRun) => {
+        let child;
+        try {
+            child = spawn(command.executable, command.argv, {
+                cwd,
+                shell: false,
+                detached: true,
+                windowsHide: true,
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+        }
+        catch (error) {
+            resolveRun({
+                ...base,
+                cwd,
+                durationMs: Date.now() - started,
+                status: "spawn-failed",
+                truncated: false,
+                stdoutBytes: 0,
+                stderrBytes: 0,
+                outputExcerpt: "",
+                refusalReason: error instanceof Error ? error.message : String(error),
+            });
+            return;
+        }
+        const stdout = newStream();
+        const stderr = newStream();
+        let settled = false;
+        let killed;
+        let spawnError;
+        const finish = (extra) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(timer);
+            options.signal?.removeEventListener("abort", onAbort);
+            const outputExcerpt = excerptFor(stdout, stderr, command);
+            // Only stdout: the artifact is the raw stream. Both streams: a
+            // stderr section is appended so the raw stdout bytes stay intact.
+            const retained = [...stdout.chunks];
+            if (stderr.chunks.length > 0) {
+                if (retained.length > 0) {
+                    retained.push(Buffer.from("\n"));
+                }
+                retained.push(Buffer.from("stderr:\n"), ...stderr.chunks);
+            }
+            const artifactPromise = options.artifactStore && retained.length > 0
+                ? options.artifactStore.writeArtifact(Buffer.concat(retained)).catch(() => undefined)
+                : Promise.resolve(undefined);
+            void artifactPromise.then((artifact) => {
+                resolveRun({
+                    ...base,
+                    cwd,
+                    durationMs: Date.now() - started,
+                    truncated: stdout.truncated || stderr.truncated,
+                    stdoutBytes: stdout.bytes,
+                    stderrBytes: stderr.bytes,
+                    outputExcerpt,
+                    ...(artifact !== undefined ? { artifact } : {}),
+                    ...extra,
+                });
+            });
+        };
+        const onAbort = () => {
+            if (settled || child.pid === undefined) {
+                return;
+            }
+            killed = "cancelled";
+            killProcessTree(child.pid);
+        };
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        const timer = setTimeout(() => {
+            if (settled || child.pid === undefined) {
+                return;
+            }
+            killed = "timeout";
+            killProcessTree(child.pid);
+        }, command.timeoutMs);
+        child.once("error", (error) => {
+            spawnError = error;
+        });
+        child.stdout?.on("data", (chunk) => capture(stdout, chunk, command.maxOutputBytes));
+        child.stderr?.on("data", (chunk) => capture(stderr, chunk, command.maxOutputBytes));
+        child.once("close", (code, termSignal) => {
+            if (spawnError !== undefined) {
+                finish({
+                    status: "spawn-failed",
+                    refusalReason: spawnError.message,
+                });
+                return;
+            }
+            if (killed === "timeout") {
+                finish({ status: "timeout", ...(termSignal ? { signal: termSignal } : {}) });
+                return;
+            }
+            if (killed === "cancelled") {
+                finish({ status: "cancelled", ...(termSignal ? { signal: termSignal } : {}) });
+                return;
+            }
+            finish({
+                status: code === 0 ? "passed" : "failed",
+                ...(code !== null ? { exitCode: code } : {}),
+                ...(termSignal ? { signal: termSignal } : {}),
+            });
+        });
+    });
+}
+//# sourceMappingURL=policy-executor.js.map

package/dist/core/policy-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-executor.js","sourceRoot":"","sources":["../../src/core/policy-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AA0C1E,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAY5C,SAAS,SAAS,GAAmB;IACpC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAAA,CAC9D;AAED,SAAS,OAAO,CAAC,MAAsB,EAAE,KAAa,EAAE,QAAgB,EAAQ;IAC/E,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;IACjC,IAAI,MAAM,CAAC,KAAK,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACrF,IAAI,cAAc,GAAG,mBAAmB,EAAE,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,uEAAuE;IACvE,qCAAqC;IACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAClF,IAAI,WAAW,GAAG,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,IAAI,IAAI,GAAG,WAAW,GAAG,QAAQ,CAAC;QAClC,OAAO,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAC9B,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;gBACzB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,GAAG,CAAC,CAAC;YACV,CAAC;QACF,CAAC;IACF,CAAC;AAAA,CACD;AAED,SAAS,MAAM,CAAC,MAAsB,EAAU;IAC/C,OAAO,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,UAAU,CAAC,MAAsB,EAAE,MAAsB,EAAE,MAAqB,EAAU;IAClG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1C,gEAAgE;QAChE,iCAAiC;QACjC,OAAO;YACN,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,cAAc,GAAG,CAAC,wBAAwB;SACpE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAsB,EAAE,OAAyB,EAA6B;IACpH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG;QACZ,QAAQ,EAAE,OAAO,CAAC,EAAE;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;KAClB,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,OAAO;YACN,GAAG,IAAI;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,OAAO,CAAC,aAAa;YAC1B,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,EAAE;YACjB,aAAa,EAAE,sCAAsC;SACrD,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9G,2EAAyE;IACzE,uEAAuE;IACvE,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,cAAc,KAAK,EAAE,IAAI,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IACnH,IAAI,CAAC,eAAe,EAAE,CAAC;QACtB,OAAO;YACN,GAAG,IAAI;YACP,GAAG;YACH,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,EAAE;YACjB,aAAa,EAAE,OAAO,OAAO,CAAC,GAAG,iCAAiC;SAClE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAmB,CAAC,UAAU,EAAE,EAAE,CAAC;QAC1D,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACJ,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE;gBAC/C,GAAG;gBACH,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,IAAI;gBACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aACjC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC;gBACV,GAAG,IAAI;gBACP,GAAG;gBACH,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM,EAAE,cAAc;gBACtB,SAAS,EAAE,KAAK;gBAChB,WAAW,EAAE,CAAC;gBACd,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,EAAE;gBACjB,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACrE,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,MAA2C,CAAC;QAChD,IAAI,UAA6B,CAAC;QAElC,MAAM,MAAM,GAAG,CAAC,KAA8D,EAAE,EAAE,CAAC;YAClF,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1D,+DAA+D;YAC/D,kEAAkE;YAClE,MAAM,QAAQ,GAAa,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAClC,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3D,CAAC;YACD,MAAM,eAAe,GACpB,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC3C,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;gBACrF,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAE/B,KAAK,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACvC,UAAU,CAAC;oBACV,GAAG,IAAI;oBACP,GAAG;oBACH,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;oBAChC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS;oBAC/C,WAAW,EAAE,MAAM,CAAC,KAAK;oBACzB,WAAW,EAAE,MAAM,CAAC,KAAK;oBACzB,aAAa;oBACb,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,KAAK;iBACR,CAAC,CAAC;YAAA,CACH,CAAC,CAAC;QAAA,CACH,CAAC;QAEF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;YACrB,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBACxC,OAAO;YACR,CAAC;YACD,MAAM,GAAG,WAAW,CAAC;YACrB,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAA,CAC3B,CAAC;QACF,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEnE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBACxC,OAAO;YACR,CAAC;YACD,MAAM,GAAG,SAAS,CAAC;YACnB,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAA,CAC3B,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEtB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9B,UAAU,GAAG,KAAK,CAAC;QAAA,CACnB,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC5F,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAE5F,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC;YACzC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC;oBACN,MAAM,EAAE,cAAc;oBACtB,aAAa,EAAE,UAAU,CAAC,OAAO;iBACjC,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC7E,OAAO;YACR,CAAC;YACD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/E,OAAO;YACR,CAAC;YACD,MAAM,CAAC;gBACN,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBACxC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAC,CAAC;QAAA,CACH,CAAC,CAAC;IAAA,CACH,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * VF.3: the bounded argv command executor (spec\n * 2026-09-01-configured-verification-and-formatting.md § 2). Runs a\n * `CommandPolicy` from the VF.2 loader verbatim: executable + argv spawn\n * with no shell, under the policy's numeric bounds, with process-tree\n * termination on timeout and cancellation. Outcomes are structured values;\n * a command that merely fails is data, never a throw.\n *\n * Trusting the loader: this module does NOT re-validate policy fields the\n * loader already guarantees (numeric bounds, shell:false, argv shapes). The\n * one defensive re-check is the cwd confinement, because a resolved path is\n * cheap to verify and the worst failure here is running outside the\n * workspace.\n */\n\nimport { spawn } from \"node:child_process\";\nimport { isAbsolute, relative, resolve } from \"node:path\";\nimport { killProcessTree, sanitizeBinaryOutput } from \"../utils/shell.ts\";\nimport type { CommandPolicy } from \"./policy-loader.ts\";\nimport type { WorkspaceArtifactRef, WorkspaceArtifactStore } from \"./workspace/artifacts.ts\";\n\nexport type PolicyRunStatus =\n\t| \"passed\"\n\t| \"failed\"\n\t| \"spawn-failed\"\n\t| \"timeout\"\n\t| \"cancelled\"\n\t| \"refused\"\n\t/** PS.2: the command ran but wrote outside its declared scope, so nothing outside was promoted. Never \"passed\". */\n\t| \"scope-violated\";\n\nexport interface PolicyRunOptions {\n\tworkspaceRoot: string;\n\tsignal?: AbortSignal;\n\t/** When present, the full combined output is retained under the session's artifact policy. */\n\tartifactStore?: WorkspaceArtifactStore;\n}\n\nexport interface PolicyRunOutcome {\n\tstatus: PolicyRunStatus;\n\tpolicyId: string;\n\texecutable: string;\n\targv: string[];\n\t/** The working directory the command actually ran in (or would have run in). */\n\tcwd: string;\n\tdurationMs: number;\n\texitCode?: number;\n\tsignal?: string;\n\t/** True when output was captured only partially because a bound was hit. */\n\ttruncated: boolean;\n\tstdoutBytes: number;\n\tstderrBytes: number;\n\t/** Bounded, sanitized text for the model; full bytes go to the artifact store. */\n\toutputExcerpt: string;\n\tartifact?: WorkspaceArtifactRef;\n\t/** Why a command could not run at all (\"refused\" / \"spawn-failed\"). */\n\trefusalReason?: string;\n}\n\n/** Hard retention ceiling for artifact bytes, independent of policy caps. */\nconst MAX_RETENTION_BYTES = 8 * 1024 * 1024;\n\ninterface CapturedStream {\n\t/** Full stream bytes up to the retention ceiling — what the artifact keeps. */\n\tchunks: Buffer[];\n\t/** True total bytes seen, even past the retention ceiling. */\n\tbytes: number;\n\t/** Last capBytes of the stream — what the excerpt shows. */\n\twindow: Buffer[];\n\ttruncated: boolean;\n}\n\nfunction newStream(): CapturedStream {\n\treturn { chunks: [], bytes: 0, window: [], truncated: false };\n}\n\nfunction capture(stream: CapturedStream, chunk: Buffer, capBytes: number): void {\n\tstream.bytes += chunk.byteLength;\n\tif (stream.bytes > capBytes) {\n\t\tstream.truncated = true;\n\t}\n\tconst retentionTotal = stream.chunks.reduce((sum, part) => sum + part.byteLength, 0);\n\tif (retentionTotal < MAX_RETENTION_BYTES) {\n\t\tstream.chunks.push(chunk);\n\t}\n\t// Keep the excerpt window bounded to the last capBytes so it shows the\n\t// most recent output, not the start.\n\tstream.window.push(chunk);\n\tconst windowTotal = stream.window.reduce((sum, part) => sum + part.byteLength, 0);\n\tif (windowTotal > capBytes) {\n\t\tstream.truncated = true;\n\t\tlet drop = windowTotal - capBytes;\n\t\twhile (drop > 0 && stream.window.length > 0) {\n\t\t\tconst first = stream.window[0];\n\t\t\tif (first.byteLength <= drop) {\n\t\t\t\tdrop -= first.byteLength;\n\t\t\t\tstream.window.shift();\n\t\t\t} else {\n\t\t\t\tstream.window[0] = first.subarray(drop);\n\t\t\t\tdrop = 0;\n\t\t\t}\n\t\t}\n\t}\n}\n\nfunction decode(stream: CapturedStream): string {\n\treturn sanitizeBinaryOutput(Buffer.concat(stream.window).toString(\"utf-8\"));\n}\n\nfunction excerptFor(stdout: CapturedStream, stderr: CapturedStream, policy: CommandPolicy): string {\n\tconst sections: string[] = [];\n\tconst stdoutText = decode(stdout);\n\tconst stderrText = decode(stderr);\n\tif (stdoutText.length > 0) {\n\t\tsections.push(stdoutText);\n\t}\n\tif (stderrText.length > 0) {\n\t\tsections.push(stderrText);\n\t}\n\tconst combined = sections.join(\"\\n\");\n\tconst lines = combined.split(\"\\n\");\n\tif (lines.length > policy.maxOutputLines) {\n\t\t// The notice lives INSIDE the budget: the excerpt never exceeds\n\t\t// maxOutputLines lines in total.\n\t\treturn [\n\t\t\t...lines.slice(0, policy.maxOutputLines - 1),\n\t\t\t`<${lines.length - policy.maxOutputLines + 1} more lines truncated>`,\n\t\t].join(\"\\n\");\n\t}\n\treturn combined;\n}\n\nexport async function runPolicyCommand(command: CommandPolicy, options: PolicyRunOptions): Promise<PolicyRunOutcome> {\n\tconst started = Date.now();\n\tconst base = {\n\t\tpolicyId: command.id,\n\t\texecutable: command.executable,\n\t\targv: command.argv,\n\t};\n\n\tif (options.signal?.aborted) {\n\t\treturn {\n\t\t\t...base,\n\t\t\targv: base.argv,\n\t\t\tcwd: options.workspaceRoot,\n\t\t\tdurationMs: 0,\n\t\t\tstatus: \"cancelled\",\n\t\t\ttruncated: false,\n\t\t\tstdoutBytes: 0,\n\t\t\tstderrBytes: 0,\n\t\t\toutputExcerpt: \"\",\n\t\t\trefusalReason: \"cancelled before the command started\",\n\t\t};\n\t}\n\n\t// Defense in depth against a cwd escaping the workspace. The loader\n\t// already rejects absolute paths and \"..\" segments; resolve() here is the\n\t// second gate, on the computed path rather than the configured string.\n\tconst cwd = command.cwd === \"workspace\" ? options.workspaceRoot : resolve(options.workspaceRoot, command.cwd);\n\t// The containment check uses relative() — a startsWith string comparison\n\t// breaks on Windows, where resolve() switches to backslash separators.\n\tconst containmentRoot = resolve(options.workspaceRoot);\n\tconst containmentRel = relative(containmentRoot, cwd);\n\tconst insideWorkspace = containmentRel === \"\" || (!containmentRel.startsWith(\"..\") && !isAbsolute(containmentRel));\n\tif (!insideWorkspace) {\n\t\treturn {\n\t\t\t...base,\n\t\t\tcwd,\n\t\t\tdurationMs: 0,\n\t\t\tstatus: \"refused\",\n\t\t\ttruncated: false,\n\t\t\tstdoutBytes: 0,\n\t\t\tstderrBytes: 0,\n\t\t\toutputExcerpt: \"\",\n\t\t\trefusalReason: `cwd ${command.cwd} resolves outside the workspace`,\n\t\t};\n\t}\n\n\treturn await new Promise<PolicyRunOutcome>((resolveRun) => {\n\t\tlet child: ReturnType<typeof spawn>;\n\t\ttry {\n\t\t\tchild = spawn(command.executable, command.argv, {\n\t\t\t\tcwd,\n\t\t\t\tshell: false,\n\t\t\t\tdetached: true,\n\t\t\t\twindowsHide: true,\n\t\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tresolveRun({\n\t\t\t\t...base,\n\t\t\t\tcwd,\n\t\t\t\tdurationMs: Date.now() - started,\n\t\t\t\tstatus: \"spawn-failed\",\n\t\t\t\ttruncated: false,\n\t\t\t\tstdoutBytes: 0,\n\t\t\t\tstderrBytes: 0,\n\t\t\t\toutputExcerpt: \"\",\n\t\t\t\trefusalReason: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\n\t\tconst stdout = newStream();\n\t\tconst stderr = newStream();\n\t\tlet settled = false;\n\t\tlet killed: \"timeout\" | \"cancelled\" | undefined;\n\t\tlet spawnError: Error | undefined;\n\n\t\tconst finish = (extra: Partial<PolicyRunOutcome> & { status: PolicyRunStatus }) => {\n\t\t\tif (settled) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timer);\n\t\t\toptions.signal?.removeEventListener(\"abort\", onAbort);\n\t\t\tconst outputExcerpt = excerptFor(stdout, stderr, command);\n\t\t\t// Only stdout: the artifact is the raw stream. Both streams: a\n\t\t\t// stderr section is appended so the raw stdout bytes stay intact.\n\t\t\tconst retained: Buffer[] = [...stdout.chunks];\n\t\t\tif (stderr.chunks.length > 0) {\n\t\t\t\tif (retained.length > 0) {\n\t\t\t\t\tretained.push(Buffer.from(\"\\n\"));\n\t\t\t\t}\n\t\t\t\tretained.push(Buffer.from(\"stderr:\\n\"), ...stderr.chunks);\n\t\t\t}\n\t\t\tconst artifactPromise =\n\t\t\t\toptions.artifactStore && retained.length > 0\n\t\t\t\t\t? options.artifactStore.writeArtifact(Buffer.concat(retained)).catch(() => undefined)\n\t\t\t\t\t: Promise.resolve(undefined);\n\n\t\t\tvoid artifactPromise.then((artifact) => {\n\t\t\t\tresolveRun({\n\t\t\t\t\t...base,\n\t\t\t\t\tcwd,\n\t\t\t\t\tdurationMs: Date.now() - started,\n\t\t\t\t\ttruncated: stdout.truncated || stderr.truncated,\n\t\t\t\t\tstdoutBytes: stdout.bytes,\n\t\t\t\t\tstderrBytes: stderr.bytes,\n\t\t\t\t\toutputExcerpt,\n\t\t\t\t\t...(artifact !== undefined ? { artifact } : {}),\n\t\t\t\t\t...extra,\n\t\t\t\t});\n\t\t\t});\n\t\t};\n\n\t\tconst onAbort = () => {\n\t\t\tif (settled || child.pid === undefined) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tkilled = \"cancelled\";\n\t\t\tkillProcessTree(child.pid);\n\t\t};\n\t\toptions.signal?.addEventListener(\"abort\", onAbort, { once: true });\n\n\t\tconst timer = setTimeout(() => {\n\t\t\tif (settled || child.pid === undefined) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tkilled = \"timeout\";\n\t\t\tkillProcessTree(child.pid);\n\t\t}, command.timeoutMs);\n\n\t\tchild.once(\"error\", (error) => {\n\t\t\tspawnError = error;\n\t\t});\n\t\tchild.stdout?.on(\"data\", (chunk: Buffer) => capture(stdout, chunk, command.maxOutputBytes));\n\t\tchild.stderr?.on(\"data\", (chunk: Buffer) => capture(stderr, chunk, command.maxOutputBytes));\n\n\t\tchild.once(\"close\", (code, termSignal) => {\n\t\t\tif (spawnError !== undefined) {\n\t\t\t\tfinish({\n\t\t\t\t\tstatus: \"spawn-failed\",\n\t\t\t\t\trefusalReason: spawnError.message,\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (killed === \"timeout\") {\n\t\t\t\tfinish({ status: \"timeout\", ...(termSignal ? { signal: termSignal } : {}) });\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (killed === \"cancelled\") {\n\t\t\t\tfinish({ status: \"cancelled\", ...(termSignal ? { signal: termSignal } : {}) });\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tfinish({\n\t\t\t\tstatus: code === 0 ? \"passed\" : \"failed\",\n\t\t\t\t...(code !== null ? { exitCode: code } : {}),\n\t\t\t\t...(termSignal ? { signal: termSignal } : {}),\n\t\t\t});\n\t\t});\n\t});\n}\n"]}

package/dist/core/policy-loader.d.ts

@@ -0,0 +1,72 @@
+/**
+ * VF.2: the ONE projection from policy settings to runtime policies (spec
+ * 2026-09-01-configured-verification-and-formatting.md § 1; ADR 0028; ADR
+ * 0010's one-projection rule applied to configured commands). Nothing else
+ * in the codebase re-derives defaults, bounds, or trust stamps — surfaces
+ * consume `loadPolicyConfiguration()` output, and the executor (VF.3)
+ * consumes these policies verbatim.
+ *
+ * Strictness contract: any validation error inside a source drops that
+ * entire source and surfaces structured errors. Half-applied policies are
+ * worse than absent ones because they look configured while running under
+ * different bounds than the user wrote. A missing `policies` key stays
+ * inert: no policies, no errors, no runtime.
+ */
+/** Hard bounds. Caps exist so a typo cannot configure an unbounded run. */
+export declare const DEFAULT_TIMEOUT_MS = 120000;
+export declare const MAX_TIMEOUT_MS = 600000;
+export declare const DEFAULT_MAX_OUTPUT_BYTES = 262144;
+export declare const MAX_MAX_OUTPUT_BYTES = 1048576;
+export declare const DEFAULT_MAX_OUTPUT_LINES = 2000;
+export declare const MAX_MAX_OUTPUT_LINES = 10000;
+/** Capability names from the shared tool-contract vocabulary (ADR 0010). */
+export type PolicyCapability = "exec" | "fs.write";
+export type PolicyPermission = "allow" | "ask" | "deny";
+export type PolicySource = "user" | "project";
+export interface CommandPolicy {
+    id: string;
+    executable: string;
+    argv: string[];
+    cwd: "workspace" | string;
+    pathScope?: string[];
+    timeoutMs: number;
+    maxOutputBytes: number;
+    maxOutputLines: number;
+    shell: false;
+    permission: PolicyPermission;
+    trustedSource: PolicySource;
+}
+export interface VerificationPolicy extends CommandPolicy {
+    kind: "verification";
+    blocksCompletion: boolean;
+}
+export interface FormatterPolicy extends CommandPolicy {
+    kind: "formatter";
+    mutatesFiles: true;
+    declaredPaths: string[];
+}
+export interface PolicyLoadError {
+    source: PolicySource;
+    /** Policy ID when the error is attributable to one entry. */
+    policyId?: string;
+    message: string;
+}
+export interface PolicySnapshot {
+    verification: VerificationPolicy[];
+    formatter: FormatterPolicy[];
+    errors: PolicyLoadError[];
+}
+export interface PolicyConfigurationInput {
+    globalSettings?: unknown;
+    projectSettings?: unknown;
+    projectTrusted: boolean;
+}
+/**
+ * Project raw per-source policy settings onto the canonical snapshot. The
+ * project source participates only when the project is trusted (ADR 0028);
+ * within a trusted project a project policy ID replaces the user policy
+ * with the same ID. This function never throws and never reads ambient
+ * state: identical inputs project identical snapshots.
+ */
+export declare function loadPolicyConfiguration(input: PolicyConfigurationInput): PolicySnapshot;
+//# sourceMappingURL=policy-loader.d.ts.map

package/dist/core/policy-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-loader.d.ts","sourceRoot":"","sources":["../../src/core/policy-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAC1C,eAAO,MAAM,cAAc,SAAU,CAAC;AACtC,eAAO,MAAM,wBAAwB,SAAU,CAAC;AAChD,eAAO,MAAM,oBAAoB,UAAY,CAAC;AAC9C,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAC9C,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,4EAA4E;AAC5E,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,UAAU,CAAC;AACnD,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,CAAC;AAE9C,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,WAAW,GAAG,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,gBAAgB,CAAC;IAC7B,aAAa,EAAE,YAAY,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACxD,IAAI,EAAE,cAAc,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACrD,IAAI,EAAE,WAAW,CAAC;IAClB,YAAY,EAAE,IAAI,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;CACxB;AAID,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC9B,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,MAAM,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACxC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,OAAO,CAAC;CACxB;AAsLD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,wBAAwB,GAAG,cAAc,CAmBvF","sourcesContent":["/**\n * VF.2: the ONE projection from policy settings to runtime policies (spec\n * 2026-09-01-configured-verification-and-formatting.md § 1; ADR 0028; ADR\n * 0010's one-projection rule applied to configured commands). Nothing else\n * in the codebase re-derives defaults, bounds, or trust stamps — surfaces\n * consume `loadPolicyConfiguration()` output, and the executor (VF.3)\n * consumes these policies verbatim.\n *\n * Strictness contract: any validation error inside a source drops that\n * entire source and surfaces structured errors. Half-applied policies are\n * worse than absent ones because they look configured while running under\n * different bounds than the user wrote. A missing `policies` key stays\n * inert: no policies, no errors, no runtime.\n */\n\n/** Hard bounds. Caps exist so a typo cannot configure an unbounded run. */\nexport const DEFAULT_TIMEOUT_MS = 120_000;\nexport const MAX_TIMEOUT_MS = 600_000;\nexport const DEFAULT_MAX_OUTPUT_BYTES = 262_144; // 256 KiB\nexport const MAX_MAX_OUTPUT_BYTES = 1_048_576; // 1 MiB\nexport const DEFAULT_MAX_OUTPUT_LINES = 2_000;\nexport const MAX_MAX_OUTPUT_LINES = 10_000;\n\n/** Capability names from the shared tool-contract vocabulary (ADR 0010). */\nexport type PolicyCapability = \"exec\" | \"fs.write\";\nexport type PolicyPermission = \"allow\" | \"ask\" | \"deny\";\nexport type PolicySource = \"user\" | \"project\";\n\nexport interface CommandPolicy {\n\tid: string;\n\texecutable: string;\n\targv: string[];\n\tcwd: \"workspace\" | string;\n\tpathScope?: string[];\n\ttimeoutMs: number;\n\tmaxOutputBytes: number;\n\tmaxOutputLines: number;\n\tshell: false;\n\tpermission: PolicyPermission;\n\ttrustedSource: PolicySource;\n}\n\nexport interface VerificationPolicy extends CommandPolicy {\n\tkind: \"verification\";\n\tblocksCompletion: boolean;\n}\n\nexport interface FormatterPolicy extends CommandPolicy {\n\tkind: \"formatter\";\n\tmutatesFiles: true;\n\tdeclaredPaths: string[];\n}\n\ntype StampedPolicy = VerificationPolicy | FormatterPolicy;\n\nexport interface PolicyLoadError {\n\tsource: PolicySource;\n\t/** Policy ID when the error is attributable to one entry. */\n\tpolicyId?: string;\n\tmessage: string;\n}\n\nexport interface PolicySnapshot {\n\tverification: VerificationPolicy[];\n\tformatter: FormatterPolicy[];\n\terrors: PolicyLoadError[];\n}\n\nexport interface PolicyConfigurationInput {\n\tglobalSettings?: unknown;\n\tprojectSettings?: unknown;\n\tprojectTrusted: boolean;\n}\n\ninterface RawPolicyEntry extends Record<string, unknown> {\n\tid?: unknown;\n\texecutable?: unknown;\n\targv?: unknown;\n\tcwd?: unknown;\n\tpathScope?: unknown;\n\ttimeoutMs?: unknown;\n\tmaxOutputBytes?: unknown;\n\tmaxOutputLines?: unknown;\n\tshell?: unknown;\n\tpermission?: unknown;\n}\n\nconst KNOWN_BASE_FIELDS = new Set([\n\t\"id\",\n\t\"executable\",\n\t\"argv\",\n\t\"cwd\",\n\t\"pathScope\",\n\t\"timeoutMs\",\n\t\"maxOutputBytes\",\n\t\"maxOutputLines\",\n\t\"shell\",\n\t\"permission\",\n]);\n\nfunction hasTraversalSegment(path: string): boolean {\n\treturn path.split(\"/\").includes(\"..\");\n}\n\n/**\n * Validate one raw entry and stamp the canonical runtime shape. Returns\n * either the policy or an error message; the caller drops the source on any\n * error. Field-by-field so error messages name the offending field.\n */\nfunction stampPolicy(\n\tsource: PolicySource,\n\tkind: \"verification\" | \"formatter\",\n\tentry: RawPolicyEntry,\n\tseenIds: Set<string>,\n): { policy?: StampedPolicy; error?: string; policyId?: string } {\n\tconst policyId = typeof entry.id === \"string\" ? entry.id : undefined;\n\tconst fail = (message: string): { error: string; policyId?: string } => ({ error: message, policyId });\n\n\tif (typeof entry.id !== \"string\" || entry.id.length === 0) {\n\t\treturn fail(\"id must be a non-empty string\");\n\t}\n\tif (seenIds.has(entry.id)) {\n\t\treturn fail(`duplicate policy id \"${entry.id}\" within one source`);\n\t}\n\tif (typeof entry.executable !== \"string\" || entry.executable.length === 0) {\n\t\treturn fail(\"executable must be a non-empty string\");\n\t}\n\tif (!Array.isArray(entry.argv) || entry.argv.length === 0 || entry.argv.some((part) => typeof part !== \"string\")) {\n\t\treturn fail(\"argv must be a non-empty array of strings\");\n\t}\n\tif (entry.shell !== undefined && entry.shell !== false) {\n\t\treturn fail(\"shell must be literal false; shell execution is not a supported policy configuration\");\n\t}\n\tif (entry.cwd !== undefined) {\n\t\tif (typeof entry.cwd !== \"string\" || entry.cwd.length === 0) {\n\t\t\treturn fail('cwd must be the literal \"workspace\" or a non-empty workspace-relative path');\n\t\t}\n\t\tif (entry.cwd !== \"workspace\" && (entry.cwd.startsWith(\"/\") || hasTraversalSegment(entry.cwd))) {\n\t\t\treturn fail('cwd must stay inside the workspace: no absolute paths, no \"..\" segments');\n\t\t}\n\t}\n\tif (entry.pathScope !== undefined) {\n\t\tif (\n\t\t\t!Array.isArray(entry.pathScope) ||\n\t\t\tentry.pathScope.length === 0 ||\n\t\t\tentry.pathScope.some((part) => typeof part !== \"string\" || part.length === 0 || hasTraversalSegment(part))\n\t\t) {\n\t\t\treturn fail('pathScope must be non-empty workspace-relative patterns without \"..\" segments');\n\t\t}\n\t}\n\n\tconst timeoutMs = (entry.timeoutMs ?? DEFAULT_TIMEOUT_MS) as number;\n\tif (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_TIMEOUT_MS) {\n\t\treturn fail(`timeoutMs must be a positive integer no greater than ${MAX_TIMEOUT_MS}`);\n\t}\n\tconst maxOutputBytes = (entry.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES) as number;\n\tif (!Number.isInteger(maxOutputBytes) || maxOutputBytes <= 0 || maxOutputBytes > MAX_MAX_OUTPUT_BYTES) {\n\t\treturn fail(`maxOutputBytes must be a positive integer no greater than ${MAX_MAX_OUTPUT_BYTES}`);\n\t}\n\tconst maxOutputLines = (entry.maxOutputLines ?? DEFAULT_MAX_OUTPUT_LINES) as number;\n\tif (!Number.isInteger(maxOutputLines) || maxOutputLines <= 0 || maxOutputLines > MAX_MAX_OUTPUT_LINES) {\n\t\treturn fail(`maxOutputLines must be a positive integer no greater than ${MAX_MAX_OUTPUT_LINES}`);\n\t}\n\n\tconst permission = (entry.permission ?? \"ask\") as PolicyPermission;\n\tif (permission !== \"allow\" && permission !== \"ask\" && permission !== \"deny\") {\n\t\treturn fail('permission must be \"allow\", \"ask\", or \"deny\"');\n\t}\n\n\tfor (const field of Object.keys(entry)) {\n\t\tif (\n\t\t\t!KNOWN_BASE_FIELDS.has(field) &&\n\t\t\t!(kind === \"verification\" && field === \"blocksCompletion\") &&\n\t\t\t!(kind === \"formatter\" && field === \"declaredPaths\")\n\t\t) {\n\t\t\treturn fail(`unknown policy field \"${field}\"`);\n\t\t}\n\t}\n\n\tconst base: Omit<CommandPolicy, \"trustedSource\"> & { trustedSource: PolicySource } = {\n\t\tid: entry.id,\n\t\texecutable: entry.executable,\n\t\targv: entry.argv as string[],\n\t\tcwd: (entry.cwd as string | undefined) ?? \"workspace\",\n\t\t...(entry.pathScope !== undefined ? { pathScope: entry.pathScope as string[] } : {}),\n\t\ttimeoutMs,\n\t\tmaxOutputBytes,\n\t\tmaxOutputLines,\n\t\tshell: false,\n\t\tpermission,\n\t\ttrustedSource: source,\n\t};\n\n\tif (kind === \"verification\") {\n\t\tif (entry.blocksCompletion !== undefined && typeof entry.blocksCompletion !== \"boolean\") {\n\t\t\treturn fail(\"blocksCompletion must be a boolean\");\n\t\t}\n\t\treturn { policy: { ...base, kind, blocksCompletion: (entry.blocksCompletion as boolean | undefined) ?? false } };\n\t}\n\n\tif (!Array.isArray(entry.declaredPaths) || entry.declaredPaths.length === 0) {\n\t\treturn fail(\"declaredPaths is required for formatter policies and must be a non-empty array\");\n\t}\n\tif (entry.declaredPaths.some((part) => typeof part !== \"string\" || part.length === 0 || hasTraversalSegment(part))) {\n\t\treturn fail('declaredPaths must be non-empty workspace-relative patterns without \"..\" segments');\n\t}\n\treturn { policy: { ...base, kind, mutatesFiles: true, declaredPaths: entry.declaredPaths as string[] } };\n}\n\n/**\n * Load one source. Returns the stamped policies plus errors; on ANY error\n * the source contributes nothing (fail closed, all-or-nothing per source).\n */\nfunction loadSource(source: PolicySource, raw: unknown, errors: PolicyLoadError[]): StampedPolicy[] {\n\tif (raw === undefined || raw === null) {\n\t\treturn [];\n\t}\n\tconst fail = (message: string, policyId?: string): [] => {\n\t\terrors.push({ source, policyId, message });\n\t\treturn [];\n\t};\n\tif (typeof raw !== \"object\") {\n\t\treturn fail(\"policies must be an object\");\n\t}\n\tconst policies = raw as Record<string, unknown>;\n\tif (policies.schemaVersion !== 1) {\n\t\treturn fail(`unsupported policies schemaVersion ${JSON.stringify(policies.schemaVersion)}`);\n\t}\n\n\tconst seenIds = new Set<string>();\n\tconst stamped: StampedPolicy[] = [];\n\tfor (const kind of [\"verification\", \"formatter\"] as const) {\n\t\tconst entries = policies[kind];\n\t\tif (entries === undefined) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (!Array.isArray(entries)) {\n\t\t\treturn fail(`policies.${kind} must be an array`);\n\t\t}\n\t\tfor (const entry of entries) {\n\t\t\tif (typeof entry !== \"object\" || entry === null) {\n\t\t\t\treturn fail(`policies.${kind} contains a non-object entry`);\n\t\t\t}\n\t\t\tconst result = stampPolicy(source, kind, entry as RawPolicyEntry, seenIds);\n\t\t\tif (result.error !== undefined || result.policy === undefined) {\n\t\t\t\treturn fail(result.error ?? \"policy failed to stamp\", result.policyId);\n\t\t\t}\n\t\t\tseenIds.add(result.policy.id);\n\t\t\tstamped.push(result.policy);\n\t\t}\n\t}\n\treturn stamped;\n}\n\n/**\n * Project raw per-source policy settings onto the canonical snapshot. The\n * project source participates only when the project is trusted (ADR 0028);\n * within a trusted project a project policy ID replaces the user policy\n * with the same ID. This function never throws and never reads ambient\n * state: identical inputs project identical snapshots.\n */\nexport function loadPolicyConfiguration(input: PolicyConfigurationInput): PolicySnapshot {\n\tconst errors: PolicyLoadError[] = [];\n\tconst userPolicies = loadSource(\"user\", input.globalSettings, errors);\n\tconst projectPolicies = input.projectTrusted ? loadSource(\"project\", input.projectSettings, errors) : [];\n\n\tconst verification: VerificationPolicy[] = [];\n\tconst formatter: FormatterPolicy[] = [];\n\tconst byId = new Map<string, StampedPolicy>();\n\tfor (const policy of [...userPolicies, ...projectPolicies]) {\n\t\tbyId.set(policy.id, policy);\n\t}\n\tfor (const policy of byId.values()) {\n\t\tif (policy.kind === \"verification\") {\n\t\t\tverification.push(policy);\n\t\t} else {\n\t\t\tformatter.push(policy as FormatterPolicy);\n\t\t}\n\t}\n\treturn { verification, formatter, errors };\n}\n"]}

package/dist/core/policy-loader.js

@@ -0,0 +1,195 @@
+/**
+ * VF.2: the ONE projection from policy settings to runtime policies (spec
+ * 2026-09-01-configured-verification-and-formatting.md § 1; ADR 0028; ADR
+ * 0010's one-projection rule applied to configured commands). Nothing else
+ * in the codebase re-derives defaults, bounds, or trust stamps — surfaces
+ * consume `loadPolicyConfiguration()` output, and the executor (VF.3)
+ * consumes these policies verbatim.
+ *
+ * Strictness contract: any validation error inside a source drops that
+ * entire source and surfaces structured errors. Half-applied policies are
+ * worse than absent ones because they look configured while running under
+ * different bounds than the user wrote. A missing `policies` key stays
+ * inert: no policies, no errors, no runtime.
+ */
+/** Hard bounds. Caps exist so a typo cannot configure an unbounded run. */
+export const DEFAULT_TIMEOUT_MS = 120_000;
+export const MAX_TIMEOUT_MS = 600_000;
+export const DEFAULT_MAX_OUTPUT_BYTES = 262_144; // 256 KiB
+export const MAX_MAX_OUTPUT_BYTES = 1_048_576; // 1 MiB
+export const DEFAULT_MAX_OUTPUT_LINES = 2_000;
+export const MAX_MAX_OUTPUT_LINES = 10_000;
+const KNOWN_BASE_FIELDS = new Set([
+    "id",
+    "executable",
+    "argv",
+    "cwd",
+    "pathScope",
+    "timeoutMs",
+    "maxOutputBytes",
+    "maxOutputLines",
+    "shell",
+    "permission",
+]);
+function hasTraversalSegment(path) {
+    return path.split("/").includes("..");
+}
+/**
+ * Validate one raw entry and stamp the canonical runtime shape. Returns
+ * either the policy or an error message; the caller drops the source on any
+ * error. Field-by-field so error messages name the offending field.
+ */
+function stampPolicy(source, kind, entry, seenIds) {
+    const policyId = typeof entry.id === "string" ? entry.id : undefined;
+    const fail = (message) => ({ error: message, policyId });
+    if (typeof entry.id !== "string" || entry.id.length === 0) {
+        return fail("id must be a non-empty string");
+    }
+    if (seenIds.has(entry.id)) {
+        return fail(`duplicate policy id "${entry.id}" within one source`);
+    }
+    if (typeof entry.executable !== "string" || entry.executable.length === 0) {
+        return fail("executable must be a non-empty string");
+    }
+    if (!Array.isArray(entry.argv) || entry.argv.length === 0 || entry.argv.some((part) => typeof part !== "string")) {
+        return fail("argv must be a non-empty array of strings");
+    }
+    if (entry.shell !== undefined && entry.shell !== false) {
+        return fail("shell must be literal false; shell execution is not a supported policy configuration");
+    }
+    if (entry.cwd !== undefined) {
+        if (typeof entry.cwd !== "string" || entry.cwd.length === 0) {
+            return fail('cwd must be the literal "workspace" or a non-empty workspace-relative path');
+        }
+        if (entry.cwd !== "workspace" && (entry.cwd.startsWith("/") || hasTraversalSegment(entry.cwd))) {
+            return fail('cwd must stay inside the workspace: no absolute paths, no ".." segments');
+        }
+    }
+    if (entry.pathScope !== undefined) {
+        if (!Array.isArray(entry.pathScope) ||
+            entry.pathScope.length === 0 ||
+            entry.pathScope.some((part) => typeof part !== "string" || part.length === 0 || hasTraversalSegment(part))) {
+            return fail('pathScope must be non-empty workspace-relative patterns without ".." segments');
+        }
+    }
+    const timeoutMs = (entry.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_TIMEOUT_MS) {
+        return fail(`timeoutMs must be a positive integer no greater than ${MAX_TIMEOUT_MS}`);
+    }
+    const maxOutputBytes = (entry.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES);
+    if (!Number.isInteger(maxOutputBytes) || maxOutputBytes <= 0 || maxOutputBytes > MAX_MAX_OUTPUT_BYTES) {
+        return fail(`maxOutputBytes must be a positive integer no greater than ${MAX_MAX_OUTPUT_BYTES}`);
+    }
+    const maxOutputLines = (entry.maxOutputLines ?? DEFAULT_MAX_OUTPUT_LINES);
+    if (!Number.isInteger(maxOutputLines) || maxOutputLines <= 0 || maxOutputLines > MAX_MAX_OUTPUT_LINES) {
+        return fail(`maxOutputLines must be a positive integer no greater than ${MAX_MAX_OUTPUT_LINES}`);
+    }
+    const permission = (entry.permission ?? "ask");
+    if (permission !== "allow" && permission !== "ask" && permission !== "deny") {
+        return fail('permission must be "allow", "ask", or "deny"');
+    }
+    for (const field of Object.keys(entry)) {
+        if (!KNOWN_BASE_FIELDS.has(field) &&
+            !(kind === "verification" && field === "blocksCompletion") &&
+            !(kind === "formatter" && field === "declaredPaths")) {
+            return fail(`unknown policy field "${field}"`);
+        }
+    }
+    const base = {
+        id: entry.id,
+        executable: entry.executable,
+        argv: entry.argv,
+        cwd: entry.cwd ?? "workspace",
+        ...(entry.pathScope !== undefined ? { pathScope: entry.pathScope } : {}),
+        timeoutMs,
+        maxOutputBytes,
+        maxOutputLines,
+        shell: false,
+        permission,
+        trustedSource: source,
+    };
+    if (kind === "verification") {
+        if (entry.blocksCompletion !== undefined && typeof entry.blocksCompletion !== "boolean") {
+            return fail("blocksCompletion must be a boolean");
+        }
+        return { policy: { ...base, kind, blocksCompletion: entry.blocksCompletion ?? false } };
+    }
+    if (!Array.isArray(entry.declaredPaths) || entry.declaredPaths.length === 0) {
+        return fail("declaredPaths is required for formatter policies and must be a non-empty array");
+    }
+    if (entry.declaredPaths.some((part) => typeof part !== "string" || part.length === 0 || hasTraversalSegment(part))) {
+        return fail('declaredPaths must be non-empty workspace-relative patterns without ".." segments');
+    }
+    return { policy: { ...base, kind, mutatesFiles: true, declaredPaths: entry.declaredPaths } };
+}
+/**
+ * Load one source. Returns the stamped policies plus errors; on ANY error
+ * the source contributes nothing (fail closed, all-or-nothing per source).
+ */
+function loadSource(source, raw, errors) {
+    if (raw === undefined || raw === null) {
+        return [];
+    }
+    const fail = (message, policyId) => {
+        errors.push({ source, policyId, message });
+        return [];
+    };
+    if (typeof raw !== "object") {
+        return fail("policies must be an object");
+    }
+    const policies = raw;
+    if (policies.schemaVersion !== 1) {
+        return fail(`unsupported policies schemaVersion ${JSON.stringify(policies.schemaVersion)}`);
+    }
+    const seenIds = new Set();
+    const stamped = [];
+    for (const kind of ["verification", "formatter"]) {
+        const entries = policies[kind];
+        if (entries === undefined) {
+            continue;
+        }
+        if (!Array.isArray(entries)) {
+            return fail(`policies.${kind} must be an array`);
+        }
+        for (const entry of entries) {
+            if (typeof entry !== "object" || entry === null) {
+                return fail(`policies.${kind} contains a non-object entry`);
+            }
+            const result = stampPolicy(source, kind, entry, seenIds);
+            if (result.error !== undefined || result.policy === undefined) {
+                return fail(result.error ?? "policy failed to stamp", result.policyId);
+            }
+            seenIds.add(result.policy.id);
+            stamped.push(result.policy);
+        }
+    }
+    return stamped;
+}
+/**
+ * Project raw per-source policy settings onto the canonical snapshot. The
+ * project source participates only when the project is trusted (ADR 0028);
+ * within a trusted project a project policy ID replaces the user policy
+ * with the same ID. This function never throws and never reads ambient
+ * state: identical inputs project identical snapshots.
+ */
+export function loadPolicyConfiguration(input) {
+    const errors = [];
+    const userPolicies = loadSource("user", input.globalSettings, errors);
+    const projectPolicies = input.projectTrusted ? loadSource("project", input.projectSettings, errors) : [];
+    const verification = [];
+    const formatter = [];
+    const byId = new Map();
+    for (const policy of [...userPolicies, ...projectPolicies]) {
+        byId.set(policy.id, policy);
+    }
+    for (const policy of byId.values()) {
+        if (policy.kind === "verification") {
+            verification.push(policy);
+        }
+        else {
+            formatter.push(policy);
+        }
+    }
+    return { verification, formatter, errors };
+}
+//# sourceMappingURL=policy-loader.js.map

package/dist/core/policy-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-loader.js","sourceRoot":"","sources":["../../src/core/policy-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AACtC,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC,CAAC,UAAU;AAC3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC,CAAC,QAAQ;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAkE3C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACjC,IAAI;IACJ,YAAY;IACZ,MAAM;IACN,KAAK;IACL,WAAW;IACX,WAAW;IACX,gBAAgB;IAChB,gBAAgB;IAChB,OAAO;IACP,YAAY;CACZ,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,IAAY,EAAW;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAAA,CACtC;AAED;;;;GAIG;AACH,SAAS,WAAW,CACnB,MAAoB,EACpB,IAAkC,EAClC,KAAqB,EACrB,OAAoB,EAC4C;IAChE,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,OAAe,EAAwC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEvG,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,wBAAwB,KAAK,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAClH,OAAO,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,sFAAsF,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,4EAA4E,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAChG,OAAO,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACxF,CAAC;IACF,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/B,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAC5B,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,EACzG,CAAC;YACF,OAAO,IAAI,CAAC,+EAA+E,CAAC,CAAC;QAC9F,CAAC;IACF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAW,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,GAAG,cAAc,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC,wDAAwD,cAAc,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,wBAAwB,CAAW,CAAC;IACpF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,IAAI,CAAC,IAAI,cAAc,GAAG,oBAAoB,EAAE,CAAC;QACvG,OAAO,IAAI,CAAC,6DAA6D,oBAAoB,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,wBAAwB,CAAW,CAAC;IACpF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,IAAI,CAAC,IAAI,cAAc,GAAG,oBAAoB,EAAE,CAAC;QACvG,OAAO,IAAI,CAAC,6DAA6D,oBAAoB,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAqB,CAAC;IACnE,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,IACC,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7B,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,KAAK,kBAAkB,CAAC;YAC1D,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,KAAK,eAAe,CAAC,EACnD,CAAC;YACF,OAAO,IAAI,CAAC,yBAAyB,KAAK,GAAG,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;IAED,MAAM,IAAI,GAA2E;QACpF,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAgB;QAC5B,GAAG,EAAG,KAAK,CAAC,GAA0B,IAAI,WAAW;QACrD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,SAAS;QACT,cAAc;QACd,cAAc;QACd,KAAK,EAAE,KAAK;QACZ,UAAU;QACV,aAAa,EAAE,MAAM;KACrB,CAAC;IAEF,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACzF,OAAO,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAG,KAAK,CAAC,gBAAwC,IAAI,KAAK,EAAE,EAAE,CAAC;IAClH,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpH,OAAO,IAAI,CAAC,mFAAmF,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAyB,EAAE,EAAE,CAAC;AAAA,CACzG;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,MAAoB,EAAE,GAAY,EAAE,MAAyB,EAAmB;IACnG,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACvC,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,QAAiB,EAAM,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,CAAC;IAAA,CACV,CAAC;IACF,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,QAAQ,GAAG,GAA8B,CAAC;IAChD,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,sCAAsC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,WAAW,CAAU,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS;QACV,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC,YAAY,IAAI,8BAA8B,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,KAAuB,EAAE,OAAO,CAAC,CAAC;YAC3E,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,wBAAwB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA+B,EAAkB;IACxF,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzG,MAAM,YAAY,GAAyB,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,YAAY,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACpC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACP,SAAS,CAAC,IAAI,CAAC,MAAyB,CAAC,CAAC;QAC3C,CAAC;IACF,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAAA,CAC3C","sourcesContent":["/**\n * VF.2: the ONE projection from policy settings to runtime policies (spec\n * 2026-09-01-configured-verification-and-formatting.md § 1; ADR 0028; ADR\n * 0010's one-projection rule applied to configured commands). Nothing else\n * in the codebase re-derives defaults, bounds, or trust stamps — surfaces\n * consume `loadPolicyConfiguration()` output, and the executor (VF.3)\n * consumes these policies verbatim.\n *\n * Strictness contract: any validation error inside a source drops that\n * entire source and surfaces structured errors. Half-applied policies are\n * worse than absent ones because they look configured while running under\n * different bounds than the user wrote. A missing `policies` key stays\n * inert: no policies, no errors, no runtime.\n */\n\n/** Hard bounds. Caps exist so a typo cannot configure an unbounded run. */\nexport const DEFAULT_TIMEOUT_MS = 120_000;\nexport const MAX_TIMEOUT_MS = 600_000;\nexport const DEFAULT_MAX_OUTPUT_BYTES = 262_144; // 256 KiB\nexport const MAX_MAX_OUTPUT_BYTES = 1_048_576; // 1 MiB\nexport const DEFAULT_MAX_OUTPUT_LINES = 2_000;\nexport const MAX_MAX_OUTPUT_LINES = 10_000;\n\n/** Capability names from the shared tool-contract vocabulary (ADR 0010). */\nexport type PolicyCapability = \"exec\" | \"fs.write\";\nexport type PolicyPermission = \"allow\" | \"ask\" | \"deny\";\nexport type PolicySource = \"user\" | \"project\";\n\nexport interface CommandPolicy {\n\tid: string;\n\texecutable: string;\n\targv: string[];\n\tcwd: \"workspace\" | string;\n\tpathScope?: string[];\n\ttimeoutMs: number;\n\tmaxOutputBytes: number;\n\tmaxOutputLines: number;\n\tshell: false;\n\tpermission: PolicyPermission;\n\ttrustedSource: PolicySource;\n}\n\nexport interface VerificationPolicy extends CommandPolicy {\n\tkind: \"verification\";\n\tblocksCompletion: boolean;\n}\n\nexport interface FormatterPolicy extends CommandPolicy {\n\tkind: \"formatter\";\n\tmutatesFiles: true;\n\tdeclaredPaths: string[];\n}\n\ntype StampedPolicy = VerificationPolicy | FormatterPolicy;\n\nexport interface PolicyLoadError {\n\tsource: PolicySource;\n\t/** Policy ID when the error is attributable to one entry. */\n\tpolicyId?: string;\n\tmessage: string;\n}\n\nexport interface PolicySnapshot {\n\tverification: VerificationPolicy[];\n\tformatter: FormatterPolicy[];\n\terrors: PolicyLoadError[];\n}\n\nexport interface PolicyConfigurationInput {\n\tglobalSettings?: unknown;\n\tprojectSettings?: unknown;\n\tprojectTrusted: boolean;\n}\n\ninterface RawPolicyEntry extends Record<string, unknown> {\n\tid?: unknown;\n\texecutable?: unknown;\n\targv?: unknown;\n\tcwd?: unknown;\n\tpathScope?: unknown;\n\ttimeoutMs?: unknown;\n\tmaxOutputBytes?: unknown;\n\tmaxOutputLines?: unknown;\n\tshell?: unknown;\n\tpermission?: unknown;\n}\n\nconst KNOWN_BASE_FIELDS = new Set([\n\t\"id\",\n\t\"executable\",\n\t\"argv\",\n\t\"cwd\",\n\t\"pathScope\",\n\t\"timeoutMs\",\n\t\"maxOutputBytes\",\n\t\"maxOutputLines\",\n\t\"shell\",\n\t\"permission\",\n]);\n\nfunction hasTraversalSegment(path: string): boolean {\n\treturn path.split(\"/\").includes(\"..\");\n}\n\n/**\n * Validate one raw entry and stamp the canonical runtime shape. Returns\n * either the policy or an error message; the caller drops the source on any\n * error. Field-by-field so error messages name the offending field.\n */\nfunction stampPolicy(\n\tsource: PolicySource,\n\tkind: \"verification\" | \"formatter\",\n\tentry: RawPolicyEntry,\n\tseenIds: Set<string>,\n): { policy?: StampedPolicy; error?: string; policyId?: string } {\n\tconst policyId = typeof entry.id === \"string\" ? entry.id : undefined;\n\tconst fail = (message: string): { error: string; policyId?: string } => ({ error: message, policyId });\n\n\tif (typeof entry.id !== \"string\" || entry.id.length === 0) {\n\t\treturn fail(\"id must be a non-empty string\");\n\t}\n\tif (seenIds.has(entry.id)) {\n\t\treturn fail(`duplicate policy id \"${entry.id}\" within one source`);\n\t}\n\tif (typeof entry.executable !== \"string\" || entry.executable.length === 0) {\n\t\treturn fail(\"executable must be a non-empty string\");\n\t}\n\tif (!Array.isArray(entry.argv) || entry.argv.length === 0 || entry.argv.some((part) => typeof part !== \"string\")) {\n\t\treturn fail(\"argv must be a non-empty array of strings\");\n\t}\n\tif (entry.shell !== undefined && entry.shell !== false) {\n\t\treturn fail(\"shell must be literal false; shell execution is not a supported policy configuration\");\n\t}\n\tif (entry.cwd !== undefined) {\n\t\tif (typeof entry.cwd !== \"string\" || entry.cwd.length === 0) {\n\t\t\treturn fail('cwd must be the literal \"workspace\" or a non-empty workspace-relative path');\n\t\t}\n\t\tif (entry.cwd !== \"workspace\" && (entry.cwd.startsWith(\"/\") || hasTraversalSegment(entry.cwd))) {\n\t\t\treturn fail('cwd must stay inside the workspace: no absolute paths, no \"..\" segments');\n\t\t}\n\t}\n\tif (entry.pathScope !== undefined) {\n\t\tif (\n\t\t\t!Array.isArray(entry.pathScope) ||\n\t\t\tentry.pathScope.length === 0 ||\n\t\t\tentry.pathScope.some((part) => typeof part !== \"string\" || part.length === 0 || hasTraversalSegment(part))\n\t\t) {\n\t\t\treturn fail('pathScope must be non-empty workspace-relative patterns without \"..\" segments');\n\t\t}\n\t}\n\n\tconst timeoutMs = (entry.timeoutMs ?? DEFAULT_TIMEOUT_MS) as number;\n\tif (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_TIMEOUT_MS) {\n\t\treturn fail(`timeoutMs must be a positive integer no greater than ${MAX_TIMEOUT_MS}`);\n\t}\n\tconst maxOutputBytes = (entry.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES) as number;\n\tif (!Number.isInteger(maxOutputBytes) || maxOutputBytes <= 0 || maxOutputBytes > MAX_MAX_OUTPUT_BYTES) {\n\t\treturn fail(`maxOutputBytes must be a positive integer no greater than ${MAX_MAX_OUTPUT_BYTES}`);\n\t}\n\tconst maxOutputLines = (entry.maxOutputLines ?? DEFAULT_MAX_OUTPUT_LINES) as number;\n\tif (!Number.isInteger(maxOutputLines) || maxOutputLines <= 0 || maxOutputLines > MAX_MAX_OUTPUT_LINES) {\n\t\treturn fail(`maxOutputLines must be a positive integer no greater than ${MAX_MAX_OUTPUT_LINES}`);\n\t}\n\n\tconst permission = (entry.permission ?? \"ask\") as PolicyPermission;\n\tif (permission !== \"allow\" && permission !== \"ask\" && permission !== \"deny\") {\n\t\treturn fail('permission must be \"allow\", \"ask\", or \"deny\"');\n\t}\n\n\tfor (const field of Object.keys(entry)) {\n\t\tif (\n\t\t\t!KNOWN_BASE_FIELDS.has(field) &&\n\t\t\t!(kind === \"verification\" && field === \"blocksCompletion\") &&\n\t\t\t!(kind === \"formatter\" && field === \"declaredPaths\")\n\t\t) {\n\t\t\treturn fail(`unknown policy field \"${field}\"`);\n\t\t}\n\t}\n\n\tconst base: Omit<CommandPolicy, \"trustedSource\"> & { trustedSource: PolicySource } = {\n\t\tid: entry.id,\n\t\texecutable: entry.executable,\n\t\targv: entry.argv as string[],\n\t\tcwd: (entry.cwd as string | undefined) ?? \"workspace\",\n\t\t...(entry.pathScope !== undefined ? { pathScope: entry.pathScope as string[] } : {}),\n\t\ttimeoutMs,\n\t\tmaxOutputBytes,\n\t\tmaxOutputLines,\n\t\tshell: false,\n\t\tpermission,\n\t\ttrustedSource: source,\n\t};\n\n\tif (kind === \"verification\") {\n\t\tif (entry.blocksCompletion !== undefined && typeof entry.blocksCompletion !== \"boolean\") {\n\t\t\treturn fail(\"blocksCompletion must be a boolean\");\n\t\t}\n\t\treturn { policy: { ...base, kind, blocksCompletion: (entry.blocksCompletion as boolean | undefined) ?? false } };\n\t}\n\n\tif (!Array.isArray(entry.declaredPaths) || entry.declaredPaths.length === 0) {\n\t\treturn fail(\"declaredPaths is required for formatter policies and must be a non-empty array\");\n\t}\n\tif (entry.declaredPaths.some((part) => typeof part !== \"string\" || part.length === 0 || hasTraversalSegment(part))) {\n\t\treturn fail('declaredPaths must be non-empty workspace-relative patterns without \"..\" segments');\n\t}\n\treturn { policy: { ...base, kind, mutatesFiles: true, declaredPaths: entry.declaredPaths as string[] } };\n}\n\n/**\n * Load one source. Returns the stamped policies plus errors; on ANY error\n * the source contributes nothing (fail closed, all-or-nothing per source).\n */\nfunction loadSource(source: PolicySource, raw: unknown, errors: PolicyLoadError[]): StampedPolicy[] {\n\tif (raw === undefined || raw === null) {\n\t\treturn [];\n\t}\n\tconst fail = (message: string, policyId?: string): [] => {\n\t\terrors.push({ source, policyId, message });\n\t\treturn [];\n\t};\n\tif (typeof raw !== \"object\") {\n\t\treturn fail(\"policies must be an object\");\n\t}\n\tconst policies = raw as Record<string, unknown>;\n\tif (policies.schemaVersion !== 1) {\n\t\treturn fail(`unsupported policies schemaVersion ${JSON.stringify(policies.schemaVersion)}`);\n\t}\n\n\tconst seenIds = new Set<string>();\n\tconst stamped: StampedPolicy[] = [];\n\tfor (const kind of [\"verification\", \"formatter\"] as const) {\n\t\tconst entries = policies[kind];\n\t\tif (entries === undefined) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (!Array.isArray(entries)) {\n\t\t\treturn fail(`policies.${kind} must be an array`);\n\t\t}\n\t\tfor (const entry of entries) {\n\t\t\tif (typeof entry !== \"object\" || entry === null) {\n\t\t\t\treturn fail(`policies.${kind} contains a non-object entry`);\n\t\t\t}\n\t\t\tconst result = stampPolicy(source, kind, entry as RawPolicyEntry, seenIds);\n\t\t\tif (result.error !== undefined || result.policy === undefined) {\n\t\t\t\treturn fail(result.error ?? \"policy failed to stamp\", result.policyId);\n\t\t\t}\n\t\t\tseenIds.add(result.policy.id);\n\t\t\tstamped.push(result.policy);\n\t\t}\n\t}\n\treturn stamped;\n}\n\n/**\n * Project raw per-source policy settings onto the canonical snapshot. The\n * project source participates only when the project is trusted (ADR 0028);\n * within a trusted project a project policy ID replaces the user policy\n * with the same ID. This function never throws and never reads ambient\n * state: identical inputs project identical snapshots.\n */\nexport function loadPolicyConfiguration(input: PolicyConfigurationInput): PolicySnapshot {\n\tconst errors: PolicyLoadError[] = [];\n\tconst userPolicies = loadSource(\"user\", input.globalSettings, errors);\n\tconst projectPolicies = input.projectTrusted ? loadSource(\"project\", input.projectSettings, errors) : [];\n\n\tconst verification: VerificationPolicy[] = [];\n\tconst formatter: FormatterPolicy[] = [];\n\tconst byId = new Map<string, StampedPolicy>();\n\tfor (const policy of [...userPolicies, ...projectPolicies]) {\n\t\tbyId.set(policy.id, policy);\n\t}\n\tfor (const policy of byId.values()) {\n\t\tif (policy.kind === \"verification\") {\n\t\t\tverification.push(policy);\n\t\t} else {\n\t\t\tformatter.push(policy as FormatterPolicy);\n\t\t}\n\t}\n\treturn { verification, formatter, errors };\n}\n"]}

package/dist/core/project-trust.d.ts

@@ -1,7 +1,7 @@
 import type { LoadExtensionsResult, ProjectTrustContext } from "./extensions/types.ts";
 import type { DefaultProjectTrust } from "./settings-manager.ts";
 import { type ProjectTrustStore } from "./trust-manager.ts";
-export type AppMode = "interactive" | "print" | "json" | "rpc";
+export type AppMode = "interactive" | "print" | "json" | "rpc" | "acp";
 export interface ResolveProjectTrustedOptions {
     cwd: string;
     trustStore: ProjectTrustStore;

package/dist/core/project-trust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-trust.d.ts","sourceRoot":"","sources":["../../src/core/project-trust.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAIN,KAAK,iBAAiB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,OAAO,GAAG,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAE/D,MAAM,WAAW,4BAA4B;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,iBAAiB,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7C;AAwBD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,OAAO,CAAC,CAkDnG","sourcesContent":["import { CONFIG_DIR_NAME } from \"../config.ts\";\nimport { emitProjectTrustEvent } from \"./extensions/runner.ts\";\nimport type { LoadExtensionsResult, ProjectTrustContext } from \"./extensions/types.ts\";\nimport type { DefaultProjectTrust } from \"./settings-manager.ts\";\nimport {\n\tgetProjectTrustOptions,\n\thasTrustRequiringProjectResources,\n\ttype ProjectTrustOption,\n\ttype ProjectTrustStore,\n} from \"./trust-manager.ts\";\n\nexport type AppMode = \"interactive\" | \"print\" | \"json\" | \"rpc\";\n\nexport interface ResolveProjectTrustedOptions {\n\tcwd: string;\n\ttrustStore: ProjectTrustStore;\n\ttrustOverride?: boolean;\n\tdefaultProjectTrust?: DefaultProjectTrust;\n\textensionsResult?: LoadExtensionsResult;\n\tprojectTrustContext: ProjectTrustContext;\n\tonExtensionError?: (message: string) => void;\n}\n\nfunction formatProjectTrustPrompt(cwd: string): string {\n\treturn `Trust project folder?\\n${cwd}\\n\\nThis allows Apex Code to load ${CONFIG_DIR_NAME} settings and resources, install missing project packages, execute project extensions, and start configured language servers.`;\n}\n\nasync function selectProjectTrustOption(\n\tcwd: string,\n\tctx: ProjectTrustContext,\n): Promise<ProjectTrustOption | undefined> {\n\tconst options = getProjectTrustOptions(cwd, { includeSessionOnly: true });\n\tconst selected = await ctx.ui.select(\n\t\tformatProjectTrustPrompt(cwd),\n\t\toptions.map((option) => option.label),\n\t);\n\treturn options.find((option) => option.label === selected);\n}\n\nfunction saveProjectTrustPromptResult(trustStore: ProjectTrustStore, result: ProjectTrustOption): void {\n\tif (result.updates.length > 0) {\n\t\ttrustStore.setMany(result.updates);\n\t}\n}\n\nexport async function resolveProjectTrusted(options: ResolveProjectTrustedOptions): Promise<boolean> {\n\tif (options.trustOverride !== undefined) {\n\t\treturn options.trustOverride;\n\t}\n\tif (!hasTrustRequiringProjectResources(options.cwd)) {\n\t\treturn true;\n\t}\n\n\tif (options.extensionsResult) {\n\t\tconst { result, errors } = await emitProjectTrustEvent(\n\t\t\toptions.extensionsResult,\n\t\t\t{ type: \"project_trust\", cwd: options.cwd },\n\t\t\toptions.projectTrustContext,\n\t\t);\n\t\tfor (const error of errors) {\n\t\t\toptions.onExtensionError?.(`Extension \"${error.extensionPath}\" project_trust error: ${error.error}`);\n\t\t}\n\t\tif (result) {\n\t\t\tconst trusted = result.trusted === \"yes\";\n\t\t\tif (result.remember === true) {\n\t\t\t\toptions.trustStore.set(options.cwd, trusted);\n\t\t\t}\n\t\t\treturn trusted;\n\t\t}\n\t}\n\n\tconst decision = options.trustStore.get(options.cwd);\n\tif (decision !== null) {\n\t\treturn decision;\n\t}\n\n\tswitch (options.defaultProjectTrust ?? \"ask\") {\n\t\tcase \"always\":\n\t\t\treturn true;\n\t\tcase \"never\":\n\t\t\treturn false;\n\t\tcase \"ask\":\n\t\t\tbreak;\n\t}\n\n\tif (!options.projectTrustContext.hasUI) {\n\t\treturn false;\n\t}\n\n\tconst selected = await selectProjectTrustOption(options.cwd, options.projectTrustContext);\n\tif (selected !== undefined) {\n\t\tsaveProjectTrustPromptResult(options.trustStore, selected);\n\t\treturn selected.trusted;\n\t}\n\treturn false;\n}\n"]}
+{"version":3,"file":"project-trust.d.ts","sourceRoot":"","sources":["../../src/core/project-trust.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAIN,KAAK,iBAAiB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,OAAO,GAAG,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;AAEvE,MAAM,WAAW,4BAA4B;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,iBAAiB,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7C;AAwBD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,OAAO,CAAC,CAkDnG","sourcesContent":["import { CONFIG_DIR_NAME } from \"../config.ts\";\nimport { emitProjectTrustEvent } from \"./extensions/runner.ts\";\nimport type { LoadExtensionsResult, ProjectTrustContext } from \"./extensions/types.ts\";\nimport type { DefaultProjectTrust } from \"./settings-manager.ts\";\nimport {\n\tgetProjectTrustOptions,\n\thasTrustRequiringProjectResources,\n\ttype ProjectTrustOption,\n\ttype ProjectTrustStore,\n} from \"./trust-manager.ts\";\n\nexport type AppMode = \"interactive\" | \"print\" | \"json\" | \"rpc\" | \"acp\";\n\nexport interface ResolveProjectTrustedOptions {\n\tcwd: string;\n\ttrustStore: ProjectTrustStore;\n\ttrustOverride?: boolean;\n\tdefaultProjectTrust?: DefaultProjectTrust;\n\textensionsResult?: LoadExtensionsResult;\n\tprojectTrustContext: ProjectTrustContext;\n\tonExtensionError?: (message: string) => void;\n}\n\nfunction formatProjectTrustPrompt(cwd: string): string {\n\treturn `Trust project folder?\\n${cwd}\\n\\nThis allows Apex Code to load ${CONFIG_DIR_NAME} settings and resources, install missing project packages, execute project extensions, and start configured language servers.`;\n}\n\nasync function selectProjectTrustOption(\n\tcwd: string,\n\tctx: ProjectTrustContext,\n): Promise<ProjectTrustOption | undefined> {\n\tconst options = getProjectTrustOptions(cwd, { includeSessionOnly: true });\n\tconst selected = await ctx.ui.select(\n\t\tformatProjectTrustPrompt(cwd),\n\t\toptions.map((option) => option.label),\n\t);\n\treturn options.find((option) => option.label === selected);\n}\n\nfunction saveProjectTrustPromptResult(trustStore: ProjectTrustStore, result: ProjectTrustOption): void {\n\tif (result.updates.length > 0) {\n\t\ttrustStore.setMany(result.updates);\n\t}\n}\n\nexport async function resolveProjectTrusted(options: ResolveProjectTrustedOptions): Promise<boolean> {\n\tif (options.trustOverride !== undefined) {\n\t\treturn options.trustOverride;\n\t}\n\tif (!hasTrustRequiringProjectResources(options.cwd)) {\n\t\treturn true;\n\t}\n\n\tif (options.extensionsResult) {\n\t\tconst { result, errors } = await emitProjectTrustEvent(\n\t\t\toptions.extensionsResult,\n\t\t\t{ type: \"project_trust\", cwd: options.cwd },\n\t\t\toptions.projectTrustContext,\n\t\t);\n\t\tfor (const error of errors) {\n\t\t\toptions.onExtensionError?.(`Extension \"${error.extensionPath}\" project_trust error: ${error.error}`);\n\t\t}\n\t\tif (result) {\n\t\t\tconst trusted = result.trusted === \"yes\";\n\t\t\tif (result.remember === true) {\n\t\t\t\toptions.trustStore.set(options.cwd, trusted);\n\t\t\t}\n\t\t\treturn trusted;\n\t\t}\n\t}\n\n\tconst decision = options.trustStore.get(options.cwd);\n\tif (decision !== null) {\n\t\treturn decision;\n\t}\n\n\tswitch (options.defaultProjectTrust ?? \"ask\") {\n\t\tcase \"always\":\n\t\t\treturn true;\n\t\tcase \"never\":\n\t\t\treturn false;\n\t\tcase \"ask\":\n\t\t\tbreak;\n\t}\n\n\tif (!options.projectTrustContext.hasUI) {\n\t\treturn false;\n\t}\n\n\tconst selected = await selectProjectTrustOption(options.cwd, options.projectTrustContext);\n\tif (selected !== undefined) {\n\t\tsaveProjectTrustPromptResult(options.trustStore, selected);\n\t\treturn selected.trusted;\n\t}\n\treturn false;\n}\n"]}