attocode 0.2.4 → 0.2.5

package/dist/src/integrations/quality/tool-recommendation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-recommendation.js","sourceRoot":"","sources":["../../../../src/integrations/quality/tool-recommendation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA8BH,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,kBAAkB,GAAmC;IACzD,QAAQ,EAAE;QACR,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC5I,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QACtD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC5E,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC1D,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;KAChF;IACD,QAAQ,EAAE;QACR,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC3H,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC1D,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;KACvD;IACD,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC5F,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;KAChE;IACD,SAAS,EAAE;QACT,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC5F,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC5E,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QACtD,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;KAC9G;IACD,IAAI,EAAE;QACJ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QACtD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC9E,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;KAC7E;IACD,QAAQ,EAAE;QACR,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC3G,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC5E,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;KACvD;IACD,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC5G,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC5E,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;KAC3D;IACD,QAAQ,EAAE;QACR,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC9E,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;KAC7E;IACD,SAAS,EAAE;QACT,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC9E,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC5E,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;KACvD;IACD,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QACtD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QACtE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;KAC7E;IACD,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC9E,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC5E,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QACtD,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;KAChF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,0BAA0B,GAAqC;IACnE,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACf,CAAC;AAEF;;GAEG;AACH,MAAM,oBAAoB,GAIrB;IACH;QACE,QAAQ,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;QACvF,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,QAAQ,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC;QACzD,SAAS,EAAE,YAAY;QACvB,WAAW,EAAE,4BAA4B;KAC1C;IACD;QACE,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,CAAC;QACtE,SAAS,EAAE,cAAc;QACzB,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,QAAQ,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,CAAC;QAC9D,SAAS,EAAE,YAAY;QACvB,WAAW,EAAE,uBAAuB;KACrC;IACD;QACE,QAAQ,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,CAAC;QAC3D,SAAS,EAAE,YAAY;QACvB,WAAW,EAAE,uBAAuB;KACrC;CACF,CAAC;AAEF,gFAAgF;AAChF,SAAS;AACT,gFAAgF;AAEhF,MAAM,OAAO,wBAAwB;IAC3B,MAAM,CAAqC;IAEnD,YAAY,MAAiC;QAC3C,IAAI,CAAC,MAAM,GAAG;YACZ,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,IAAI,EAAE;YAChD,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,IAAI,IAAI;YAClD,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,IAAI,EAAE;SACnD,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,cAAc,CACZ,eAAuB,EACvB,QAAgB,EAChB,kBAA4B,EAC5B,UAA6B;QAE7B,MAAM,eAAe,GAAoC,IAAI,GAAG,EAAE,CAAC;QACnE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAEjD,2CAA2C;QAC3C,4EAA4E;QAC5E,IAAI,UAA0B,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,UAAU,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;aAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,MAAM,YAAY,GAAG,UAAU;gBAC7B,CAAC,CAAC,0BAA0B,CAAC,UAAU,CAAC,IAAI,WAAW;gBACvD,CAAC,CAAC,WAAW,CAAC;YAChB,UAAU,GAAG,kBAAkB,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACtD,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACtC,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACjE,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE;wBAC5B,QAAQ;wBACR,cAAc,EAAE,QAAQ,CAAC,SAAS;wBAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,aAAa,QAAQ,QAAQ;wBACrD,MAAM,EAAE,SAAS;qBAClB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC;QAChD,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAChF,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;gBACnB,+CAA+C;gBAC/C,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;oBAC1C,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;wBACzD,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE;4BAC5B,QAAQ;4BACR,cAAc,EAAE,SAAS;4BACzB,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,cAAc,UAAU,YAAY;4BAClE,MAAM,EAAE,KAAK;yBACd,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,IAAI,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3E,eAAe,CAAC,GAAG,CAAC,aAAa,EAAE;gBACjC,QAAQ,EAAE,aAAa;gBACvB,cAAc,EAAE,GAAG;gBACnB,MAAM,EAAE,0BAA0B;gBAClC,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;QACL,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC;aACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;aACnD,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,eAAuB;QAC3C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO,EAAE,CAAC;QAE7C,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,wBAAwB,CACtB,QAAgB,EAChB,kBAA4B;QAE5B,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC9E,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,SAAiB;QACpC,MAAM,UAAU,GAA2B;YACzC,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,OAAO;YACpB,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,OAAO;SAChB,CAAC;QAEF,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAiC;IAEjC,OAAO,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC"}

package/dist/src/integrations/safety/bash-policy.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Unified bash policy classifier.
+ *
+ * Centralizes shell command safety decisions so sandbox/safety/mode checks
+ * all use the same logic.
+ */
+export type BashMode = 'disabled' | 'read_only' | 'task_scoped' | 'full';
+export type BashWriteProtection = 'off' | 'block_file_mutation';
+export interface BashPolicyDecision {
+    allowed: boolean;
+    reason?: string;
+    isWrite: boolean;
+    category: 'disabled' | 'read' | 'write' | 'blocked';
+}
+/** F6: Exported as single source of truth for read-only bash command patterns. */
+export declare const READ_ONLY_PATTERNS: RegExp[];
+/** F6: Exported as single source of truth for write command patterns. */
+export declare const WRITE_COMMAND_PATTERNS: RegExp[];
+/** F6: Exported as single source of truth for file mutation patterns. */
+export declare const FILE_MUTATION_PATTERNS: Array<{
+    pattern: RegExp;
+    reason: string;
+}>;
+export declare function detectFileMutationViaBash(command: string): {
+    detected: boolean;
+    reason?: string;
+};
+/** Strip leading `cd <dir> &&` prefixes from a command for pattern matching. */
+export declare function stripCdPrefix(command: string): string;
+export declare function isReadOnlyBashCommand(command: string): boolean;
+export declare function isWriteLikeBashCommand(command: string): boolean;
+export declare function evaluateBashPolicy(command: string, mode?: BashMode, writeProtection?: BashWriteProtection): BashPolicyDecision;
+//# sourceMappingURL=bash-policy.d.ts.map

package/dist/src/integrations/safety/bash-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-policy.d.ts","sourceRoot":"","sources":["../../../../src/integrations/safety/bash-policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,MAAM,CAAC;AACzE,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,qBAAqB,CAAC;AAEhE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CACrD;AAED,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,EAAE,MAAM,EA2CtC,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,sBAAsB,EAAE,MAAM,EAa1C,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAW7E,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAOjG;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAU9D;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAM/D;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,QAAiB,EACvB,eAAe,GAAE,mBAA2B,GAC3C,kBAAkB,CAsCpB"}

package/dist/src/integrations/safety/bash-policy.js

@@ -0,0 +1,144 @@
+/**
+ * Unified bash policy classifier.
+ *
+ * Centralizes shell command safety decisions so sandbox/safety/mode checks
+ * all use the same logic.
+ */
+/** F6: Exported as single source of truth for read-only bash command patterns. */
+export const READ_ONLY_PATTERNS = [
+    /^\s*ls\b/,
+    /^\s*cat\b/,
+    /^\s*head\b/,
+    /^\s*tail\b/,
+    /^\s*wc\b/,
+    /^\s*find\b/,
+    /^\s*grep\b/,
+    /^\s*rg\b/,
+    /^\s*fd\b/,
+    /^\s*tree\b/,
+    /^\s*pwd\b/,
+    /^\s*which\b/,
+    /^\s*whoami\b/,
+    /^\s*env\b/,
+    /^\s*echo\b/,
+    /^\s*git\s+(status|log|diff|show|branch|remote|rev-parse|describe|tag)\b/,
+    /^\s*node\s+(--version|-v)\b/,
+    /^\s*npm\s+(list|ls|view|info|show|outdated|audit|test|run\s+test)\b/,
+    /^\s*python3?\s+(--version|-V)\b/,
+    /^\s*du\b/,
+    /^\s*df\b/,
+    /^\s*file\b/,
+    /^\s*stat\b/,
+    /^\s*uname\b/,
+    /^\s*date\b/,
+    /^\s*uptime\b/,
+    /^\s*type\b/,
+    /^\s*less\b/,
+    /^\s*more\b/,
+    /^\s*diff\b/,
+    /^\s*jq\b/,
+    /^\s*sort\b/,
+    /^\s*uniq\b/,
+    /^\s*cut\b/,
+    /^\s*tr\b/,
+    /^\s*tsc\s+--noEmit\b/,
+    /^\s*npx\s+tsc\s+--noEmit\b/,
+    /^\s*vitest\b/,
+    /^\s*jest\b/,
+    /^\s*pytest\b/,
+    /^\s*eslint\b/,
+    /^\s*prettier\s+(--check|-c|--list-different)\b/,
+];
+/** F6: Exported as single source of truth for write command patterns. */
+export const WRITE_COMMAND_PATTERNS = [
+    /\brm\b/,
+    /\bmv\b/,
+    /\bcp\b/,
+    /\bmkdir\b/,
+    /\btouch\b/,
+    /\bchmod\b/,
+    /\bchown\b/,
+    /\bsed\b.*\s-i\b/,
+    /\bawk\b.*\s-i(\s|$)/,
+    /\bperl\b.*\s-i\b/,
+    /\bgit\s+(add|commit|push|pull|merge|rebase|reset|checkout)\b/,
+    /\b(npm|yarn|pnpm)\s+(install|add|remove|uninstall)\b/i,
+];
+/** F6: Exported as single source of truth for file mutation patterns. */
+export const FILE_MUTATION_PATTERNS = [
+    { pattern: /<<-?\s*['"]?[A-Za-z_][\w-]*/m, reason: 'heredoc (<<)' },
+    { pattern: /(^|[^<])>>(?!&)\s*(?!\/dev\/null)\S/m, reason: 'append redirect (>>)' },
+    { pattern: /(^|[^>])>(?!&)\s*(?!\/dev\/null)\S/m, reason: 'output redirect (>)' },
+    { pattern: /\|\s*tee\b\s+(?:-[aip]\s+)*(?!\/dev\/null\b)(?!\||;|$)[^\s|;]/m, reason: 'pipe to tee' },
+    { pattern: /\bsed\b[^|;]*\s-i(\b|['"])/m, reason: 'in-place sed edit' },
+    { pattern: /\bperl\b[^|;]*\s-i(\b|['"])/m, reason: 'in-place perl edit' },
+    { pattern: /\bawk\b[^|;]*-i\s*(inplace|in_place)?/mi, reason: 'in-place awk edit' },
+    { pattern: /-exec\b.*\b(rm|mv|cp|chmod|chown)\b/m, reason: 'find -exec mutation' },
+    { pattern: /-delete\b/m, reason: 'find -delete' },
+    { pattern: /\bxargs\b.*\b(rm|mv|cp|chmod|chown)\b/m, reason: 'xargs mutation' },
+];
+export function detectFileMutationViaBash(command) {
+    for (const { pattern, reason } of FILE_MUTATION_PATTERNS) {
+        if (pattern.test(command)) {
+            return { detected: true, reason };
+        }
+    }
+    return { detected: false };
+}
+/** Strip leading `cd <dir> &&` prefixes from a command for pattern matching. */
+export function stripCdPrefix(command) {
+    return command.replace(/^(\s*cd\s+\S+\s*&&\s*)+/, '').trim();
+}
+export function isReadOnlyBashCommand(command) {
+    const trimmed = command.trim();
+    const effective = stripCdPrefix(trimmed);
+    if (!READ_ONLY_PATTERNS.some(p => p.test(effective))) {
+        return false;
+    }
+    if (WRITE_COMMAND_PATTERNS.some(p => p.test(trimmed))) {
+        return false;
+    }
+    return !detectFileMutationViaBash(trimmed).detected;
+}
+export function isWriteLikeBashCommand(command) {
+    const trimmed = command.trim();
+    if (detectFileMutationViaBash(trimmed).detected) {
+        return true;
+    }
+    return WRITE_COMMAND_PATTERNS.some(p => p.test(trimmed));
+}
+export function evaluateBashPolicy(command, mode = 'full', writeProtection = 'off') {
+    const mutation = detectFileMutationViaBash(command);
+    const isWrite = isWriteLikeBashCommand(command);
+    if (mode === 'disabled') {
+        return {
+            allowed: false,
+            isWrite,
+            category: 'disabled',
+            reason: 'Bash is disabled by policy profile.',
+        };
+    }
+    if (mode === 'read_only' && !isReadOnlyBashCommand(command)) {
+        return {
+            allowed: false,
+            isWrite: true,
+            category: 'blocked',
+            reason: 'Only read-only bash commands are allowed by policy profile.',
+        };
+    }
+    if (writeProtection === 'block_file_mutation' && mutation.detected) {
+        return {
+            allowed: false,
+            isWrite: true,
+            category: 'blocked',
+            reason: `File creation/modification via bash is blocked (${mutation.reason}). ` +
+                'Use write_file to create files and edit_file to modify them.',
+        };
+    }
+    return {
+        allowed: true,
+        isWrite,
+        category: isWrite ? 'write' : 'read',
+    };
+}
+//# sourceMappingURL=bash-policy.js.map

package/dist/src/integrations/safety/bash-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-policy.js","sourceRoot":"","sources":["../../../../src/integrations/safety/bash-policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,UAAU;IACV,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,UAAU;IACV,YAAY;IACZ,WAAW;IACX,aAAa;IACb,cAAc;IACd,WAAW;IACX,YAAY;IACZ,yEAAyE;IACzE,6BAA6B;IAC7B,qEAAqE;IACrE,iCAAiC;IACjC,UAAU;IACV,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,UAAU;IACV,sBAAsB;IACtB,4BAA4B;IAC5B,cAAc;IACd,YAAY;IACZ,cAAc;IACd,cAAc;IACd,gDAAgD;CACjD,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,sBAAsB,GAAa;IAC9C,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,WAAW;IACX,WAAW;IACX,WAAW;IACX,iBAAiB;IACjB,qBAAqB;IACrB,kBAAkB;IAClB,8DAA8D;IAC9D,uDAAuD;CACxD,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,sBAAsB,GAA+C;IAChF,EAAE,OAAO,EAAE,8BAA8B,EAAE,MAAM,EAAE,cAAc,EAAE;IACnE,EAAE,OAAO,EAAE,sCAAsC,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACnF,EAAE,OAAO,EAAE,qCAAqC,EAAE,MAAM,EAAE,qBAAqB,EAAE;IACjF,EAAE,OAAO,EAAE,gEAAgE,EAAE,MAAM,EAAE,aAAa,EAAE;IACpG,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,mBAAmB,EAAE;IACvE,EAAE,OAAO,EAAE,8BAA8B,EAAE,MAAM,EAAE,oBAAoB,EAAE;IACzE,EAAE,OAAO,EAAE,yCAAyC,EAAE,MAAM,EAAE,mBAAmB,EAAE;IACnF,EAAE,OAAO,EAAE,sCAAsC,EAAE,MAAM,EAAE,qBAAqB,EAAE;IAClF,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE;IACjD,EAAE,OAAO,EAAE,wCAAwC,EAAE,MAAM,EAAE,gBAAgB,EAAE;CAChF,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,OAAiB,MAAM,EACvB,kBAAuC,KAAK;IAE5C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAEhD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO;YACP,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,qCAAqC;SAC9C,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,6DAA6D;SACtE,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,KAAK,qBAAqB,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACnE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,SAAS;YACnB,MAAM,EACJ,mDAAmD,QAAQ,CAAC,MAAM,KAAK;gBACvE,8DAA8D;SACjE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;KACrC,CAAC;AACJ,CAAC"}

package/dist/src/integrations/safety/edit-validator.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Edit Validator (Phase 5.1)
+ *
+ * Post-edit syntax validation using tree-sitter AST parsing.
+ * Catches broken edits before they hit runtime by detecting ERROR
+ * nodes in the parsed syntax tree.
+ *
+ * Only validates files with AST support (TS/TSX/JS/JSX/Python).
+ * Unsupported files always return valid (no-op).
+ */
+export interface SyntaxError {
+    line: number;
+    column: number;
+    message: string;
+}
+export interface ValidationResult {
+    valid: boolean;
+    errors: SyntaxError[];
+}
+/**
+ * Validate syntax of file content using tree-sitter.
+ * Returns { valid: true } for unsupported file types (no-op).
+ */
+export declare function validateSyntax(content: string, filePath: string): ValidationResult;
+/**
+ * Validate an edit by checking if the "after" content introduces syntax errors.
+ * Compares error count: if "after" has more errors than "before", reports the new ones.
+ */
+export declare function validateEdit(before: string, after: string, filePath: string): ValidationResult;
+//# sourceMappingURL=edit-validator.d.ts.map

package/dist/src/integrations/safety/edit-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edit-validator.d.ts","sourceRoot":"","sources":["../../../../src/integrations/safety/edit-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB;AA2BD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAoBlF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CA4B9F"}

package/dist/src/integrations/safety/edit-validator.js

@@ -0,0 +1,87 @@
+/**
+ * Edit Validator (Phase 5.1)
+ *
+ * Post-edit syntax validation using tree-sitter AST parsing.
+ * Catches broken edits before they hit runtime by detecting ERROR
+ * nodes in the parsed syntax tree.
+ *
+ * Only validates files with AST support (TS/TSX/JS/JSX/Python).
+ * Unsupported files always return valid (no-op).
+ */
+import * as path from 'path';
+import { getParser, getCachedParse } from '../context/codebase-ast.js';
+// =============================================================================
+// VALIDATION
+// =============================================================================
+/**
+ * Walk the AST tree and collect all ERROR nodes.
+ */
+function collectErrors(node, errors, maxErrors = 10) {
+    if (errors.length >= maxErrors)
+        return;
+    if (node.type === 'ERROR') {
+        const snippet = node.text.slice(0, 60).replace(/\n/g, '\\n');
+        errors.push({
+            line: node.startPosition.row + 1,
+            column: node.startPosition.column + 1,
+            message: `Syntax error near: ${snippet}`,
+        });
+        return; // Don't recurse into ERROR children
+    }
+    for (const child of node.namedChildren) {
+        collectErrors(child, errors, maxErrors);
+    }
+}
+/**
+ * Validate syntax of file content using tree-sitter.
+ * Returns { valid: true } for unsupported file types (no-op).
+ */
+export function validateSyntax(content, filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    const parser = getParser(ext);
+    // Unsupported files always pass
+    if (!parser) {
+        return { valid: true, errors: [] };
+    }
+    try {
+        // Use cached tree if available (file may have just been parsed during analyze)
+        const cached = getCachedParse(filePath);
+        const tree = cached?.tree ?? parser.parse(content);
+        const errors = [];
+        collectErrors(tree.rootNode, errors);
+        return { valid: errors.length === 0, errors };
+    }
+    catch {
+        // Parser crash — don't block on this
+        return { valid: true, errors: [] };
+    }
+}
+/**
+ * Validate an edit by checking if the "after" content introduces syntax errors.
+ * Compares error count: if "after" has more errors than "before", reports the new ones.
+ */
+export function validateEdit(before, after, filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    const parser = getParser(ext);
+    if (!parser) {
+        return { valid: true, errors: [] };
+    }
+    try {
+        const beforeErrors = [];
+        const afterErrors = [];
+        const beforeTree = parser.parse(before);
+        collectErrors(beforeTree.rootNode, beforeErrors);
+        const afterTree = parser.parse(after);
+        collectErrors(afterTree.rootNode, afterErrors);
+        // Only report if the edit introduced NEW errors
+        if (afterErrors.length > beforeErrors.length) {
+            const newErrors = afterErrors.slice(beforeErrors.length);
+            return { valid: false, errors: newErrors };
+        }
+        return { valid: true, errors: [] };
+    }
+    catch {
+        return { valid: true, errors: [] };
+    }
+}
+//# sourceMappingURL=edit-validator.js.map

package/dist/src/integrations/safety/edit-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edit-validator.js","sourceRoot":"","sources":["../../../../src/integrations/safety/edit-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,cAAc,EAAmB,MAAM,4BAA4B,CAAC;AAiBxF,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;GAEG;AACH,SAAS,aAAa,CAAC,IAAgB,EAAE,MAAqB,EAAE,YAAoB,EAAE;IACpF,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO;IAEvC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACrC,OAAO,EAAE,sBAAsB,OAAO,EAAE;SACzC,CAAC,CAAC;QACH,OAAO,CAAC,oCAAoC;IAC9C,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,QAAgB;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAE9B,gCAAgC;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,CAAC;QACH,+EAA+E;QAC/E,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;QACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,QAAgB;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAkB,EAAE,CAAC;QACvC,MAAM,WAAW,GAAkB,EAAE,CAAC;QAEtC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,aAAa,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAEjD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAE/C,gDAAgD;QAChD,IAAI,WAAW,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC7C,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/src/integrations/safety/execution-policy.d.ts

@@ -0,0 +1,189 @@
+/**
+ * Lesson 25: Execution Policy Integration
+ *
+ * Integrates execution policies and intent classification (from Lesson 23)
+ * into the production agent. Provides three-tier tool access control
+ * and intent-aware policy decisions.
+ */
+import type { ToolCall, Message } from '../../types.js';
+/**
+ * Execution policy level.
+ */
+export type PolicyLevel = 'allow' | 'prompt' | 'forbidden';
+/**
+ * Intent classification result.
+ */
+export type IntentType = 'deliberate' | 'accidental' | 'inferred';
+/**
+ * Policy condition for conditional tool policies.
+ */
+export interface PolicyCondition {
+    /** Argument pattern to match */
+    argMatch?: Record<string, string | RegExp>;
+    /** Context condition */
+    contextMatch?: (context: PolicyContext) => boolean;
+    /** Resulting policy if condition matches */
+    policy: PolicyLevel;
+    /** Reason for this condition */
+    reason?: string;
+}
+/**
+ * Tool policy configuration.
+ */
+export interface ToolPolicy {
+    /** Base policy for this tool */
+    policy: PolicyLevel;
+    /** Conditional overrides */
+    conditions?: PolicyCondition[];
+    /** Reason for policy */
+    reason?: string;
+}
+/**
+ * Full policy configuration.
+ */
+export interface ExecutionPolicyConfig {
+    /** Default policy for unlisted tools */
+    defaultPolicy: PolicyLevel;
+    /** Per-tool policies */
+    toolPolicies: Record<string, ToolPolicy>;
+    /** Enable intent-aware decisions */
+    intentAware?: boolean;
+    /** Minimum confidence for intent */
+    intentConfidenceThreshold?: number;
+}
+/**
+ * Context for policy evaluation.
+ */
+export interface PolicyContext {
+    /** Conversation history */
+    messages: Message[];
+    /** Current user message */
+    currentMessage?: string;
+    /** Previous tool calls in this turn */
+    previousToolCalls?: ToolCall[];
+    /** Custom context data */
+    custom?: Record<string, unknown>;
+}
+/**
+ * Intent classification result.
+ */
+export interface IntentClassification {
+    type: IntentType;
+    confidence: number;
+    evidence: string[];
+}
+/**
+ * Permission grant (temporary permission).
+ */
+export interface PermissionGrant {
+    id: string;
+    toolName: string;
+    argPattern?: Record<string, unknown>;
+    grantedBy: 'user' | 'system' | 'inferred';
+    expiresAt?: Date;
+    usageCount?: number;
+    maxUsages?: number;
+    reason?: string;
+}
+/**
+ * Policy evaluation result.
+ */
+export interface PolicyEvaluation {
+    policy: PolicyLevel;
+    reason: string;
+    intent?: IntentClassification;
+    grantUsed?: PermissionGrant;
+    requiresApproval: boolean;
+}
+/**
+ * Execution policy events.
+ */
+export type PolicyEvent = {
+    type: 'policy.evaluated';
+    tool: string;
+    result: PolicyEvaluation;
+} | {
+    type: 'intent.classified';
+    tool: string;
+    intent: IntentClassification;
+} | {
+    type: 'grant.created';
+    grant: PermissionGrant;
+} | {
+    type: 'grant.used';
+    grant: PermissionGrant;
+} | {
+    type: 'grant.expired';
+    grantId: string;
+} | {
+    type: 'tool.blocked';
+    tool: string;
+    reason: string;
+} | {
+    type: 'tool.prompted';
+    tool: string;
+};
+export type PolicyEventListener = (event: PolicyEvent) => void;
+/**
+ * ExecutionPolicyManager handles tool access control and intent classification.
+ */
+export declare class ExecutionPolicyManager {
+    private config;
+    private grants;
+    private listeners;
+    private grantIdCounter;
+    constructor(config?: Partial<ExecutionPolicyConfig>);
+    /**
+     * Evaluate policy for a tool call.
+     */
+    evaluate(toolCall: ToolCall, context: PolicyContext): PolicyEvaluation;
+    /**
+     * Create a permission grant.
+     */
+    createGrant(options: Omit<PermissionGrant, 'id'>): PermissionGrant;
+    /**
+     * Revoke a grant.
+     */
+    revokeGrant(grantId: string): boolean;
+    /**
+     * Get active grants.
+     */
+    getActiveGrants(): PermissionGrant[];
+    /**
+     * Subscribe to events.
+     */
+    on(listener: PolicyEventListener): () => void;
+    /**
+     * Update tool policy.
+     */
+    setToolPolicy(toolName: string, policy: ToolPolicy): void;
+    /**
+     * Get current config.
+     */
+    getConfig(): ExecutionPolicyConfig;
+    private emit;
+    private findGrant;
+    private useGrant;
+    private cleanupExpiredGrants;
+    private matchesCondition;
+    private matchesArgPattern;
+    private classifyIntent;
+    private getLastUserMessage;
+}
+/**
+ * Create an execution policy manager.
+ */
+export declare function createExecutionPolicyManager(config?: Partial<ExecutionPolicyConfig>): ExecutionPolicyManager;
+/**
+ * Strict policy preset - minimal auto-allow.
+ */
+export declare const STRICT_POLICY: ExecutionPolicyConfig;
+/**
+ * Balanced policy preset - reasonable defaults.
+ */
+export declare const BALANCED_POLICY: ExecutionPolicyConfig;
+/**
+ * Permissive policy preset - trust the agent.
+ */
+export declare const PERMISSIVE_POLICY: ExecutionPolicyConfig;
+//# sourceMappingURL=execution-policy.d.ts.map

package/dist/src/integrations/safety/execution-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-policy.d.ts","sourceRoot":"","sources":["../../../../src/integrations/safety/execution-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAMxD;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE3D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,UAAU,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,gCAAgC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAC3C,wBAAwB;IACxB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC;IACnD,4CAA4C;IAC5C,MAAM,EAAE,WAAW,CAAC;IACpB,gCAAgC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,gCAAgC;IAChC,MAAM,EAAE,WAAW,CAAC;IACpB,4BAA4B;IAC5B,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,aAAa,EAAE,WAAW,CAAC;IAC3B,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC,oCAAoC;IACpC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oCAAoC;IACpC,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,2BAA2B;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC/B,0BAA0B;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC1C,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GACzE;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;AAM/D;;GAEG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,MAAM,CAAsC;IACpD,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,cAAc,CAAK;gBAEf,MAAM,GAAE,OAAO,CAAC,qBAAqB,CAAM;IASvD;;OAEG;IACH,QAAQ,CACN,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,aAAa,GACrB,gBAAgB;IA4DnB;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,eAAe;IAYlE;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAQrC;;OAEG;IACH,eAAe,IAAI,eAAe,EAAE;IAKpC;;OAEG;IACH,EAAE,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,IAAI;IAQ7C;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI;IAIzD;;OAEG;IACH,SAAS,IAAI,qBAAqB;IAQlC,OAAO,CAAC,IAAI;IAUZ,OAAO,CAAC,SAAS;IAwBjB,OAAO,CAAC,QAAQ;IAWhB,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,gBAAgB;IA4BxB,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,cAAc;IA+DtB,OAAO,CAAC,kBAAkB;CAQ3B;AAMD;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,GACtC,sBAAsB,CAExB;AAMD;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,qBAmB3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,qBAkB7B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,qBAa/B,CAAC"}