azcodr 2.6.0 → 2.7.1

package/.agents/hooks.json

@@ -7,7 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "./.agents/scripts/safety_guard.sh",
+            "command": "node .agents/scripts/safety_guard.js",
             "timeout": 15
           }
         ]
@@ -22,7 +22,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "./.agents/scripts/agent_guard.js",
+            "command": "node .agents/scripts/agent_guard.js",
             "timeout": 15
           }
         ]
@@ -49,7 +49,7 @@
     "Stop": [
       {
         "type": "command",
-        "command": "./.agents/scripts/verify_completion.sh",
+        "command": "node .agents/scripts/verify_completion.js",
         "timeout": 120
       }
     ]

package/.agents/hooks.json.example

@@ -7,7 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "./.agents/scripts/safety_guard.sh",
+            "command": "node .agents/scripts/safety_guard.js",
             "timeout": 15
           }
         ]
@@ -22,7 +22,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "./.agents/scripts/agent_guard.js",
+            "command": "node .agents/scripts/agent_guard.js",
             "timeout": 15
           }
         ]
@@ -49,8 +49,8 @@
     "Stop": [
       {
         "type": "command",
-        "command": "./.agents/scripts/verify_completion.sh",
-        "timeout": 15
+        "command": "node .agents/scripts/verify_completion.js",
+        "timeout": 120
       }
     ]
   }

package/.agents/lib/agent-guard-command.js

@@ -75,6 +75,12 @@ export const DESTRUCTIVE_RULES = [
         reason: 'package publish must run via release workflow, not ad-hoc tool call'
     }
 ];
+/**
+ * Collapses multi-line strings and extra whitespace into a single normalized shell command string.
+ *
+ * @param raw - Raw command string.
+ * @returns Cleaned single-line command string.
+ */
 export function normalizeCommand(raw) {
     return raw.replace(/[\r\n\t]+/g, ' ').replace(/\s+/g, ' ').trim();
 }

package/.agents/lib/agent-guard-file.js

@@ -1,11 +1,26 @@
 import fs from 'node:fs';
 import path from 'node:path';
+/**
+ * Default maximum lines allowed per file before triggering Refactor-Before-Add enforcement.
+ */
 export const DEFAULT_MAX_FILE_LINES = 300;
+/**
+ * Calculates the number of newline-delimited lines in a given text string.
+ *
+ * @param text - Input string to evaluate.
+ * @returns Total count of lines.
+ */
 export function countLines(text) {
     if (!text)
         return 0;
     return text.split('\n').length;
 }
+/**
+ * Reads an existing file from disk and returns its current line count.
+ *
+ * @param filePath - Path of the file to inspect.
+ * @returns Total number of lines, or 0 if unreadable or non-existent.
+ */
 export function readExistingLines(filePath) {
     if (!fs.existsSync(filePath))
         return 0;

package/.agents/lib/agent-guard-tdd.js

@@ -1,5 +1,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
+/**
+ * Identifies whether a given path is a unit or integration test file.
+ *
+ * @param filePath - File path to inspect.
+ * @returns True if path matches test directory or file extension patterns.
+ */
 export function isTestFile(filePath) {
     const norm = filePath.replace(/\\/g, '/').toLowerCase();
     if (/(^|\/)(tests?|__tests__)(\/|$)/i.test(norm)) {
@@ -7,11 +13,23 @@ export function isTestFile(filePath) {
     }
     return /\.(test|spec)\.[a-z0-9]+$/i.test(norm);
 }
+/**
+ * Identifies whether a given path is a non-code file (markdown, json, yaml, images).
+ *
+ * @param filePath - File path to inspect.
+ * @returns True if file extension indicates non-code asset or configuration.
+ */
 export function isNonCodeFile(filePath) {
     const ext = path.extname(filePath).toLowerCase();
     const nonCodeExts = new Set(['.md', '.json', '.yml', '.yaml', '.txt', '.toml', '.lock', '.svg', '.png']);
     return nonCodeExts.has(ext);
 }
+/**
+ * Identifies whether a given file path corresponds to production code under src/, lib/, or app/.
+ *
+ * @param filePath - File path to inspect.
+ * @returns True if path is production source code subject to RED-before-GREEN discipline.
+ */
 export function isProductionFile(filePath) {
     if (isNonCodeFile(filePath))
         return false;
@@ -20,6 +38,12 @@ export function isProductionFile(filePath) {
     const norm = filePath.replace(/\\/g, '/').toLowerCase();
     return norm.includes('src/') || norm.includes('lib/') || norm.includes('app/');
 }
+/**
+ * Loads session TDD tracking state from disk, defaulting to unrecorded state if missing.
+ *
+ * @param stateFile - Path to the persistent session state JSON file.
+ * @returns Parsed SessionTddState object.
+ */
 export function readTddState(stateFile) {
     if (!fs.existsSync(stateFile)) {
         return { lastFailingTestRecorded: false };
@@ -32,6 +56,12 @@ export function readTddState(stateFile) {
         return { lastFailingTestRecorded: false };
     }
 }
+/**
+ * Persists session TDD state to disk with fail-safe error handling to avoid disrupting execution.
+ *
+ * @param stateFile - Path to the persistent session state JSON file.
+ * @param state - SessionTddState object to record.
+ */
 export function writeTddState(stateFile, state) {
     try {
         const dir = path.dirname(stateFile);

package/.agents/lib/boundaries.js

@@ -1,5 +1,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
+/**
+ * Canonical architectural boundary rules enforcing Hexagonal / Clean Architecture layer constraints.
+ */
 export const DEFAULT_BOUNDARY_RULES = [
     {
         fromLayer: 'domain',
@@ -19,6 +22,13 @@ function isEligibleSource(name) {
         return false;
     return !name.includes('.test.') && !name.includes('.spec.');
 }
+/**
+ * Recursively discovers all eligible source files (.ts and .js) within a directory,
+ * ignoring skipped directories (e.g. node_modules, lib) and test files.
+ *
+ * @param dir - Root directory to search.
+ * @returns Sorted array of absolute file paths.
+ */
 export function findSourceFiles(dir) {
     if (!fs.existsSync(dir))
         return [];
@@ -49,6 +59,12 @@ function resolveImportTarget(sourceFile, specifier) {
     }
     return null;
 }
+/**
+ * Scans a source file and extracts all local relative import and export paths.
+ *
+ * @param filePath - Absolute or relative path to the source file.
+ * @returns Sorted array of resolved local file paths imported or re-exported.
+ */
 export function extractLocalImports(filePath) {
     if (!fs.existsSync(filePath))
         return [];
@@ -66,6 +82,12 @@ export function extractLocalImports(filePath) {
     }
     return imports.sort();
 }
+/**
+ * Constructs a dependency graph mapping each source file to its imported local files.
+ *
+ * @param files - Array of source file paths.
+ * @returns Map where keys are source file paths and values are arrays of imported local file paths.
+ */
 export function buildDependencyGraph(files) {
     const graph = new Map();
     for (const file of files) {
@@ -73,6 +95,12 @@ export function buildDependencyGraph(files) {
     }
     return graph;
 }
+/**
+ * Analyzes a dependency graph using depth-first search to detect circular import cycles.
+ *
+ * @param graph - Map of file paths to their imported dependency file paths.
+ * @returns Array of cycle paths, where each cycle path is an array of file paths.
+ */
 export function detectDependencyCycles(graph) {
     const cycles = [];
     const visited = new Set();
@@ -105,6 +133,13 @@ export function detectDependencyCycles(graph) {
 function hasLayerSegment(pathStr, segment) {
     return new RegExp(`(^|[/\\\\])${segment}([/\\\\]|$)`, 'i').test(pathStr);
 }
+/**
+ * Evaluates a dependency graph against architectural boundary rules to detect prohibited cross-layer imports.
+ *
+ * @param graph - Map of file paths to their imported dependency file paths.
+ * @param rules - Architectural boundary rules to enforce (defaults to DEFAULT_BOUNDARY_RULES).
+ * @returns Array of detected boundary violations.
+ */
 export function detectBoundaryViolations(graph, rules = DEFAULT_BOUNDARY_RULES) {
     const violations = [];
     for (const [file, imports] of graph.entries()) {

package/.agents/scripts/desktop_doctor.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+
+/**
+ * Pre-flight Desktop Distribution Doctor (Milestone 4).
+ * Prevents hybrid desktop build defects: missing custom-protocol, hollow CSS, dev-url embedding.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+
+function findCargoToml(targetDir) {
+  const candidates = [
+    path.join(targetDir, 'Cargo.toml'),
+    path.join(targetDir, 'src-tauri', 'Cargo.toml')
+  ];
+  for (const c of candidates) {
+    if (fs.existsSync(c)) return c;
+  }
+  return null;
+}
+
+function verifyCargoTauri(cargoPath) {
+  const content = fs.readFileSync(cargoPath, 'utf-8');
+  if (!content.includes('tauri')) return { ok: true, skipped: true };
+
+  const hasProtocol = content.includes('custom-protocol');
+  if (!hasProtocol) {
+    return {
+      ok: false,
+      reason: "Missing 'custom-protocol' feature in Cargo.toml dependencies. Tauri release binaries cannot embed frontend dist assets without it."
+    };
+  }
+  return { ok: true, message: 'Custom protocol enabled in Cargo.toml.' };
+}
+
+function collectCssFiles(dir) {
+  const files = [];
+  if (!fs.existsSync(dir)) return files;
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) files.push(...collectCssFiles(full));
+    else if (entry.name.endsWith('.css')) files.push(full);
+  }
+  return files;
+}
+
+function verifyCssDensity(targetDir, minBytes = 5000) {
+  const searchDirs = [
+    path.join(targetDir, 'dist'),
+    path.join(targetDir, 'client', 'dist'),
+    path.join(targetDir, 'build')
+  ];
+  let foundAny = false;
+  let totalBytes = 0;
+
+  for (const dir of searchDirs) {
+    const cssList = collectCssFiles(dir);
+    if (cssList.length > 0) {
+      foundAny = true;
+      for (const f of cssList) totalBytes += fs.statSync(f).size;
+    }
+  }
+
+  if (!foundAny) return { ok: true, skipped: true };
+  if (totalBytes < minBytes) {
+    return {
+      ok: false,
+      reason: `Hollow CSS bundle detected (${totalBytes} bytes < ${minBytes} bytes). Check that postcss.config.js is configured for Tailwind.`
+    };
+  }
+  return { ok: true, message: `CSS bundle density verified (${totalBytes} bytes).` };
+}
+
+function main() {
+  const targetDir = path.resolve(process.argv[2] || process.cwd());
+  const cargoPath = findCargoToml(targetDir);
+  const cssResult = verifyCssDensity(targetDir);
+
+  if (!cargoPath && cssResult.skipped) {
+    console.log('ℹ️  No desktop artifacts found in: ' + targetDir);
+    process.exit(0);
+  }
+
+  let failed = false;
+  console.log('🩺 Desktop Distribution Doctor inspecting: ' + targetDir);
+
+  if (cargoPath) {
+    const cargoRes = verifyCargoTauri(cargoPath);
+    if (!cargoRes.ok) {
+      console.error(`🚨 ${cargoRes.reason}`);
+      failed = true;
+    } else if (cargoRes.message) {
+      console.log(`✅ ${cargoRes.message}`);
+    }
+  }
+
+  if (!cssResult.ok) {
+    console.error(`🚨 ${cssResult.reason}`);
+    failed = true;
+  } else if (cssResult.message) {
+    console.log(`✅ ${cssResult.message}`);
+  }
+
+  process.exit(failed ? 1 : 0);
+}
+
+main();

package/.agents/scripts/safety_guard.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+
+/**
+ * Cross-platform PreToolUse safety guard in pure Node.js.
+ * Blocks high-severity destructive shell commands (rm -rf, force push, drop db).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const selfDir = path.dirname(fileURLToPath(import.meta.url));
+
+const candidates = [
+  process.env.AZCODR_GUARD_ENGINE,
+  path.resolve(selfDir, '../lib/agent-guard-command.js'),
+  path.resolve(selfDir, '../../lib/agent-guard-command.js')
+].filter(Boolean);
+
+async function getCommandModule() {
+  const tried = [];
+  for (const candidate of candidates) {
+    if (!fs.existsSync(candidate)) {
+      tried.push(candidate);
+      continue;
+    }
+    try {
+      return await import(pathToFileURL(candidate).href);
+    } catch (err) {
+      tried.push(`${candidate} (${err.message})`);
+    }
+  }
+  console.error(
+    '🚨 Safety Guard misconfigured: command engine not found. Tried:\n' +
+    tried.map((t) => `  - ${t}`).join('\n')
+  );
+  process.exit(2);
+}
+
+async function readStdin(timeoutMs = 1500) {
+  if (process.stdin.isTTY) return '';
+  return new Promise((resolve) => {
+    let acc = '';
+    const timer = setTimeout(() => resolve(acc), timeoutMs);
+    process.stdin.setEncoding('utf-8');
+    process.stdin.on('data', (chunk) => { acc += chunk; });
+    process.stdin.on('end', () => {
+      clearTimeout(timer);
+      resolve(acc);
+    });
+    process.stdin.on('error', () => {
+      clearTimeout(timer);
+      resolve(acc);
+    });
+  });
+}
+
+async function main() {
+  const argvInput = process.argv.slice(2).join(' ').trim();
+  const stdinInput = (await readStdin()).trim();
+  const rawInput = argvInput || stdinInput;
+
+  if (!rawInput) {
+    process.exit(0);
+  }
+
+  const { inspectCommand } = await getCommandModule();
+  const decision = inspectCommand(rawInput);
+
+  if (decision.blocked) {
+    console.error(`🚨 Safety Guard: ${decision.reason}`);
+    console.error(`   command: ${decision.command || rawInput.slice(0, 300)}`);
+    process.exit(1);
+  }
+
+  process.exit(0);
+}
+
+main().catch((err) => {
+  console.error(`🚨 Safety Guard crashed: ${err?.message || err}`);
+  process.exit(2);
+});

package/.agents/scripts/smoke_test.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+
+/**
+ * Cross-platform Boundary & Environment Smoke Test (Milestone 3).
+ * Verifies boundaries and diagnoses port occupancy before dev launch.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import net from 'node:net';
+import process from 'node:process';
+import { spawnSync } from 'node:child_process';
+
+function parseMonitoredPorts(argv) {
+  const customIndex = argv.indexOf('--ports');
+  if (customIndex !== -1 && argv[customIndex + 1]) {
+    return argv[customIndex + 1].split(',').map((p) => parseInt(p.trim(), 10)).filter(Boolean);
+  }
+  return [5173, 3000, 4000, 8080];
+}
+
+function checkPort(port, host = '127.0.0.1') {
+  return new Promise((resolve) => {
+    const server = net.createServer();
+    server.once('error', (err) => {
+      resolve({ port, available: false, error: err.code });
+    });
+    server.once('listening', () => {
+      server.close(() => resolve({ port, available: true }));
+    });
+    server.listen(port, host);
+  });
+}
+
+async function runPortDoctor(ports) {
+  console.log('🩺 Port doctor inspecting local dev ports...');
+  const results = await Promise.all(ports.map((p) => checkPort(p)));
+  for (const r of results) {
+    if (!r.available) {
+      console.log(`⚠️  Port ${r.port} is occupied (${r.error}). Check for background services to prevent collisions.`);
+    } else {
+      console.log(`✅ Port ${r.port} is free.`);
+    }
+  }
+}
+
+function runBoundaryGuard(targetDir) {
+  const guardPath = path.resolve(process.cwd(), '.agents', 'scripts', 'boundary_guard.js');
+  if (!fs.existsSync(guardPath)) {
+    console.log('ℹ️  Boundary guard script not found, skipping static graph check.');
+    return true;
+  }
+  console.log('🔍 Boundary smoke verification running on: ' + targetDir);
+  const res = spawnSync('node', [guardPath, targetDir], { stdio: 'inherit', shell: true });
+  return res.status === 0;
+}
+
+async function main() {
+  const positional = process.argv.slice(2).filter((a) => !a.startsWith('--'));
+  const targetDir = path.resolve(positional[0] || process.cwd());
+  const ports = parseMonitoredPorts(process.argv);
+
+  console.log('🚀 Running Full-Stack Smoke Verification...');
+  const boundaryPassed = runBoundaryGuard(targetDir);
+  await runPortDoctor(ports);
+
+  if (!boundaryPassed) {
+    console.error('🚨 Boundary verification failed!');
+    process.exit(1);
+  }
+
+  console.log('✅ Smoke verification passed cleanly!');
+  process.exit(0);
+}
+
+main().catch((err) => {
+  console.error(`🚨 Smoke verification crashed: ${err?.message || err}`);
+  process.exit(2);
+});

package/.agents/scripts/verify_completion.js

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+
+/**
+ * Cross-platform Stop hook in pure Node.js.
+ * Blocks premature agent exit when verification gates (validate, coverage, test, lint) fail.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { spawnSync } from 'node:child_process';
+
+function loadPackageJson() {
+  const pkgPath = path.resolve(process.cwd(), 'package.json');
+  if (!fs.existsSync(pkgPath)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function runNpmScript(name, label) {
+  console.error(label);
+  const result = spawnSync('npm', ['run', name, '--silent'], {
+    stdio: 'inherit',
+    shell: true
+  });
+  return result.status === 0;
+}
+
+function verifyCoverageGate() {
+  const [major, minor] = process.versions.node.split('.').map(Number);
+  const eligible = (major > 22 || (major === 22 && minor >= 8));
+  if (!eligible) {
+    console.error(`⚠️  Skipping coverage gate: needs Node >= 22.8 (current: ${process.version})`);
+    return true;
+  }
+  return runNpmScript('test:coverage', '📈 Running coverage gate...');
+}
+
+function main() {
+  const pkg = loadPackageJson();
+  if (!pkg || !pkg.scripts) {
+    console.error('⚠️  Stop Verifier: no verifiable package.json found -- nothing checked.');
+    process.exit(0);
+  }
+
+  const scripts = pkg.scripts;
+  let ranAny = false;
+  let failed = false;
+
+  if (typeof scripts.validate === 'string') {
+    ranAny = true;
+    if (!runNpmScript('validate', '🔍 Running architecture validation...')) failed = true;
+  }
+  if (typeof scripts['test:coverage'] === 'string') {
+    ranAny = true;
+    if (!verifyCoverageGate()) failed = true;
+  }
+  if (typeof scripts.test === 'string') {
+    ranAny = true;
+    if (!runNpmScript('test', '🧪 Running test suite...')) failed = true;
+  }
+  if (typeof scripts.lint === 'string') {
+    ranAny = true;
+    if (!runNpmScript('lint', '🔎 Running lint...')) failed = true;
+  }
+
+  if (!ranAny) {
+    console.error('⚠️  Stop Verifier: no verifiable scripts found in package.json.');
+  }
+
+  process.exit(failed ? 1 : 0);
+}
+
+main();

package/.agents/skills/lets-build/scripts/bootstrap_workspace.sh

@@ -583,3 +583,9 @@ fi
 
 echo "--------------------------------------------------------------"
 echo "✅ Topology '${TOPOLOGY}' scaffolded with strict YAGNI (0 speculative folders)!"
+echo ""
+echo "🛑 MANDATORY HANDOVER GATE (ADR-008):"
+echo "   Bootstrapping is COMPLETE. Zero application domain entities have been created."
+echo "   DO NOT fabricate domain models, entities, or features during lets-build."
+echo "   Next: invoke 'product-analyst' & 'relentless-questioner' to conduct formal"
+echo "   stakeholder domain analysis, INVEST story decomposition, and Gherkin criteria."

package/.gitignore

@@ -35,6 +35,7 @@ Thumbs.db
 .tmp/
 .tmp-scratch/
 opencode.json
+.agents/.agents/
 
 # Case-insensitive filesystem parity (agents.md is generated/symlinked on Linux, native on macOS/Windows)
 agents.md

package/lib/agent-guard-command.d.ts

@@ -1,16 +1,33 @@
 /**
  * Command safety guard inspecting shell commands against a destructive denylist.
  */
+/**
+ * Represents the result of evaluating a shell command against the safety denylist.
+ */
 export interface CommandViolation {
+    /** Whether the command is prohibited by the safety denylist. */
     blocked: boolean;
+    /** Explanatory rationale if the command is blocked. */
     reason?: string;
+    /** Normalized command string evaluated. */
     command?: string;
 }
+/**
+ * Denylist pattern definition matching prohibited shell commands.
+ */
 export interface DenylistRule {
+    /** Regular expression pattern detecting prohibited command syntax. */
     pattern: RegExp;
+    /** Human-readable explanation of why the command is unsafe. */
     reason: string;
 }
 export declare const DESTRUCTIVE_RULES: readonly DenylistRule[];
+/**
+ * Collapses multi-line strings and extra whitespace into a single normalized shell command string.
+ *
+ * @param raw - Raw command string.
+ * @returns Cleaned single-line command string.
+ */
 export declare function normalizeCommand(raw: string): string;
 /**
  * Checks a command string against the safety denylist.

package/lib/agent-guard-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-guard-command.d.ts","sourceRoot":"","sources":["../src/agent-guard-command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,iBAAiB,EAAE,SAAS,YAAY,EAyEpD,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAehE;;;;;;AAED,wBAAuE"}
+{"version":3,"file":"agent-guard-command.d.ts","sourceRoot":"","sources":["../src/agent-guard-command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,iBAAiB,EAAE,SAAS,YAAY,EAyEpD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAehE;;;;;;AAED,wBAAuE"}

package/lib/agent-guard-command.js

@@ -75,6 +75,12 @@ export const DESTRUCTIVE_RULES = [
         reason: 'package publish must run via release workflow, not ad-hoc tool call'
     }
 ];
+/**
+ * Collapses multi-line strings and extra whitespace into a single normalized shell command string.
+ *
+ * @param raw - Raw command string.
+ * @returns Cleaned single-line command string.
+ */
 export function normalizeCommand(raw) {
     return raw.replace(/[\r\n\t]+/g, ' ').replace(/\s+/g, ' ').trim();
 }

package/lib/agent-guard-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-guard-command.js","sourceRoot":"","sources":["../src/agent-guard-command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAaH,MAAM,CAAC,MAAM,iBAAiB,GAA4B;IACxD;QACE,OAAO,EAAE,qGAAqG;QAC9G,MAAM,EAAE,sEAAsE;KAC/E;IACD;QACE,OAAO,EAAE,0DAA0D;QACnE,MAAM,EAAE,uCAAuC;KAChD;IACD;QACE,OAAO,EAAE,iDAAiD;QAC1D,MAAM,EAAE,sCAAsC;KAC/C;IACD;QACE,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,0DAA0D;KACnE;IACD;QACE,OAAO,EAAE,gDAAgD;QACzD,MAAM,EAAE,4CAA4C;KACrD;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,MAAM,EAAE,sDAAsD;KAC/D;IACD;QACE,OAAO,EAAE,uCAAuC;QAChD,MAAM,EAAE,6BAA6B;KACtC;IACD;QACE,OAAO,EAAE,+CAA+C;QACxD,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,OAAO,EAAE,6BAA6B;QACtC,MAAM,EAAE,iDAAiD;KAC1D;IACD;QACE,OAAO,EAAE,wBAAwB;QACjC,MAAM,EAAE,qBAAqB;KAC9B;IACD;QACE,OAAO,EAAE,kEAAkE;QAC3E,MAAM,EAAE,qBAAqB;KAC9B;IACD;QACE,OAAO,EAAE,2DAA2D;QACpE,MAAM,EAAE,qBAAqB;KAC9B;IACD;QACE,OAAO,EAAE,iCAAiC;QAC1C,MAAM,EAAE,6BAA6B;KACtC;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,MAAM,EAAE,oBAAoB;KAC7B;IACD;QACE,OAAO,EAAE,yCAAyC;QAClD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,6CAA6C;QACtD,MAAM,EAAE,+CAA+C;KACxD;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,MAAM,EAAE,sCAAsC;KAC/C;IACD;QACE,OAAO,EAAE,gCAAgC;QACzC,MAAM,EAAE,qEAAqE;KAC9E;CACF,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"agent-guard-command.js","sourceRoot":"","sources":["../src/agent-guard-command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAwBH,MAAM,CAAC,MAAM,iBAAiB,GAA4B;IACxD;QACE,OAAO,EAAE,qGAAqG;QAC9G,MAAM,EAAE,sEAAsE;KAC/E;IACD;QACE,OAAO,EAAE,0DAA0D;QACnE,MAAM,EAAE,uCAAuC;KAChD;IACD;QACE,OAAO,EAAE,iDAAiD;QAC1D,MAAM,EAAE,sCAAsC;KAC/C;IACD;QACE,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,0DAA0D;KACnE;IACD;QACE,OAAO,EAAE,gDAAgD;QACzD,MAAM,EAAE,4CAA4C;KACrD;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,MAAM,EAAE,sDAAsD;KAC/D;IACD;QACE,OAAO,EAAE,uCAAuC;QAChD,MAAM,EAAE,6BAA6B;KACtC;IACD;QACE,OAAO,EAAE,+CAA+C;QACxD,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,OAAO,EAAE,6BAA6B;QACtC,MAAM,EAAE,iDAAiD;KAC1D;IACD;QACE,OAAO,EAAE,wBAAwB;QACjC,MAAM,EAAE,qBAAqB;KAC9B;IACD;QACE,OAAO,EAAE,kEAAkE;QAC3E,MAAM,EAAE,qBAAqB;KAC9B;IACD;QACE,OAAO,EAAE,2DAA2D;QACpE,MAAM,EAAE,qBAAqB;KAC9B;IACD;QACE,OAAO,EAAE,iCAAiC;QAC1C,MAAM,EAAE,6BAA6B;KACtC;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,MAAM,EAAE,oBAAoB;KAC7B;IACD;QACE,OAAO,EAAE,yCAAyC;QAClD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,6CAA6C;QACtD,MAAM,EAAE,+CAA+C;KACxD;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,MAAM,EAAE,sCAAsC;KAC/C;IACD;QACE,OAAO,EAAE,gCAAgC;QACzC,MAAM,EAAE,qEAAqE;KAC9E;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC"}