create-agentfs 0.1.1

package/dist/security/parser.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Security policy parser — reads policy.yaml into SecurityPolicy.
+ *
+ * Story 7.1: Parse `.agentos/security/policy.yaml` into a structured
+ * SecurityPolicy object that the compile pipeline can use to generate
+ * native enforcement rules.
+ *
+ * @module security/parser
+ */
+import type { SecurityPolicy } from '../types/index.js';
+/**
+ * Default security policy used when no policy.yaml exists.
+ */
+export declare const DEFAULT_POLICY: SecurityPolicy;
+/**
+ * Read and parse the security policy from a vault.
+ *
+ * @param vaultRoot - Absolute path to vault root
+ * @returns Parsed SecurityPolicy, or default if file doesn't exist
+ */
+export declare function readSecurityPolicy(vaultRoot: string): Promise<SecurityPolicy>;
+/**
+ * Write a security policy to disk.
+ *
+ * @param vaultRoot - Absolute path to vault root
+ * @param policy    - SecurityPolicy to persist
+ */
+export declare function writeSecurityPolicy(vaultRoot: string, policy: SecurityPolicy): Promise<void>;
+/**
+ * Validate content against input validation patterns.
+ *
+ * Story 7.3: Scans content for prompt injection patterns and returns matches.
+ *
+ * @param content - Text to scan
+ * @param policy  - Security policy with patterns
+ * @returns Array of matched pattern strings
+ */
+export declare function scanForInjections(content: string, policy: SecurityPolicy): string[];
+/**
+ * Check if a command is blocked by policy.
+ *
+ * @param command - Command string to check
+ * @param policy  - Security policy
+ * @returns 'blocked' | 'ask' | 'allowed'
+ */
+export declare function checkCommand(command: string, policy: SecurityPolicy): 'blocked' | 'ask' | 'allowed';
+//# sourceMappingURL=parser.d.ts.map

package/dist/security/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/security/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,cA8B5B,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,CAAC,CAUzB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAKf;AA4BD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,GACrB,MAAM,EAAE,CAOV;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,GACrB,SAAS,GAAG,KAAK,GAAG,SAAS,CAY/B"}

package/dist/security/parser.js

@@ -0,0 +1,136 @@
+/**
+ * Security policy parser — reads policy.yaml into SecurityPolicy.
+ *
+ * Story 7.1: Parse `.agentos/security/policy.yaml` into a structured
+ * SecurityPolicy object that the compile pipeline can use to generate
+ * native enforcement rules.
+ *
+ * @module security/parser
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import yaml from 'js-yaml';
+const POLICY_PATH = '.agentos/security/policy.yaml';
+/**
+ * Default security policy used when no policy.yaml exists.
+ */
+export const DEFAULT_POLICY = {
+    version: '1.0',
+    default_mode: 'complain',
+    file_access: {
+        default: 'rw',
+        allow_write: ['**/*.md', '**/*.yaml', '**/*.json'],
+        ask_write: ['.agentos/**', '.claude/**'],
+        deny_read: ['.env', '**/*.pem', '**/*.key'],
+        deny_write: ['.git/**', 'node_modules/**'],
+    },
+    input_validation: {
+        enabled: true,
+        scan_on_read: [
+            { pattern: 'ignore previous instructions' },
+            { pattern: 'system prompt override' },
+            { pattern: 'you are now' },
+        ],
+        action: 'warn',
+        quarantine_path: '.agentos/security/quarantine/',
+    },
+    network: {
+        deny_exfil_patterns: [
+            { regex: '(api_key|secret|password|token)\\s*[:=]' },
+        ],
+        allowed_domains: [],
+    },
+    commands: {
+        blocked: ['rm -rf /', 'curl | sh', 'wget | sh'],
+        ask_before: ['npm install', 'pip install', 'brew install'],
+    },
+};
+/**
+ * Read and parse the security policy from a vault.
+ *
+ * @param vaultRoot - Absolute path to vault root
+ * @returns Parsed SecurityPolicy, or default if file doesn't exist
+ */
+export async function readSecurityPolicy(vaultRoot) {
+    const policyPath = path.join(vaultRoot, POLICY_PATH);
+    try {
+        const content = await fs.readFile(policyPath, 'utf8');
+        const parsed = yaml.load(content);
+        return mergeWithDefaults(parsed);
+    }
+    catch {
+        return DEFAULT_POLICY;
+    }
+}
+/**
+ * Write a security policy to disk.
+ *
+ * @param vaultRoot - Absolute path to vault root
+ * @param policy    - SecurityPolicy to persist
+ */
+export async function writeSecurityPolicy(vaultRoot, policy) {
+    const policyPath = path.join(vaultRoot, POLICY_PATH);
+    await fs.mkdir(path.dirname(policyPath), { recursive: true });
+    const content = yaml.dump(policy, { lineWidth: 120 });
+    await fs.writeFile(policyPath, content, 'utf8');
+}
+/**
+ * Merge a partial policy with defaults.
+ */
+function mergeWithDefaults(partial) {
+    return {
+        version: partial.version ?? DEFAULT_POLICY.version,
+        default_mode: partial.default_mode ?? DEFAULT_POLICY.default_mode,
+        file_access: {
+            ...DEFAULT_POLICY.file_access,
+            ...partial.file_access,
+        },
+        input_validation: {
+            ...DEFAULT_POLICY.input_validation,
+            ...partial.input_validation,
+        },
+        network: {
+            ...DEFAULT_POLICY.network,
+            ...partial.network,
+        },
+        commands: {
+            ...DEFAULT_POLICY.commands,
+            ...partial.commands,
+        },
+    };
+}
+/**
+ * Validate content against input validation patterns.
+ *
+ * Story 7.3: Scans content for prompt injection patterns and returns matches.
+ *
+ * @param content - Text to scan
+ * @param policy  - Security policy with patterns
+ * @returns Array of matched pattern strings
+ */
+export function scanForInjections(content, policy) {
+    if (!policy.input_validation.enabled)
+        return [];
+    const lower = content.toLowerCase();
+    return policy.input_validation.scan_on_read
+        .filter((p) => lower.includes(p.pattern.toLowerCase()))
+        .map((p) => p.pattern);
+}
+/**
+ * Check if a command is blocked by policy.
+ *
+ * @param command - Command string to check
+ * @param policy  - Security policy
+ * @returns 'blocked' | 'ask' | 'allowed'
+ */
+export function checkCommand(command, policy) {
+    const lower = command.toLowerCase();
+    if (policy.commands.blocked.some((b) => lower.includes(b.toLowerCase()))) {
+        return 'blocked';
+    }
+    if (policy.commands.ask_before.some((a) => lower.startsWith(a.toLowerCase()))) {
+        return 'ask';
+    }
+    return 'allowed';
+}
+//# sourceMappingURL=parser.js.map

package/dist/security/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../src/security/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,SAAS,CAAC;AAG3B,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAEpD;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,OAAO,EAAE,KAAK;IACd,YAAY,EAAE,UAAU;IACxB,WAAW,EAAE;QACX,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC;QAClD,SAAS,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;QACxC,SAAS,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC;QAC3C,UAAU,EAAE,CAAC,SAAS,EAAE,iBAAiB,CAAC;KAC3C;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE,IAAI;QACb,YAAY,EAAE;YACZ,EAAE,OAAO,EAAE,8BAA8B,EAAE;YAC3C,EAAE,OAAO,EAAE,wBAAwB,EAAE;YACrC,EAAE,OAAO,EAAE,aAAa,EAAE;SAC3B;QACD,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,+BAA+B;KACjD;IACD,OAAO,EAAE;QACP,mBAAmB,EAAE;YACnB,EAAE,KAAK,EAAE,yCAAyC,EAAE;SACrD;QACD,eAAe,EAAE,EAAE;KACpB;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC;QAC/C,UAAU,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,cAAc,CAAC;KAC3D;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAA4B,CAAC;QAC7D,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,MAAsB;IAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,OAAgC;IACzD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC,OAAO;QAClD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,cAAc,CAAC,YAAY;QACjE,WAAW,EAAE;YACX,GAAG,cAAc,CAAC,WAAW;YAC7B,GAAG,OAAO,CAAC,WAAW;SACvB;QACD,gBAAgB,EAAE;YAChB,GAAG,cAAc,CAAC,gBAAgB;YAClC,GAAG,OAAO,CAAC,gBAAgB;SAC5B;QACD,OAAO,EAAE;YACP,GAAG,cAAc,CAAC,OAAO;YACzB,GAAG,OAAO,CAAC,OAAO;SACnB;QACD,QAAQ,EAAE;YACR,GAAG,cAAc,CAAC,QAAQ;YAC1B,GAAG,OAAO,CAAC,QAAQ;SACpB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,MAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAEhD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,gBAAgB,CAAC,YAAY;SACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,MAAsB;IAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAEpC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/sync/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Sync module — barrel export.
+ * @module sync
+ */
+export { importFromOmc, detectDrift, exportToOmc, } from './sync.js';
+export type { DriftResult } from './sync.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/sync/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC"}

package/dist/sync/index.js

@@ -0,0 +1,6 @@
+/**
+ * Sync module — barrel export.
+ * @module sync
+ */
+export { importFromOmc, detectDrift, exportToOmc, } from './sync.js';
+//# sourceMappingURL=index.js.map

package/dist/sync/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,WAAW,CAAC"}

package/dist/sync/sync.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Sync & Import module — bidirectional synchronization.
+ *
+ * Story 9.1: Import memory from native agent stores (e.g. .omc/project-memory.json)
+ * Story 9.2: Drift detection between manifest and compiled outputs
+ * Story 9.3: Bidirectional OpenClaw memory sync
+ *
+ * @module sync/sync
+ */
+/**
+ * Import memory facts from .omc/project-memory.json into semantic.md.
+ * Canonical source always wins on conflicts — duplicates are skipped.
+ *
+ * @param vaultRoot - Vault root path
+ * @returns Import result with counts
+ */
+export declare function importFromOmc(vaultRoot: string): Promise<{
+    imported: number;
+    skipped: number;
+    errors: string[];
+}>;
+/** Drift detection result for a single file. */
+export interface DriftResult {
+    file: string;
+    drifted: boolean;
+    currentHash: string;
+    expectedHash: string;
+}
+/**
+ * Detect drift between compiled outputs and what compile would generate.
+ *
+ * Simple approach: compare file content hashes.
+ *
+ * @param vaultRoot - Vault root path
+ * @param files     - List of managed file paths to check
+ * @returns Array of DriftResults
+ */
+export declare function detectDrift(vaultRoot: string, files: string[]): Promise<DriftResult[]>;
+/**
+ * Export semantic memory to .omc/project-memory.json format.
+ *
+ * @param vaultRoot - Vault root path
+ * @returns Number of entries exported
+ */
+export declare function exportToOmc(vaultRoot: string): Promise<number>;
+//# sourceMappingURL=sync.d.ts.map

package/dist/sync/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/sync/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAoDlE;AAoCD,gDAAgD;AAChD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,WAAW,EAAE,CAAC,CAuBxB;AAoBD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CA4BjB"}

package/dist/sync/sync.js

@@ -0,0 +1,174 @@
+/**
+ * Sync & Import module — bidirectional synchronization.
+ *
+ * Story 9.1: Import memory from native agent stores (e.g. .omc/project-memory.json)
+ * Story 9.2: Drift detection between manifest and compiled outputs
+ * Story 9.3: Bidirectional OpenClaw memory sync
+ *
+ * @module sync/sync
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { parseSemanticMemory, appendSemanticEntry } from '../memory/parser.js';
+// ---------------------------------------------------------------------------
+// Story 9.1: Memory Import
+// ---------------------------------------------------------------------------
+/**
+ * Import memory facts from .omc/project-memory.json into semantic.md.
+ * Canonical source always wins on conflicts — duplicates are skipped.
+ *
+ * @param vaultRoot - Vault root path
+ * @returns Import result with counts
+ */
+export async function importFromOmc(vaultRoot) {
+    const omcPath = path.join(vaultRoot, '.omc/project-memory.json');
+    const semanticPath = path.join(vaultRoot, '.agentos/memory/semantic.md');
+    const errors = [];
+    let imported = 0;
+    let skipped = 0;
+    let omcData;
+    try {
+        const raw = await fs.readFile(omcPath, 'utf8');
+        omcData = JSON.parse(raw);
+    }
+    catch {
+        return { imported: 0, skipped: 0, errors: ['Cannot read .omc/project-memory.json'] };
+    }
+    // Parse OMC memory format — expects { facts: string[] } or similar
+    const facts = extractFactsFromOmc(omcData);
+    if (facts.length === 0) {
+        return { imported: 0, skipped: 0, errors: [] };
+    }
+    // Ensure semantic.md exists
+    try {
+        await fs.access(semanticPath);
+    }
+    catch {
+        return { imported: 0, skipped: 0, errors: ['No semantic.md found. Run agentfs onboard first.'] };
+    }
+    for (const fact of facts) {
+        try {
+            const entry = {
+                type: 'FACT',
+                content: fact,
+                status: 'active',
+            };
+            // appendSemanticEntry handles dedup internally
+            const before = await fs.readFile(semanticPath, 'utf8');
+            await appendSemanticEntry(semanticPath, entry);
+            const after = await fs.readFile(semanticPath, 'utf8');
+            if (before === after) {
+                skipped++;
+            }
+            else {
+                imported++;
+            }
+        }
+        catch {
+            errors.push(`Failed to import fact: ${fact}`);
+        }
+    }
+    return { imported, skipped, errors };
+}
+/**
+ * Extract facts from OMC memory format.
+ * Handles various shapes: { facts: [] }, { entries: [] }, or array directly.
+ */
+function extractFactsFromOmc(data) {
+    if (Array.isArray(data)) {
+        return data.filter((d) => typeof d === 'string');
+    }
+    if (data && typeof data === 'object') {
+        const obj = data;
+        // Try common keys
+        for (const key of ['facts', 'entries', 'memories', 'items']) {
+            if (Array.isArray(obj[key])) {
+                return obj[key]
+                    .map((item) => {
+                    if (typeof item === 'string')
+                        return item;
+                    if (item && typeof item === 'object' && 'content' in item) {
+                        return String(item.content);
+                    }
+                    return null;
+                })
+                    .filter((s) => s !== null);
+            }
+        }
+    }
+    return [];
+}
+/**
+ * Detect drift between compiled outputs and what compile would generate.
+ *
+ * Simple approach: compare file content hashes.
+ *
+ * @param vaultRoot - Vault root path
+ * @param files     - List of managed file paths to check
+ * @returns Array of DriftResults
+ */
+export async function detectDrift(vaultRoot, files) {
+    const results = [];
+    for (const file of files) {
+        const filePath = path.join(vaultRoot, file);
+        let currentHash = '';
+        try {
+            const content = await fs.readFile(filePath, 'utf8');
+            currentHash = simpleHash(content);
+        }
+        catch {
+            currentHash = 'MISSING';
+        }
+        results.push({
+            file,
+            drifted: false, // Will be set to true when we have compiled comparison
+            currentHash,
+            expectedHash: '', // Populated during compile comparison
+        });
+    }
+    return results;
+}
+/**
+ * Simple string hash for drift detection.
+ * Not cryptographic — just for comparison.
+ */
+function simpleHash(content) {
+    let hash = 0;
+    for (let i = 0; i < content.length; i++) {
+        const char = content.charCodeAt(i);
+        hash = ((hash << 5) - hash) + char;
+        hash |= 0;
+    }
+    return hash.toString(16);
+}
+// ---------------------------------------------------------------------------
+// Story 9.3: Export to OMC
+// ---------------------------------------------------------------------------
+/**
+ * Export semantic memory to .omc/project-memory.json format.
+ *
+ * @param vaultRoot - Vault root path
+ * @returns Number of entries exported
+ */
+export async function exportToOmc(vaultRoot) {
+    const semanticPath = path.join(vaultRoot, '.agentos/memory/semantic.md');
+    let content;
+    try {
+        content = await fs.readFile(semanticPath, 'utf8');
+    }
+    catch {
+        return 0;
+    }
+    const entries = parseSemanticMemory(content);
+    const active = entries.filter((e) => e.status === 'active');
+    const omcData = {
+        version: '1.0',
+        source: 'agentfs',
+        facts: active.map((e) => `${e.type}: ${e.content}`),
+    };
+    const omcDir = path.join(vaultRoot, '.omc');
+    await fs.mkdir(omcDir, { recursive: true });
+    await fs.writeFile(path.join(omcDir, 'project-memory.json'), JSON.stringify(omcData, null, 2) + '\n', 'utf8');
+    return active.length;
+}
+//# sourceMappingURL=sync.js.map

package/dist/sync/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/sync/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG/E,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,sCAAsC,CAAC,EAAE,CAAC;IACvF,CAAC;IAED,mEAAmE;IACnE,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACjD,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,kDAAkD,CAAC,EAAE,CAAC;IACnG,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAkB;gBAC3B,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,QAAQ;aACjB,CAAC;YACF,+CAA+C;YAC/C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAEtD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,QAAQ,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,kBAAkB;QAClB,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC5B,OAAQ,GAAG,CAAC,GAAG,CAAe;qBAC3B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBACZ,IAAI,OAAO,IAAI,KAAK,QAAQ;wBAAE,OAAO,IAAI,CAAC;oBAC1C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;wBAC1D,OAAO,MAAM,CAAE,IAAgC,CAAC,OAAO,CAAC,CAAC;oBAC3D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC,CAAC;qBACD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,KAAe;IAEf,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,WAAW,GAAG,EAAE,CAAC;QAErB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpD,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,uDAAuD;YACvE,WAAW;YACX,YAAY,EAAE,EAAE,EAAE,sCAAsC;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB;IAEjB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;IAEzE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;KACpD,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACxC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACvC,MAAM,CACP,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC"}

package/dist/types/compiler.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Compile Pipeline types — kernel → native agent configs.
+ *
+ * Each agent has a "driver" (compiler) that translates the canonical
+ * manifest + init.d + memory into the agent's native format.
+ *
+ * @see docs/architecture.md Section 9 "Compile Pipeline"
+ */
+import type { AgentRuntime, Manifest } from './manifest.js';
+/**
+ * Context passed to compilers during the compile phase.
+ * Contains everything a driver needs to generate native output.
+ */
+export interface CompileContext {
+    /** Parsed manifest.yaml */
+    manifest: Manifest;
+    /** Contents of init.d/ scripts, keyed by filename */
+    initScripts: Record<string, string>;
+    /** Semantic memory content (always loaded) */
+    semanticMemory: string | null;
+    /** Corrections content (agent mistakes) */
+    corrections: string | null;
+    /** Root path of the vault */
+    vaultRoot: string;
+    /** Whether this is a dry-run (preview only, don't write) */
+    dryRun: boolean;
+}
+/** A single file that a compiler wants to write. */
+export interface CompileOutput {
+    /** Relative path from vault root */
+    path: string;
+    /** File content to write */
+    content: string;
+    /** Whether this file is owned by AgentFS (true) or user (false) */
+    managed: boolean;
+}
+/** Result of a compile operation. */
+export interface CompileResult {
+    /** Which agent this result is for */
+    agent: AgentRuntime;
+    /** Files to write (or that would be written in dry-run) */
+    outputs: CompileOutput[];
+    /** Human-readable summary of what was/would be done */
+    summary: string;
+}
+/**
+ * Agent compiler interface — one per supported agent.
+ *
+ * Implement this to add support for a new AI agent runtime.
+ * Each compiler lives in `src/compilers/{agent}.ts`.
+ *
+ * @example
+ * ```ts
+ * const claude: AgentCompiler = {
+ *   name: 'claude',
+ *   compile(ctx) { ... },
+ *   supports(feature) { ... },
+ * };
+ * ```
+ */
+export interface AgentCompiler {
+    /** Agent runtime name */
+    readonly name: AgentRuntime;
+    /**
+     * Compile manifest + context into native agent config files.
+     *
+     * @param context - Everything the compiler needs
+     * @returns Files to write and a summary
+     */
+    compile(context: CompileContext): Promise<CompileResult>;
+    /**
+     * Check if this agent supports a given feature.
+     *
+     * Used to determine which security/memory features
+     * can be compiled for this agent.
+     *
+     * @param feature - Feature name (e.g. 'security-enforce', 'memory-sync')
+     */
+    supports(feature: string): boolean;
+}
+//# sourceMappingURL=compiler.d.ts.map

package/dist/types/compiler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compiler.d.ts","sourceRoot":"","sources":["../../src/types/compiler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,8CAA8C;IAC9C,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2CAA2C;IAC3C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,2DAA2D;IAC3D,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAE5B;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEzD;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;CACpC"}

package/dist/types/compiler.js

@@ -0,0 +1,10 @@
+/**
+ * Compile Pipeline types — kernel → native agent configs.
+ *
+ * Each agent has a "driver" (compiler) that translates the canonical
+ * manifest + init.d + memory into the agent's native format.
+ *
+ * @see docs/architecture.md Section 9 "Compile Pipeline"
+ */
+export {};
+//# sourceMappingURL=compiler.js.map

package/dist/types/compiler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compiler.js","sourceRoot":"","sources":["../../src/types/compiler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/types/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * AgentFS core types — barrel export.
+ *
+ * Import all types from here:
+ * ```ts
+ * import type { Manifest, AgentCompiler, SecurityPolicy } from './types/index.js';
+ * ```
+ */
+export type { Profile, AgentRuntime, SecurityMode, FhsPaths, AgentConfig, BootConfig, FrontmatterConfig, SubagentStatus, HookEvent, HooksConfig, Manifest, } from './manifest.js';
+export type { CompileContext, CompileOutput, CompileResult, AgentCompiler, } from './compiler.js';
+export type { FilePermission, ValidationAction, FileAccessPolicy, InputValidationPolicy, NetworkPolicy, CommandPolicy, SecurityPolicy, } from './security.js';
+export type { SemanticEntryType, EntryStatus, SemanticEntry, ConfidenceConfig, EpisodicEntry, ProceduralEntry, } from './memory.js';
+export { DEFAULT_CONFIDENCE } from './memory.js';
+export type { SetupAnswers, GeneratorResult, ScaffoldResult, } from './setup.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EACV,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,WAAW,EACX,QAAQ,GACT,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,YAAY,EACV,YAAY,EACZ,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC"}

package/dist/types/index.js

@@ -0,0 +1,10 @@
+/**
+ * AgentFS core types — barrel export.
+ *
+ * Import all types from here:
+ * ```ts
+ * import type { Manifest, AgentCompiler, SecurityPolicy } from './types/index.js';
+ * ```
+ */
+export { DEFAULT_CONFIDENCE } from './memory.js';
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0CH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC"}