npm - github-router - Versions diffs - 0.3.297 → 0.3.303 - Mend

github-router 0.3.297 → 0.3.303

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (104) hide show

package/dist/{internal-artifact-open-D6tKMg8v.js.map → internal-artifact-open-DRSxShAW.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"internal-artifact-open-D6tKMg8v.js","names":[],"sources":["../src/lib/artifact/plan-html.ts","../src/internal-artifact-open.ts"],"sourcesContent":["/*\n Render a plan's markdown into a self-contained, styled HTML document for the\n * ai-or-die Artifact panel. HTML is the canonical review artifact (lavish's\n * model); converting here means the hands-off auto-open shows a formatted,\n * annotatable page instead of raw markdown.\n \n Security: the iframe ai-or-die serves this into runs with\n * `allow-scripts allow-same-origin`, so a `<script>` smuggled into the plan\n * markdown could read the per-session asset token. Two defenses:\n * 1. marked is configured to ESCAPE raw HTML tokens (render as visible text).\n * 2. `link`/`image` hrefs with script-bearing schemes (javascript:, vbscript:,\n * non-image data:) are neutralised before rendering.\n * No separate sanitizer/dep needed.\n /\nimport { Marked } from \"marked\"\n\nfunction escapeHtml(s: string): string {\n return s\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\")\n}\n\n/* Decode the HTML character references a browser would resolve in an attribute\n * value, so an entity-obfuscated scheme (`javascript&colon;`, `javascript:`)\n * cannot slip past the scheme check below. Numeric refs cover any letter; the\n * small named map covers the scheme-relevant punctuation. /\nconst NAMED_REFS: Record<string, string> = {\n colon: \":\", tab: \"\\t\", newline: \"\\n\", sol: \"/\", semi: \";\", amp: \"&\", lpar: \"(\", rpar: \")\",\n}\nfunction decodeEntities(s: string): string {\n return s.replace(/&(#[xX][0-9a-fA-F]+\|#[0-9]+\|[a-zA-Z]+);?/g, (m, body: string) => {\n if (body[0] === \"#\") {\n const code = body[1] === \"x\" \|\| body[1] === \"X\"\n ? Number.parseInt(body.slice(2), 16)\n : Number.parseInt(body.slice(1), 10)\n return Number.isFinite(code) && code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : m\n }\n return NAMED_REFS[body.toLowerCase()] ?? m\n })\n}\n\n/* Block script-bearing URL schemes (defense-in-depth on top of HTML escaping). /\nfunction isDangerousUrl(url: string, isImage: boolean): boolean {\n // Decode entities first (a browser resolves them in href), then drop ASCII\n // control chars + spaces (code <= 0x20) a browser ignores inside a scheme.\n const v = Array.from(decodeEntities(url)).filter((c) => c.charCodeAt(0) > 0x20).join(\"\").toLowerCase()\n if (v.startsWith(\"javascript:\") \|\| v.startsWith(\"vbscript:\")) return true\n if (v.startsWith(\"data:\")) {\n // Allow only raster image data URIs (and only for <img>); SVG can script.\n return !(isImage && v.startsWith(\"data:image/\") && !v.startsWith(\"data:image/svg\"))\n }\n return false\n}\n\n/* A marked instance that escapes raw HTML (raw markup never becomes live). /\nfunction makeMarked(): Marked {\n const m = new Marked({ gfm: true, breaks: false })\n m.use({\n renderer: {\n // Raw HTML in the source is rendered as escaped text, never live markup.\n html(token: unknown): string {\n const text = typeof token === \"string\" ? token : ((token as { text?: string }).text ?? \"\")\n return escapeHtml(text)\n },\n },\n })\n return m\n}\n\ninterface MdToken {\n type?: string\n href?: string\n tokens?: MdToken[]\n items?: MdToken[]\n header?: Array<{ tokens?: MdToken[] }>\n rows?: Array<Array<{ tokens?: MdToken[] }>>\n}\n\n/\n Recursively neutralise script-bearing link/image hrefs in the lexed token tree.\n * Done as an explicit walk (not marked's `walkTokens` hook) because we render via\n * the low-level `lexer`+`parser` split, which does not run registered walkTokens.\n /\nfunction neutralizeUrls(tokens: MdToken[]): void {\n for (const t of tokens) {\n if ((t.type === \"link\" \|\| t.type === \"image\") && typeof t.href === \"string\") {\n if (isDangerousUrl(t.href, t.type === \"image\")) t.href = \"#\"\n }\n if (t.tokens) neutralizeUrls(t.tokens)\n if (t.items) neutralizeUrls(t.items)\n if (t.header) for (const cell of t.header) if (cell.tokens) neutralizeUrls(cell.tokens)\n if (t.rows) for (const row of t.rows) for (const cell of row) if (cell.tokens) neutralizeUrls(cell.tokens)\n }\n}\n\n/* Add `data-source-line=\"N\"` to the first opening tag of a rendered block. /\nfunction tagSourceLine(html: string, line: number): string {\n return html.replace(/^(\\s)<([a-zA-Z][\\w-])/, `$1<$2 data-source-line=\"${line}\"`)\n}\n\n/\n Render markdown to inner HTML, tagging each top-level block with its 1-based\n * source line so an annotation in the panel can map back to a plan line.\n /\nexport function renderMarkdownBody(source: string): string {\n const m = makeMarked()\n let tokens: Array<{ raw?: string }>\n try {\n tokens = m.lexer(source) as Array<{ raw?: string }>\n } catch {\n // Lexing should not fail, but never throw out of the hook path.\n return `<pre>${escapeHtml(source)}</pre>`\n }\n neutralizeUrls(tokens as MdToken[])\n let line = 1\n let out = \"\"\n for (const tok of tokens) {\n let html: string\n try {\n html = m.parser([tok] as Parameters<typeof m.parser>[0])\n } catch {\n html = \"\"\n }\n if (html.trim()) out += tagSourceLine(html, line)\n line += (tok.raw?.match(/\\n/g)?.length ?? 0)\n }\n return out \|\| `<pre>${escapeHtml(source)}</pre>`\n}\n\n/\n Wrap rendered markdown in a complete, self-contained HTML document with\n * readable typography (works even before ai-or-die injects its annotation SDK).\n /\nexport function renderPlanHtml(source: string, title = \"Plan\"): string {\n return wrapArtifactDocument(renderMarkdownBody(source), title)\n}\n\nconst BASE_STYLE = ` :root {\n --bg: #0f1115; --fg: #f7f3ea; --muted: #aeb6c6; --border: #2a2f3a;\n --accent: #f4c95d; --code-bg: #171a21;\n --serif: 'Iowan Old Style', Georgia, 'Times New Roman', serif;\n --sans: ui-sans-serif, system-ui, -apple-system, 'Segoe UI', sans-serif;\n --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n }\n { box-sizing: border-box; }\n html, body { margin: 0; background: var(--bg); color: var(--fg); }\n body { font-family: var(--serif); font-size: 16px; line-height: 1.6;\n padding: 32px clamp(16px, 5vw, 56px); }\n main { max-width: 78ch; margin: 0 auto; }\n h1, h2, h3, h4 { font-family: var(--sans); line-height: 1.25; margin: 1.6em 0 0.5em; }\n h1 { font-size: 1.9em; } h2 { font-size: 1.45em; padding-bottom: 0.2em;\n border-bottom: 1px solid var(--border); } h3 { font-size: 1.2em; }\n p, li { color: var(--fg); }\n a { color: var(--accent); }\n code { font-family: var(--mono); font-size: 0.9em; background: var(--code-bg);\n padding: 0.12em 0.35em; border-radius: 5px; }\n pre { background: var(--code-bg); border: 1px solid var(--border); border-radius: 8px;\n padding: 12px 14px; overflow: auto; }\n pre code { background: none; padding: 0; }\n blockquote { margin: 1em 0; padding: 0.2em 1em; border-left: 3px solid var(--accent);\n color: var(--muted); }\n table { border-collapse: collapse; width: 100%; margin: 1em 0; font-family: var(--sans);\n font-size: 0.95em; }\n th, td { border: 1px solid var(--border); padding: 6px 10px; text-align: left; }\n th { background: var(--code-bg); }\n hr { border: 0; border-top: 1px solid var(--border); margin: 1.5em 0; }\n ul, ol { padding-left: 1.4em; }`\n\nconst INTERACTIVE_STYLE = `\n .aod-group { margin: 1.4em 0; padding: 14px 16px; border: 1px solid var(--border);\n border-radius: 10px; background: var(--code-bg); }\n .aod-prompt { font-family: var(--sans); font-weight: 600; margin: 0 0 0.6em; }\n .aod-options { display: flex; flex-wrap: wrap; gap: 8px; }\n .aod-multi-select .aod-options { flex-direction: column; gap: 6px; }\n .aod-action, .aod-submit { font-family: var(--sans); font-size: 0.95em; font-weight: 600;\n cursor: pointer; border: 1px solid var(--border); border-radius: 8px;\n padding: 8px 12px; background: var(--bg); color: var(--fg); }\n .aod-action:hover, .aod-submit:hover { border-color: var(--accent); }\n .aod-submit { margin-top: 10px; background: var(--accent); color: #17130a; border-color: var(--accent); }\n .aod-check { display: flex; align-items: center; gap: 8px; font-family: var(--sans); cursor: pointer; }\n .aod-steps { list-style: decimal; }\n .aod-step { margin: 0.5em 0; }\n .aod-step-actions { display: inline-flex; gap: 6px; margin-left: 8px; }`\n\n/*\n Wrap rendered inner HTML in the self-contained document shell. `extraStyle` is\n * appended to the inline stylesheet so the interactive variant can add its own\n * rules without a second `<style>` block. Static callers pass \"\" (default), so\n * the static document is byte-identical to the pre-refactor output.\n /\nfunction wrapArtifactDocument(body: string, title: string, extraStyle = \"\"): string {\n return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeHtml(title)}</title>\n<style>\n${BASE_STYLE}${extraStyle}\n</style>\n</head>\n<body>\n<main>\n${body}\n</main>\n</body>\n</html>\n`\n}\n\n/ -------------------------------------------------------------------------- /\n/ Interactive artifacts (contract v2.2 §4: declarative data-aod-* vocab) /\n/ -------------------------------------------------------------------------- /\n\nexport interface InteractiveOption {\n /* Stable id echoed back as `elementId` in the action event. Required. /\n elementId: string\n /* Human-visible label. /\n label: string\n /* Optional value echoed as `data-aod-value` (checkbox submits use \"true\"/\"false\"). /\n value?: string\n}\n\n/* One immediate-fire choice group: each option posts an action the instant it is clicked. /\nexport interface ChooseOneBlock {\n kind: \"choose-one\"\n /* `data-aod-group` shared by the options (marks them as one decision). /\n group: string\n prompt?: string\n /* `data-aod-action` verb for every option (default \"choose\"). /\n action?: string\n options: InteractiveOption[]\n}\n\n/* A multi-select group: checkbox toggles plus one submit that carries {group, selected}. /\nexport interface MultiSelectBlock {\n kind: \"multi-select\"\n group: string\n prompt?: string\n submitLabel?: string\n submitElementId?: string\n options: InteractiveOption[]\n}\n\nexport interface StepAction {\n /* `data-aod-action` verb (e.g. \"approve\", \"skip\"). /\n action: string\n label: string\n value?: string\n}\n\nexport interface StepItem {\n /* Stable `data-aod-id` echoed as `elementId`. /\n elementId: string\n label: string\n sourceLine?: number\n actions: StepAction[]\n}\n\n/* An ordered list of plan steps, each with its own inline action buttons. /\nexport interface StepsBlock {\n kind: \"steps\"\n steps: StepItem[]\n}\n\nexport type InteractiveBlock = ChooseOneBlock \| MultiSelectBlock \| StepsBlock\n\nexport interface InteractivePlanModel {\n /* Optional prose rendered above the interactive blocks (same escaping as static). /\n markdown?: string\n blocks: InteractiveBlock[]\n}\n\n/* Build a ` data-x=\"y\"` attribute string, dropping undefined values, all escaped. /\nfunction dataAttrs(pairs: Array<[string, string \| undefined]>): string {\n let out = \"\"\n for (const [name, value] of pairs) {\n if (value === undefined) continue\n out += ` ${name}=\"${escapeHtml(value)}\"`\n }\n return out\n}\n\nfunction renderChooseOne(block: ChooseOneBlock): string {\n const action = block.action && block.action.trim() ? block.action : \"choose\"\n const prompt = block.prompt ? `<p class=\"aod-prompt\">${escapeHtml(block.prompt)}</p>` : \"\"\n const options = block.options\n .filter((o) => o.elementId.trim() !== \"\")\n .map((o) => {\n const attrs = dataAttrs([\n [\"data-aod-action\", action],\n [\"data-aod-group\", block.group],\n [\"data-aod-id\", o.elementId],\n [\"data-aod-value\", o.value],\n ])\n return `<button type=\"button\" class=\"aod-action\"${attrs}>${escapeHtml(o.label)}</button>`\n })\n .join(\"\\n\")\n return `<div class=\"aod-group aod-choose-one\"${dataAttrs([[\"data-aod-group\", block.group]])}>\n${prompt}<div class=\"aod-options\">\n${options}\n</div>\n</div>`\n}\n\nfunction renderMultiSelect(block: MultiSelectBlock): string {\n const prompt = block.prompt ? `<p class=\"aod-prompt\">${escapeHtml(block.prompt)}</p>` : \"\"\n const options = block.options\n .filter((o) => o.elementId.trim() !== \"\")\n .map((o) => {\n const attrs = dataAttrs([\n [\"data-aod-action\", \"check\"],\n [\"data-aod-group\", block.group],\n [\"data-aod-id\", o.elementId],\n [\"data-aod-value\", o.value],\n ])\n return `<label class=\"aod-check\"><input type=\"checkbox\"${attrs}> <span>${escapeHtml(o.label)}</span></label>`\n })\n .join(\"\\n\")\n const submitId = block.submitElementId && block.submitElementId.trim()\n ? block.submitElementId\n : `${block.group}-submit`\n const submitAttrs = dataAttrs([\n [\"data-aod-action\", \"submit\"],\n [\"data-aod-group\", block.group],\n [\"data-aod-id\", submitId],\n ])\n const submitLabel = block.submitLabel && block.submitLabel.trim() ? block.submitLabel : \"Submit\"\n return `<div class=\"aod-group aod-multi-select\"${dataAttrs([[\"data-aod-group\", block.group]])}>\n${prompt}<div class=\"aod-options\">\n${options}\n</div>\n<button type=\"button\" class=\"aod-submit\"${submitAttrs}>${escapeHtml(submitLabel)}</button>\n</div>`\n}\n\nfunction renderSteps(block: StepsBlock): string {\n const items = block.steps\n .filter((s) => s.elementId.trim() !== \"\")\n .map((s) => {\n const liAttrs = dataAttrs([\n [\"data-aod-id\", s.elementId],\n [\"data-source-line\", s.sourceLine === undefined ? undefined : String(s.sourceLine)],\n ])\n const actions = s.actions\n .map((a) => {\n const attrs = dataAttrs([\n [\"data-aod-action\", a.action],\n [\"data-aod-id\", s.elementId],\n [\"data-aod-value\", a.value],\n ])\n return `<button type=\"button\" class=\"aod-action\"${attrs}>${escapeHtml(a.label)}</button>`\n })\n .join(\"\")\n return `<li class=\"aod-step\"${liAttrs}><span class=\"aod-step-label\">${escapeHtml(s.label)}</span><span class=\"aod-step-actions\">${actions}</span></li>`\n })\n .join(\"\\n\")\n return `<ol class=\"aod-steps\">\n${items}\n</ol>`\n}\n\nfunction renderInteractiveBlock(block: InteractiveBlock): string {\n switch (block.kind) {\n case \"choose-one\":\n return renderChooseOne(block)\n case \"multi-select\":\n return renderMultiSelect(block)\n case \"steps\":\n return renderSteps(block)\n default:\n return \"\"\n }\n}\n\n/\n Render a typed interactive plan model into a self-contained HTML document that\n * carries the declarative `data-aod-` action vocabulary the ai-or-die panel SDK\n wires (contract v2.2 §4). Optional prose (`markdown`) is rendered with the SAME\n * escaping + dangerous-URL neutralization as the static path; all control\n * attributes and labels are HTML-escaped, so no author string can break out of an\n * attribute or inject live markup.\n /\nexport function renderInteractivePlanHtml(model: InteractivePlanModel, title = \"Plan\"): string {\n const prose = model.markdown && model.markdown.trim() ? renderMarkdownBody(model.markdown) : \"\"\n const blocks = model.blocks.map(renderInteractiveBlock).filter((h) => h.trim() !== \"\").join(\"\\n\")\n const body = [prose, blocks].filter((s) => s.trim() !== \"\").join(\"\\n\")\n return wrapArtifactDocument(body \|\| `<pre>${escapeHtml(JSON.stringify(model))}</pre>`, title, INTERACTIVE_STYLE)\n}\n","/\n The internal `internal-artifact-open` subcommand: invoked by a spawned Claude\n * Code session's `PostToolUse` hook (matcher `ExitPlanMode`), registered into the\n * mirrored settings.json by the launcher when running inside an ai-or-die tab\n * (`AIORDIE_SESSION_ID` set). It auto-opens the just-finalized plan in the\n * ai-or-die Artifact review panel so the human reviews it WITHOUT the model\n * having to call artifact_open itself.\n \n Auth: AIORDIE_TOKEN is stripped from the child env, so the token can't come via\n * env or argv (argv leaks to `ps`). The launcher writes a mode-600\n * `.aiordie-artifact.json` into CLAUDE_CONFIG_DIR; this hook reads it.\n \n Plan: the EXACT plan for THIS session comes from the ExitPlanMode payload —\n * `tool_input.planFilePath` (per-session; never the globally-newest file in the\n * shared plans dir) with `tool_input.plan` as the markdown fallback. The plan\n * markdown is rendered to a self-contained styled HTML file (HTML is the\n * canonical artifact, lavish's model — formatted + annotatable, not raw md), and\n * THAT `.html` is opened.\n \n Side-effect only: never writes stdout, never throws, always exits 0. Skips\n * subagent payloads (agent_id/agent_type) like the other hooks.\n /\n\nimport { defineCommand } from \"citty\"\n\nimport { readFileSync, realpathSync, writeFileSync } from \"node:fs\"\nimport { homedir } from \"node:os\"\nimport path from \"node:path\"\n\nimport { ArtifactClient } from \"./lib/artifact/client\"\nimport { renderPlanHtml } from \"./lib/artifact/plan-html\"\nimport { isSubagentContext } from \"./lib/orchestration/stop-gate-policy\"\n\ninterface ArtifactCreds {\n baseUrl: string\n token: string\n sessionId: string\n insecureTLS: boolean\n}\n\ninterface ExitPlanPayload {\n planFilePath?: string\n planMarkdown?: string\n}\n\nfunction readStdin(): string {\n try {\n if (process.stdin.isTTY) return \"\"\n return readFileSync(0, \"utf8\")\n } catch {\n return \"\"\n }\n}\n\nfunction credsPath(): string {\n const dir = process.env.CLAUDE_CONFIG_DIR \|\| path.join(homedir(), \".claude\")\n return path.join(dir, \".aiordie-artifact.json\")\n}\n\nfunction isSubagent(payload: unknown): boolean {\n try {\n return isSubagentContext(payload as Parameters<typeof isSubagentContext>[0])\n } catch {\n return false\n }\n}\n\n/* Pull the per-session plan path + markdown content out of the hook payload. /\nexport function parseExitPlanPayload(raw: string): ExitPlanPayload {\n try {\n const obj = JSON.parse(raw) as { tool_input?: { planFilePath?: unknown; plan?: unknown } }\n const ti = obj.tool_input ?? {}\n const planFilePath = typeof ti.planFilePath === \"string\" && ti.planFilePath.trim() ? ti.planFilePath : undefined\n const planMarkdown = typeof ti.plan === \"string\" && ti.plan.trim() ? ti.plan : undefined\n return { planFilePath, planMarkdown }\n } catch {\n return {}\n }\n}\n\nfunction readCreds(): ArtifactCreds \| undefined {\n try {\n const parsed = JSON.parse(readFileSync(credsPath(), \"utf8\")) as Partial<ArtifactCreds>\n if (!parsed.baseUrl \|\| !parsed.token \|\| !parsed.sessionId) return undefined\n return {\n baseUrl: parsed.baseUrl,\n token: parsed.token,\n sessionId: parsed.sessionId,\n insecureTLS: parsed.insecureTLS === true,\n }\n } catch {\n return undefined\n }\n}\n\n/\n Resolve the plan markdown + a title, preferring the file at `planFilePath`\n * (the source of truth, may be newer than the payload's snapshot), falling back\n * to the inline `tool_input.plan` content.\n /\nfunction resolvePlanMarkdown(p: ExitPlanPayload): { markdown: string; title: string; nearPath?: string } \| undefined {\n if (p.planFilePath) {\n try {\n const md = readFileSync(p.planFilePath, \"utf8\")\n if (md.trim()) return { markdown: md, title: path.basename(p.planFilePath, path.extname(p.planFilePath)), nearPath: p.planFilePath }\n } catch {\n / fall through to inline content /\n }\n }\n if (p.planMarkdown) return { markdown: p.planMarkdown, title: \"Plan\" }\n return undefined\n}\n\n/\n Write the rendered HTML next to the plan (an allowed root) when we have a real\n * path, else into the plans dir under CLAUDE_CONFIG_DIR. Returns the realpath of\n * the written `.html`, or undefined on failure.\n /\nfunction writePlanHtml(html: string, nearPath: string \| undefined): string \| undefined {\n let target: string\n if (nearPath) {\n // `<plan>.md` -> `<plan>.aiordie.html` (or append when there is no .md ext).\n const base = nearPath.replace(/\\.(md\|markdown)$/i, \"\")\n target = `${base}.aiordie.html`\n } else {\n const dir = path.join(process.env.CLAUDE_CONFIG_DIR \|\| path.join(homedir(), \".claude\"), \"plans\")\n target = path.join(dir, `aiordie-plan-${process.pid}.html`)\n }\n try {\n writeFileSync(target, html, \"utf8\")\n try {\n return realpathSync.native(target)\n } catch {\n return target\n }\n } catch {\n return undefined\n }\n}\n\nexport const internalArtifactOpen = defineCommand({\n meta: { name: \"internal-artifact-open\", description: \"Open the finalized plan in the ai-or-die panel\" },\n async run() {\n try {\n const raw = readStdin()\n let payload: unknown\n try {\n payload = JSON.parse(raw)\n } catch {\n payload = undefined\n }\n if (isSubagent(payload)) return\n const creds = readCreds()\n if (!creds) return\n const plan = resolvePlanMarkdown(parseExitPlanPayload(raw))\n if (!plan) return\n const htmlPath = writePlanHtml(renderPlanHtml(plan.markdown, plan.title), plan.nearPath)\n if (!htmlPath) return\n const client = new ArtifactClient(creds)\n await client.open(htmlPath)\n } catch {\n / side-effect only: never block, never throw */\n }\n },\n})\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgBA,SAAS,WAAW,GAAmB;CACrC,OAAO,EACJ,QAAQ,MAAM,OAAO,CAAC,CACtB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,QAAQ,CAAC,CACvB,QAAQ,MAAM,OAAO;AAC1B;;;;;AAMA,MAAM,aAAqC;CACzC,OAAO;CAAK,KAAK;CAAM,SAAS;CAAM,KAAK;CAAK,MAAM;CAAK,KAAK;CAAK,MAAM;CAAK,MAAM;AACxF;AACA,SAAS,eAAe,GAAmB;CACzC,OAAO,EAAE,QAAQ,8CAA8C,GAAG,SAAiB;EACjF,IAAI,KAAK,OAAO,KAAK;GACnB,MAAM,OAAO,KAAK,OAAO,OAAO,KAAK,OAAO,MACxC,OAAO,SAAS,KAAK,MAAM,CAAC,GAAG,EAAE,IACjC,OAAO,SAAS,KAAK,MAAM,CAAC,GAAG,EAAE;GACrC,OAAO,OAAO,SAAS,IAAI,KAAK,OAAO,KAAK,QAAQ,UAAW,OAAO,cAAc,IAAI,IAAI;EAC9F;EACA,OAAO,WAAW,KAAK,YAAY,MAAM;CAC3C,CAAC;AACH;;AAGA,SAAS,eAAe,KAAa,SAA2B;CAG9D,MAAM,IAAI,MAAM,KAAK,eAAe,GAAG,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,WAAW,CAAC,IAAI,EAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,YAAY;CACrG,IAAI,EAAE,WAAW,aAAa,KAAK,EAAE,WAAW,WAAW,GAAG,OAAO;CACrE,IAAI,EAAE,WAAW,OAAO,GAEtB,OAAO,EAAE,WAAW,EAAE,WAAW,aAAa,KAAK,CAAC,EAAE,WAAW,gBAAgB;CAEnF,OAAO;AACT;;AAGA,SAAS,aAAqB;CAC5B,MAAM,IAAI,IAAI,OAAO;EAAE,KAAK;EAAM,QAAQ;CAAM,CAAC;CACjD,EAAE,IAAI,EACJ,UAAU,EAER,KAAK,OAAwB;EAE3B,OAAO,WADM,OAAO,UAAU,WAAW,QAAU,MAA4B,QAAQ,EACjE;CACxB,EACF,EACF,CAAC;CACD,OAAO;AACT;;;;;;AAgBA,SAAS,eAAe,QAAyB;CAC/C,KAAK,MAAM,KAAK,QAAQ;EACtB,KAAK,EAAE,SAAS,UAAU,EAAE,SAAS,YAAY,OAAO,EAAE,SAAS,UAC7D;OAAA,eAAe,EAAE,MAAM,EAAE,SAAS,OAAO,GAAG,EAAE,OAAO;EAAA;EAE3D,IAAI,EAAE,QAAQ,eAAe,EAAE,MAAM;EACrC,IAAI,EAAE,OAAO,eAAe,EAAE,KAAK;EACnC,IAAI,EAAE,QAAa;QAAA,MAAM,QAAQ,EAAE,QAAQ,IAAI,KAAK,QAAQ,eAAe,KAAK,MAAM;EAAA;EACtF,IAAI,EAAE,MAAW;QAAA,MAAM,OAAO,EAAE,MAAM,KAAK,MAAM,QAAQ,KAAK,IAAI,KAAK,QAAQ,eAAe,KAAK,MAAM;EAAA;CAC3G;AACF;;AAGA,SAAS,cAAc,MAAc,MAAsB;CACzD,OAAO,KAAK,QAAQ,2BAA2B,2BAA2B,KAAK,EAAE;AACnF;;;;;AAMA,SAAgB,mBAAmB,QAAwB;CACzD,MAAM,IAAI,WAAW;CACrB,IAAI;CACJ,IAAI;EACF,SAAS,EAAE,MAAM,MAAM;CACzB,QAAQ;EAEN,OAAO,QAAQ,WAAW,MAAM,EAAE;CACpC;CACA,eAAe,MAAmB;CAClC,IAAI,OAAO;CACX,IAAI,MAAM;CACV,KAAK,MAAM,OAAO,QAAQ;EACxB,IAAI;EACJ,IAAI;GACF,OAAO,EAAE,OAAO,CAAC,GAAG,CAAmC;EACzD,QAAQ;GACN,OAAO;EACT;EACA,IAAI,KAAK,KAAK,GAAG,OAAO,cAAc,MAAM,IAAI;EAChD,QAAS,IAAI,KAAK,MAAM,KAAK,CAAC,EAAE,UAAU;CAC5C;CACA,OAAO,OAAO,QAAQ,WAAW,MAAM,EAAE;AAC3C;;;;;AAMA,SAAgB,eAAe,QAAgB,QAAQ,QAAgB;CACrE,OAAO,qBAAqB,mBAAmB,MAAM,GAAG,KAAK;AAC/D;AAEA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDnB,SAAS,qBAAqB,MAAc,OAAe,aAAa,IAAY;CAClF,OAAO;;;;;SAKA,WAAW,KAAK,EAAE;;EAEzB,aAAa,WAAW;;;;;EAKxB,KAAK;;;;;AAKP;;;;;;;;;;;;;;;;;;;;;;;;;ACtKA,SAAS,YAAoB;CAC3B,IAAI;EACF,IAAI,QAAQ,MAAM,OAAO,OAAO;EAChC,OAAO,aAAa,GAAG,MAAM;CAC/B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAoB;CAC3B,MAAM,MAAM,QAAQ,IAAI,qBAAqB,KAAK,KAAK,QAAQ,GAAG,SAAS;CAC3E,OAAO,KAAK,KAAK,KAAK,wBAAwB;AAChD;AAEA,SAAS,WAAW,SAA2B;CAC7C,IAAI;EACF,OAAO,kBAAkB,OAAkD;CAC7E,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,qBAAqB,KAA8B;CACjE,IAAI;EAEF,MAAM,KADM,KAAK,MAAM,GACV,CAAC,CAAC,cAAc,CAAC;EAG9B,OAAO;GAAE,cAFY,OAAO,GAAG,iBAAiB,YAAY,GAAG,aAAa,KAAK,IAAI,GAAG,eAAe,KAAA;GAEhF,cADF,OAAO,GAAG,SAAS,YAAY,GAAG,KAAK,KAAK,IAAI,GAAG,OAAO,KAAA;EAC3C;CACtC,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,SAAS,YAAuC;CAC9C,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,aAAa,UAAU,GAAG,MAAM,CAAC;EAC3D,IAAI,CAAC,OAAO,WAAW,CAAC,OAAO,SAAS,CAAC,OAAO,WAAW,OAAO,KAAA;EAClE,OAAO;GACL,SAAS,OAAO;GAChB,OAAO,OAAO;GACd,WAAW,OAAO;GAClB,aAAa,OAAO,gBAAgB;EACtC;CACF,QAAQ;EACN;CACF;AACF;;;;;;AAOA,SAAS,oBAAoB,GAAwF;CACnH,IAAI,EAAE,cACJ,IAAI;EACF,MAAM,KAAK,aAAa,EAAE,cAAc,MAAM;EAC9C,IAAI,GAAG,KAAK,GAAG,OAAO;GAAE,UAAU;GAAI,OAAO,KAAK,SAAS,EAAE,cAAc,KAAK,QAAQ,EAAE,YAAY,CAAC;GAAG,UAAU,EAAE;EAAa;CACrI,QAAQ,CAER;CAEF,IAAI,EAAE,cAAc,OAAO;EAAE,UAAU,EAAE;EAAc,OAAO;CAAO;AAEvE;;;;;;AAOA,SAAS,cAAc,MAAc,UAAkD;CACrF,IAAI;CACJ,IAAI,UAGF,SAAS,GADI,SAAS,QAAQ,qBAAqB,EACpC,EAAE;MACZ;EACL,MAAM,MAAM,KAAK,KAAK,QAAQ,IAAI,qBAAqB,KAAK,KAAK,QAAQ,GAAG,SAAS,GAAG,OAAO;EAC/F,SAAS,KAAK,KAAK,KAAK,gBAAgB,QAAQ,IAAI,MAAM;CAC5D;CACA,IAAI;EACF,cAAc,QAAQ,MAAM,MAAM;EAClC,IAAI;GACF,OAAO,aAAa,OAAO,MAAM;EACnC,QAAQ;GACN,OAAO;EACT;CACF,QAAQ;EACN;CACF;AACF;AAEA,MAAa,uBAAuB,cAAc;CAChD,MAAM;EAAE,MAAM;EAA0B,aAAa;CAAiD;CACtG,MAAM,MAAM;EACV,IAAI;GACF,MAAM,MAAM,UAAU;GACtB,IAAI;GACJ,IAAI;IACF,UAAU,KAAK,MAAM,GAAG;GAC1B,QAAQ;IACN,UAAU,KAAA;GACZ;GACA,IAAI,WAAW,OAAO,GAAG;GACzB,MAAM,QAAQ,UAAU;GACxB,IAAI,CAAC,OAAO;GACZ,MAAM,OAAO,oBAAoB,qBAAqB,GAAG,CAAC;GAC1D,IAAI,CAAC,MAAM;GACX,MAAM,WAAW,cAAc,eAAe,KAAK,UAAU,KAAK,KAAK,GAAG,KAAK,QAAQ;GACvF,IAAI,CAAC,UAAU;GAEf,MAAM,IADa,eAAe,KACvB,CAAC,CAAC,KAAK,QAAQ;EAC5B,QAAQ,CAER;CACF;AACF,CAAC"}
1	+ {"version":3,"file":"internal-artifact-open-DRSxShAW.js","names":[],"sources":["../src/lib/artifact/plan-html.ts","../src/internal-artifact-open.ts"],"sourcesContent":["/*\n Render a plan's markdown into a self-contained, styled HTML document for the\n * ai-or-die Artifact panel. HTML is the canonical review artifact (lavish's\n * model); converting here means the hands-off auto-open shows a formatted,\n * annotatable page instead of raw markdown.\n \n Security: the iframe ai-or-die serves this into runs with\n * `allow-scripts allow-same-origin`, so a `<script>` smuggled into the plan\n * markdown could read the per-session asset token. Two defenses:\n * 1. marked is configured to ESCAPE raw HTML tokens (render as visible text).\n * 2. `link`/`image` hrefs with script-bearing schemes (javascript:, vbscript:,\n * non-image data:) are neutralised before rendering.\n * No separate sanitizer/dep needed.\n /\nimport { Marked } from \"marked\"\n\nfunction escapeHtml(s: string): string {\n return s\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\")\n}\n\n/* Decode the HTML character references a browser would resolve in an attribute\n * value, so an entity-obfuscated scheme (`javascript&colon;`, `javascript:`)\n * cannot slip past the scheme check below. Numeric refs cover any letter; the\n * small named map covers the scheme-relevant punctuation. /\nconst NAMED_REFS: Record<string, string> = {\n colon: \":\", tab: \"\\t\", newline: \"\\n\", sol: \"/\", semi: \";\", amp: \"&\", lpar: \"(\", rpar: \")\",\n}\nfunction decodeEntities(s: string): string {\n return s.replace(/&(#[xX][0-9a-fA-F]+\|#[0-9]+\|[a-zA-Z]+);?/g, (m, body: string) => {\n if (body[0] === \"#\") {\n const code = body[1] === \"x\" \|\| body[1] === \"X\"\n ? Number.parseInt(body.slice(2), 16)\n : Number.parseInt(body.slice(1), 10)\n return Number.isFinite(code) && code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : m\n }\n return NAMED_REFS[body.toLowerCase()] ?? m\n })\n}\n\n/* Block script-bearing URL schemes (defense-in-depth on top of HTML escaping). /\nfunction isDangerousUrl(url: string, isImage: boolean): boolean {\n // Decode entities first (a browser resolves them in href), then drop ASCII\n // control chars + spaces (code <= 0x20) a browser ignores inside a scheme.\n const v = Array.from(decodeEntities(url)).filter((c) => c.charCodeAt(0) > 0x20).join(\"\").toLowerCase()\n if (v.startsWith(\"javascript:\") \|\| v.startsWith(\"vbscript:\")) return true\n if (v.startsWith(\"data:\")) {\n // Allow only raster image data URIs (and only for <img>); SVG can script.\n return !(isImage && v.startsWith(\"data:image/\") && !v.startsWith(\"data:image/svg\"))\n }\n return false\n}\n\n/* A marked instance that escapes raw HTML (raw markup never becomes live). /\nfunction makeMarked(): Marked {\n const m = new Marked({ gfm: true, breaks: false })\n m.use({\n renderer: {\n // Raw HTML in the source is rendered as escaped text, never live markup.\n html(token: unknown): string {\n const text = typeof token === \"string\" ? token : ((token as { text?: string }).text ?? \"\")\n return escapeHtml(text)\n },\n },\n })\n return m\n}\n\ninterface MdToken {\n type?: string\n href?: string\n tokens?: MdToken[]\n items?: MdToken[]\n header?: Array<{ tokens?: MdToken[] }>\n rows?: Array<Array<{ tokens?: MdToken[] }>>\n}\n\n/\n Recursively neutralise script-bearing link/image hrefs in the lexed token tree.\n * Done as an explicit walk (not marked's `walkTokens` hook) because we render via\n * the low-level `lexer`+`parser` split, which does not run registered walkTokens.\n /\nfunction neutralizeUrls(tokens: MdToken[]): void {\n for (const t of tokens) {\n if ((t.type === \"link\" \|\| t.type === \"image\") && typeof t.href === \"string\") {\n if (isDangerousUrl(t.href, t.type === \"image\")) t.href = \"#\"\n }\n if (t.tokens) neutralizeUrls(t.tokens)\n if (t.items) neutralizeUrls(t.items)\n if (t.header) for (const cell of t.header) if (cell.tokens) neutralizeUrls(cell.tokens)\n if (t.rows) for (const row of t.rows) for (const cell of row) if (cell.tokens) neutralizeUrls(cell.tokens)\n }\n}\n\n/* Add `data-source-line=\"N\"` to the first opening tag of a rendered block. /\nfunction tagSourceLine(html: string, line: number): string {\n return html.replace(/^(\\s)<([a-zA-Z][\\w-])/, `$1<$2 data-source-line=\"${line}\"`)\n}\n\n/\n Render markdown to inner HTML, tagging each top-level block with its 1-based\n * source line so an annotation in the panel can map back to a plan line.\n /\nexport function renderMarkdownBody(source: string): string {\n const m = makeMarked()\n let tokens: Array<{ raw?: string }>\n try {\n tokens = m.lexer(source) as Array<{ raw?: string }>\n } catch {\n // Lexing should not fail, but never throw out of the hook path.\n return `<pre>${escapeHtml(source)}</pre>`\n }\n neutralizeUrls(tokens as MdToken[])\n let line = 1\n let out = \"\"\n for (const tok of tokens) {\n let html: string\n try {\n html = m.parser([tok] as Parameters<typeof m.parser>[0])\n } catch {\n html = \"\"\n }\n if (html.trim()) out += tagSourceLine(html, line)\n line += (tok.raw?.match(/\\n/g)?.length ?? 0)\n }\n return out \|\| `<pre>${escapeHtml(source)}</pre>`\n}\n\n/\n Wrap rendered markdown in a complete, self-contained HTML document with\n * readable typography (works even before ai-or-die injects its annotation SDK).\n /\nexport function renderPlanHtml(source: string, title = \"Plan\"): string {\n return wrapArtifactDocument(renderMarkdownBody(source), title)\n}\n\nconst BASE_STYLE = ` :root {\n --bg: #0f1115; --fg: #f7f3ea; --muted: #aeb6c6; --border: #2a2f3a;\n --accent: #f4c95d; --code-bg: #171a21;\n --serif: 'Iowan Old Style', Georgia, 'Times New Roman', serif;\n --sans: ui-sans-serif, system-ui, -apple-system, 'Segoe UI', sans-serif;\n --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n }\n { box-sizing: border-box; }\n html, body { margin: 0; background: var(--bg); color: var(--fg); }\n body { font-family: var(--serif); font-size: 16px; line-height: 1.6;\n padding: 32px clamp(16px, 5vw, 56px); }\n main { max-width: 78ch; margin: 0 auto; }\n h1, h2, h3, h4 { font-family: var(--sans); line-height: 1.25; margin: 1.6em 0 0.5em; }\n h1 { font-size: 1.9em; } h2 { font-size: 1.45em; padding-bottom: 0.2em;\n border-bottom: 1px solid var(--border); } h3 { font-size: 1.2em; }\n p, li { color: var(--fg); }\n a { color: var(--accent); }\n code { font-family: var(--mono); font-size: 0.9em; background: var(--code-bg);\n padding: 0.12em 0.35em; border-radius: 5px; }\n pre { background: var(--code-bg); border: 1px solid var(--border); border-radius: 8px;\n padding: 12px 14px; overflow: auto; }\n pre code { background: none; padding: 0; }\n blockquote { margin: 1em 0; padding: 0.2em 1em; border-left: 3px solid var(--accent);\n color: var(--muted); }\n table { border-collapse: collapse; width: 100%; margin: 1em 0; font-family: var(--sans);\n font-size: 0.95em; }\n th, td { border: 1px solid var(--border); padding: 6px 10px; text-align: left; }\n th { background: var(--code-bg); }\n hr { border: 0; border-top: 1px solid var(--border); margin: 1.5em 0; }\n ul, ol { padding-left: 1.4em; }`\n\nconst INTERACTIVE_STYLE = `\n .aod-group { margin: 1.4em 0; padding: 14px 16px; border: 1px solid var(--border);\n border-radius: 10px; background: var(--code-bg); }\n .aod-prompt { font-family: var(--sans); font-weight: 600; margin: 0 0 0.6em; }\n .aod-options { display: flex; flex-wrap: wrap; gap: 8px; }\n .aod-multi-select .aod-options { flex-direction: column; gap: 6px; }\n .aod-action, .aod-submit { font-family: var(--sans); font-size: 0.95em; font-weight: 600;\n cursor: pointer; border: 1px solid var(--border); border-radius: 8px;\n padding: 8px 12px; background: var(--bg); color: var(--fg); }\n .aod-action:hover, .aod-submit:hover { border-color: var(--accent); }\n .aod-submit { margin-top: 10px; background: var(--accent); color: #17130a; border-color: var(--accent); }\n .aod-check { display: flex; align-items: center; gap: 8px; font-family: var(--sans); cursor: pointer; }\n .aod-steps { list-style: decimal; }\n .aod-step { margin: 0.5em 0; }\n .aod-step-actions { display: inline-flex; gap: 6px; margin-left: 8px; }`\n\n/*\n Wrap rendered inner HTML in the self-contained document shell. `extraStyle` is\n * appended to the inline stylesheet so the interactive variant can add its own\n * rules without a second `<style>` block. Static callers pass \"\" (default), so\n * the static document is byte-identical to the pre-refactor output.\n /\nfunction wrapArtifactDocument(body: string, title: string, extraStyle = \"\"): string {\n return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeHtml(title)}</title>\n<style>\n${BASE_STYLE}${extraStyle}\n</style>\n</head>\n<body>\n<main>\n${body}\n</main>\n</body>\n</html>\n`\n}\n\n/ -------------------------------------------------------------------------- /\n/ Interactive artifacts (contract v2.2 §4: declarative data-aod-* vocab) /\n/ -------------------------------------------------------------------------- /\n\nexport interface InteractiveOption {\n /* Stable id echoed back as `elementId` in the action event. Required. /\n elementId: string\n /* Human-visible label. /\n label: string\n /* Optional value echoed as `data-aod-value` (checkbox submits use \"true\"/\"false\"). /\n value?: string\n}\n\n/* One immediate-fire choice group: each option posts an action the instant it is clicked. /\nexport interface ChooseOneBlock {\n kind: \"choose-one\"\n /* `data-aod-group` shared by the options (marks them as one decision). /\n group: string\n prompt?: string\n /* `data-aod-action` verb for every option (default \"choose\"). /\n action?: string\n options: InteractiveOption[]\n}\n\n/* A multi-select group: checkbox toggles plus one submit that carries {group, selected}. /\nexport interface MultiSelectBlock {\n kind: \"multi-select\"\n group: string\n prompt?: string\n submitLabel?: string\n submitElementId?: string\n options: InteractiveOption[]\n}\n\nexport interface StepAction {\n /* `data-aod-action` verb (e.g. \"approve\", \"skip\"). /\n action: string\n label: string\n value?: string\n}\n\nexport interface StepItem {\n /* Stable `data-aod-id` echoed as `elementId`. /\n elementId: string\n label: string\n sourceLine?: number\n actions: StepAction[]\n}\n\n/* An ordered list of plan steps, each with its own inline action buttons. /\nexport interface StepsBlock {\n kind: \"steps\"\n steps: StepItem[]\n}\n\nexport type InteractiveBlock = ChooseOneBlock \| MultiSelectBlock \| StepsBlock\n\nexport interface InteractivePlanModel {\n /* Optional prose rendered above the interactive blocks (same escaping as static). /\n markdown?: string\n blocks: InteractiveBlock[]\n}\n\n/* Build a ` data-x=\"y\"` attribute string, dropping undefined values, all escaped. /\nfunction dataAttrs(pairs: Array<[string, string \| undefined]>): string {\n let out = \"\"\n for (const [name, value] of pairs) {\n if (value === undefined) continue\n out += ` ${name}=\"${escapeHtml(value)}\"`\n }\n return out\n}\n\nfunction renderChooseOne(block: ChooseOneBlock): string {\n const action = block.action && block.action.trim() ? block.action : \"choose\"\n const prompt = block.prompt ? `<p class=\"aod-prompt\">${escapeHtml(block.prompt)}</p>` : \"\"\n const options = block.options\n .filter((o) => o.elementId.trim() !== \"\")\n .map((o) => {\n const attrs = dataAttrs([\n [\"data-aod-action\", action],\n [\"data-aod-group\", block.group],\n [\"data-aod-id\", o.elementId],\n [\"data-aod-value\", o.value],\n ])\n return `<button type=\"button\" class=\"aod-action\"${attrs}>${escapeHtml(o.label)}</button>`\n })\n .join(\"\\n\")\n return `<div class=\"aod-group aod-choose-one\"${dataAttrs([[\"data-aod-group\", block.group]])}>\n${prompt}<div class=\"aod-options\">\n${options}\n</div>\n</div>`\n}\n\nfunction renderMultiSelect(block: MultiSelectBlock): string {\n const prompt = block.prompt ? `<p class=\"aod-prompt\">${escapeHtml(block.prompt)}</p>` : \"\"\n const options = block.options\n .filter((o) => o.elementId.trim() !== \"\")\n .map((o) => {\n const attrs = dataAttrs([\n [\"data-aod-action\", \"check\"],\n [\"data-aod-group\", block.group],\n [\"data-aod-id\", o.elementId],\n [\"data-aod-value\", o.value],\n ])\n return `<label class=\"aod-check\"><input type=\"checkbox\"${attrs}> <span>${escapeHtml(o.label)}</span></label>`\n })\n .join(\"\\n\")\n const submitId = block.submitElementId && block.submitElementId.trim()\n ? block.submitElementId\n : `${block.group}-submit`\n const submitAttrs = dataAttrs([\n [\"data-aod-action\", \"submit\"],\n [\"data-aod-group\", block.group],\n [\"data-aod-id\", submitId],\n ])\n const submitLabel = block.submitLabel && block.submitLabel.trim() ? block.submitLabel : \"Submit\"\n return `<div class=\"aod-group aod-multi-select\"${dataAttrs([[\"data-aod-group\", block.group]])}>\n${prompt}<div class=\"aod-options\">\n${options}\n</div>\n<button type=\"button\" class=\"aod-submit\"${submitAttrs}>${escapeHtml(submitLabel)}</button>\n</div>`\n}\n\nfunction renderSteps(block: StepsBlock): string {\n const items = block.steps\n .filter((s) => s.elementId.trim() !== \"\")\n .map((s) => {\n const liAttrs = dataAttrs([\n [\"data-aod-id\", s.elementId],\n [\"data-source-line\", s.sourceLine === undefined ? undefined : String(s.sourceLine)],\n ])\n const actions = s.actions\n .map((a) => {\n const attrs = dataAttrs([\n [\"data-aod-action\", a.action],\n [\"data-aod-id\", s.elementId],\n [\"data-aod-value\", a.value],\n ])\n return `<button type=\"button\" class=\"aod-action\"${attrs}>${escapeHtml(a.label)}</button>`\n })\n .join(\"\")\n return `<li class=\"aod-step\"${liAttrs}><span class=\"aod-step-label\">${escapeHtml(s.label)}</span><span class=\"aod-step-actions\">${actions}</span></li>`\n })\n .join(\"\\n\")\n return `<ol class=\"aod-steps\">\n${items}\n</ol>`\n}\n\nfunction renderInteractiveBlock(block: InteractiveBlock): string {\n switch (block.kind) {\n case \"choose-one\":\n return renderChooseOne(block)\n case \"multi-select\":\n return renderMultiSelect(block)\n case \"steps\":\n return renderSteps(block)\n default:\n return \"\"\n }\n}\n\n/\n Render a typed interactive plan model into a self-contained HTML document that\n * carries the declarative `data-aod-` action vocabulary the ai-or-die panel SDK\n wires (contract v2.2 §4). Optional prose (`markdown`) is rendered with the SAME\n * escaping + dangerous-URL neutralization as the static path; all control\n * attributes and labels are HTML-escaped, so no author string can break out of an\n * attribute or inject live markup.\n /\nexport function renderInteractivePlanHtml(model: InteractivePlanModel, title = \"Plan\"): string {\n const prose = model.markdown && model.markdown.trim() ? renderMarkdownBody(model.markdown) : \"\"\n const blocks = model.blocks.map(renderInteractiveBlock).filter((h) => h.trim() !== \"\").join(\"\\n\")\n const body = [prose, blocks].filter((s) => s.trim() !== \"\").join(\"\\n\")\n return wrapArtifactDocument(body \|\| `<pre>${escapeHtml(JSON.stringify(model))}</pre>`, title, INTERACTIVE_STYLE)\n}\n","/\n The internal `internal-artifact-open` subcommand: invoked by a spawned Claude\n * Code session's `PostToolUse` hook (matcher `ExitPlanMode`), registered into the\n * mirrored settings.json by the launcher when running inside an ai-or-die tab\n * (`AIORDIE_SESSION_ID` set). It auto-opens the just-finalized plan in the\n * ai-or-die Artifact review panel so the human reviews it WITHOUT the model\n * having to call artifact_open itself.\n \n Auth: AIORDIE_TOKEN is stripped from the child env, so the token can't come via\n * env or argv (argv leaks to `ps`). The launcher writes a mode-600\n * `.aiordie-artifact.json` into CLAUDE_CONFIG_DIR; this hook reads it.\n \n Plan: the EXACT plan for THIS session comes from the ExitPlanMode payload —\n * `tool_input.planFilePath` (per-session; never the globally-newest file in the\n * shared plans dir) with `tool_input.plan` as the markdown fallback. The plan\n * markdown is rendered to a self-contained styled HTML file (HTML is the\n * canonical artifact, lavish's model — formatted + annotatable, not raw md), and\n * THAT `.html` is opened.\n \n Side-effect only: never writes stdout, never throws, always exits 0. Skips\n * subagent payloads (agent_id/agent_type) like the other hooks.\n /\n\nimport { defineCommand } from \"citty\"\n\nimport { readFileSync, realpathSync, writeFileSync } from \"node:fs\"\nimport { homedir } from \"node:os\"\nimport path from \"node:path\"\n\nimport { ArtifactClient } from \"./lib/artifact/client\"\nimport { renderPlanHtml } from \"./lib/artifact/plan-html\"\nimport { isSubagentContext } from \"./lib/orchestration/stop-gate-policy\"\n\ninterface ArtifactCreds {\n baseUrl: string\n token: string\n sessionId: string\n insecureTLS: boolean\n}\n\ninterface ExitPlanPayload {\n planFilePath?: string\n planMarkdown?: string\n}\n\nfunction readStdin(): string {\n try {\n if (process.stdin.isTTY) return \"\"\n return readFileSync(0, \"utf8\")\n } catch {\n return \"\"\n }\n}\n\nfunction credsPath(): string {\n const dir = process.env.CLAUDE_CONFIG_DIR \|\| path.join(homedir(), \".claude\")\n return path.join(dir, \".aiordie-artifact.json\")\n}\n\nfunction isSubagent(payload: unknown): boolean {\n try {\n return isSubagentContext(payload as Parameters<typeof isSubagentContext>[0])\n } catch {\n return false\n }\n}\n\n/* Pull the per-session plan path + markdown content out of the hook payload. /\nexport function parseExitPlanPayload(raw: string): ExitPlanPayload {\n try {\n const obj = JSON.parse(raw) as { tool_input?: { planFilePath?: unknown; plan?: unknown } }\n const ti = obj.tool_input ?? {}\n const planFilePath = typeof ti.planFilePath === \"string\" && ti.planFilePath.trim() ? ti.planFilePath : undefined\n const planMarkdown = typeof ti.plan === \"string\" && ti.plan.trim() ? ti.plan : undefined\n return { planFilePath, planMarkdown }\n } catch {\n return {}\n }\n}\n\nfunction readCreds(): ArtifactCreds \| undefined {\n try {\n const parsed = JSON.parse(readFileSync(credsPath(), \"utf8\")) as Partial<ArtifactCreds>\n if (!parsed.baseUrl \|\| !parsed.token \|\| !parsed.sessionId) return undefined\n return {\n baseUrl: parsed.baseUrl,\n token: parsed.token,\n sessionId: parsed.sessionId,\n insecureTLS: parsed.insecureTLS === true,\n }\n } catch {\n return undefined\n }\n}\n\n/\n Resolve the plan markdown + a title, preferring the file at `planFilePath`\n * (the source of truth, may be newer than the payload's snapshot), falling back\n * to the inline `tool_input.plan` content.\n /\nfunction resolvePlanMarkdown(p: ExitPlanPayload): { markdown: string; title: string; nearPath?: string } \| undefined {\n if (p.planFilePath) {\n try {\n const md = readFileSync(p.planFilePath, \"utf8\")\n if (md.trim()) return { markdown: md, title: path.basename(p.planFilePath, path.extname(p.planFilePath)), nearPath: p.planFilePath }\n } catch {\n / fall through to inline content /\n }\n }\n if (p.planMarkdown) return { markdown: p.planMarkdown, title: \"Plan\" }\n return undefined\n}\n\n/\n Write the rendered HTML next to the plan (an allowed root) when we have a real\n * path, else into the plans dir under CLAUDE_CONFIG_DIR. Returns the realpath of\n * the written `.html`, or undefined on failure.\n /\nfunction writePlanHtml(html: string, nearPath: string \| undefined): string \| undefined {\n let target: string\n if (nearPath) {\n // `<plan>.md` -> `<plan>.aiordie.html` (or append when there is no .md ext).\n const base = nearPath.replace(/\\.(md\|markdown)$/i, \"\")\n target = `${base}.aiordie.html`\n } else {\n const dir = path.join(process.env.CLAUDE_CONFIG_DIR \|\| path.join(homedir(), \".claude\"), \"plans\")\n target = path.join(dir, `aiordie-plan-${process.pid}.html`)\n }\n try {\n writeFileSync(target, html, \"utf8\")\n try {\n return realpathSync.native(target)\n } catch {\n return target\n }\n } catch {\n return undefined\n }\n}\n\nexport const internalArtifactOpen = defineCommand({\n meta: { name: \"internal-artifact-open\", description: \"Open the finalized plan in the ai-or-die panel\" },\n async run() {\n try {\n const raw = readStdin()\n let payload: unknown\n try {\n payload = JSON.parse(raw)\n } catch {\n payload = undefined\n }\n if (isSubagent(payload)) return\n const creds = readCreds()\n if (!creds) return\n const plan = resolvePlanMarkdown(parseExitPlanPayload(raw))\n if (!plan) return\n const htmlPath = writePlanHtml(renderPlanHtml(plan.markdown, plan.title), plan.nearPath)\n if (!htmlPath) return\n const client = new ArtifactClient(creds)\n await client.open(htmlPath)\n } catch {\n / side-effect only: never block, never throw */\n }\n },\n})\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgBA,SAAS,WAAW,GAAmB;CACrC,OAAO,EACJ,QAAQ,MAAM,OAAO,CAAC,CACtB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,QAAQ,CAAC,CACvB,QAAQ,MAAM,OAAO;AAC1B;;;;;AAMA,MAAM,aAAqC;CACzC,OAAO;CAAK,KAAK;CAAM,SAAS;CAAM,KAAK;CAAK,MAAM;CAAK,KAAK;CAAK,MAAM;CAAK,MAAM;AACxF;AACA,SAAS,eAAe,GAAmB;CACzC,OAAO,EAAE,QAAQ,8CAA8C,GAAG,SAAiB;EACjF,IAAI,KAAK,OAAO,KAAK;GACnB,MAAM,OAAO,KAAK,OAAO,OAAO,KAAK,OAAO,MACxC,OAAO,SAAS,KAAK,MAAM,CAAC,GAAG,EAAE,IACjC,OAAO,SAAS,KAAK,MAAM,CAAC,GAAG,EAAE;GACrC,OAAO,OAAO,SAAS,IAAI,KAAK,OAAO,KAAK,QAAQ,UAAW,OAAO,cAAc,IAAI,IAAI;EAC9F;EACA,OAAO,WAAW,KAAK,YAAY,MAAM;CAC3C,CAAC;AACH;;AAGA,SAAS,eAAe,KAAa,SAA2B;CAG9D,MAAM,IAAI,MAAM,KAAK,eAAe,GAAG,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,WAAW,CAAC,IAAI,EAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,YAAY;CACrG,IAAI,EAAE,WAAW,aAAa,KAAK,EAAE,WAAW,WAAW,GAAG,OAAO;CACrE,IAAI,EAAE,WAAW,OAAO,GAEtB,OAAO,EAAE,WAAW,EAAE,WAAW,aAAa,KAAK,CAAC,EAAE,WAAW,gBAAgB;CAEnF,OAAO;AACT;;AAGA,SAAS,aAAqB;CAC5B,MAAM,IAAI,IAAI,OAAO;EAAE,KAAK;EAAM,QAAQ;CAAM,CAAC;CACjD,EAAE,IAAI,EACJ,UAAU,EAER,KAAK,OAAwB;EAE3B,OAAO,WADM,OAAO,UAAU,WAAW,QAAU,MAA4B,QAAQ,EACjE;CACxB,EACF,EACF,CAAC;CACD,OAAO;AACT;;;;;;AAgBA,SAAS,eAAe,QAAyB;CAC/C,KAAK,MAAM,KAAK,QAAQ;EACtB,KAAK,EAAE,SAAS,UAAU,EAAE,SAAS,YAAY,OAAO,EAAE,SAAS,UAC7D;OAAA,eAAe,EAAE,MAAM,EAAE,SAAS,OAAO,GAAG,EAAE,OAAO;EAAA;EAE3D,IAAI,EAAE,QAAQ,eAAe,EAAE,MAAM;EACrC,IAAI,EAAE,OAAO,eAAe,EAAE,KAAK;EACnC,IAAI,EAAE,QAAa;QAAA,MAAM,QAAQ,EAAE,QAAQ,IAAI,KAAK,QAAQ,eAAe,KAAK,MAAM;EAAA;EACtF,IAAI,EAAE,MAAW;QAAA,MAAM,OAAO,EAAE,MAAM,KAAK,MAAM,QAAQ,KAAK,IAAI,KAAK,QAAQ,eAAe,KAAK,MAAM;EAAA;CAC3G;AACF;;AAGA,SAAS,cAAc,MAAc,MAAsB;CACzD,OAAO,KAAK,QAAQ,2BAA2B,2BAA2B,KAAK,EAAE;AACnF;;;;;AAMA,SAAgB,mBAAmB,QAAwB;CACzD,MAAM,IAAI,WAAW;CACrB,IAAI;CACJ,IAAI;EACF,SAAS,EAAE,MAAM,MAAM;CACzB,QAAQ;EAEN,OAAO,QAAQ,WAAW,MAAM,EAAE;CACpC;CACA,eAAe,MAAmB;CAClC,IAAI,OAAO;CACX,IAAI,MAAM;CACV,KAAK,MAAM,OAAO,QAAQ;EACxB,IAAI;EACJ,IAAI;GACF,OAAO,EAAE,OAAO,CAAC,GAAG,CAAmC;EACzD,QAAQ;GACN,OAAO;EACT;EACA,IAAI,KAAK,KAAK,GAAG,OAAO,cAAc,MAAM,IAAI;EAChD,QAAS,IAAI,KAAK,MAAM,KAAK,CAAC,EAAE,UAAU;CAC5C;CACA,OAAO,OAAO,QAAQ,WAAW,MAAM,EAAE;AAC3C;;;;;AAMA,SAAgB,eAAe,QAAgB,QAAQ,QAAgB;CACrE,OAAO,qBAAqB,mBAAmB,MAAM,GAAG,KAAK;AAC/D;AAEA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDnB,SAAS,qBAAqB,MAAc,OAAe,aAAa,IAAY;CAClF,OAAO;;;;;SAKA,WAAW,KAAK,EAAE;;EAEzB,aAAa,WAAW;;;;;EAKxB,KAAK;;;;;AAKP;;;;;;;;;;;;;;;;;;;;;;;;;ACtKA,SAAS,YAAoB;CAC3B,IAAI;EACF,IAAI,QAAQ,MAAM,OAAO,OAAO;EAChC,OAAO,aAAa,GAAG,MAAM;CAC/B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAoB;CAC3B,MAAM,MAAM,QAAQ,IAAI,qBAAqB,KAAK,KAAK,QAAQ,GAAG,SAAS;CAC3E,OAAO,KAAK,KAAK,KAAK,wBAAwB;AAChD;AAEA,SAAS,WAAW,SAA2B;CAC7C,IAAI;EACF,OAAO,kBAAkB,OAAkD;CAC7E,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,qBAAqB,KAA8B;CACjE,IAAI;EAEF,MAAM,KADM,KAAK,MAAM,GACV,CAAC,CAAC,cAAc,CAAC;EAG9B,OAAO;GAAE,cAFY,OAAO,GAAG,iBAAiB,YAAY,GAAG,aAAa,KAAK,IAAI,GAAG,eAAe,KAAA;GAEhF,cADF,OAAO,GAAG,SAAS,YAAY,GAAG,KAAK,KAAK,IAAI,GAAG,OAAO,KAAA;EAC3C;CACtC,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,SAAS,YAAuC;CAC9C,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,aAAa,UAAU,GAAG,MAAM,CAAC;EAC3D,IAAI,CAAC,OAAO,WAAW,CAAC,OAAO,SAAS,CAAC,OAAO,WAAW,OAAO,KAAA;EAClE,OAAO;GACL,SAAS,OAAO;GAChB,OAAO,OAAO;GACd,WAAW,OAAO;GAClB,aAAa,OAAO,gBAAgB;EACtC;CACF,QAAQ;EACN;CACF;AACF;;;;;;AAOA,SAAS,oBAAoB,GAAwF;CACnH,IAAI,EAAE,cACJ,IAAI;EACF,MAAM,KAAK,aAAa,EAAE,cAAc,MAAM;EAC9C,IAAI,GAAG,KAAK,GAAG,OAAO;GAAE,UAAU;GAAI,OAAO,KAAK,SAAS,EAAE,cAAc,KAAK,QAAQ,EAAE,YAAY,CAAC;GAAG,UAAU,EAAE;EAAa;CACrI,QAAQ,CAER;CAEF,IAAI,EAAE,cAAc,OAAO;EAAE,UAAU,EAAE;EAAc,OAAO;CAAO;AAEvE;;;;;;AAOA,SAAS,cAAc,MAAc,UAAkD;CACrF,IAAI;CACJ,IAAI,UAGF,SAAS,GADI,SAAS,QAAQ,qBAAqB,EACpC,EAAE;MACZ;EACL,MAAM,MAAM,KAAK,KAAK,QAAQ,IAAI,qBAAqB,KAAK,KAAK,QAAQ,GAAG,SAAS,GAAG,OAAO;EAC/F,SAAS,KAAK,KAAK,KAAK,gBAAgB,QAAQ,IAAI,MAAM;CAC5D;CACA,IAAI;EACF,cAAc,QAAQ,MAAM,MAAM;EAClC,IAAI;GACF,OAAO,aAAa,OAAO,MAAM;EACnC,QAAQ;GACN,OAAO;EACT;CACF,QAAQ;EACN;CACF;AACF;AAEA,MAAa,uBAAuB,cAAc;CAChD,MAAM;EAAE,MAAM;EAA0B,aAAa;CAAiD;CACtG,MAAM,MAAM;EACV,IAAI;GACF,MAAM,MAAM,UAAU;GACtB,IAAI;GACJ,IAAI;IACF,UAAU,KAAK,MAAM,GAAG;GAC1B,QAAQ;IACN,UAAU,KAAA;GACZ;GACA,IAAI,WAAW,OAAO,GAAG;GACzB,MAAM,QAAQ,UAAU;GACxB,IAAI,CAAC,OAAO;GACZ,MAAM,OAAO,oBAAoB,qBAAqB,GAAG,CAAC;GAC1D,IAAI,CAAC,MAAM;GACX,MAAM,WAAW,cAAc,eAAe,KAAK,UAAU,KAAK,KAAK,GAAG,KAAK,QAAQ;GACvF,IAAI,CAAC,UAAU;GAEf,MAAM,IADa,eAAe,KACvB,CAAC,CAAC,KAAK,QAAQ;EAC5B,QAAQ,CAER;CACF;AACF,CAAC"}

package/dist/{internal-fast-dispatch-guard-Bkr_iGOu.js → internal-fast-dispatch-guard-BhpZ6LvO.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { i as FAST_PROFILE_DELEGATION_GRAPH, o as FAST_PROFILE_NATIVE_AGENT_NAMES } from "./fast-profile-contract-K3P58nj3.js";
-import { t as buildSelfCommand } from "./self-invocation-DAB_od0C.js";
+import { i as FAST_PROFILE_DELEGATION_GRAPH, o as FAST_PROFILE_NATIVE_AGENT_NAMES } from "./fast-profile-contract-B6xn-Rzo.js";
+import { t as buildSelfCommand } from "./self-invocation-BJWbA8ka.js";
 import { defineCommand } from "citty";
 import { readFileSync } from "node:fs";
 //#region src/lib/fast-dispatch-acl.ts
@@ -11,15 +11,17 @@ import { readFileSync } from "node:fs";
 * It is an in-session Task/Agent ACL, not a shell sandbox: role tool lists
 * narrow the available tools while this graph narrows native dispatch edges.
 */
+const FAST_BROWSE_DISPATCH_AGENT = "worker-browse";
 const FAST_NATIVE_AGENT_NAMES = FAST_PROFILE_NATIVE_AGENT_NAMES;
-const FAST_NATIVE_AGENT_SET = new Set(FAST_NATIVE_AGENT_NAMES);
+new Set(FAST_NATIVE_AGENT_NAMES);
 /** Frozen authority graph: each key is a caller and each value its targets. */
 const FAST_DISPATCH_GRAPH = Object.freeze({
 	Explore: new Set(FAST_PROFILE_DELEGATION_GRAPH.Explore),
+	Plan: new Set(FAST_PROFILE_DELEGATION_GRAPH.Plan),
+	"general-purpose": new Set(FAST_PROFILE_DELEGATION_GRAPH["general-purpose"]),
 	implementer: new Set(FAST_PROFILE_DELEGATION_GRAPH.implementer),
 	reviewer: new Set(FAST_PROFILE_DELEGATION_GRAPH.reviewer),
-	planner: new Set(FAST_PROFILE_DELEGATION_GRAPH.planner),
-	critic: new Set(FAST_PROFILE_DELEGATION_GRAPH.critic)
+	"worker-browse": /* @__PURE__ */ new Set([])
 });
 /** The hook matcher is intentionally limited to native dispatch tool names. */
 const FAST_DISPATCH_TOOL_MATCHER = "^(Task|Agent)$";
@@ -69,13 +71,41 @@ function deny(reason, target, caller) {
 	};
 }
 /**
+* Continuation / reattachment target selectors that must be rejected on Fast dispatch.
+* Any non-null value in tool_input fails closed to prevent bypassing role edges.
+*/
+const CONTINUATION_FIELDS = [
+	"resume",
+	"resume_session",
+	"resumeSession",
+	"resume_agent_id",
+	"resumeAgentId",
+	"continuation",
+	"continue",
+	"continue_session",
+	"continueSession",
+	"agent_id",
+	"agentId",
+	"session_id",
+	"sessionId",
+	"thread_id",
+	"threadId",
+	"task_id",
+	"taskId",
+	"target_agent_id",
+	"targetAgentId",
+	"reattach",
+	"reattach_session",
+	"reattachSession"
+];
+/**
 * Evaluate one raw Claude Code PreToolUse payload.
 *
 * Classification happens before strict parsing. A malformed or unrelated
 * ordinary-tool hook therefore passes through, while a recognized Task/Agent
 * dispatch fails closed on malformed input or identity.
 */
-function decideFastDispatchGuard(stdin) {
+function decideFastDispatchGuard(stdin, opts) {
 	let parsed;
 	try {
 		parsed = typeof stdin === "string" ? JSON.parse(stdin) : stdin;
@@ -91,13 +121,19 @@ function decideFastDispatchGuard(stdin) {
 		verdict: "allow-non-dispatch"
 	};
 	if (!payload.tool_input || typeof payload.tool_input !== "object" || Array.isArray(payload.tool_input)) return deny(`fast dispatch denied: ${toolName} payload has malformed tool_input`);
-	const targetResult = resolveAliasedString(payload.tool_input, ["subagent_type", "subagentType"]);
+	const toolInput = payload.tool_input;
+	for (const field of CONTINUATION_FIELDS) if (hasOwn(toolInput, field)) {
+		const val = toolInput[field];
+		if (val !== void 0 && val !== null && val !== false) return deny(`fast dispatch denied: ${toolName} continuation/reattachment (${field}) is not permitted in fast profile`);
+	}
+	const targetResult = resolveAliasedString(toolInput, ["subagent_type", "subagentType"]);
 	if (targetResult.malformed) return deny(`fast dispatch denied: ${toolName} target identity is malformed`);
 	if (targetResult.conflict) return deny(`fast dispatch denied: ${toolName} target aliases conflict`);
 	const targetValue = targetResult.value;
-	if (!targetValue || !FAST_NATIVE_AGENT_SET.has(targetValue)) return deny(`fast dispatch denied: ${toolName} target must be one of ${FAST_NATIVE_AGENT_NAMES.join(", ")}`);
+	const effectiveAllowedTargets = opts?.allowedTargets ? new Set(opts.allowedTargets) : /* @__PURE__ */ new Set([...FAST_NATIVE_AGENT_NAMES, ...opts?.allowBrowse ? [FAST_BROWSE_DISPATCH_AGENT] : []]);
+	if (!targetValue || !effectiveAllowedTargets.has(targetValue)) return deny(`fast dispatch denied: ${toolName} target must be one of ${[...effectiveAllowedTargets].join(", ")}`);
 	const target = targetValue;
-	const updatedInput = { ...payload.tool_input };
+	const updatedInput = { ...toolInput };
 	delete updatedInput.model;
 	const callerType = resolveAliasedString(payload, ["agent_type", "agentType"]);
 	const callerId = resolveAliasedString(payload, ["agent_id", "agentId"]);
@@ -125,9 +161,9 @@ function decideFastDispatchGuard(stdin) {
 			verdict: "allow"
 		};
 	}
-	if (!FAST_NATIVE_AGENT_SET.has(callerTypeValue)) return deny(`fast dispatch denied: unknown caller role ${JSON.stringify(callerTypeValue)}`, target);
+	if (!(/* @__PURE__ */ new Set([...FAST_NATIVE_AGENT_NAMES, "worker-browse"])).has(callerTypeValue)) return deny(`fast dispatch denied: unknown caller role ${JSON.stringify(callerTypeValue)}`, target);
 	const caller = callerTypeValue;
-	if (!FAST_DISPATCH_GRAPH[caller].has(target)) return deny(`fast dispatch denied: ${caller} cannot invoke ${target}`, target, caller);
+	if (!(FAST_DISPATCH_GRAPH[caller] ?? /* @__PURE__ */ new Set()).has(target)) return deny(`fast dispatch denied: ${caller} cannot invoke ${target}`, target, caller);
 	return {
 		allowed: true,
 		caller,
@@ -174,18 +210,38 @@ const internalFastDispatchGuard = defineCommand({
 		name: "internal-fast-dispatch-guard",
 		description: "Internal: PreToolUse guard enforcing the fast-profile native Task/Agent ACL."
 	},
-	run() {
-		const decision = decideFastDispatchGuard(readStdinSync());
+	args: {
+		allowBrowse: {
+			type: "boolean",
+			description: "Whether worker-browse is allowed as a target.",
+			default: false
+		},
+		allowedTargets: {
+			type: "string",
+			description: "Comma-separated list of allowed target subagents."
+		}
+	},
+	run({ args }) {
+		const allowedTargets = args.allowedTargets ? args.allowedTargets.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+		const allowBrowse = args.allowBrowse === true || (allowedTargets ? allowedTargets.includes("worker-browse") : false);
+		const decision = decideFastDispatchGuard(readStdinSync(), {
+			allowedTargets,
+			allowBrowse
+		});
 		if (!decision.allowed && decision.reason) process.stdout.write(fastDispatchDenyOutput(decision.reason));
 		else if (decision.verdict === "allow" && decision.updatedInput) process.stdout.write(fastDispatchAllowOutput(decision.updatedInput));
 		process.exitCode = 0;
 	}
 });
 /** Build the persisted command for the fast-profile PreToolUse hook. */
-function buildFastDispatchGuardHookCommand(invocation) {
-	return buildSelfCommand(invocation, "internal-fast-dispatch-guard");
+function buildFastDispatchGuardHookCommand(invocation, opts) {
+	const flags = [];
+	if (opts?.allowBrowse) flags.push("--allowBrowse");
+	if (opts?.allowedTargets && opts.allowedTargets.length > 0) flags.push(`--allowedTargets "${opts.allowedTargets.join(",")}"`);
+	const args = ["internal-fast-dispatch-guard", ...flags].join(" ");
+	return buildSelfCommand(invocation, args);
 }
 //#endregion
 export { internalFastDispatchGuard as n, FAST_DISPATCH_TOOL_MATCHER as r, buildFastDispatchGuardHookCommand as t };
-//# sourceMappingURL=internal-fast-dispatch-guard-Bkr_iGOu.js.map
+//# sourceMappingURL=internal-fast-dispatch-guard-BhpZ6LvO.js.map

package/dist/internal-fast-dispatch-guard-BhpZ6LvO.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"internal-fast-dispatch-guard-BhpZ6LvO.js","names":[],"sources":["../src/lib/fast-dispatch-acl.ts","../src/internal-fast-dispatch-guard.ts"],"sourcesContent":["/**\n * Pure policy for the fast profile's native Task/Agent delegation graph.\n *\n * This policy is compiled into the hook rather than read from per-launch files,\n * so cleanup or a partial runtime-file write cannot silently disarm the guard.\n * It is an in-session Task/Agent ACL, not a shell sandbox: role tool lists\n * narrow the available tools while this graph narrows native dispatch edges.\n */\n\nimport {\n FAST_PROFILE_DELEGATION_GRAPH,\n FAST_PROFILE_NATIVE_AGENT_NAMES,\n type FastProfileNativeAgentName,\n} from \"./fast-profile-contract\"\n\nexport const FAST_BROWSE_DISPATCH_AGENT = \"worker-browse\" as const\n\nexport const FAST_NATIVE_AGENT_NAMES = FAST_PROFILE_NATIVE_AGENT_NAMES\n\nexport type FastNativeAgentName = FastProfileNativeAgentName\n\nexport type FastDispatchTargetName = FastNativeAgentName | typeof FAST_BROWSE_DISPATCH_AGENT\nexport type FastDispatchCallerName = FastNativeAgentName | typeof FAST_BROWSE_DISPATCH_AGENT\n\nexport const FAST_NATIVE_AGENT_SET = new Set<string>(FAST_NATIVE_AGENT_NAMES)\n\n/** Frozen authority graph: each key is a caller and each value its targets. */\nexport const FAST_DISPATCH_GRAPH: Readonly<\n Record<FastDispatchCallerName, ReadonlySet<FastDispatchTargetName>>\n> = Object.freeze({\n Explore: new Set<FastDispatchTargetName>(FAST_PROFILE_DELEGATION_GRAPH.Explore),\n Plan: new Set<FastDispatchTargetName>(FAST_PROFILE_DELEGATION_GRAPH.Plan),\n \"general-purpose\": new Set<FastDispatchTargetName>(\n FAST_PROFILE_DELEGATION_GRAPH[\"general-purpose\"],\n ),\n implementer: new Set<FastDispatchTargetName>(\n FAST_PROFILE_DELEGATION_GRAPH.implementer,\n ),\n reviewer: new Set<FastDispatchTargetName>(FAST_PROFILE_DELEGATION_GRAPH.reviewer),\n \"worker-browse\": new Set<FastDispatchTargetName>([]),\n})\n\n/** The hook matcher is intentionally limited to native dispatch tool names. */\nexport const FAST_DISPATCH_TOOL_MATCHER = \"^(Task|Agent)$\"\n\ninterface DispatchPayload {\n tool_name?: unknown\n tool_input?: unknown\n agent_type?: unknown\n agent_id?: unknown\n parent_tool_use_id?: unknown\n agentType?: unknown\n agentId?: unknown\n parentToolUseId?: unknown\n}\n\nexport interface FastDispatchGuardOptions {\n /** Optional restriction on allowed target subagents (e.g. from launch profile or hook CLI). */\n allowedTargets?: ReadonlySet<string> | ReadonlyArray<string>\n /** Whether worker-browse is permitted as a target for the lead. */\n allowBrowse?: boolean\n}\n\nexport interface FastDispatchGuardResult {\n allowed: boolean\n reason?: string\n caller?: FastDispatchCallerName | \"lead\"\n target?: FastDispatchTargetName\n /** Cloned Agent/Task input with a caller model override removed. */\n updatedInput?: Record<string, unknown>\n verdict: \"allow-non-dispatch\" | \"allow\" | \"deny\"\n}\n\nfunction hasOwn(obj: object, key: string): boolean {\n return Object.prototype.hasOwnProperty.call(obj, key)\n}\n\nfunction valuesForAliases(obj: Record<string, unknown>, names: ReadonlyArray<string>): Array<unknown> {\n return names.filter((name) => hasOwn(obj, name)).map((name) => obj[name])\n}\n\n/**\n * Resolve an aliased string field. Null and undefined are marker values. One\n * concrete value is accepted, while different concrete aliases are a conflict.\n */\nfunction resolveAliasedString(\n obj: Record<string, unknown>,\n names: ReadonlyArray<string>,\n): { present: boolean; value?: string; malformed: boolean; conflict: boolean } {\n const values = valuesForAliases(obj, names)\n if (values.length === 0) return { present: false, malformed: false, conflict: false }\n const concrete = values.filter((value) => value !== undefined && value !== null)\n if (concrete.some((value) => typeof value !== \"string\" || value.trim().length === 0)) {\n return { present: true, malformed: true, conflict: false }\n }\n const distinct = [...new Set((concrete as Array<string>).map((value) => value.trim()))]\n if (distinct.length > 1) return { present: true, malformed: false, conflict: true }\n return { present: true, value: distinct[0], malformed: false, conflict: false }\n}\n\nfunction deny(\n reason: string,\n target?: FastDispatchTargetName,\n caller?: FastDispatchCallerName | \"lead\",\n): FastDispatchGuardResult {\n return { allowed: false, reason, target, caller, verdict: \"deny\" }\n}\n\n/**\n * Continuation / reattachment target selectors that must be rejected on Fast dispatch.\n * Any non-null value in tool_input fails closed to prevent bypassing role edges.\n */\nconst CONTINUATION_FIELDS: ReadonlyArray<string> = [\n \"resume\",\n \"resume_session\",\n \"resumeSession\",\n \"resume_agent_id\",\n \"resumeAgentId\",\n \"continuation\",\n \"continue\",\n \"continue_session\",\n \"continueSession\",\n \"agent_id\",\n \"agentId\",\n \"session_id\",\n \"sessionId\",\n \"thread_id\",\n \"threadId\",\n \"task_id\",\n \"taskId\",\n \"target_agent_id\",\n \"targetAgentId\",\n \"reattach\",\n \"reattach_session\",\n \"reattachSession\",\n]\n\n/**\n * Evaluate one raw Claude Code PreToolUse payload.\n *\n * Classification happens before strict parsing. A malformed or unrelated\n * ordinary-tool hook therefore passes through, while a recognized Task/Agent\n * dispatch fails closed on malformed input or identity.\n */\nexport function decideFastDispatchGuard(\n stdin: string | unknown,\n opts?: FastDispatchGuardOptions,\n): FastDispatchGuardResult {\n let parsed: unknown\n try {\n parsed = typeof stdin === \"string\" ? JSON.parse(stdin) : stdin\n } catch {\n return deny(\"fast dispatch denied: malformed hook payload\")\n }\n if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n return deny(\"fast dispatch denied: hook payload must be an object\")\n }\n\n const payload = parsed as DispatchPayload\n if (typeof payload.tool_name !== \"string\") {\n return deny(\"fast dispatch denied: hook payload has no tool_name\")\n }\n const toolName = payload.tool_name\n if (!/^(Task|Agent)$/.test(toolName)) {\n return { allowed: true, verdict: \"allow-non-dispatch\" }\n }\n\n if (!payload.tool_input || typeof payload.tool_input !== \"object\" || Array.isArray(payload.tool_input)) {\n return deny(`fast dispatch denied: ${toolName} payload has malformed tool_input`)\n }\n const toolInput = payload.tool_input as Record<string, unknown>\n\n // Reject non-null continuation / reattachment / agent-id target selectors that could bypass role edges\n for (const field of CONTINUATION_FIELDS) {\n if (hasOwn(toolInput, field)) {\n const val = toolInput[field]\n if (val !== undefined && val !== null && val !== false) {\n return deny(`fast dispatch denied: ${toolName} continuation/reattachment (${field}) is not permitted in fast profile`)\n }\n }\n }\n\n const targetResult = resolveAliasedString(\n toolInput,\n [\"subagent_type\", \"subagentType\"],\n )\n if (targetResult.malformed) {\n return deny(`fast dispatch denied: ${toolName} target identity is malformed`)\n }\n if (targetResult.conflict) {\n return deny(`fast dispatch denied: ${toolName} target aliases conflict`)\n }\n const targetValue = targetResult.value\n\n const effectiveAllowedTargets = opts?.allowedTargets\n ? new Set(opts.allowedTargets)\n : new Set<string>([\n ...FAST_NATIVE_AGENT_NAMES,\n ...(opts?.allowBrowse ? [FAST_BROWSE_DISPATCH_AGENT] : []),\n ])\n\n if (!targetValue || !effectiveAllowedTargets.has(targetValue)) {\n return deny(\n `fast dispatch denied: ${toolName} target must be one of ${[...effectiveAllowedTargets].join(\", \")}`,\n )\n }\n const target = targetValue as FastDispatchTargetName\n\n // Invocation-level `model` outranks custom-agent frontmatter in Claude Code.\n // The fast profile promises fixed role models, so allowed dispatches must\n // remove that one caller-owned field while preserving every other input.\n const updatedInput = { ...toolInput }\n delete updatedInput.model\n\n const callerType = resolveAliasedString(payload as Record<string, unknown>, [\"agent_type\", \"agentType\"])\n const callerId = resolveAliasedString(payload as Record<string, unknown>, [\"agent_id\", \"agentId\"])\n const parentMarker = resolveAliasedString(payload as Record<string, unknown>, [\n \"parent_tool_use_id\",\n \"parentToolUseId\",\n ])\n if (callerType.malformed || callerId.malformed || parentMarker.malformed) {\n return deny(`fast dispatch denied: ${toolName} caller identity is malformed`, target)\n }\n if (callerType.conflict || callerId.conflict || parentMarker.conflict) {\n return deny(`fast dispatch denied: ${toolName} caller identity aliases conflict`, target)\n }\n\n const callerTypeValue = callerType.value\n const callerIdValue = callerId.value\n const parentValue = parentMarker.value\n\n // A non-null agent id or parent marker cannot impersonate a role by itself.\n // A valid role may be accompanied by either marker as supplemental evidence.\n if (!callerTypeValue && callerIdValue) {\n return deny(`fast dispatch denied: ${toolName} has agent_id without agent_type`, target)\n }\n if (!callerTypeValue && parentValue) {\n return deny(`fast dispatch denied: ${toolName} has only a parent execution marker`, target)\n }\n\n // Absent or null identity fields are the only lead representation. Empty\n // strings and non-string values were rejected above; unknown roles fail closed.\n if (!callerTypeValue) {\n const hasPresentMarker = callerType.present || callerId.present || parentMarker.present\n const hasUnresolvedNonNullMarker = [callerType, callerId, parentMarker].some(\n (marker) => marker.value !== undefined,\n )\n if (hasPresentMarker && hasUnresolvedNonNullMarker) {\n return deny(`fast dispatch denied: ${toolName} has no resolvable caller role`, target)\n }\n return {\n allowed: true,\n caller: \"lead\",\n target,\n updatedInput,\n verdict: \"allow\",\n }\n }\n\n const validCallers = new Set<string>([\n ...FAST_NATIVE_AGENT_NAMES,\n FAST_BROWSE_DISPATCH_AGENT,\n ])\n\n if (!validCallers.has(callerTypeValue)) {\n return deny(`fast dispatch denied: unknown caller role ${JSON.stringify(callerTypeValue)}`, target)\n }\n const caller = callerTypeValue as FastDispatchCallerName\n const allowedTargets = FAST_DISPATCH_GRAPH[caller] ?? new Set<FastDispatchTargetName>()\n if (!allowedTargets.has(target)) {\n return deny(`fast dispatch denied: ${caller} cannot invoke ${target}`, target, caller)\n }\n return { allowed: true, caller, target, updatedInput, verdict: \"allow\" }\n}\n\n/** JSON response consumed by Claude Code for an allowed, model-pinned dispatch. */\nexport function fastDispatchAllowOutput(\n updatedInput: Record<string, unknown>,\n): string {\n return JSON.stringify({\n hookSpecificOutput: {\n hookEventName: \"PreToolUse\",\n permissionDecision: \"allow\",\n updatedInput,\n },\n })\n}\n\n/** JSON response consumed by Claude Code's PreToolUse hook protocol. */\nexport function fastDispatchDenyOutput(reason: string): string {\n return JSON.stringify({\n hookSpecificOutput: {\n hookEventName: \"PreToolUse\",\n permissionDecision: \"deny\",\n permissionDecisionReason: reason,\n },\n })\n}\n","/**\n * Internal PreToolUse guard for the `-m fast` native Task/Agent ACL.\n *\n * The policy is intentionally pure and compiled into this hook. This entrypoint\n * only performs synchronous stdin I/O, emits Claude Code's deny envelope, and\n * exits naturally so Windows libuv teardown is not raced by process.exit().\n */\n\nimport { defineCommand } from \"citty\"\nimport { readFileSync } from \"node:fs\"\n\nimport {\n decideFastDispatchGuard,\n fastDispatchAllowOutput,\n fastDispatchDenyOutput,\n} from \"./lib/fast-dispatch-acl\"\nimport { buildSelfCommand, type SelfInvocation } from \"./lib/hook-launcher/self-invocation\"\n\nfunction readStdinSync(): string {\n try {\n if (process.stdin.isTTY) return \"\"\n return readFileSync(0, \"utf8\")\n } catch {\n return \"\"\n }\n}\n\nexport const internalFastDispatchGuard = defineCommand({\n meta: {\n name: \"internal-fast-dispatch-guard\",\n description:\n \"Internal: PreToolUse guard enforcing the fast-profile native Task/Agent ACL.\",\n },\n args: {\n allowBrowse: {\n type: \"boolean\",\n description: \"Whether worker-browse is allowed as a target.\",\n default: false,\n },\n allowedTargets: {\n type: \"string\",\n description: \"Comma-separated list of allowed target subagents.\",\n },\n },\n run({ args }) {\n const allowedTargets = args.allowedTargets\n ? args.allowedTargets.split(\",\").map((s) => s.trim()).filter(Boolean)\n : undefined\n const allowBrowse = args.allowBrowse === true || (allowedTargets ? allowedTargets.includes(\"worker-browse\") : false)\n const decision = decideFastDispatchGuard(readStdinSync(), {\n allowedTargets,\n allowBrowse,\n })\n if (!decision.allowed && decision.reason) {\n process.stdout.write(fastDispatchDenyOutput(decision.reason))\n } else if (decision.verdict === \"allow\" && decision.updatedInput) {\n process.stdout.write(fastDispatchAllowOutput(decision.updatedInput))\n }\n // Natural exit is required on Windows. Claude Code consumes the JSON\n // permission decision; an exit code is not used to deny this hook.\n process.exitCode = 0\n },\n})\n\n/** Build the persisted command for the fast-profile PreToolUse hook. */\nexport function buildFastDispatchGuardHookCommand(\n invocation: SelfInvocation,\n opts?: { allowBrowse?: boolean; allowedTargets?: ReadonlyArray<string> },\n): string {\n const flags: string[] = []\n if (opts?.allowBrowse) flags.push(\"--allowBrowse\")\n if (opts?.allowedTargets && opts.allowedTargets.length > 0) {\n flags.push(`--allowedTargets \"${opts.allowedTargets.join(\",\")}\"`)\n }\n const args = [\"internal-fast-dispatch-guard\", ...flags].join(\" \")\n return buildSelfCommand(invocation, args)\n}\n"],"mappings":";;;;;;;;;;;;;AAeA,MAAa,6BAA6B;AAE1C,MAAa,0BAA0B;AAOF,IAAI,IAAY,uBAAuB;;AAG5E,MAAa,sBAET,OAAO,OAAO;CAChB,SAAS,IAAI,IAA4B,8BAA8B,OAAO;CAC9E,MAAM,IAAI,IAA4B,8BAA8B,IAAI;CACxE,mBAAmB,IAAI,IACrB,8BAA8B,kBAChC;CACA,aAAa,IAAI,IACf,8BAA8B,WAChC;CACA,UAAU,IAAI,IAA4B,8BAA8B,QAAQ;CAChF,iCAAiB,IAAI,IAA4B,CAAC,CAAC;AACrD,CAAC;;AAGD,MAAa,6BAA6B;AA8B1C,SAAS,OAAO,KAAa,KAAsB;CACjD,OAAO,OAAO,UAAU,eAAe,KAAK,KAAK,GAAG;AACtD;AAEA,SAAS,iBAAiB,KAA8B,OAA8C;CACpG,OAAO,MAAM,QAAQ,SAAS,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK;AAC1E;;;;;AAMA,SAAS,qBACP,KACA,OAC6E;CAC7E,MAAM,SAAS,iBAAiB,KAAK,KAAK;CAC1C,IAAI,OAAO,WAAW,GAAG,OAAO;EAAE,SAAS;EAAO,WAAW;EAAO,UAAU;CAAM;CACpF,MAAM,WAAW,OAAO,QAAQ,UAAU,UAAU,KAAA,KAAa,UAAU,IAAI;CAC/E,IAAI,SAAS,MAAM,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,WAAW,CAAC,GACjF,OAAO;EAAE,SAAS;EAAM,WAAW;EAAM,UAAU;CAAM;CAE3D,MAAM,WAAW,CAAC,GAAG,IAAI,IAAK,SAA2B,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAAC;CACtF,IAAI,SAAS,SAAS,GAAG,OAAO;EAAE,SAAS;EAAM,WAAW;EAAO,UAAU;CAAK;CAClF,OAAO;EAAE,SAAS;EAAM,OAAO,SAAS;EAAI,WAAW;EAAO,UAAU;CAAM;AAChF;AAEA,SAAS,KACP,QACA,QACA,QACyB;CACzB,OAAO;EAAE,SAAS;EAAO;EAAQ;EAAQ;EAAQ,SAAS;CAAO;AACnE;;;;;AAMA,MAAM,sBAA6C;CACjD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;AASA,SAAgB,wBACd,OACA,MACyB;CACzB,IAAI;CACJ,IAAI;EACF,SAAS,OAAO,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;CAC3D,QAAQ;EACN,OAAO,KAAK,8CAA8C;CAC5D;CACA,IAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAC/D,OAAO,KAAK,sDAAsD;CAGpE,MAAM,UAAU;CAChB,IAAI,OAAO,QAAQ,cAAc,UAC/B,OAAO,KAAK,qDAAqD;CAEnE,MAAM,WAAW,QAAQ;CACzB,IAAI,CAAC,iBAAiB,KAAK,QAAQ,GACjC,OAAO;EAAE,SAAS;EAAM,SAAS;CAAqB;CAGxD,IAAI,CAAC,QAAQ,cAAc,OAAO,QAAQ,eAAe,YAAY,MAAM,QAAQ,QAAQ,UAAU,GACnG,OAAO,KAAK,yBAAyB,SAAS,kCAAkC;CAElF,MAAM,YAAY,QAAQ;CAG1B,KAAK,MAAM,SAAS,qBAClB,IAAI,OAAO,WAAW,KAAK,GAAG;EAC5B,MAAM,MAAM,UAAU;EACtB,IAAI,QAAQ,KAAA,KAAa,QAAQ,QAAQ,QAAQ,OAC/C,OAAO,KAAK,yBAAyB,SAAS,8BAA8B,MAAM,mCAAmC;CAEzH;CAGF,MAAM,eAAe,qBACnB,WACA,CAAC,iBAAiB,cAAc,CAClC;CACA,IAAI,aAAa,WACf,OAAO,KAAK,yBAAyB,SAAS,8BAA8B;CAE9E,IAAI,aAAa,UACf,OAAO,KAAK,yBAAyB,SAAS,yBAAyB;CAEzE,MAAM,cAAc,aAAa;CAEjC,MAAM,0BAA0B,MAAM,iBAClC,IAAI,IAAI,KAAK,cAAc,oBAC3B,IAAI,IAAY,CACd,GAAG,yBACH,GAAI,MAAM,cAAc,CAAC,0BAA0B,IAAI,CAAC,CAC1D,CAAC;CAEL,IAAI,CAAC,eAAe,CAAC,wBAAwB,IAAI,WAAW,GAC1D,OAAO,KACL,yBAAyB,SAAS,yBAAyB,CAAC,GAAG,uBAAuB,CAAC,CAAC,KAAK,IAAI,GACnG;CAEF,MAAM,SAAS;CAKf,MAAM,eAAe,EAAE,GAAG,UAAU;CACpC,OAAO,aAAa;CAEpB,MAAM,aAAa,qBAAqB,SAAoC,CAAC,cAAc,WAAW,CAAC;CACvG,MAAM,WAAW,qBAAqB,SAAoC,CAAC,YAAY,SAAS,CAAC;CACjG,MAAM,eAAe,qBAAqB,SAAoC,CAC5E,sBACA,iBACF,CAAC;CACD,IAAI,WAAW,aAAa,SAAS,aAAa,aAAa,WAC7D,OAAO,KAAK,yBAAyB,SAAS,gCAAgC,MAAM;CAEtF,IAAI,WAAW,YAAY,SAAS,YAAY,aAAa,UAC3D,OAAO,KAAK,yBAAyB,SAAS,oCAAoC,MAAM;CAG1F,MAAM,kBAAkB,WAAW;CACnC,MAAM,gBAAgB,SAAS;CAC/B,MAAM,cAAc,aAAa;CAIjC,IAAI,CAAC,mBAAmB,eACtB,OAAO,KAAK,yBAAyB,SAAS,mCAAmC,MAAM;CAEzF,IAAI,CAAC,mBAAmB,aACtB,OAAO,KAAK,yBAAyB,SAAS,sCAAsC,MAAM;CAK5F,IAAI,CAAC,iBAAiB;EACpB,MAAM,mBAAmB,WAAW,WAAW,SAAS,WAAW,aAAa;EAChF,MAAM,6BAA6B;GAAC;GAAY;GAAU;EAAY,CAAC,CAAC,MACrE,WAAW,OAAO,UAAU,KAAA,CAC/B;EACA,IAAI,oBAAoB,4BACtB,OAAO,KAAK,yBAAyB,SAAS,iCAAiC,MAAM;EAEvF,OAAO;GACL,SAAS;GACT,QAAQ;GACR;GACA;GACA,SAAS;EACX;CACF;CAOA,IAAI,kBAAC,IALoB,IAAY,CACnC,GAAG,yBAAA,eAEL,CAEgB,EAAA,CAAE,IAAI,eAAe,GACnC,OAAO,KAAK,6CAA6C,KAAK,UAAU,eAAe,KAAK,MAAM;CAEpG,MAAM,SAAS;CAEf,IAAI,EADmB,oBAAoB,2BAAW,IAAI,IAA4B,EAAA,CAClE,IAAI,MAAM,GAC5B,OAAO,KAAK,yBAAyB,OAAO,iBAAiB,UAAU,QAAQ,MAAM;CAEvF,OAAO;EAAE,SAAS;EAAM;EAAQ;EAAQ;EAAc,SAAS;CAAQ;AACzE;;AAGA,SAAgB,wBACd,cACQ;CACR,OAAO,KAAK,UAAU,EACpB,oBAAoB;EAClB,eAAe;EACf,oBAAoB;EACpB;CACF,EACF,CAAC;AACH;;AAGA,SAAgB,uBAAuB,QAAwB;CAC7D,OAAO,KAAK,UAAU,EACpB,oBAAoB;EAClB,eAAe;EACf,oBAAoB;EACpB,0BAA0B;CAC5B,EACF,CAAC;AACH;;;;;;;;;;ACvRA,SAAS,gBAAwB;CAC/B,IAAI;EACF,IAAI,QAAQ,MAAM,OAAO,OAAO;EAChC,OAAO,aAAa,GAAG,MAAM;CAC/B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAa,4BAA4B,cAAc;CACrD,MAAM;EACJ,MAAM;EACN,aACE;CACJ;CACA,MAAM;EACJ,aAAa;GACX,MAAM;GACN,aAAa;GACb,SAAS;EACX;EACA,gBAAgB;GACd,MAAM;GACN,aAAa;EACf;CACF;CACA,IAAI,EAAE,QAAQ;EACZ,MAAM,iBAAiB,KAAK,iBACxB,KAAK,eAAe,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,IAClE,KAAA;EACJ,MAAM,cAAc,KAAK,gBAAgB,SAAS,iBAAiB,eAAe,SAAS,eAAe,IAAI;EAC9G,MAAM,WAAW,wBAAwB,cAAc,GAAG;GACxD;GACA;EACF,CAAC;EACD,IAAI,CAAC,SAAS,WAAW,SAAS,QAChC,QAAQ,OAAO,MAAM,uBAAuB,SAAS,MAAM,CAAC;OACvD,IAAI,SAAS,YAAY,WAAW,SAAS,cAClD,QAAQ,OAAO,MAAM,wBAAwB,SAAS,YAAY,CAAC;EAIrE,QAAQ,WAAW;CACrB;AACF,CAAC;;AAGD,SAAgB,kCACd,YACA,MACQ;CACR,MAAM,QAAkB,CAAC;CACzB,IAAI,MAAM,aAAa,MAAM,KAAK,eAAe;CACjD,IAAI,MAAM,kBAAkB,KAAK,eAAe,SAAS,GACvD,MAAM,KAAK,qBAAqB,KAAK,eAAe,KAAK,GAAG,EAAE,EAAE;CAElE,MAAM,OAAO,CAAC,gCAAgC,GAAG,KAAK,CAAC,CAAC,KAAK,GAAG;CAChE,OAAO,iBAAiB,YAAY,IAAI;AAC1C"}

package/dist/{internal-fast-dispatch-guard-N-RaLrOn.js → internal-fast-dispatch-guard-C6BNoOnn.js} RENAMED Viewed

@@ -1,2 +1,2 @@
-import { n as internalFastDispatchGuard } from "./internal-fast-dispatch-guard-Bkr_iGOu.js";
+import { n as internalFastDispatchGuard } from "./internal-fast-dispatch-guard-BhpZ6LvO.js";
 export { internalFastDispatchGuard };

package/dist/{internal-first-mate-guard-C9BV7J4U.js → internal-first-mate-guard-Bcb5JwiO.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { t as buildSelfCommand } from "./self-invocation-DAB_od0C.js";
-import { a as dispatcherAgentName, t as ALL_WORKER_DISPATCH_MODES } from "./worker-dispatch-BEHkTbnH.js";
+import { t as buildSelfCommand } from "./self-invocation-BJWbA8ka.js";
+import { a as dispatcherAgentName, t as ALL_WORKER_DISPATCH_MODES } from "./worker-dispatch-DgP5yT26.js";
 import { defineCommand } from "citty";
 import { readFileSync } from "node:fs";
 //#region src/lib/first-mate/operator-shaping.ts
@@ -124,4 +124,4 @@ function buildFirstMateGuardHookCommand(invocation) {
 //#endregion
 export { assertShapingInstalled as i, buildFirstMateGuardHookCommand as n, internalFirstMateGuard as r, FIRST_MATE_GUARD_MATCHER as t };
-//# sourceMappingURL=internal-first-mate-guard-C9BV7J4U.js.map
+//# sourceMappingURL=internal-first-mate-guard-Bcb5JwiO.js.map

package/dist/{internal-first-mate-guard-C9BV7J4U.js.map → internal-first-mate-guard-Bcb5JwiO.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"internal-first-mate-guard-~~C9BV7J4U~~.js","names":[],"sources":["../src/lib/first-mate/operator-shaping.ts","../src/internal-first-mate-guard.ts"],"sourcesContent":["/*\n Operator-mode steering for github-router `--agents` sessions.\n \n In first-mate/operator mode the spawned Claude is the cloud-agent operator, not\n * the product implementer. Product implementation is steered to GitHub cloud\n * agents by first-mate guidance and the gh-first-mate skill. This module no\n * longer hard-blocks local file writes or shell commands: Edit/Write/NotebookEdit\n * and Bash remain available as escape hatches when needed.\n \n The only enforced main-operator boundary is that local worker/orchestrate MCP\n * tools stay subagent-only. The main operator should invoke the worker-* Agent\n * subagents or delegate to GitHub cloud agents rather than calling\n * `mcp__workers__` / `mcp__orchestrate__` directly.\n /\n\nimport {\n ALL_WORKER_DISPATCH_MODES,\n dispatcherAgentName,\n type WorkerDispatchMode,\n} from \"../worker-dispatch\"\n\n/* Tools denied to the main operator by exact name. /\nexport const OPERATOR_DENIED_TOOLS = [] as const\n\n/* MCP prefixes denied to the main operator; these remain subagent-only. /\nexport const OPERATOR_DENIED_MCP_PREFIXES = [\"mcp__workers__\", \"mcp__orchestrate__\"] as const\n\n/* Tools explicitly preserved (documented; used by assertion tests). /\nexport const OPERATOR_KEPT_TOOLS = [\n \"Agent\",\n \"Task\",\n \"Edit\",\n \"Write\",\n \"NotebookEdit\",\n \"Bash\",\n \"Read\",\n \"Grep\",\n \"Glob\",\n \"mcp__first-mate__\",\n] as const\n\n/\n Least-privilege note for what the cloud agents themselves may touch — the\n * operator scopes missions to specific repos and forbids irreversible actions\n * without human approval (see first-mate house rules). This constant documents\n * the intent for the launcher/README; enforcement of the cloud-agent scope is\n * the GitHub agent-token scope (repo/workflow) + the mission house_rules.\n /\nexport const CLOUD_AGENT_SCOPE_NOTE =\n \"Cloud agents operate only within mission-listed repos; merges, releases, \" +\n \"Pages, and deletes require explicit human approval (first-mate merge gate).\"\n\nexport interface OperatorToolInput extends Record<string, unknown> {\n agent_type?: unknown\n}\n\nexport interface PreToolUseDecision {\n block: boolean\n reason?: string\n}\n\n/\n Decide whether a tool call must be blocked for the main operator. Pure — used\n * both by the PreToolUse hook handler and by config-assertion tests. When\n * operator mode is off, nothing is blocked (normal sessions unaffected).\n /\nfunction parseWorkerMode(toolName: string): WorkerDispatchMode \| null {\n const workersPrefix = \"mcp__workers__\"\n if (!toolName.startsWith(workersPrefix)) return null\n const mode = toolName.slice(workersPrefix.length)\n return (ALL_WORKER_DISPATCH_MODES as ReadonlyArray<string>).includes(mode) ? (mode as WorkerDispatchMode) : null\n}\n\nfunction isMatchingWorkerDispatcher(toolName: string, input?: OperatorToolInput): boolean {\n const mode = parseWorkerMode(toolName)\n if (mode === null) return false\n return input?.agent_type === dispatcherAgentName(mode)\n}\n\nexport function shouldDenyOperatorTool(\n toolName: string,\n operatorMode: boolean,\n input?: OperatorToolInput,\n): boolean {\n if (!operatorMode) return false\n if (isMatchingWorkerDispatcher(toolName, input)) return false\n return OPERATOR_DENIED_MCP_PREFIXES.some((prefix) => toolName.startsWith(prefix))\n}\n\n/\n M4 — fail-CLOSED. If operator/`--agents` mode is active but the reduced\n * worker/orchestrate guard could NOT be installed (e.g. settings.json unwritable),\n * the operator session must NOT start with direct main-thread worker/orchestrate\n * MCP calls available. Non-agents sessions are never affected.\n /\nexport function assertShapingInstalled(agentsMode: boolean, injectionSucceeded: boolean): void {\n if (agentsMode && !injectionSucceeded) {\n throw new Error(\n \"cloud-agent operator mode requires the worker/orchestrate PreToolUse hook, \" +\n \"but it could not be installed — refusing to start an unguarded operator session.\",\n )\n }\n}\n\n/\n The PreToolUse hook decision for a given tool name in operator mode.\n \n Bash and file-authoring tools are always allowed. Only direct main-operator\n * calls to local worker/orchestrate MCP tools are blocked so those backends stay\n * reachable through the worker-* Agent subagents rather than the lead context.\n /\nexport function operatorPreToolUse(\n toolName: string,\n operatorMode: boolean,\n input?: OperatorToolInput,\n): PreToolUseDecision {\n if (!operatorMode) return { block: false }\n if (shouldDenyOperatorTool(toolName, operatorMode, input)) {\n return {\n block: true,\n reason: `${toolName} is subagent-only in cloud-agent operator mode — use the worker- Agent subagents or delegate implementation to a GitHub cloud agent via the first-mate MCP instead of calling local worker/orchestrate MCP tools from the main operator.`,\n }\n }\n return { block: false }\n}\n","/*\n The internal `internal-first-mate-guard` subcommand: a PreToolUse hook that\n * keeps local worker/orchestrate MCP tools subagent-only in cloud-agent OPERATOR\n * mode. It is injected into the spawned Claude session's settings ONLY in\n * `--agents`/operator mode, with a matcher scoped to those MCP tool prefixes.\n \n Reads the PreToolUse payload from stdin (`{tool_name, tool_input, ...}`) and,\n * if the tool is denied in operator mode, blocks via exit code 2 with a reason\n * on stderr (the repo's hook convention). Bash and file-authoring tools are not\n * matched by this guard and are not blocked.\n /\nimport { defineCommand } from \"citty\"\n\nimport { readFileSync } from \"node:fs\"\n\nimport { operatorPreToolUse, type OperatorToolInput } from \"./lib/first-mate/operator-shaping\"\nimport { buildSelfCommand, type SelfInvocation } from \"./lib/hook-launcher/self-invocation\"\n\nfunction readStdinSync(): string {\n try {\n return readFileSync(0, \"utf8\")\n } catch {\n return \"\"\n }\n}\n\nexport const internalFirstMateGuard = defineCommand({\n meta: {\n name: \"internal-first-mate-guard\",\n description: \"PreToolUse guard enforcing cloud-agent operator capability shaping.\",\n },\n run() {\n let toolName = \"\"\n let hookInput: OperatorToolInput \| undefined\n let parsed: boolean\n try {\n const payload = JSON.parse(readStdinSync()) as {\n tool_name?: unknown\n tool_input?: unknown\n agent_type?: unknown\n }\n if (typeof payload.tool_name === \"string\") toolName = payload.tool_name\n if (typeof payload.agent_type === \"string\") hookInput = { agent_type: payload.agent_type }\n parsed = true\n } catch {\n parsed = false // fail-closed below for a named-but-unparseable payload\n }\n if (toolName.length === 0) {\n // Nothing to guard (empty/absent tool name) → allow. But if the payload\n // did not even parse we cannot know it was empty; the matcher only routes\n // the denied tools here, so a parse failure means one of THOSE arrived\n // unreadable → fail-closed.\n if (!parsed) {\n process.stderr.write(\"operator guard: unparseable PreToolUse payload — blocking (fail-closed)\")\n process.exit(2)\n }\n process.exit(0)\n }\n // This hook is only injected in operator mode, so operatorMode = true.\n const decision = operatorPreToolUse(toolName, true, hookInput)\n if (decision.block) {\n process.stderr.write(decision.reason ?? `${toolName} is disabled in operator mode`)\n process.exit(2) // exit 2 blocks the tool call (Claude Code hook convention)\n }\n process.exit(0)\n },\n})\n\n/* The regex matcher scoping the guard hook to exactly the denied tools. /\nexport const FIRST_MATE_GUARD_MATCHER = \"mcp__workers__.\|mcp__orchestrate__.\"\n\n/* Build the hook command string that runs this subcommand. */\nexport function buildFirstMateGuardHookCommand(invocation: SelfInvocation): string {\n return buildSelfCommand(invocation, \"internal-first-mate-guard\")\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyBA,MAAa,+BAA+B,CAAC,kBAAkB,oBAAoB;;;;;;AAyCnF,SAAS,gBAAgB,UAA6C;CAEpE,IAAI,CAAC,SAAS,WAAW,gBAAa,GAAG,OAAO;CAChD,MAAM,OAAO,SAAS,MAAM,EAAoB;CAChD,OAAQ,0BAAoD,SAAS,IAAI,IAAK,OAA8B;AAC9G;AAEA,SAAS,2BAA2B,UAAkB,OAAoC;CACxF,MAAM,OAAO,gBAAgB,QAAQ;CACrC,IAAI,SAAS,MAAM,OAAO;CAC1B,OAAO,OAAO,eAAe,oBAAoB,IAAI;AACvD;AAEA,SAAgB,uBACd,UACA,cACA,OACS;CACT,IAAI,CAAC,cAAc,OAAO;CAC1B,IAAI,2BAA2B,UAAU,KAAK,GAAG,OAAO;CACxD,OAAO,6BAA6B,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAClF;;;;;;;AAQA,SAAgB,uBAAuB,YAAqB,oBAAmC;CAC7F,IAAI,cAAc,CAAC,oBACjB,MAAM,IAAI,MACR,6JAEF;AAEJ;;;;;;;;AASA,SAAgB,mBACd,UACA,cACA,OACoB;CACpB,IAAI,CAAC,cAAc,OAAO,EAAE,OAAO,MAAM;CACzC,IAAI,uBAAuB,UAAU,cAAc,KAAK,GACtD,OAAO;EACL,OAAO;EACP,QAAQ,GAAG,SAAS;CACtB;CAEF,OAAO,EAAE,OAAO,MAAM;AACxB;;;;;;;;;;;;;;AC1GA,SAAS,gBAAwB;CAC/B,IAAI;EACF,OAAO,aAAa,GAAG,MAAM;CAC/B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAa,yBAAyB,cAAc;CAClD,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,MAAM;EACJ,IAAI,WAAW;EACf,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,MAAM,UAAU,KAAK,MAAM,cAAc,CAAC;GAK1C,IAAI,OAAO,QAAQ,cAAc,UAAU,WAAW,QAAQ;GAC9D,IAAI,OAAO,QAAQ,eAAe,UAAU,YAAY,EAAE,YAAY,QAAQ,WAAW;GACzF,SAAS;EACX,QAAQ;GACN,SAAS;EACX;EACA,IAAI,SAAS,WAAW,GAAG;GAKzB,IAAI,CAAC,QAAQ;IACX,QAAQ,OAAO,MAAM,yEAAyE;IAC9F,QAAQ,KAAK,CAAC;GAChB;GACA,QAAQ,KAAK,CAAC;EAChB;EAEA,MAAM,WAAW,mBAAmB,UAAU,MAAM,SAAS;EAC7D,IAAI,SAAS,OAAO;GAClB,QAAQ,OAAO,MAAM,SAAS,UAAU,GAAG,SAAS,8BAA8B;GAClF,QAAQ,KAAK,CAAC;EAChB;EACA,QAAQ,KAAK,CAAC;CAChB;AACF,CAAC;;AAGD,MAAa,2BAA2B;;AAGxC,SAAgB,+BAA+B,YAAoC;CACjF,OAAO,iBAAiB,YAAY,2BAA2B;AACjE"}
1	+ {"version":3,"file":"internal-first-mate-guard-Bcb5JwiO.js","names":[],"sources":["../src/lib/first-mate/operator-shaping.ts","../src/internal-first-mate-guard.ts"],"sourcesContent":["/*\n Operator-mode steering for github-router `--agents` sessions.\n \n In first-mate/operator mode the spawned Claude is the cloud-agent operator, not\n * the product implementer. Product implementation is steered to GitHub cloud\n * agents by first-mate guidance and the gh-first-mate skill. This module no\n * longer hard-blocks local file writes or shell commands: Edit/Write/NotebookEdit\n * and Bash remain available as escape hatches when needed.\n \n The only enforced main-operator boundary is that local worker/orchestrate MCP\n * tools stay subagent-only. The main operator should invoke the worker-* Agent\n * subagents or delegate to GitHub cloud agents rather than calling\n * `mcp__workers__` / `mcp__orchestrate__` directly.\n /\n\nimport {\n ALL_WORKER_DISPATCH_MODES,\n dispatcherAgentName,\n type WorkerDispatchMode,\n} from \"../worker-dispatch\"\n\n/* Tools denied to the main operator by exact name. /\nexport const OPERATOR_DENIED_TOOLS = [] as const\n\n/* MCP prefixes denied to the main operator; these remain subagent-only. /\nexport const OPERATOR_DENIED_MCP_PREFIXES = [\"mcp__workers__\", \"mcp__orchestrate__\"] as const\n\n/* Tools explicitly preserved (documented; used by assertion tests). /\nexport const OPERATOR_KEPT_TOOLS = [\n \"Agent\",\n \"Task\",\n \"Edit\",\n \"Write\",\n \"NotebookEdit\",\n \"Bash\",\n \"Read\",\n \"Grep\",\n \"Glob\",\n \"mcp__first-mate__\",\n] as const\n\n/\n Least-privilege note for what the cloud agents themselves may touch — the\n * operator scopes missions to specific repos and forbids irreversible actions\n * without human approval (see first-mate house rules). This constant documents\n * the intent for the launcher/README; enforcement of the cloud-agent scope is\n * the GitHub agent-token scope (repo/workflow) + the mission house_rules.\n /\nexport const CLOUD_AGENT_SCOPE_NOTE =\n \"Cloud agents operate only within mission-listed repos; merges, releases, \" +\n \"Pages, and deletes require explicit human approval (first-mate merge gate).\"\n\nexport interface OperatorToolInput extends Record<string, unknown> {\n agent_type?: unknown\n}\n\nexport interface PreToolUseDecision {\n block: boolean\n reason?: string\n}\n\n/\n Decide whether a tool call must be blocked for the main operator. Pure — used\n * both by the PreToolUse hook handler and by config-assertion tests. When\n * operator mode is off, nothing is blocked (normal sessions unaffected).\n /\nfunction parseWorkerMode(toolName: string): WorkerDispatchMode \| null {\n const workersPrefix = \"mcp__workers__\"\n if (!toolName.startsWith(workersPrefix)) return null\n const mode = toolName.slice(workersPrefix.length)\n return (ALL_WORKER_DISPATCH_MODES as ReadonlyArray<string>).includes(mode) ? (mode as WorkerDispatchMode) : null\n}\n\nfunction isMatchingWorkerDispatcher(toolName: string, input?: OperatorToolInput): boolean {\n const mode = parseWorkerMode(toolName)\n if (mode === null) return false\n return input?.agent_type === dispatcherAgentName(mode)\n}\n\nexport function shouldDenyOperatorTool(\n toolName: string,\n operatorMode: boolean,\n input?: OperatorToolInput,\n): boolean {\n if (!operatorMode) return false\n if (isMatchingWorkerDispatcher(toolName, input)) return false\n return OPERATOR_DENIED_MCP_PREFIXES.some((prefix) => toolName.startsWith(prefix))\n}\n\n/\n M4 — fail-CLOSED. If operator/`--agents` mode is active but the reduced\n * worker/orchestrate guard could NOT be installed (e.g. settings.json unwritable),\n * the operator session must NOT start with direct main-thread worker/orchestrate\n * MCP calls available. Non-agents sessions are never affected.\n /\nexport function assertShapingInstalled(agentsMode: boolean, injectionSucceeded: boolean): void {\n if (agentsMode && !injectionSucceeded) {\n throw new Error(\n \"cloud-agent operator mode requires the worker/orchestrate PreToolUse hook, \" +\n \"but it could not be installed — refusing to start an unguarded operator session.\",\n )\n }\n}\n\n/\n The PreToolUse hook decision for a given tool name in operator mode.\n \n Bash and file-authoring tools are always allowed. Only direct main-operator\n * calls to local worker/orchestrate MCP tools are blocked so those backends stay\n * reachable through the worker-* Agent subagents rather than the lead context.\n /\nexport function operatorPreToolUse(\n toolName: string,\n operatorMode: boolean,\n input?: OperatorToolInput,\n): PreToolUseDecision {\n if (!operatorMode) return { block: false }\n if (shouldDenyOperatorTool(toolName, operatorMode, input)) {\n return {\n block: true,\n reason: `${toolName} is subagent-only in cloud-agent operator mode — use the worker- Agent subagents or delegate implementation to a GitHub cloud agent via the first-mate MCP instead of calling local worker/orchestrate MCP tools from the main operator.`,\n }\n }\n return { block: false }\n}\n","/*\n The internal `internal-first-mate-guard` subcommand: a PreToolUse hook that\n * keeps local worker/orchestrate MCP tools subagent-only in cloud-agent OPERATOR\n * mode. It is injected into the spawned Claude session's settings ONLY in\n * `--agents`/operator mode, with a matcher scoped to those MCP tool prefixes.\n \n Reads the PreToolUse payload from stdin (`{tool_name, tool_input, ...}`) and,\n * if the tool is denied in operator mode, blocks via exit code 2 with a reason\n * on stderr (the repo's hook convention). Bash and file-authoring tools are not\n * matched by this guard and are not blocked.\n /\nimport { defineCommand } from \"citty\"\n\nimport { readFileSync } from \"node:fs\"\n\nimport { operatorPreToolUse, type OperatorToolInput } from \"./lib/first-mate/operator-shaping\"\nimport { buildSelfCommand, type SelfInvocation } from \"./lib/hook-launcher/self-invocation\"\n\nfunction readStdinSync(): string {\n try {\n return readFileSync(0, \"utf8\")\n } catch {\n return \"\"\n }\n}\n\nexport const internalFirstMateGuard = defineCommand({\n meta: {\n name: \"internal-first-mate-guard\",\n description: \"PreToolUse guard enforcing cloud-agent operator capability shaping.\",\n },\n run() {\n let toolName = \"\"\n let hookInput: OperatorToolInput \| undefined\n let parsed: boolean\n try {\n const payload = JSON.parse(readStdinSync()) as {\n tool_name?: unknown\n tool_input?: unknown\n agent_type?: unknown\n }\n if (typeof payload.tool_name === \"string\") toolName = payload.tool_name\n if (typeof payload.agent_type === \"string\") hookInput = { agent_type: payload.agent_type }\n parsed = true\n } catch {\n parsed = false // fail-closed below for a named-but-unparseable payload\n }\n if (toolName.length === 0) {\n // Nothing to guard (empty/absent tool name) → allow. But if the payload\n // did not even parse we cannot know it was empty; the matcher only routes\n // the denied tools here, so a parse failure means one of THOSE arrived\n // unreadable → fail-closed.\n if (!parsed) {\n process.stderr.write(\"operator guard: unparseable PreToolUse payload — blocking (fail-closed)\")\n process.exit(2)\n }\n process.exit(0)\n }\n // This hook is only injected in operator mode, so operatorMode = true.\n const decision = operatorPreToolUse(toolName, true, hookInput)\n if (decision.block) {\n process.stderr.write(decision.reason ?? `${toolName} is disabled in operator mode`)\n process.exit(2) // exit 2 blocks the tool call (Claude Code hook convention)\n }\n process.exit(0)\n },\n})\n\n/* The regex matcher scoping the guard hook to exactly the denied tools. /\nexport const FIRST_MATE_GUARD_MATCHER = \"mcp__workers__.\|mcp__orchestrate__.\"\n\n/* Build the hook command string that runs this subcommand. */\nexport function buildFirstMateGuardHookCommand(invocation: SelfInvocation): string {\n return buildSelfCommand(invocation, \"internal-first-mate-guard\")\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyBA,MAAa,+BAA+B,CAAC,kBAAkB,oBAAoB;;;;;;AAyCnF,SAAS,gBAAgB,UAA6C;CAEpE,IAAI,CAAC,SAAS,WAAW,gBAAa,GAAG,OAAO;CAChD,MAAM,OAAO,SAAS,MAAM,EAAoB;CAChD,OAAQ,0BAAoD,SAAS,IAAI,IAAK,OAA8B;AAC9G;AAEA,SAAS,2BAA2B,UAAkB,OAAoC;CACxF,MAAM,OAAO,gBAAgB,QAAQ;CACrC,IAAI,SAAS,MAAM,OAAO;CAC1B,OAAO,OAAO,eAAe,oBAAoB,IAAI;AACvD;AAEA,SAAgB,uBACd,UACA,cACA,OACS;CACT,IAAI,CAAC,cAAc,OAAO;CAC1B,IAAI,2BAA2B,UAAU,KAAK,GAAG,OAAO;CACxD,OAAO,6BAA6B,MAAM,WAAW,SAAS,WAAW,MAAM,CAAC;AAClF;;;;;;;AAQA,SAAgB,uBAAuB,YAAqB,oBAAmC;CAC7F,IAAI,cAAc,CAAC,oBACjB,MAAM,IAAI,MACR,6JAEF;AAEJ;;;;;;;;AASA,SAAgB,mBACd,UACA,cACA,OACoB;CACpB,IAAI,CAAC,cAAc,OAAO,EAAE,OAAO,MAAM;CACzC,IAAI,uBAAuB,UAAU,cAAc,KAAK,GACtD,OAAO;EACL,OAAO;EACP,QAAQ,GAAG,SAAS;CACtB;CAEF,OAAO,EAAE,OAAO,MAAM;AACxB;;;;;;;;;;;;;;AC1GA,SAAS,gBAAwB;CAC/B,IAAI;EACF,OAAO,aAAa,GAAG,MAAM;CAC/B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAa,yBAAyB,cAAc;CAClD,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,MAAM;EACJ,IAAI,WAAW;EACf,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,MAAM,UAAU,KAAK,MAAM,cAAc,CAAC;GAK1C,IAAI,OAAO,QAAQ,cAAc,UAAU,WAAW,QAAQ;GAC9D,IAAI,OAAO,QAAQ,eAAe,UAAU,YAAY,EAAE,YAAY,QAAQ,WAAW;GACzF,SAAS;EACX,QAAQ;GACN,SAAS;EACX;EACA,IAAI,SAAS,WAAW,GAAG;GAKzB,IAAI,CAAC,QAAQ;IACX,QAAQ,OAAO,MAAM,yEAAyE;IAC9F,QAAQ,KAAK,CAAC;GAChB;GACA,QAAQ,KAAK,CAAC;EAChB;EAEA,MAAM,WAAW,mBAAmB,UAAU,MAAM,SAAS;EAC7D,IAAI,SAAS,OAAO;GAClB,QAAQ,OAAO,MAAM,SAAS,UAAU,GAAG,SAAS,8BAA8B;GAClF,QAAQ,KAAK,CAAC;EAChB;EACA,QAAQ,KAAK,CAAC;CAChB;AACF,CAAC;;AAGD,MAAa,2BAA2B;;AAGxC,SAAgB,+BAA+B,YAAoC;CACjF,OAAO,iBAAiB,YAAY,2BAA2B;AACjE"}

package/dist/{internal-first-mate-guard-WJApyc8j.js → internal-first-mate-guard-Brh_uois.js} RENAMED Viewed

@@ -1,2 +1,2 @@
-import { r as internalFirstMateGuard } from "./internal-first-mate-guard-C9BV7J4U.js";
+import { r as internalFirstMateGuard } from "./internal-first-mate-guard-Bcb5JwiO.js";
 export { internalFirstMateGuard };

package/dist/internal-max-dispatch-guard-DhAr8N_o.js ADDED Viewed

@@ -0,0 +1,215 @@
+import { a as MAX_PROFILE_NATIVE_AGENT_NAMES, s as MAX_PROFILE_NATIVE_MODELS } from "./max-profile-contract-Ct62mtAR.js";
+import { t as buildSelfCommand } from "./self-invocation-BJWbA8ka.js";
+import { defineCommand } from "citty";
+import { readFileSync } from "node:fs";
+//#region src/lib/max-dispatch-acl.ts
+const MAX_DISPATCH_TOOL_MATCHER = "^(Task|Agent)$";
+const MAX_BROWSE_DISPATCH_AGENT = "worker-browse";
+const MAX_NATIVE_AGENT_SET = /* @__PURE__ */ new Set([...MAX_PROFILE_NATIVE_AGENT_NAMES, MAX_BROWSE_DISPATCH_AGENT]);
+/** Assert max launches never start without their native Task/Agent ACL. */
+var MaxDispatchGuardInstallError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MaxDispatchGuardInstallError";
+	}
+};
+function assertMaxDispatchGuardInstalled(maxProfile, installationSucceeded) {
+	if (maxProfile && !installationSucceeded) throw new MaxDispatchGuardInstallError("max profile requires the native Task/Agent ACL hook, but it could not be installed; refusing to start an unguarded max session.");
+}
+const MAX_ALLOWED_MODEL_BASES = /* @__PURE__ */ new Set([
+	"gpt-5.6-luna",
+	"gemini-3.7-flash",
+	"grok-4.6"
+]);
+/**
+* Claude Code's public Agent schema currently requires one of these built-in
+* model aliases even when the selected custom agent already owns its model in
+* frontmatter. They are transport placeholders in max, not model overrides.
+* Strip them so the role's catalog-validated max model remains authoritative.
+* Case and a trailing `[1m]` are ignored deliberately: neither can turn a
+* client-owned placeholder into an Opus override in the closed max roster.
+*/
+const MAX_AGENT_SCHEMA_MODEL_ALIASES = Object.freeze([
+	"sonnet",
+	"opus",
+	"haiku",
+	"fable"
+]);
+const MAX_AGENT_SCHEMA_MODEL_ALIAS_SET = new Set(MAX_AGENT_SCHEMA_MODEL_ALIASES);
+function isMaxAgentSchemaModelAlias(model) {
+	if (typeof model !== "string") return false;
+	return MAX_AGENT_SCHEMA_MODEL_ALIAS_SET.has(baseModel(model.trim()).toLowerCase());
+}
+function stringField(input, ...keys) {
+	const values = keys.filter((key) => Object.prototype.hasOwnProperty.call(input, key)).map((key) => input[key]).filter((value) => value !== void 0 && value !== null);
+	if (values.length === 0) return void 0;
+	if (values.some((value) => typeof value !== "string" || value.trim().length === 0)) return void 0;
+	const distinct = [...new Set(values.map((value) => value.trim()))];
+	return distinct.length === 1 ? distinct[0] : void 0;
+}
+function baseModel(model) {
+	return model.replace(/(?:\[1m\])+$/i, "");
+}
+function normalizeMaxDispatchModel(model) {
+	if (typeof model !== "string" || model.trim().length === 0) return void 0;
+	const base = baseModel(model.trim());
+	return MAX_ALLOWED_MODEL_BASES.has(base) ? base === "grok-4.6" ? base : `${base}[1m]` : void 0;
+}
+function normalizeMaxDispatchEffort(model, effort) {
+	if (effort === void 0 || effort === null) return void 0;
+	if (typeof effort !== "string") return void 0;
+	if ((model === "gpt-5.6-sol" ? [
+		"high",
+		"xhigh",
+		"max"
+	] : model === "gpt-5.6-luna" ? [
+		"none",
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	] : model === "grok-4.6" || model === "gemini-3.7-flash" ? [
+		"low",
+		"medium",
+		"high"
+	] : []).includes(effort)) return effort;
+}
+/**
+* Native max Task/Agent ACL. Role frontmatter owns the fixed model. Required
+* public-schema aliases are stripped as transport placeholders; a client that
+* can express custom ids may override only to Luna, Gemini, or Grok with a
+* live-ladder effort. Sol/Codex/unknown/private ids are rejected. The lead may
+* target any emitted max role; role-to-role edges are unrestricted here.
+*/
+function decideMaxDispatchGuard(stdin, opts = {}) {
+	let parsed;
+	try {
+		parsed = typeof stdin === "string" ? JSON.parse(stdin) : stdin;
+	} catch {
+		return {
+			allowed: false,
+			reason: "max dispatch denied: malformed hook payload",
+			verdict: "deny"
+		};
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {
+		allowed: false,
+		reason: "max dispatch denied: hook payload must be an object",
+		verdict: "deny"
+	};
+	const payload = parsed;
+	if (typeof payload.tool_name !== "string") return {
+		allowed: false,
+		reason: "max dispatch denied: hook payload has no tool_name",
+		verdict: "deny"
+	};
+	if (!/^(Task|Agent)$/.test(payload.tool_name)) return {
+		allowed: true,
+		verdict: "allow-non-dispatch"
+	};
+	if (!payload.tool_input || typeof payload.tool_input !== "object" || Array.isArray(payload.tool_input)) return {
+		allowed: false,
+		reason: `max dispatch denied: ${payload.tool_name} payload has malformed tool_input`,
+		verdict: "deny"
+	};
+	const toolInput = payload.tool_input;
+	const target = stringField(toolInput, "subagent_type", "subagentType");
+	if (!target || !MAX_NATIVE_AGENT_SET.has(target)) return {
+		allowed: false,
+		reason: `max dispatch denied: target must be one of ${[...MAX_PROFILE_NATIVE_AGENT_NAMES, MAX_BROWSE_DISPATCH_AGENT].join(", ")}`,
+		verdict: "deny"
+	};
+	const nativeTarget = target;
+	const modelValue = toolInput.model;
+	const schemaAlias = isMaxAgentSchemaModelAlias(modelValue);
+	const normalizedModel = modelValue === void 0 || schemaAlias ? void 0 : normalizeMaxDispatchModel(modelValue);
+	if (modelValue !== void 0 && !schemaAlias && !normalizedModel) return {
+		allowed: false,
+		reason: "max dispatch denied: model must be a Claude Code Agent schema alias, Luna[1m], Gemini 3.7 Flash[1m], or bare Grok 4.6",
+		target,
+		verdict: "deny"
+	};
+	const requestedEffort = toolInput.thinking ?? toolInput.effort;
+	const effort = normalizeMaxDispatchEffort(normalizedModel ? baseModel(normalizedModel) : nativeTarget === "worker-browse" ? "gpt-5.6-luna" : nativeTarget === "reviewer" && opts.reviewerModel ? baseModel(opts.reviewerModel) : MAX_PROFILE_NATIVE_MODELS[nativeTarget], requestedEffort);
+	if ((toolInput.thinking !== void 0 || toolInput.effort !== void 0) && !effort) return {
+		allowed: false,
+		reason: "max dispatch denied: reasoning override is not supported by the selected model",
+		target,
+		verdict: "deny"
+	};
+	const effectiveEffort = (nativeTarget === "reviewer" && !normalizedModel && opts.reviewerModel ? opts.reviewerEffort ?? (baseModel(opts.reviewerModel) === "gpt-5.6-luna" ? "max" : "high") : void 0) ?? effort;
+	const updatedInput = { ...toolInput };
+	if (normalizedModel) updatedInput.model = normalizedModel;
+	else delete updatedInput.model;
+	if (effectiveEffort) if (toolInput.thinking !== void 0) updatedInput.thinking = effectiveEffort;
+	else updatedInput.effort = effectiveEffort;
+	if (toolInput.thinking !== void 0 && toolInput.effort !== void 0) delete updatedInput.effort;
+	if (toolInput.model === void 0 && normalizedModel === void 0) delete updatedInput.model;
+	return {
+		allowed: true,
+		target,
+		effort: effectiveEffort,
+		updatedInput,
+		verdict: "allow"
+	};
+}
+function maxDispatchAllowOutput(updatedInput) {
+	return JSON.stringify({ hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		permissionDecision: "allow",
+		updatedInput
+	} });
+}
+function maxDispatchDenyOutput(reason) {
+	return JSON.stringify({ hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		permissionDecision: "deny",
+		permissionDecisionReason: reason
+	} });
+}
+//#endregion
+//#region src/internal-max-dispatch-guard.ts
+function readStdinSync() {
+	try {
+		if (process.stdin.isTTY) return "";
+		return readFileSync(0, "utf8");
+	} catch {
+		return "";
+	}
+}
+const internalMaxDispatchGuard = defineCommand({
+	meta: {
+		name: "internal-max-dispatch-guard",
+		description: "Internal: PreToolUse guard enforcing the max-profile native Task/Agent policy."
+	},
+	args: {
+		reviewerModel: {
+			type: "string",
+			description: "Catalog-resolved Max reviewer model for this launch."
+		},
+		reviewerEffort: {
+			type: "string",
+			description: "Fixed Max reviewer effort for this launch."
+		}
+	},
+	run({ args }) {
+		const decision = decideMaxDispatchGuard(readStdinSync(), {
+			reviewerModel: args.reviewerModel,
+			reviewerEffort: args.reviewerEffort === "max" ? "max" : "high"
+		});
+		if (!decision.allowed && decision.reason) process.stdout.write(maxDispatchDenyOutput(decision.reason));
+		else if (decision.verdict === "allow" && decision.updatedInput) process.stdout.write(maxDispatchAllowOutput(decision.updatedInput));
+		process.exitCode = 0;
+	}
+});
+function buildMaxDispatchGuardHookCommand(invocation, opts = {}) {
+	const flags = [];
+	if (opts.reviewerModel) flags.push(`--reviewerModel "${opts.reviewerModel}"`);
+	if (opts.reviewerEffort) flags.push(`--reviewerEffort ${opts.reviewerEffort}`);
+	return buildSelfCommand(invocation, ["internal-max-dispatch-guard", ...flags].join(" "));
+}
+//#endregion
+export { assertMaxDispatchGuardInstalled as i, internalMaxDispatchGuard as n, MAX_DISPATCH_TOOL_MATCHER as r, buildMaxDispatchGuardHookCommand as t };
+//# sourceMappingURL=internal-max-dispatch-guard-DhAr8N_o.js.map