harnery 0.11.0 → 0.12.1

package/README.md

@@ -21,7 +21,7 @@
 
 - **Multi-agent coordination:** per-agent heartbeats in `.harnery/active/`, claim-time and commit-time guards, the canonical event stream, councils, a decision docket, per-agent scratchpads, and harness adapters for Claude Code / Cursor / Codex.
 - **Cross-machine presence:** sessions on every machine that shares a repo see each other, labeled by machine. Zero-config over the repo's own git remote (presence refs), with an optional live-socket upgrade via an end-to-end-encrypted relay — the public `relay.harnery.com`, or self-host with `harn relay serve` / the bundled Cloudflare Worker (`relay/worker/`). The relay sees only ciphertext in opaquely-named rooms.
-- **Coordination-aware workflows:** `harn workflow run <script>` executes bounded, schema-gated multi-subagent workflow scripts — plain JS stages fanning out to headless harness-CLI subagents that are born coordination-registered (heartbeats, events, claim guards), with deterministic code deciding the routing between stages.
+- **Coordination-aware workflows:** `harn workflow run <script>` executes bounded, schema-gated multi-subagent workflow scripts — plain JS stages fanning out to headless harness-CLI subagents that are born coordination-registered (heartbeats, events, claim guards), with deterministic code deciding the routing between stages. An optional host-owned policy gates dispatch and declared external mutations with fail-closed `ALLOW`, `ASK`, and `DENY` decisions recorded in the run proof.
 - **Standalone web UI:** `harn web up` boots a local Next.js dashboard for the coord layer, councils, per-project state, and a local coding-agent status view (Claude Code / Codex / Cursor usage, backed by `harn devtools`). Ships with the git clone, not the npm package (see [Install](#install)).
 - **Backup + sync:** `harn backup` snapshots `.harnery/` via [restic](https://restic.net/); `harn sync` keeps a curated subset live across machines via [rclone](https://rclone.org/) (Google Drive or any rclone remote).
 

package/dist/commander.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commander.d.ts","sourceRoot":"","sources":["../src/commander.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqCpC,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAEhC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IAEnB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,8CAA8C;AAC9C,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAEnD,MAAM,WAAW,qBAAqB;IACpC,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CACjE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,IAAI,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,KAAK,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,GAAG,OAAO,GAAG,IAAI,CAAC;IACrF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IACpE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,eAAO,MAAM,WAAW,EAAE,WAkCzB,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAiD3E"}
+{"version":3,"file":"commander.d.ts","sourceRoot":"","sources":["../src/commander.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsCpC,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAEhC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IAEnB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,8CAA8C;AAC9C,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAEnD,MAAM,WAAW,qBAAqB;IACpC,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CACjE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,IAAI,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,KAAK,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,GAAG,OAAO,GAAG,IAAI,CAAC;IACrF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IACpE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,eAAO,MAAM,WAAW,EAAE,WAkCzB,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAkD3E"}

package/dist/commander.js

@@ -41,6 +41,7 @@ import { registerGrepCommand } from "./commands/grep.js";
 import { registerHarnessCommand } from "./commands/harness.js";
 import { registerInitCommand } from "./commands/init.js";
 import { registerOutlineCommand } from "./commands/outline.js";
+import { registerPolicyCommand } from "./commands/policy.js";
 import { registerPresenceCommand } from "./commands/presence.js";
 import { registerReadCommand } from "./commands/read.js";
 import { registerRelayCommand } from "./commands/relay.js";
@@ -109,6 +110,7 @@ export function createHarneryProgram(opts = {}) {
     registerEditBatchCommand(program, emit);
     registerGrepCommand(program, emit, opts.context);
     registerHarnessCommand(program, emit);
+    registerPolicyCommand(program, emit);
     registerCookiesCommand(program, emit);
     registerFetchCommand(program, emit, opts.context);
     registerReadCommand(program, emit);

package/dist/commands/browse.js

@@ -396,9 +396,7 @@ async function runPrintMode(browser, navResult, opts, evalResult, visibility, wi
         body = await browser.htmlContent(opts.selector);
     }
     else if (opts.snapshot) {
-        body = opts.selector
-            ? await browser.evaluate(`(() => { const el = document.querySelector(${JSON.stringify(opts.selector)}); return el ? el.innerText : ''; })()`)
-            : await browser.textSnapshot();
+        body = await browser.textSnapshot(opts.selector);
     }
     if (opts.json) {
         const result = {

package/dist/commands/eml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eml.d.ts","sourceRoot":"","sources":["../../src/commands/eml.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,YAAY,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD;;;;;;;;;GASG;AAEH,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAkB5E;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAuCD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,EAAE,CAYjE;AA4VD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,aAAa,EAAE,EACzB,IAAI,EAAE,OAAO,GACZ,MAAM,CAyDR"}
+{"version":3,"file":"eml.d.ts","sourceRoot":"","sources":["../../src/commands/eml.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,YAAY,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD;;;;;;;;;GASG;AAEH,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAkB5E;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAuCD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,EAAE,CAYjE;AAwSD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,aAAa,EAAE,EACzB,IAAI,EAAE,OAAO,GACZ,MAAM,CAyDR"}

package/dist/commands/eml.js

@@ -1,4 +1,5 @@
 import { readFileSync, writeFileSync } from "node:fs";
+import { parseHTML } from "linkedom";
 import { simpleParser } from "mailparser";
 export function registerEmlCommand(program, emit) {
     program
@@ -261,13 +262,13 @@ function parseAttribution(text) {
     const nameMatch = cleaned.match(/(?:AM|PM)\s+(.+?)(?:\s*<[^>]+>)?\s+wrote:/i);
     let name = "Unknown";
     if (nameMatch) {
-        name = nameMatch[1].replace(/<[^>]+>/g, "").trim();
+        name = nameMatch[1].trim();
     }
     else {
         // Try simpler pattern without AM/PM
         const simpleMatch = cleaned.match(/at\s+[\d:]+\s+(.+?)(?:\s*<[^>]+>)?\s+wrote:/i);
         if (simpleMatch) {
-            name = simpleMatch[1].replace(/<[^>]+>/g, "").trim();
+            name = simpleMatch[1].trim();
         }
     }
     return { name, date };
@@ -276,18 +277,11 @@ function parseAttribution(text) {
  * Strip HTML tags, decode entities, and normalize whitespace.
  */
 function stripHtml(html) {
-    let text = html;
-    // Replace <br>, <br/>, <br /> with newlines
-    text = text.replace(/<br\s*\/?>/gi, "\n");
-    // Replace block-level elements with newlines
-    text = text.replace(/<\/(p|div|tr|li|h[1-6])>/gi, "\n");
-    text = text.replace(/<(p|div|tr|li|h[1-6])\b[^>]*>/gi, "\n");
-    // Replace <td> with tab
-    text = text.replace(/<\/td>/gi, "\t");
-    // Remove all remaining HTML tags
-    text = text.replace(/<[^>]+>/g, "");
-    // Decode HTML entities
-    text = decodeEntities(text);
+    const { document } = parseHTML(`<html><body>${html}</body></html>`);
+    for (const unsafe of document.querySelectorAll("script, style, template, noscript")) {
+        unsafe.remove();
+    }
+    let text = document.body?.innerText ?? "";
     // Normalize whitespace (but preserve newlines)
     text = text
         .split("\n")
@@ -295,38 +289,6 @@ function stripHtml(html) {
         .join("\n");
     return text;
 }
-/**
- * Decode common HTML entities.
- */
-function decodeEntities(text) {
-    const entities = {
-        "&amp;": "&",
-        "&lt;": "<",
-        "&gt;": ">",
-        "&quot;": '"',
-        "&#39;": "'",
-        "&apos;": "'",
-        "&nbsp;": " ",
-        "&#160;": " ",
-        "&ndash;": "-",
-        "&mdash;": "-",
-        "&laquo;": "<<",
-        "&raquo;": ">>",
-        "&bull;": "*",
-        "&hellip;": "...",
-        "&copy;": "(c)",
-        "&reg;": "(R)",
-        "&trade;": "(TM)",
-    };
-    let result = text;
-    for (const [entity, char] of Object.entries(entities)) {
-        result = result.replaceAll(entity, char);
-    }
-    // Decode numeric entities (&#NNN; and &#xHHH;)
-    result = result.replace(/&#(\d+);/g, (_, code) => String.fromCharCode(Number.parseInt(code, 10)));
-    result = result.replace(/&#x([0-9a-fA-F]+);/g, (_, code) => String.fromCharCode(Number.parseInt(code, 16)));
-    return result;
-}
 /**
  * Clean up message body text.
  */
@@ -347,10 +309,9 @@ function cleanBody(text) {
             }
         }
     }
-    // Remove stray partial HTML tags at the end of the body
-    body = body.replace(/<\w+\s*$/, "");
-    // Remove any remaining HTML tags that slipped through
-    body = body.replace(/<[^>]+>/g, "");
+    // The renderer emits Markdown. Neutralize raw HTML in both DOM-derived and
+    // plain-text messages so decoded entities cannot become executable markup.
+    body = body.replaceAll("<", "&lt;").replaceAll(">", "&gt;");
     // Collapse 3+ consecutive newlines into 2
     body = body.replace(/\n{3,}/g, "\n\n");
     return body.trim();

package/dist/commands/policy.d.ts

@@ -0,0 +1,6 @@
+import type { Command } from "commander";
+import type { EmitContext } from "../commander.js";
+import type { NormalizedPolicy } from "../core/policy/index.js";
+export declare function registerPolicyCommand(program: Command, emit: EmitContext): void;
+export declare function renderPolicy(policy: Readonly<NormalizedPolicy>, digest: string): string;
+//# sourceMappingURL=policy.d.ts.map

package/dist/commands/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/commands/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOhE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAwB/E;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAcvF"}

package/dist/commands/policy.js

@@ -0,0 +1,42 @@
+import { loadPolicyFile, policyDigest } from "../core/policy/index.js";
+export function registerPolicyCommand(program, emit) {
+    const command = program
+        .command("policy")
+        .description("Inspect host-enforced workflow policy documents.");
+    command
+        .command("check <file>")
+        .description("Validate and print a normalized policy without running a workflow.")
+        .option("--json", "Emit the normalized policy and digest as JSON")
+        .action((file, opts) => {
+        try {
+            const policy = loadPolicyFile(file);
+            const result = { policy, sha256: policyDigest(policy) };
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data(result);
+            }
+            else {
+                emit.text(renderPolicy(policy, result.sha256));
+            }
+        }
+        catch (error) {
+            emit.error({ code: "policy_invalid", message: error.message });
+            emit.setExitCode(1);
+        }
+    });
+}
+export function renderPolicy(policy, digest) {
+    const lines = [
+        `${policy.name} (schema ${policy.schema_version})`,
+        `sha256: ${digest}`,
+        `cost ceiling: ${policy.max_cost_usd === undefined ? "none" : `$${policy.max_cost_usd.toFixed(4)}`}`,
+        `unknown cost: ${policy.unknown_cost}`,
+        `network: ${policy.network}`,
+        `external actions: ${policy.external_actions}`,
+        `harnesses: ${policy.allowed_harnesses?.join(", ") ?? "any"}`,
+        `models: ${policy.allowed_models?.join(", ") ?? "any"}`,
+        `paths: ${policy.allowed_paths?.join(", ") ?? "any"}`,
+        `isolation: ${policy.allowed_isolation?.join(", ") ?? "any"}`,
+    ];
+    return `${lines.join("\n")}\n`;
+}

package/dist/commands/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA8BnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA+IjF"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAkCnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAuKjF"}

package/dist/commands/workflow.js

@@ -1,6 +1,7 @@
 import { workflowSubscriptionOnly } from "../core/config.js";
 import { createBuiltinHarnessRegistry } from "../core/harnesses/index.js";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.js";
+import { loadPolicyFile } from "../core/policy/index.js";
 export function registerWorkflowCommand(program, emit) {
     const registry = createBuiltinHarnessRegistry();
     const harnesses = registry.ids();
@@ -9,7 +10,7 @@ export function registerWorkflowCommand(program, emit) {
         .description("Run bounded, schema-gated multi-subagent workflow scripts.");
     workflow
         .command("run <script>")
-        .description("Execute a workflow script (plain JS: `export default async ({agent, parallel, stage, log, evidence}) => …`). " +
+        .description("Execute a workflow script (plain JS: `export default async ({agent, parallel, stage, log, evidence, authorize}) => …`). " +
         "Subagents spawn as headless harness-CLI subprocesses, coordination-registered.")
         .option("--max-agents <n>", "Total-agent ceiling for the run (default 50)")
         .option("--concurrency <n>", "Concurrent-subagent cap (default 4)")
@@ -20,6 +21,8 @@ export function registerWorkflowCommand(program, emit) {
         "harness has no stored login (repo default via config.jsonc workflow.subscriptionOnly)")
         .option("--allow-api-billing", "Permit an exported API key to override a stored subscription login (per-token billing); " +
         "without this the engine refuses that silent-override state")
+        .option("--policy <file>", "Host policy JSON/JSONC applied before dispatch and external mutation")
+        .option("--isolation <mode>", "Host-created execution boundary: shared | worktree | sandbox | remote (default shared)")
         .option("--json", "Emit the full RunReport as JSON")
         .action(async (script, opts) => {
         const coordRoot = findCoordRoot();
@@ -37,6 +40,14 @@ export function registerWorkflowCommand(program, emit) {
             });
             process.exit(1);
         }
+        if (opts.isolation &&
+            !["shared", "worktree", "sandbox", "remote"].includes(opts.isolation)) {
+            emit.error({
+                code: "bad_isolation",
+                message: `unknown isolation ${JSON.stringify(opts.isolation)} (expected: shared | worktree | sandbox | remote)`,
+            });
+            process.exit(1);
+        }
         // Flag beats config; the two flags contradict each other by design.
         const subscriptionOnly = opts.subscriptionOnly || workflowSubscriptionOnly(coordRoot);
         if (subscriptionOnly && opts.allowApiBilling) {
@@ -65,6 +76,12 @@ export function registerWorkflowCommand(program, emit) {
                     adapter.profile.id,
                     { toolEvidence: adapter.profile.capabilities.toolEvidence },
                 ])),
+                policy: opts.policy ? loadPolicyFile(opts.policy) : undefined,
+                isolation: opts.isolation,
+                // CLI harness subprocesses inherit the host network. A policy that
+                // forbids network must therefore deny dispatch unless a future host
+                // adapter creates and declares a network-disabled boundary.
+                networkAccess: "enabled",
             });
             if (opts.json) {
                 emit.config({ format: "json" });

package/dist/core/agents/coord-client.d.ts

@@ -6,6 +6,13 @@
  * ppid map, so a single coord state can be observed and mutated from
  * either side without divergence.
  */
+/**
+ * Instance IDs become coordination filenames, so only one portable basename
+ * alphabet is accepted at every filesystem boundary. UUIDs, test IDs, and
+ * legacy hex IDs all fit this contract; separators and dot segments do not.
+ */
+export declare function isSafeInstanceId(value: unknown): value is string;
+export declare function assertSafeInstanceId(value: unknown): asserts value is string;
 export interface Heartbeat {
     instance_id: string;
     name?: string;

package/dist/core/agents/coord-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coord-client.d.ts","sourceRoot":"","sources":["../../../src/core/agents/coord-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0IAA0I;IAC1I,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mEAAmE;IACnE,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CA0C5C;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI1D;AAaD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,iBAAiB,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;CAC5F,CAkEA;AA4CD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2BpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyBpE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAKlE;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAIxC"}
+{"version":3,"file":"coord-client.d.ts","sourceRoot":"","sources":["../../../src/core/agents/coord-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAWhE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAI5E;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0IAA0I;IAC1I,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mEAAmE;IACnE,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CA0C5C;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI1D;AAaD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,iBAAiB,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;CAC5F,CAkEA;AA4CD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2BpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyBpE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAKlE;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAIxC"}

package/dist/core/agents/coord-client.js

@@ -9,6 +9,32 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
+// NOTE: kept dependency-free (node builtins only); this file is vendored verbatim into
+// a downstream consumer, so it cannot import the coordEnv helper.
+const MAX_INSTANCE_ID_LENGTH = 128;
+/**
+ * Instance IDs become coordination filenames, so only one portable basename
+ * alphabet is accepted at every filesystem boundary. UUIDs, test IDs, and
+ * legacy hex IDs all fit this contract; separators and dot segments do not.
+ */
+export function isSafeInstanceId(value) {
+    if (typeof value !== "string" || value.length === 0 || value.length > MAX_INSTANCE_ID_LENGTH) {
+        return false;
+    }
+    for (let index = 0; index < value.length; index++) {
+        const code = value.charCodeAt(index);
+        const alpha = (code >= 65 && code <= 90) || (code >= 97 && code <= 122);
+        const digit = code >= 48 && code <= 57;
+        if (!alpha && !digit && code !== 45 && code !== 95)
+            return false;
+    }
+    return true;
+}
+export function assertSafeInstanceId(value) {
+    if (!isSafeInstanceId(value)) {
+        throw new Error("instance_id must be 1-128 ASCII letters, digits, hyphens, or underscores");
+    }
+}
 /**
  * Resolve the monorepo root for coord-state purposes.
  *
@@ -303,7 +329,7 @@ export function resolveSingleActiveOwner(root) {
  * `.harnery/active/<id>.json` (the canonical location every reader expects).
  */
 export function readHeartbeat(instanceId) {
-    if (!instanceId)
+    if (!isSafeInstanceId(instanceId))
         return null;
     const root = monorepoRoot();
     if (!root)

package/dist/core/policy/evaluate.d.ts

@@ -0,0 +1,14 @@
+import type { NormalizedPolicy, PolicyEvaluation, PolicyIsolation, PolicyRequest, PolicyRequestSummary, PolicySpec } from "./types.js";
+export declare class PolicyDeniedError extends Error {
+    readonly decisionId: string;
+    constructor(message: string, decisionId: string);
+}
+export declare function normalizePolicy(input: PolicySpec, options?: {
+    baseDir?: string;
+}): Readonly<NormalizedPolicy>;
+export declare function policyDigest(policy: NormalizedPolicy): string;
+export declare function evaluatePolicy(policy: Readonly<NormalizedPolicy>, rawRequest: PolicyRequest): PolicyEvaluation;
+/** Bound and normalize the receipt-safe subset before it reaches a journal or proof. */
+export declare function summarizePolicyRequest(input: PolicyRequest): PolicyRequestSummary;
+export type { PolicyIsolation };
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/core/policy/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../../src/core/policy/evaluate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,oBAAoB,EAEpB,UAAU,EAEX,MAAM,YAAY,CAAC;AAqBpB,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAKhD;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GACjC,QAAQ,CAAC,gBAAgB,CAAC,CAwB5B;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAE7D;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAClC,UAAU,EAAE,aAAa,GACxB,gBAAgB,CA8FlB;AAED,wFAAwF;AACxF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,oBAAoB,CA8BjF;AAyGD,YAAY,EAAE,eAAe,EAAE,CAAC"}

package/dist/core/policy/evaluate.js

@@ -0,0 +1,238 @@
+import { createHash } from "node:crypto";
+import { isAbsolute, relative, resolve } from "node:path";
+import { POLICY_SCHEMA_VERSION } from "./types.js";
+const VERDICTS = ["allow", "ask", "deny"];
+const ISOLATIONS = ["shared", "worktree", "sandbox", "remote"];
+const MAX_NAME = 200;
+const MAX_FIELD = 500;
+const MAX_LIST = 100;
+const POLICY_FIELDS = new Set([
+    "schema_version",
+    "name",
+    "max_cost_usd",
+    "unknown_cost",
+    "allowed_harnesses",
+    "allowed_models",
+    "allowed_paths",
+    "network",
+    "external_actions",
+    "allowed_isolation",
+]);
+export class PolicyDeniedError extends Error {
+    decisionId;
+    constructor(message, decisionId) {
+        super(message);
+        this.name = "PolicyDeniedError";
+        this.decisionId = decisionId;
+    }
+}
+export function normalizePolicy(input, options = {}) {
+    if (!isRecord(input))
+        throw new Error("policy must be an object");
+    const unknownFields = Object.keys(input).filter((field) => !POLICY_FIELDS.has(field));
+    if (unknownFields.length > 0) {
+        throw new Error(`policy contains unknown field(s): ${unknownFields.sort().join(", ")}`);
+    }
+    const schemaVersion = input.schema_version ?? POLICY_SCHEMA_VERSION;
+    if (schemaVersion !== POLICY_SCHEMA_VERSION) {
+        throw new Error(`unsupported policy schema_version ${JSON.stringify(schemaVersion)}`);
+    }
+    const baseDir = resolve(options.baseDir ?? process.cwd());
+    const normalized = {
+        schema_version: POLICY_SCHEMA_VERSION,
+        name: boundedString(input.name ?? "workflow policy", "policy name", MAX_NAME),
+        max_cost_usd: optionalMoney(input.max_cost_usd, "max_cost_usd"),
+        unknown_cost: enumValue(input.unknown_cost ?? "deny", ["ask", "deny"], "unknown_cost"),
+        allowed_harnesses: optionalStringList(input.allowed_harnesses, "allowed_harnesses"),
+        allowed_models: optionalStringList(input.allowed_models, "allowed_models"),
+        allowed_paths: optionalPathList(input.allowed_paths, baseDir),
+        network: enumValue(input.network ?? "deny", VERDICTS, "network"),
+        external_actions: enumValue(input.external_actions ?? "deny", VERDICTS, "external_actions"),
+        allowed_isolation: optionalEnumList(input.allowed_isolation, ISOLATIONS, "allowed_isolation"),
+    };
+    return deepFreeze(normalized);
+}
+export function policyDigest(policy) {
+    return createHash("sha256").update(JSON.stringify(policy)).digest("hex");
+}
+export function evaluatePolicy(policy, rawRequest) {
+    const request = summarizePolicyRequest(rawRequest);
+    const rules = [];
+    const add = (code, verdict, reason) => {
+        rules.push({ code, verdict, reason });
+    };
+    if (policy.allowed_harnesses && request.phase === "dispatch") {
+        if (!request.harness || !policy.allowed_harnesses.includes(request.harness)) {
+            add("harness_not_allowed", "deny", `harness ${JSON.stringify(request.harness ?? "unknown")} is not allowed`);
+        }
+    }
+    if (policy.allowed_models && request.phase === "dispatch") {
+        if (!request.model || !policy.allowed_models.includes(request.model)) {
+            add("model_not_allowed", "deny", `model ${JSON.stringify(request.model ?? "unknown")} is not allowed`);
+        }
+    }
+    if (policy.allowed_paths) {
+        if (!request.path || !policy.allowed_paths.some((root) => contains(root, request.path))) {
+            add("path_not_allowed", "deny", `path ${JSON.stringify(request.path ?? "unknown")} is outside the allowed roots`);
+        }
+    }
+    if (policy.allowed_isolation && !policy.allowed_isolation.includes(request.isolation)) {
+        add("isolation_not_allowed", "deny", `isolation ${JSON.stringify(request.isolation)} is not allowed`);
+    }
+    if (request.network_access !== "disabled" && policy.network !== "allow") {
+        add(request.network_access === "unknown" ? "network_unknown" : "network_restricted", policy.network, request.network_access === "unknown"
+            ? "network access is unknown"
+            : "network access requires policy authorization");
+    }
+    if (request.phase === "external_mutation" && policy.external_actions !== "allow") {
+        add("external_action_restricted", policy.external_actions, "external mutation requires policy authorization");
+    }
+    if (policy.max_cost_usd !== undefined && request.phase === "dispatch") {
+        const current = request.current_cost_usd ?? 0;
+        if (current >= policy.max_cost_usd) {
+            add("cost_budget_exhausted", "deny", `run cost $${current.toFixed(4)} has reached the $${policy.max_cost_usd.toFixed(4)} ceiling`);
+        }
+        else if (request.projected_cost_usd === null || request.projected_cost_usd === undefined) {
+            add("dispatch_cost_unknown", policy.unknown_cost, `dispatch cost is unknown under a $${policy.max_cost_usd.toFixed(4)} ceiling`);
+        }
+        else if (current + request.projected_cost_usd > policy.max_cost_usd) {
+            add("cost_budget_exceeded", "deny", `projected run cost $${(current + request.projected_cost_usd).toFixed(4)} exceeds the $${policy.max_cost_usd.toFixed(4)} ceiling`);
+        }
+    }
+    if (rules.length === 0) {
+        rules.push({ code: "policy_allow", verdict: "allow", reason: "all configured rules allow" });
+    }
+    const verdict = rules.some((rule) => rule.verdict === "deny")
+        ? "deny"
+        : rules.some((rule) => rule.verdict === "ask")
+            ? "ask"
+            : "allow";
+    const decisive = rules.filter((rule) => rule.verdict === verdict);
+    return {
+        verdict,
+        reason: decisive.map((rule) => rule.reason).join("; "),
+        rules,
+    };
+}
+/** Bound and normalize the receipt-safe subset before it reaches a journal or proof. */
+export function summarizePolicyRequest(input) {
+    if (!isRecord(input))
+        throw new Error("policy request must be an object");
+    const phase = enumValue(input.phase, ["dispatch", "external_mutation"], "policy phase");
+    const isolation = enumValue(input.isolation, ISOLATIONS, "policy isolation");
+    const networkAccess = enumValue(input.network_access, ["enabled", "disabled", "unknown"], "policy network_access");
+    return {
+        phase,
+        action: boundedString(input.action, "policy action", MAX_FIELD),
+        path: optionalBounded(input.path, "policy path"),
+        harness: optionalBounded(input.harness, "policy harness"),
+        model: optionalBounded(input.model, "policy model"),
+        effort: optionalBounded(input.effort, "policy effort"),
+        max_attempts: optionalWholeNumber(input.max_attempts, "policy max_attempts", 1),
+        max_turns: optionalWholeNumber(input.max_turns, "policy max_turns", 1),
+        timeout_ms: optionalWholeNumber(input.timeout_ms, "policy timeout_ms", 1),
+        prompt_bytes: optionalWholeNumber(input.prompt_bytes, "policy prompt_bytes", 0),
+        isolation,
+        network_access: networkAccess,
+        service: optionalBounded(input.service, "policy service"),
+        target: optionalBounded(safeTarget(input.target), "policy target"),
+        current_cost_usd: optionalMoney(input.current_cost_usd, "current_cost_usd"),
+        projected_cost_usd: input.projected_cost_usd === null
+            ? null
+            : optionalMoney(input.projected_cost_usd, "projected_cost_usd"),
+    };
+}
+function contains(root, candidate) {
+    const rel = relative(resolve(root), resolve(candidate));
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+function optionalPathList(value, baseDir) {
+    const values = optionalStringList(value, "allowed_paths");
+    if (!values)
+        return undefined;
+    return [...new Set(values.map((item) => resolve(baseDir, item)))].sort();
+}
+function optionalStringList(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0 || value.length > MAX_LIST) {
+        throw new Error(`${field} must be a non-empty array with at most ${MAX_LIST} entries`);
+    }
+    return [
+        ...new Set(value.map((item, index) => boundedString(item, `${field}[${index}]`, MAX_FIELD))),
+    ].sort();
+}
+function optionalEnumList(value, allowed, field) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0 || value.length > MAX_LIST) {
+        throw new Error(`${field} must be a non-empty array with at most ${MAX_LIST} entries`);
+    }
+    return [...new Set(value.map((item) => enumValue(item, allowed, field)))].sort();
+}
+function enumValue(value, values, field) {
+    if (typeof value !== "string" || !values.includes(value)) {
+        throw new Error(`${field} must be one of: ${values.join(", ")}`);
+    }
+    return value;
+}
+function optionalMoney(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+        throw new Error(`${field} must be a finite non-negative number`);
+    }
+    return value;
+}
+function optionalWholeNumber(value, field, minimum) {
+    if (value === undefined)
+        return undefined;
+    if (!Number.isSafeInteger(value) || value < minimum) {
+        throw new Error(`${field} must be a safe integer greater than or equal to ${minimum}`);
+    }
+    return value;
+}
+function boundedString(value, field, max) {
+    if (typeof value !== "string")
+        throw new Error(`${field} must be a string`);
+    const normalized = withoutControls(value).replace(/\s+/g, " ").trim();
+    if (!normalized)
+        throw new Error(`${field} must not be empty`);
+    if (normalized.length > max)
+        throw new Error(`${field} exceeds ${max} characters`);
+    return normalized;
+}
+function optionalBounded(value, field) {
+    return value === undefined ? undefined : boundedString(value, field, MAX_FIELD);
+}
+function safeTarget(value) {
+    if (typeof value !== "string")
+        return value;
+    try {
+        const url = new URL(value);
+        return `${url.origin}${url.pathname}`;
+    }
+    catch {
+        const query = value.indexOf("?");
+        const fragment = value.indexOf("#");
+        const boundary = Math.min(query === -1 ? value.length : query, fragment === -1 ? value.length : fragment);
+        return value.slice(0, boundary);
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function withoutControls(value) {
+    return Array.from(value, (character) => {
+        const code = character.charCodeAt(0);
+        return code < 32 || code === 127 ? " " : character;
+    }).join("");
+}
+function deepFreeze(value) {
+    if (value && typeof value === "object") {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}

package/dist/core/policy/file.d.ts

@@ -0,0 +1,3 @@
+import type { NormalizedPolicy } from "./types.js";
+export declare function loadPolicyFile(path: string): Readonly<NormalizedPolicy>;
+//# sourceMappingURL=file.d.ts.map

package/dist/core/policy/file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../../src/core/policy/file.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAc,MAAM,YAAY,CAAC;AAE/D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAavE"}

package/dist/core/policy/file.js

@@ -0,0 +1,20 @@
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { stripJsonComments } from "../config.js";
+import { normalizePolicy } from "./evaluate.js";
+export function loadPolicyFile(path) {
+    const absolute = resolve(path);
+    let parsed;
+    try {
+        parsed = JSON.parse(stripJsonComments(readFileSync(absolute, "utf8")));
+    }
+    catch (error) {
+        throw new Error(`cannot parse policy at ${absolute}: ${error.message}`);
+    }
+    try {
+        return normalizePolicy(parsed, { baseDir: dirname(absolute) });
+    }
+    catch (error) {
+        throw new Error(`invalid policy at ${absolute}: ${error.message}`);
+    }
+}

package/dist/core/policy/index.d.ts

@@ -0,0 +1,5 @@
+export { evaluatePolicy, normalizePolicy, PolicyDeniedError, policyDigest, summarizePolicyRequest, } from "./evaluate.js";
+export { loadPolicyFile } from "./file.js";
+export type { DispatchCostEstimator, ExternalMutationRequest, NormalizedPolicy, PolicyAskResolution, PolicyAskResolver, PolicyDecision, PolicyEvaluation, PolicyIsolation, PolicyNetworkAccess, PolicyPhase, PolicyRequest, PolicyRequestSummary, PolicyRuleResult, PolicySpec, PolicyVerdict, } from "./types.js";
+export { POLICY_SCHEMA_VERSION } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/core/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}