mecord-connect 1.0.0

package/runtime/app/src/core/machine-state.js

@@ -0,0 +1,160 @@
+import crypto from 'node:crypto';
+                                                                        
+                                                                                 
+
+const SAFE_STATE_KEYS = new Set([
+  'sha256', 'size', 'bytes', 'count', 'clean', 'operation', 'verified',
+  'exitCode', 'state', 'healthy', 'selected', 'expand_collapse_state', 'truncated',
+  'events_truncated', 'waited_ms', 'observed_ms', 'max_nodes', 'max_depth'
+]);
+const AMBIGUOUS_ERROR = /AMBIGUOUS|MULTIPLE_MATCH|TARGET_NOT_UNIQUE/i;
+
+export function normalizeMachineObservation(
+  action               ,
+  result              ,
+  channel                        = 'semantic'
+)                           {
+  const domain = observationDomain(result.capability, result.provider);
+  const importantState = importantStateFromResult(result);
+  const entityId = observationEntityId(action, result, domain);
+  return {
+    schemaVersion: 2,
+    channel,
+    domain,
+    provider: bounded(result.provider, 256),
+    capability: bounded(result.capability, 256),
+    entityId,
+    observedAt: new Date().toISOString(),
+    stateVersion: sha256(canonicalJson({ domain, entityId, importantState })),
+    importantState,
+    ambiguous: AMBIGUOUS_ERROR.test(result.error?.code ?? ''),
+    confidence: observationConfidence(result),
+    evidenceRefs: result.evidence.slice(0, 100).map(evidenceRef)
+  };
+}
+
+export function observationDomain(capability        , provider        )                        {
+  const lowerProvider = provider.toLowerCase();
+  if (lowerProvider.includes('uia')) return 'uia';
+  if (capability.startsWith('project.')) return 'project';
+  if (capability.startsWith('file.')) return 'filesystem';
+  if (capability.startsWith('git.')) return 'git';
+  if (capability.startsWith('docker.')) return 'docker';
+  if (capability.startsWith('postgres.')) return 'database';
+  if (capability.startsWith('vscode.')) return 'ide';
+  if (capability.startsWith('browser.')) return 'browser';
+  if (capability.startsWith('terminal.') || capability.startsWith('process.')) return 'process';
+  if (capability.startsWith('computer.')) return 'system';
+  if (capability.startsWith('app.')) return 'application';
+  return channelFromProvider(lowerProvider);
+}
+
+function channelFromProvider(provider        )                        {
+  if (provider.includes('docker')) return 'docker';
+  if (provider.includes('postgres')) return 'database';
+  if (provider.includes('vscode')) return 'ide';
+  return 'unknown';
+}
+function observationEntityId(action               , result              , domain                       )         {
+  const output = record(result.output);
+  const target = action.target
+    ?? text(output.targetId)
+    ?? text(record(output.target).id)
+    ?? text(action.input.path)
+    ?? text(action.input.cwd)
+    ?? text(action.input.targetId)
+    ?? canonicalJson(action.input.selector ?? {});
+  return `${domain}:${sha256(`${result.capability}\0${target || result.provider}`).slice(0, 32)}`;
+}
+
+function importantStateFromResult(result              )                          {
+  const state                          = { ok: result.ok };
+  if (result.error?.code) state.errorCode = bounded(result.error.code, 128);
+  const output = record(result.output);
+  for (const [key, value] of Object.entries(output)) {
+    if (SAFE_STATE_KEYS.has(key) && isSafeScalar(value)) state[key] = value;
+  }
+  if (result.capability.startsWith('docker.')) {
+    const scope = text(output.scope);
+    if (scope === 'project' || scope === 'daemon') state.scope = scope;
+    for (const key of ['fingerprint', 'beforeFingerprint', 'afterFingerprint']) {
+      const value = text(output[key]);
+      if (value && /^[0-9a-f]{64}$/i.test(value)) state[key] = value.toLowerCase();
+    }
+    const services = normalizeDockerServices(output.services ?? output.states);
+    if (services.length) state.services = services;
+  }
+  if (result.capability.startsWith('postgres.')) {
+    const profileId = text(output.profileId);
+    const schema = text(output.schema);
+    const table = text(output.table);
+    if (profileId && /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(profileId)) state.profileId = profileId;
+    if (schema && /^[A-Za-z_][A-Za-z0-9_$]{0,62}$/.test(schema)) state.schema = schema;
+    if (table && /^[A-Za-z_][A-Za-z0-9_$]{0,62}$/.test(table)) state.table = table;
+    for (const key of ['rowCount', 'limit', 'offset']) {
+      const value = Number(output[key]);
+      if (Number.isSafeInteger(value) && value >= 0 && value <= 10_000) state[key] = value;
+    }
+    if (Array.isArray(output.columns)) {
+      const columns = output.columns.map(String).filter((column) => column === '*' || /^[A-Za-z_][A-Za-z0-9_$]{0,62}$/.test(column)).slice(0, 50);
+      if (columns.length) state.columns = columns;
+    }
+    if (Array.isArray(output.profiles)) state.profileCount = Math.min(output.profiles.length, 1000);
+    if (Array.isArray(output.rows) && output.operation === 'columns') state.columnCount = Math.min(output.rows.length, 500);
+  }
+  const postcondition = record(output.postcondition);
+  const safePostcondition                          = {};
+  for (const [key, value] of Object.entries(postcondition)) {
+    if ((SAFE_STATE_KEYS.has(key) || key === 'focused' || key === 'foreground') && isSafeScalar(value)) safePostcondition[key] = value;
+  }
+  if (Object.keys(safePostcondition).length) state.postcondition = safePostcondition;
+  return state;
+}
+
+function normalizeDockerServices(input         )                                                                   {
+  if (!Array.isArray(input)) return [];
+  const output                                                                   = [];
+  for (const item of input.slice(0, 50)) {
+    const raw = record(item);
+    const service = text(raw.service);
+    const containers = Number(raw.containers ?? 0);
+    const states = Array.isArray(raw.states)
+      ? [...new Set(raw.states.map(String).filter((state) => /^[a-z][a-z0-9_-]{0,63}$/i.test(state)))].sort().slice(0, 20)
+      : [];
+    if (!service || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(service)) continue;
+    if (!Number.isSafeInteger(containers) || containers < 0 || containers > 1000) continue;
+    output.push({ service, containers, states });
+  }
+  return output.sort((a, b) => a.service.localeCompare(b.service));
+}
+
+function observationConfidence(result              )         {
+  if (AMBIGUOUS_ERROR.test(result.error?.code ?? '')) return 0;
+  return result.ok ? 1 : 0.5;
+}
+function evidenceRef(item          )         {
+  return sha256(canonicalJson({ kind: item.kind, status: item.status, timestamp: item.timestamp }));
+}
+function isSafeScalar(value         )                                            {
+  return value === null || typeof value === 'boolean' || typeof value === 'number'
+    || (typeof value === 'string' && value.length <= 256 && !/[\r\n\0]/.test(value));
+}
+function record(value         )                          {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value                            : {};
+}
+function text(value         )                     {
+  return typeof value === 'string' && value.length <= 4096 ? value : undefined;
+}
+function bounded(value        , max        )         {
+  return value.slice(0, max).replace(/[\r\n\0]/g, ' ');
+}
+function sha256(value        )         {
+  return crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function canonicalJson(value         )         {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
+  if (!value || typeof value !== 'object') return JSON.stringify(value);
+  const object = value                           ;
+  return `{${Object.keys(object).sort().filter((key) => object[key] !== undefined)
+    .map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(',')}}`;
+}

package/runtime/app/src/core/network-authority.js

@@ -0,0 +1,20 @@
+                                        
+import { OperatorError } from './errors.js';
+
+export function requireLiteralLoopbackBindHost(input        , label = 'Local service')         {
+  const host = String(input ?? '').trim().toLowerCase();
+  if (host === '127.0.0.1') return host;
+  if (host === '::1' || host === '[::1]') return '::1';
+  throw new OperatorError(
+    'UNSAFE_LOCAL_BIND_HOST',
+    `${label} must bind to a literal loopback address (127.0.0.1 or ::1). Remote ingress must use the approved relay/tunnel boundary.`
+  );
+}
+
+export function applyBoundedHttpServerPolicy(server        )       {
+  server.headersTimeout = 10_000;
+  server.requestTimeout = 30_000;
+  server.keepAliveTimeout = 5_000;
+  server.maxRequestsPerSocket = 100;
+  server.maxHeadersCount = 64;
+}

package/runtime/app/src/core/policy.js

@@ -0,0 +1,67 @@
+import path from 'node:path';
+                                                                   
+import { PolicyError } from './errors.js';
+import { assertInstructionAuthority } from './provenance.js';
+import { assertCanonicalRisk, capabilityRiskRule } from './capability-policy.js';
+import { normalizeScopedPathSyntax } from './scoped-path-syntax.js';
+
+function capabilityAllowed(capability        , allowed          )          {
+  return allowed.some((rule) => rule === capability || (rule.endsWith('.*') && capability.startsWith(rule.slice(0, -1))));
+}
+
+function pathWithin(child        , root        )          {
+  const rel = path.relative(path.resolve(root), child);
+  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+
+function policyPath(inputPath        , roots          )                     {
+  const syntax = normalizeScopedPathSyntax(inputPath);
+  if (syntax.kind === 'native-absolute') return syntax.value;
+  if (syntax.kind === 'foreign-windows-absolute' || roots.length !== 1) return undefined;
+  return path.resolve(roots[0] , syntax.value);
+}
+
+export class PolicyEngine {
+  authorizeBase(action               , permissions                   )       {
+    assertInstructionAuthority(action.provenance);
+
+    if (!capabilityAllowed(action.capability, permissions.allowedCapabilities)) {
+      throw new PolicyError('CAPABILITY_DENIED', `Capability ${action.capability} is not permitted.`);
+    }
+
+    const targetPath = typeof action.input.path === 'string'
+      ? action.input.path
+      : typeof action.input.cwd === 'string'
+        ? action.input.cwd
+        : undefined;
+
+    if (targetPath && permissions.allowedRoots.length > 0) {
+      const candidate = policyPath(targetPath, permissions.allowedRoots);
+      if (!candidate || !permissions.allowedRoots.some((root) => pathWithin(candidate, root))) {
+        throw new PolicyError('PATH_OUTSIDE_SCOPE', 'Requested path is outside the authorized roots.', { targetPath });
+      }
+    }
+
+  }
+
+  authorizeRisk(action               , permissions                   )       {
+    const approved = new Set(permissions.approvedActionIds ?? []);
+    if (action.risk === 'external' && !permissions.allowExternalWrites && !approved.has(action.id)) {
+      throw new PolicyError('APPROVAL_REQUIRED', 'External write requires explicit approval.', { actionId: action.id });
+    }
+    if (action.risk === 'system' && !permissions.allowSystemChanges && !approved.has(action.id)) {
+      throw new PolicyError('APPROVAL_REQUIRED', 'System change requires explicit approval.', { actionId: action.id });
+    }
+    if (action.risk === 'destructive' && !permissions.allowDestructive && !approved.has(action.id)) {
+      throw new PolicyError('APPROVAL_REQUIRED', 'Destructive action requires explicit approval.', { actionId: action.id });
+    }
+  }
+
+  authorize(action               , permissions                   )       {
+    this.authorizeBase(action, permissions);
+    const rule = capabilityRiskRule(action.capability);
+    if (rule === 'dynamic') throw new PolicyError('CAPABILITY_RISK_UNRESOLVED', `Capability ${action.capability} requires trusted dynamic risk resolution.`);
+    assertCanonicalRisk(action, rule);
+    this.authorizeRisk(action, permissions);
+  }
+}

package/runtime/app/src/core/product-identity.js

@@ -0,0 +1,7 @@
+export const PRODUCT_NAME = 'mecord-connect';
+export const PRODUCT_TITLE = 'Mecord Connect';
+export const PRODUCT_VERSION = '1.0.0';
+
+export function runtimeProductIdentity()                                                   {
+  return { name: PRODUCT_NAME, title: PRODUCT_TITLE, version: PRODUCT_VERSION };
+}

package/runtime/app/src/core/provenance.js

@@ -0,0 +1,18 @@
+                                             
+import { PolicyError } from './errors.js';
+
+const INSTRUCTION_AUTHORITIES = new Set(['user', 'chatgpt', 'trusted_policy', 'runtime']);
+
+export function assertInstructionAuthority(provenance            )       {
+  if (!INSTRUCTION_AUTHORITIES.has(provenance.kind)) {
+    throw new PolicyError(
+      'UNTRUSTED_INSTRUCTION_SOURCE',
+      `Content from ${provenance.kind} is observation data and cannot redefine task goals or permissions.`,
+      { provenance }
+    );
+  }
+}
+
+export function isObservedContent(provenance            )          {
+  return !INSTRUCTION_AUTHORITIES.has(provenance.kind);
+}

package/runtime/app/src/core/provider-learning.js

@@ -0,0 +1,274 @@
+import path from 'node:path';
+import { OperatorError } from './errors.js';
+import { readDurableStateText, writeDurableStateText } from './durable-state.js';
+
+const MAX_ENTRIES = 512;
+const MAX_COUNTER_TOTAL = 1000;
+const MAX_ADJUSTMENT = 0.06;
+const MAX_RELIABILITY_ADJUSTMENT = 0.05;
+const MAX_LATENCY_PENALTY = 0.01;
+const MAX_LATENCY_MS = 60 * 60_000;
+const STATE_OPTIONS = {
+  maxBytes: 512 * 1024,
+  errorCode: 'PROVIDER_LEARNING_STATE_CORRUPT',
+  invalidMessage: 'Provider learning state is invalid.'
+}         ;
+
+                                        
+                   
+                      
+  
+
+                                   
+                                                                                      
+                                                                                                                                   
+ 
+
+                      
+                     
+                   
+                  
+                   
+                 
+                        
+                         
+                    
+  
+
+                      
+             
+                           
+  
+
+export class ProviderLearningStore                             {
+  #file        ;
+  #clock            ;
+  #serial                = Promise.resolve();
+
+  constructor(stateDir        , options                         = {}) {
+    this.#file = path.join(path.resolve(stateDir), 'provider-learning.json');
+    this.#clock = options.clock ?? (() => new Date());
+  }
+
+  async adjustment(capabilityInput        , providerInput        , contextInput = 'global')                  {
+    const capability = boundedKey(capabilityInput, 'capability');
+    const provider = boundedKey(providerInput, 'provider');
+    const context = boundedContext(contextInput);
+    await this.#serial;
+    const state = await this.#read();
+    const exact = state.entries.find((item) => item.capability === capability && item.provider === provider && item.context === context);
+    const fallback = context === 'global'
+      ? undefined
+      : state.entries.find((item) => item.capability === capability && item.provider === provider && item.context === 'global');
+    const entry = exact ?? fallback;
+    return entry ? learnedAdjustment(entry.verified, entry.failed, entry.latencyEwmaMs, entry.latencySamples) : 0;
+  }
+
+  async record(
+    capabilityInput        ,
+    providerInput        ,
+    outcome                       ,
+    metadata                           = {}
+  )                {
+    const capability = boundedKey(capabilityInput, 'capability');
+    const provider = boundedKey(providerInput, 'provider');
+    const context = boundedContext(metadata.context ?? 'global');
+    const durationMs = boundedDuration(metadata.durationMs);
+    if (outcome !== 'verified' && outcome !== 'failed') throw new OperatorError('PROVIDER_LEARNING_INPUT_INVALID', 'Provider learning outcome is invalid.');
+
+    const run = this.#serial.then(async () => {
+      const state = await this.#read();
+      let entry = state.entries.find((item) => item.capability === capability && item.provider === provider && item.context === context);
+      if (!entry) {
+        if (state.entries.length >= MAX_ENTRIES) {
+          state.entries.sort((a, b) => a.updatedAt.localeCompare(b.updatedAt) || entryKey(a).localeCompare(entryKey(b)));
+          state.entries.shift();
+        }
+        entry = {
+          capability, provider, context,
+          verified: 0, failed: 0,
+          latencyEwmaMs: 0, latencySamples: 0,
+          updatedAt: this.#clock().toISOString()
+        };
+        state.entries.push(entry);
+      }
+
+      if (entry.verified + entry.failed >= MAX_COUNTER_TOTAL) {
+        entry.verified = Math.floor(entry.verified / 2);
+        entry.failed = Math.floor(entry.failed / 2);
+      }
+      if (outcome === 'verified') entry.verified += 1;
+      else entry.failed += 1;
+
+      if (durationMs !== undefined) {
+        entry.latencyEwmaMs = entry.latencySamples === 0
+          ? durationMs
+          : Math.round((entry.latencyEwmaMs * 0.8 + durationMs * 0.2) * 1000) / 1000;
+        entry.latencySamples = Math.min(MAX_COUNTER_TOTAL, entry.latencySamples + 1);
+      }
+
+      entry.updatedAt = this.#clock().toISOString();
+      state.entries.sort((a, b) => entryKey(a).localeCompare(entryKey(b)));
+      await writeDurableStateText(this.#file, JSON.stringify(state, null, 2), STATE_OPTIONS);
+    });
+    this.#serial = run.catch(() => undefined);
+    return await run;
+  }
+
+  async #read()                         {
+    let text        ;
+    try {
+      text = await readDurableStateText(this.#file, STATE_OPTIONS);
+    } catch (error) {
+      if ((error                         ).code === 'ENOENT') return { version: 2, entries: [] };
+      throw error;
+    }
+
+    let decoded         ;
+    try { decoded = JSON.parse(text); }
+    catch { throw corrupt('State is not valid JSON.'); }
+    return validateState(decoded);
+  }
+}
+
+export function learnedAdjustment(verified        , failed        , latencyEwmaMs = 0, latencySamples = 0)         {
+  const successes = boundedCount(verified);
+  const failures = boundedCount(failed);
+  const total = successes + failures;
+
+  let reliabilityAdjustment = 0;
+  if (total >= 2) {
+    const posteriorSuccess = (successes + 2) / (total + 4);
+    const centered = (posteriorSuccess - 0.5) * 2;
+    const confidence = Math.min(1, total / 20);
+    reliabilityAdjustment = centered * confidence * MAX_RELIABILITY_ADJUSTMENT;
+  }
+
+  const samples = boundedCount(latencySamples);
+  const latency = boundedLatencyState(latencyEwmaMs);
+  let latencyPenalty = 0;
+  if (samples >= 3 && latency > 100) {
+    const normalized = clamp((Math.log10(latency) - 2) / 3, 0, 1);
+    latencyPenalty = normalized * MAX_LATENCY_PENALTY;
+  }
+
+  return clamp(reliabilityAdjustment - latencyPenalty, -MAX_ADJUSTMENT, MAX_ADJUSTMENT);
+}
+
+function validateState(input         )                {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw corrupt('State must be an object.');
+  const raw = input                           ;
+  if (!Array.isArray(raw.entries) || raw.entries.length > MAX_ENTRIES) {
+    throw corrupt(`State must contain at most ${MAX_ENTRIES} entries.`);
+  }
+
+  if (raw.version === 1) {
+    const seen = new Set        ();
+    const entries = raw.entries.map((value, index)                => {
+      if (!value || typeof value !== 'object' || Array.isArray(value)) throw corrupt(`Entry ${index} must be an object.`);
+      const item = value                           ;
+      const entry                = {
+        capability: storedKey(item.capability, `entry ${index} capability`),
+        provider: storedKey(item.provider, `entry ${index} provider`),
+        context: 'global',
+        verified: boundedCount(item.verified),
+        failed: boundedCount(item.failed),
+        latencyEwmaMs: 0,
+        latencySamples: 0,
+        updatedAt: validIso(item.updatedAt, `entry ${index} updatedAt`)
+      };
+      const key = entryKey(entry);
+      if (seen.has(key)) throw corrupt(`Entry ${index} duplicates a capability/provider/context tuple.`);
+      seen.add(key);
+      return entry;
+    });
+    return { version: 2, entries };
+  }
+
+  if (raw.version !== 2) throw corrupt('State version must be 1 or 2.');
+  const seen = new Set        ();
+  const entries = raw.entries.map((value, index)                => {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) throw corrupt(`Entry ${index} must be an object.`);
+    const item = value                           ;
+    const entry                = {
+      capability: storedKey(item.capability, `entry ${index} capability`),
+      provider: storedKey(item.provider, `entry ${index} provider`),
+      context: storedContext(item.context, `entry ${index} context`),
+      verified: boundedCount(item.verified),
+      failed: boundedCount(item.failed),
+      latencyEwmaMs: boundedLatencyState(item.latencyEwmaMs),
+      latencySamples: boundedCount(item.latencySamples),
+      updatedAt: validIso(item.updatedAt, `entry ${index} updatedAt`)
+    };
+    const key = entryKey(entry);
+    if (seen.has(key)) throw corrupt(`Entry ${index} duplicates a capability/provider/context tuple.`);
+    seen.add(key);
+    return entry;
+  });
+  return { version: 2, entries };
+}
+
+function entryKey(entry                                                            )         {
+  return `${entry.capability}\0${entry.provider}\0${entry.context}`;
+}
+
+function storedKey(input         , label        )         {
+  try { return boundedKey(input, label); }
+  catch { throw corrupt(`${label} is invalid.`); }
+}
+
+function storedContext(input         , label        )         {
+  try { return boundedContext(input); }
+  catch { throw corrupt(`${label} is invalid.`); }
+}
+
+function boundedKey(input         , label        )         {
+  if (typeof input !== 'string' || input.length < 1 || input.length > 256 || input.includes('\0') || /[\r\n]/.test(input)) {
+    throw new OperatorError('PROVIDER_LEARNING_INPUT_INVALID', `${label} is invalid.`);
+  }
+  return input;
+}
+
+function boundedContext(input         )         {
+  const value = String(input ?? 'global');
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value)) {
+    throw new OperatorError('PROVIDER_LEARNING_INPUT_INVALID', 'learning context is invalid.');
+  }
+  return value;
+}
+
+function boundedDuration(input         )                     {
+  if (input === undefined) return undefined;
+  const value = Number(input);
+  if (!Number.isFinite(value) || value < 0 || value > MAX_LATENCY_MS) {
+    throw new OperatorError('PROVIDER_LEARNING_INPUT_INVALID', 'learning duration is invalid.');
+  }
+  return Math.round(value * 1000) / 1000;
+}
+
+function boundedLatencyState(input         )         {
+  const value = Number(input ?? 0);
+  if (!Number.isFinite(value) || value < 0 || value > MAX_LATENCY_MS) throw corrupt('Learning latency is invalid.');
+  return value;
+}
+
+function boundedCount(input         )         {
+  const value = Number(input);
+  if (!Number.isSafeInteger(value) || value < 0 || value > MAX_COUNTER_TOTAL) throw corrupt('Learning counters are invalid.');
+  return value;
+}
+
+function validIso(input         , label        )         {
+  const value = String(input ?? '');
+  const parsed = Date.parse(value);
+  if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== value) throw corrupt(`${label} must be an ISO timestamp.`);
+  return value;
+}
+
+function clamp(value        , min        , max        )         {
+  return Math.max(min, Math.min(max, value));
+}
+
+function corrupt(message        )                {
+  return new OperatorError('PROVIDER_LEARNING_STATE_CORRUPT', `Provider learning state is invalid. ${message}`);
+}

package/runtime/app/src/core/public-plugin-surface.js

@@ -0,0 +1,25 @@
+// Dependency-free contract shared by root publication tests and the MCP adapter.
+// Keep this list limited to tools that are intentionally exposed by the public plugin.
+export const PUBLIC_PLUGIN_SURFACE_VERSION = 1;
+export const PUBLIC_PLUGIN_TOOL_NAMES = Object.freeze([
+  'computer.inspect',
+  'project.inspect',
+  'project.commands',
+  'file.list',
+  'file.read',
+  'file.create',
+  'file.replace',
+  'git.status',
+  'git.diff'
+].sort());
+export const PUBLIC_PLUGIN_CAPABILITIES = Object.freeze([
+  'computer.inspect',
+  'project.inspect',
+  'project.command.inspect',
+  'file.list',
+  'file.read',
+  'file.create',
+  'file.replace',
+  'git.status',
+  'git.diff'
+].sort());