mindweave 0.0.1 → 2.1.2

package/dist/governor/forbidden.js

@@ -0,0 +1,181 @@
+/**
+ * forbidden.ts — the user's per-project deny-list, enforced mechanically.
+ *
+ * This is the strong half of "forbidden": besides being told in the prompt, the
+ * mutating tools call these pure checks before acting, so a forbidden file
+ * literally cannot be edited/overwritten and a command that names a forbidden
+ * path is refused. It's the user-defined sibling of guard.ts's built-in
+ * protected-paths list — same shape (reason string or null), same fail-open rule
+ * (anything not matched is allowed).
+ *
+ * Format of `forbidden.md` (one pattern per line; `#` comments and blanks
+ * ignored): gitignore-style globs relative to the project root —
+ *   src/legacy/**        # a folder and everything under it
+ *   config/prod.json     # a single file
+ *   *.pem                # a glob
+ * A leading `/` or `./` is tolerated and treated as project-relative.
+ */
+import { isAbsolute, relative, resolve } from "node:path";
+import { globToRegExp, literalPrefix } from "./glob.js";
+/** Parse the raw text of a forbidden.md into a clean pattern list. */
+export function parseForbidden(text) {
+    const patterns = [];
+    for (const line of text.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        // Normalize a leading `/` or `./` to a plain project-relative pattern.
+        const cleaned = trimmed.replace(/^\.?\//, "").replace(/\/+$/, "");
+        if (cleaned)
+            patterns.push(cleaned);
+    }
+    return patterns;
+}
+/** Parse the raw text of a forbidden-commands.md into a clean pattern list. Unlike
+ *  path patterns these are command fragments, so there is NO path normalization —
+ *  a line is kept verbatim (trimmed), minus `#` comments and blanks. */
+export function parseForbiddenCommands(text) {
+    const patterns = [];
+    for (const line of text.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        patterns.push(trimmed);
+    }
+    return patterns;
+}
+/**
+ * If `command` matches a forbidden command pattern, return the pattern (for the
+ * message); otherwise null. Match is case-insensitive on whitespace-collapsed text,
+ * so `tauri dev` blocks `npm run tauri  dev` alike. Deterministic and strict by
+ * design — the model cannot run a forbidden command; only the user can lift it.
+ */
+/**
+ * Parse `forbidden-mcp-tools.md` into tool names. Verbatim like commands, not
+ * path-normalized: an MCP tool name is an identifier, not a path.
+ */
+export function parseForbiddenMcpTools(text) {
+    return parseForbiddenCommands(text);
+}
+/**
+ * Compile one command pattern into a word-boundary matcher (pure).
+ *
+ * A bare substring test is what this used to do, and it over-blocks badly on short
+ * patterns: forbidding `rm` also refused `npm run warm` and `npm run format`, which
+ * reads as the agent being broken rather than as a rule firing.
+ *
+ * Two details make the boundary version actually work:
+ *
+ *  - The pattern is user text and can hold regex metacharacters (`c++`, `a|b`), so it
+ *    is escaped before it becomes a pattern.
+ *  - `\b` is defined between a word character and a non-word one, so a pattern that
+ *    starts or ends with something else (`-rf`, `./deploy`, `--force`) would never
+ *    match with `\b` glued on. The boundary is therefore applied only at an edge that
+ *    is itself a word character; other edges match anywhere, which is correct because
+ *    the neighbouring character is already punctuation.
+ */
+export function commandPatternRegExp(pattern) {
+    const pat = pattern.toLowerCase().replace(/\s+/g, " ").trim();
+    if (!pat)
+        return null;
+    const escaped = pat.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const left = /^\w/.test(pat) ? "\\b" : "";
+    const right = /\w$/.test(pat) ? "\\b" : "";
+    return new RegExp(`${left}${escaped}${right}`);
+}
+export function forbiddenCommandPatternReason(cfg, command) {
+    const commands = cfg?.commands;
+    if (!commands || commands.length === 0)
+        return null;
+    // Whitespace is collapsed on BOTH sides, so `tauri dev` still blocks
+    // `npm run tauri  dev` — the run of spaces in the command becomes one.
+    const norm = command.toLowerCase().replace(/\s+/g, " ");
+    for (const raw of commands) {
+        const re = commandPatternRegExp(raw);
+        if (re && re.test(norm))
+            return raw;
+    }
+    return null;
+}
+function toPosix(p) {
+    return p.split("\\").join("/");
+}
+// Cache compilation per `patterns` array (tiny lists, but checks run per
+// edit/write/command). Keyed on the array identity, which is stable for a session.
+const cache = new WeakMap();
+function compile(patterns) {
+    let compiled = cache.get(patterns);
+    if (!compiled) {
+        compiled = patterns.map((raw) => ({ raw, re: globToRegExp(raw), prefix: literalPrefix(raw) }));
+        cache.set(patterns, compiled);
+    }
+    return compiled;
+}
+/**
+ * If `absPath` is forbidden, return the pattern that matched (for the message);
+ * otherwise null. Paths outside the project root are never matched by relative
+ * patterns. `cfg` may be undefined (no forbidden list) → always allow.
+ */
+export function forbiddenPathReason(cfg, absPath, roots = []) {
+    if (!cfg || cfg.patterns.length === 0)
+        return null;
+    const abs = isAbsolute(absPath) ? absPath : resolve(cfg.root, absPath);
+    // EVERY root in the workspace, not just the one the project started in.
+    //
+    // A pattern is written relative to a project, and a session can hold several once
+    // `/include` has added a folder. Judging only against the primary meant a rule that
+    // blocked `src/legacy` in the project you opened silently did nothing in the folder
+    // you added, which is the shape of failure a deny-list can least afford: the rule is
+    // still listed, still shown by `/forbidden`, and simply not in force.
+    //
+    // Erring towards denying is deliberate and the same call made for case folding. A
+    // pattern that matches something in an included folder the user did not have in mind
+    // costs one refusal they can adjust; the other direction costs the protection itself.
+    for (const base of [cfg.root, ...roots]) {
+        const hit = matchUnderRoot(cfg, abs, base);
+        if (hit)
+            return hit;
+    }
+    return null;
+}
+/** Test one absolute path against the patterns, read relative to `base`. */
+function matchUnderRoot(cfg, abs, base) {
+    const rel = toPosix(relative(base, abs));
+    if (rel === "" || rel.startsWith(".."))
+        return null; // the root itself / outside it
+    for (const { raw, re, prefix } of compile(cfg.patterns)) {
+        if (re.test(rel))
+            return raw;
+        // A bare folder/file prefix matches the path itself and anything under it,
+        // so `src/legacy` forbids `src/legacy` and `src/legacy/x.ts` alike.
+        // Case-folded, matching globToRegExp: on Windows and macOS `src/Legacy` IS
+        // `src/legacy`, and a sensitive compare let the other spelling through.
+        const lower = prefix.toLowerCase();
+        const relLower = rel.toLowerCase();
+        if (prefix && (relLower === lower || relLower.startsWith(lower + "/")))
+            return raw;
+    }
+    return null;
+}
+/**
+ * If `command` references a forbidden path, return the pattern that matched;
+ * otherwise null. Best a static check can do for a shell: if a forbidden
+ * pattern's literal portion appears anywhere in the command string, refuse it
+ * (the chosen strict policy — better a false positive the user can adjust than a
+ * silent shell bypass of a forbidden file).
+ */
+export function forbiddenCommandReason(cfg, command) {
+    if (!cfg || cfg.patterns.length === 0)
+        return null;
+    for (const { raw, prefix } of compile(cfg.patterns)) {
+        // Need a meaningful literal to scan for; a pure-glob pattern like `*.pem`
+        // has prefix "" and can't be located in free-form command text.
+        // Case-folded like the path check. `cat SRC/LEGACY/keys` names the same file on
+        // Windows as `src/legacy/keys`, and a sensitive scan is the shell bypass this
+        // function exists to prevent, spelled slightly differently.
+        if (prefix.length >= 2 && command.toLowerCase().includes(prefix.toLowerCase()))
+            return raw;
+    }
+    return null;
+}
+//# sourceMappingURL=forbidden.js.map

package/dist/governor/forbidden.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forbidden.js","sourceRoot":"","sources":["../../src/governor/forbidden.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGxD,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,uEAAuE;QACvE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;wEAEwE;AACxE,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,OAAO,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,GAAgC,EAChC,OAAe;IAEf,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC;IAC/B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AASD,yEAAyE;AACzE,mFAAmF;AACnF,MAAM,KAAK,GAAG,IAAI,OAAO,EAAwB,CAAC;AAElD,SAAS,OAAO,CAAC,QAAkB;IACjC,IAAI,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/F,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAgC,EAChC,OAAe,EACf,QAA2B,EAAE;IAE7B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEvE,wEAAwE;IACxE,EAAE;IACF,kFAAkF;IAClF,oFAAoF;IACpF,oFAAoF;IACpF,qFAAqF;IACrF,sEAAsE;IACtE,EAAE;IACF,kFAAkF;IAClF,qFAAqF;IACrF,sFAAsF;IACtF,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CAAC,GAAoB,EAAE,GAAW,EAAE,IAAY;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;IAEpF,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAC7B,2EAA2E;QAC3E,oEAAoE;QACpE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,MAAM,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAgC,EAAE,OAAe;IACtF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,0EAA0E;QAC1E,gEAAgE;QAChE,gFAAgF;QAChF,8EAA8E;QAC9E,4DAA4D;QAC5D,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC;IAC7F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/governor/freshness.js

@@ -0,0 +1,83 @@
+/**
+ * freshness.ts — noticing that the user edited their governance by hand.
+ *
+ * Rules, skills and the forbidden lists are files. The model writes them through tools,
+ * but a person editing `rules/use-pnpm.md` in their editor is at least as likely, and
+ * that edit used to do nothing at all until the session was restarted — silently, with
+ * the old rule still being enforced and nothing on screen to say so.
+ *
+ * Freshness is kept two different ways, and both are here because they answer
+ * different failure modes:
+ *
+ *   1. STAT FRESHNESS. A watched config is re-read when
+ *      mtime moves, guarded so their own writes do not cause a re-read and so a
+ *      concurrent write-through is never regressed to a stale snapshot. `stamp()` below
+ *      is the same signal (mtime + size), sampled once per turn rather than by a
+ *      persistent watcher: governance is only ever consulted while building a request,
+ *      so checking it when it is used costs one stat pass and needs no watcher
+ *      lifecycle, no polling thread, and no cleanup on exit.
+ *
+ *   2. LIFECYCLE INVALIDATION. A memoized snapshot has to be dropped at the moments that
+ *      rebuild everything around it: starting a fresh conversation, and after a compaction.
+ *      A compaction rebuilds the prompt from scratch, so it is the natural point to also
+ *      rebuild what the prompt is made of. The engine forces a reload there.
+ *
+ * The stamp deliberately covers presence as well as content: a rule DELETED from disk
+ * has to stop applying, and a stamp built only from surviving files would miss it.
+ */
+import { promises as fs } from "node:fs";
+import { join } from "node:path";
+import { projectDir } from "../memory/store.js";
+/** The files and directories a project's governance is read from. */
+const FORBIDDEN_FILES = ["forbidden.md", "forbidden-commands.md", "forbidden-mcp-tools.md"];
+/** One directory's entries as `name:mtime:size`, sorted so the stamp is order-stable. */
+async function dirStamp(dir, depth) {
+    let names;
+    try {
+        names = (await fs.readdir(dir)).sort();
+    }
+    catch {
+        return `${dir}:-`; // absent is a state too — creating the first rule must register
+    }
+    const parts = [];
+    for (const name of names) {
+        const full = join(dir, name);
+        try {
+            const st = await fs.stat(full);
+            // Skills are a directory each (SKILL.md plus bundled files), so one level of
+            // recursion is what makes editing a skill body count as a change.
+            if (st.isDirectory() && depth > 0)
+                parts.push(`${name}/(${await dirStamp(full, depth - 1)})`);
+            else
+                parts.push(`${name}:${st.mtimeMs}:${st.size}`);
+        }
+        catch {
+            parts.push(`${name}:?`);
+        }
+    }
+    return parts.join(",");
+}
+/**
+ * A cheap fingerprint of everything `loadGovernance` reads.
+ *
+ * Compared as an opaque string: any difference means reload, and the cost of a false
+ * positive is one directory read, so it errs towards reloading.
+ */
+export async function governanceStamp(cwd) {
+    const stateDir = projectDir(cwd);
+    const [rules, skills, ...files] = await Promise.all([
+        dirStamp(join(stateDir, "rules"), 0),
+        dirStamp(join(stateDir, "skills"), 1),
+        ...FORBIDDEN_FILES.map(async (name) => {
+            try {
+                const st = await fs.stat(join(stateDir, name));
+                return `${name}:${st.mtimeMs}:${st.size}`;
+            }
+            catch {
+                return `${name}:-`;
+            }
+        }),
+    ]);
+    return `r[${rules}] s[${skills}] f[${files.join("|")}]`;
+}
+//# sourceMappingURL=freshness.js.map

package/dist/governor/freshness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness.js","sourceRoot":"","sources":["../../src/governor/freshness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,qEAAqE;AACrE,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,uBAAuB,EAAE,wBAAwB,CAAC,CAAC;AAE5F,yFAAyF;AACzF,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,KAAa;IAChD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,GAAG,IAAI,CAAC,CAAC,gEAAgE;IACrF,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,6EAA6E;YAC7E,kEAAkE;YAClE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;;gBACzF,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrC,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACpC,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC/C,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,IAAI,CAAC;YACrB,CAAC;QACH,CAAC,CAAC;KACH,CAAC,CAAC;IACH,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1D,CAAC"}

package/dist/governor/frontmatter.js

@@ -0,0 +1,38 @@
+/**
+ * frontmatter.ts — a tiny YAML-frontmatter reader for governor files.
+ *
+ * Rules and skills are plain markdown with a small `--- … ---` header, the same
+ * shape widely used for agent rules and skills. We
+ * only need flat `key: value` pairs, so this is a deliberately minimal parser —
+ * no YAML dependency, no nesting, no lists. Anything fancier than `key: value`
+ * is ignored rather than erroring, so a hand-edited file never breaks loading.
+ */
+/** Split a markdown file into its frontmatter header and body. */
+export function parseFrontmatter(raw) {
+    // Strip a UTF-8 BOM so a `---` on line 1 is still recognized.
+    const text = raw.replace(/^/, "");
+    const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text);
+    if (!match)
+        return { data: {}, body: text.trim() };
+    const data = {};
+    for (const line of match[1].split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        const colon = trimmed.indexOf(":");
+        if (colon === -1)
+            continue;
+        const key = trimmed.slice(0, colon).trim();
+        let value = trimmed.slice(colon + 1).trim();
+        // Unwrap a single layer of surrounding quotes.
+        if (value.length >= 2 &&
+            ((value.startsWith('"') && value.endsWith('"')) ||
+                (value.startsWith("'") && value.endsWith("'")))) {
+            value = value.slice(1, -1);
+        }
+        if (key)
+            data[key] = value;
+    }
+    return { data, body: text.slice(match[0].length).trim() };
+}
+//# sourceMappingURL=frontmatter.js.map

package/dist/governor/frontmatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.js","sourceRoot":"","sources":["../../src/governor/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,8DAA8D;IAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IAEnD,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,+CAA+C;QAC/C,IACE,KAAK,CAAC,MAAM,IAAI,CAAC;YACjB,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC7C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EACjD,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,GAAG;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC5D,CAAC"}

package/dist/governor/glob.js

@@ -0,0 +1,75 @@
+/**
+ * glob.ts — the one gitignore-ish path matcher the governor shares.
+ *
+ * Both the forbidden deny-list and glob-scoped rules ask the same question: does
+ * this project-relative path match a pattern? `**` spans path segments, `*`/`?`
+ * stay within one, and a bare folder/file prefix (no wildcards) matches the path
+ * itself and everything under it (so `src/api` covers `src/api/x.ts`).
+ */
+/** The non-wildcard prefix of a pattern (used for dir matching + command scan). */
+export function literalPrefix(pattern) {
+    const wildcard = pattern.search(/[*?]/);
+    const prefix = wildcard === -1 ? pattern : pattern.slice(0, wildcard);
+    return prefix.replace(/\/+$/, "");
+}
+/**
+ * Translate a glob to an anchored RegExp (`**` spans segments, `*`/`?` don't).
+ *
+ * CASE-INSENSITIVE, and that is a correctness fix rather than a convenience. Windows
+ * and macOS filesystems are case-insensitive, so `.env` and `.ENV` are one file — but
+ * this matcher backs the forbidden deny-list, and a case-sensitive compare let the
+ * second spelling straight past a rule written with the first. Nothing adversarial was
+ * needed: a model that writes `.ENV` because it saw that spelling somewhere silently
+ * escaped the deny-list and wrote the very file it was forbidden.
+ *
+ * Always, rather than switched on the platform. A deny-list should err towards denying,
+ * and a guard that protects you on one machine and not another is worse than one that
+ * is merely slightly broad: it makes the same rule mean two things. The cost on a
+ * case-sensitive filesystem is that `src/Foo` and `src/foo`, genuinely different files
+ * there, are covered by one pattern. For a deny-list that is the safe direction, and
+ * for glob-scoped rules, which are advisory, it is harmless.
+ */
+export function globToRegExp(glob) {
+    let re = "";
+    for (let i = 0; i < glob.length; i++) {
+        const c = glob[i];
+        if (c === "*") {
+            if (glob[i + 1] === "*") {
+                re += ".*";
+                i++;
+                if (glob[i + 1] === "/")
+                    i++; // collapse `**/` so it can match zero segments
+            }
+            else {
+                re += "[^/]*";
+            }
+        }
+        else if (c === "?") {
+            re += "[^/]";
+        }
+        else if ("\\^$.|+()[]{}".includes(c)) {
+            re += "\\" + c;
+        }
+        else {
+            re += c;
+        }
+    }
+    return new RegExp("^" + re + "$", "i");
+}
+/** Does one project-relative POSIX path match one glob pattern? */
+export function globMatch(relPosixPath, glob) {
+    if (globToRegExp(glob).test(relPosixPath))
+        return true;
+    const prefix = literalPrefix(glob);
+    // Folded to one case for the same reason the regex is: a bare-prefix pattern is the
+    // commonest kind of forbidden entry (`src/legacy`, `secrets`), so a case-sensitive
+    // compare here would leave the widest half of the deny-list bypassable.
+    const path = relPosixPath.toLowerCase();
+    const lower = prefix.toLowerCase();
+    return prefix !== "" && (path === lower || path.startsWith(lower + "/"));
+}
+/** Does any of `relPaths` match any of `globs`? */
+export function anyPathMatches(relPaths, globs) {
+    return globs.some((g) => relPaths.some((p) => globMatch(p, g)));
+}
+//# sourceMappingURL=glob.js.map

package/dist/governor/glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../../src/governor/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,EAAE,IAAI,IAAI,CAAC;gBACX,CAAC,EAAE,CAAC;gBACJ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,EAAE,CAAC,CAAC,+CAA+C;YAC/E,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,SAAS,CAAC,YAAoB,EAAE,IAAY;IAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,oFAAoF;IACpF,mFAAmF;IACnF,wEAAwE;IACxE,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,MAAM,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAAC,QAAkB,EAAE,KAAe;IAChE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/governor/index.js

@@ -0,0 +1,87 @@
+/**
+ * governor — the per-project control layer (rules · skills · forbidden).
+ *
+ * Like an engine's governor regulates how it may run, this regulates how Mindweave
+ * works inside a project: the standing rules it must follow, the skills it can
+ * run, and the paths/actions it must never touch. Everything is scoped to one
+ * project and stored under that project's state dir (`~/.mindweave/projects/<proj>/`),
+ * the same place sessions live — so a rule set in project A never leaks into B.
+ * (Global rules/skills are a planned second layer; the per-project design leaves
+ * a clean seam for merging one on top.)
+ *
+ * `loadGovernance` reads it all once at session start (cheap: a couple of small
+ * directory reads). The forbidden config rides on the tool context for
+ * mechanical enforcement; the rules and skill catalog are rendered into the
+ * system prompt by the engine.
+ */
+import { projectDir } from "../memory/store.js";
+import { promises as fs } from "node:fs";
+import { join } from "node:path";
+import { loadRules } from "./rules.js";
+import { loadSkillCatalog } from "./skills.js";
+import { parseForbidden, parseForbiddenCommands, parseForbiddenMcpTools } from "./forbidden.js";
+/** Read a project state file (forbidden.md / forbidden-commands.md), "" if absent. */
+async function readStateFile(stateDir, name) {
+    try {
+        return await fs.readFile(join(stateDir, name), "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+/** Load all governance for the project rooted at `cwd`. Always succeeds (empties). */
+export async function loadGovernance(cwd) {
+    const stateDir = projectDir(cwd);
+    const [rules, skills, forbiddenText, forbiddenCmdText, forbiddenMcpText] = await Promise.all([
+        loadRules(stateDir),
+        loadSkillCatalog(stateDir),
+        readStateFile(stateDir, "forbidden.md"),
+        readStateFile(stateDir, "forbidden-commands.md"),
+        readStateFile(stateDir, "forbidden-mcp-tools.md"),
+    ]);
+    return {
+        rules,
+        skills,
+        forbidden: {
+            patterns: parseForbidden(forbiddenText),
+            commands: parseForbiddenCommands(forbiddenCmdText),
+            mcpTools: parseForbiddenMcpTools(forbiddenMcpText),
+            root: cwd,
+        },
+    };
+}
+export { renderRules } from "./rules.js";
+export { renderSkillCatalog } from "./skills.js";
+/**
+ * Re-read governance from disk, keeping everything that exists only in this session.
+ *
+ * Three things do NOT come from disk and must survive a reload:
+ *   - `lifted` — patterns the user allowed for this session only (approval.ts). The
+ *     on-disk rule is intentionally left in place, so a plain reload would restore it
+ *     and re-block a path the user had just permitted.
+ *   - `notices` — one-shot lines the UI has not drained yet. Dropping them loses the
+ *     message rather than delaying it.
+ *   - the fired rule-scope, which is not on `Governance` at all: it lives on the tool
+ *     context and is re-judged against the new rule list by the caller.
+ *
+ * Returns a NEW object rather than mutating: the forbidden matcher caches compiled
+ * patterns in a WeakMap keyed on array identity, so fresh arrays are what make it
+ * recompile instead of enforcing the old list.
+ */
+export async function reloadGovernance(cwd, previous) {
+    const fresh = await loadGovernance(cwd);
+    const lifted = previous.lifted ?? [];
+    return {
+        ...fresh,
+        forbidden: {
+            ...fresh.forbidden,
+            patterns: fresh.forbidden.patterns.filter((p) => !lifted.includes(p)),
+            commands: (fresh.forbidden.commands ?? []).filter((c) => !lifted.includes(c)),
+        },
+        ...(lifted.length > 0 ? { lifted } : {}),
+        ...(previous.notices && previous.notices.length > 0 ? { notices: previous.notices } : {}),
+    };
+}
+export { governanceStamp } from "./freshness.js";
+export { createRuleScope, noteScopePath, rescope } from "./scope.js";
+//# sourceMappingURL=index.js.map

package/dist/governor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/governor/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAGhG,sFAAsF;AACtF,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,IAAY;IACzD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3F,SAAS,CAAC,QAAQ,CAAC;QACnB,gBAAgB,CAAC,QAAQ,CAAC;QAC1B,aAAa,CAAC,QAAQ,EAAE,cAAc,CAAC;QACvC,aAAa,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QAChD,aAAa,CAAC,QAAQ,EAAE,wBAAwB,CAAC;KAClD,CAAC,CAAC;IACH,OAAO;QACL,KAAK;QACL,MAAM;QACN,SAAS,EAAE;YACT,QAAQ,EAAE,cAAc,CAAC,aAAa,CAAC;YACvC,QAAQ,EAAE,sBAAsB,CAAC,gBAAgB,CAAC;YAClD,QAAQ,EAAE,sBAAsB,CAAC,gBAAgB,CAAC;YAClD,IAAI,EAAE,GAAG;SACV;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGjD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAAoB;IACtE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,OAAO;QACL,GAAG,KAAK;QACR,SAAS,EAAE;YACT,GAAG,KAAK,CAAC,SAAS;YAClB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACrE,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;SAC9E;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC"}

package/dist/governor/rules.js

@@ -0,0 +1,80 @@
+/**
+ * rules.ts — the user's standing rules for a project.
+ *
+ * A rule is a directive the user has asked Mindweave to always follow here ("use
+ * pnpm, never npm"; "every component gets a test"). Each lives as its own
+ * markdown file under `<project-state>/rules/`, and ALL of them are injected into
+ * the system prompt every turn — this is the always-on layer of project directives.
+ * Per-file (not one big file) so a single rule
+ * can be added or removed cleanly, the same way the memory system works.
+ *
+ * "Make it a rule" is the model writing a new file here; the loader just reads
+ * whatever files exist, so hand-authored rules work identically.
+ */
+import { promises as fs } from "node:fs";
+import { basename, join } from "node:path";
+import { parseFrontmatter } from "./frontmatter.js";
+/** Parse a frontmatter `globs` field (comma/space/newline separated) into a clean list. */
+export function parseGlobs(raw) {
+    if (!raw)
+        return [];
+    return raw
+        .split(/[,\s]+/)
+        .map((g) => g.trim().replace(/^\.?\//, "").replace(/\/+$/, ""))
+        .filter((g) => g.length > 0);
+}
+/** Read every `rules/*.md` for the project, newest-named last (stable order). */
+export async function loadRules(stateDir) {
+    const dir = join(stateDir, "rules");
+    let names;
+    try {
+        names = (await fs.readdir(dir)).filter((n) => n.toLowerCase().endsWith(".md")).sort();
+    }
+    catch {
+        return []; // no rules dir yet
+    }
+    const rules = [];
+    for (const name of names) {
+        try {
+            const raw = await fs.readFile(join(dir, name), "utf8");
+            const { data, body } = parseFrontmatter(raw);
+            if (!body)
+                continue; // an empty rule says nothing — skip it
+            const globs = parseGlobs(data.globs);
+            rules.push({
+                name: data.name || basename(name, ".md"),
+                description: data.description || "",
+                body,
+                ...(globs.length > 0 ? { globs } : {}),
+            });
+        }
+        catch {
+            // Unreadable file — skip it rather than fail all rule loading.
+        }
+    }
+    return rules;
+}
+/**
+ * Pick the rules active for this turn: every always-on rule (no globs) plus any
+ * glob-scoped rule that has already FIRED — see scope.ts, which decides that once, when
+ * a matching path is touched, instead of re-deriving it from the whole working set on
+ * every model call.
+ *
+ * `fired` holds rule NAMES. Filtering by the live rule list rather than by that set is
+ * what makes a rule deleted from disk stop rendering even though its name is remembered.
+ */
+export function activeRules(rules, fired = new Set()) {
+    return rules.filter((r) => !r.globs || r.globs.length === 0 || fired.has(r.name));
+}
+/**
+ * Render the active rules into the block injected in the system prompt. "" when
+ * none apply (the engine then omits the block). Content only — the engine wraps
+ * it in its `<rules>` framing, matching how the task list is done.
+ */
+export function renderRules(rules, fired = new Set()) {
+    const active = activeRules(rules, fired);
+    if (active.length === 0)
+        return "";
+    return active.map((r) => `- ${r.body}`).join("\n");
+}
+//# sourceMappingURL=rules.js.map

package/dist/governor/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/governor/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGpD,2FAA2F;AAC3F,MAAM,UAAU,UAAU,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAgB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,mBAAmB;IAChC,CAAC;IAED,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,SAAS,CAAC,uCAAuC;YAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;gBACxC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;gBACnC,IAAI;gBACJ,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,QAA6B,IAAI,GAAG,EAAE;IAC/E,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,QAA6B,IAAI,GAAG,EAAE;IAC/E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC"}