mustflow 2.114.11 → 2.115.0

package/dist/cli/commands/script-pack.js

@@ -2,7 +2,8 @@ import { printUsageError, renderHelp } from '../lib/cli-output.js';
 import { t } from '../lib/i18n.js';
 import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
 import { resolveMustflowRoot } from '../lib/project-root.js';
-import { findScriptPackScript, listScriptPackScripts, SCRIPT_PACKS, } from '../lib/script-pack-registry.js';
+import { withScriptPackChildProcessGuard } from '../lib/script-pack-execution-guard.js';
+import { findScriptPackScript, listScriptPackScripts, SCRIPT_PACKS, SCRIPT_PACK_SAFETY_CONTRACT, } from '../lib/script-pack-registry.js';
 import { createScriptPackSuggestionReport, isScriptPackSuggestionPhase, } from '../../core/script-pack-suggestions.js';
 const SCRIPT_PACK_LIST_OPTIONS = [{ name: '--json', kind: 'boolean' }];
 const SCRIPT_PACK_SUGGEST_OPTIONS = [
@@ -39,6 +40,7 @@ function createCatalogReport(mustflowRoot, packs) {
                 risk_level: script.riskLevel,
                 cost: script.cost,
                 report_schema_file: script.reportSchemaFile,
+                safety_contract: SCRIPT_PACK_SAFETY_CONTRACT,
             })),
         })),
         issues: [],
@@ -253,8 +255,10 @@ async function runScriptPackScript(args, reporter, lang) {
         printUsageError(reporter, t(lang, 'scriptPack.error.unknownScript', { script: scriptRef }), 'mf script-pack list', getScriptPackHelp(lang), lang);
         return 1;
     }
-    const runner = await script.loadRunner();
-    return runner(scriptArgs, reporter, lang);
+    return withScriptPackChildProcessGuard(async () => {
+        const runner = await script.loadRunner();
+        return runner(scriptArgs, reporter, lang);
+    });
 }
 export async function runScriptPack(args, reporter, lang = 'en') {
     const [action, ...rest] = args;

package/dist/cli/lib/script-pack-execution-guard.js

@@ -0,0 +1,528 @@
+import { createRequire, syncBuiltinESMExports } from 'node:module';
+const require = createRequire(import.meta.url);
+const childProcess = require('node:child_process');
+const fs = require('node:fs');
+const workerThreads = require('node:worker_threads');
+const MAX_RECORDED_DENIALS = 20;
+const READ_ONLY_GIT_SUBCOMMANDS = new Set(['check-ignore', 'config', 'diff', 'ls-files', 'rev-parse', 'show', 'status']);
+const GIT_WRITE_SUBCOMMANDS = new Set([
+    'add',
+    'am',
+    'apply',
+    'bisect',
+    'branch',
+    'checkout',
+    'cherry-pick',
+    'clean',
+    'clone',
+    'commit',
+    'fetch',
+    'gc',
+    'merge',
+    'mv',
+    'pull',
+    'push',
+    'rebase',
+    'remote',
+    'reset',
+    'restore',
+    'revert',
+    'rm',
+    'submodule',
+    'switch',
+    'tag',
+    'worktree',
+]);
+const PACKAGE_MANAGER_COMMANDS = new Set(['bun', 'corepack', 'npm', 'npx', 'pnpm', 'pnpx', 'yarn', 'yarnpkg']);
+const SHELL_COMMANDS = new Set(['bash', 'cmd', 'cmd.exe', 'fish', 'powershell', 'powershell.exe', 'pwsh', 'pwsh.exe', 'sh', 'sh.exe', 'zsh']);
+const PUBLISH_COMMANDS = new Set(['curl', 'gh', 'hub', 'wget']);
+const PACKAGE_MANAGER_DENIED_ARGS = new Set([
+    'add',
+    'audit',
+    'build',
+    'ci',
+    'exec',
+    'install',
+    'i',
+    'lint',
+    'publish',
+    'release',
+    'run',
+    'test',
+    'upgrade',
+    'update',
+]);
+const SHELL_WRAPPER_ARGS = new Set(['-c', '/c', 'eval']);
+const FORBIDDEN_GIT_GLOBAL_OPTIONS = new Set([
+    '-c',
+    '--config-env',
+    '--exec-path',
+    '--git-dir',
+    '--literal-pathspecs',
+    '--namespace',
+    '--work-tree',
+]);
+const FORBIDDEN_GIT_READ_OPTIONS = new Set([
+    '--ext-diff',
+    '--external-diff',
+    '--textconv',
+]);
+const FORBIDDEN_ENV_PREFIXES = ['GIT_', 'NPM_', 'NODE_OPTIONS'];
+const FORBIDDEN_ENV_NAMES = new Set([
+    'BUN_AUTH_TOKEN',
+    'COREPACK_HOME',
+    'GITHUB_TOKEN',
+    'NODE_AUTH_TOKEN',
+    'PNPM_HOME',
+    'YARN_ENABLE_SCRIPTS',
+]);
+const FS_WRITE_FUNCTIONS = [
+    'appendFile',
+    'appendFileSync',
+    'chmod',
+    'chmodSync',
+    'chown',
+    'chownSync',
+    'copyFile',
+    'copyFileSync',
+    'cp',
+    'cpSync',
+    'createWriteStream',
+    'lchmod',
+    'lchmodSync',
+    'lchown',
+    'lchownSync',
+    'link',
+    'linkSync',
+    'mkdir',
+    'mkdirSync',
+    'open',
+    'openSync',
+    'rename',
+    'renameSync',
+    'rm',
+    'rmSync',
+    'symlink',
+    'symlinkSync',
+    'truncate',
+    'truncateSync',
+    'unlink',
+    'unlinkSync',
+    'writeFile',
+    'writeFileSync',
+];
+const FS_PROMISE_WRITE_FUNCTIONS = [
+    'appendFile',
+    'chmod',
+    'chown',
+    'copyFile',
+    'cp',
+    'lchmod',
+    'lchown',
+    'link',
+    'mkdir',
+    'open',
+    'rename',
+    'rm',
+    'symlink',
+    'truncate',
+    'unlink',
+    'writeFile',
+];
+const FS_WRITE_OPEN_FLAGS = /[+wax]/iu;
+const FS_WRITE_OPEN_FLAG_BITS = fs.constants.O_WRONLY |
+    fs.constants.O_RDWR |
+    fs.constants.O_CREAT |
+    fs.constants.O_TRUNC |
+    fs.constants.O_APPEND;
+let activeGuardContext = null;
+export class ScriptPackExecutionDeniedError extends Error {
+    command;
+    args;
+    reason;
+    denial;
+    constructor(command, args, reason, denial = createGuardDenial(command, args, reason)) {
+        super(`script-pack child process denied: ${reason}: ${formatCommand(command, args)}`);
+        this.name = 'ScriptPackExecutionDeniedError';
+        this.command = command;
+        this.args = args;
+        this.reason = reason;
+        this.denial = denial;
+    }
+}
+function basenameCommand(command) {
+    const normalized = command.replace(/\\/gu, '/').split('/').pop() ?? command;
+    return normalized.toLowerCase();
+}
+function normalizeArg(value) {
+    return String(value).trim().toLowerCase();
+}
+function normalizeArgs(args) {
+    return Array.isArray(args) ? args.map((arg) => String(arg)) : [];
+}
+function formatCommand(command, args) {
+    return [command, ...args].join(' ');
+}
+function redactGuardToken(value) {
+    const trimmed = value.trim();
+    if (trimmed.length > 160) {
+        return `${trimmed.slice(0, 80)}...[truncated]`;
+    }
+    if (/^(?:https?:\/\/|ssh:\/\/)/iu.test(trimmed)) {
+        return '[redacted-url]';
+    }
+    if (/(?:token|secret|password|passwd|authorization|credential|sshcommand|proxycommand)/iu.test(trimmed)) {
+        const separatorIndex = trimmed.search(/[=:]/u);
+        if (separatorIndex > 0) {
+            return `${trimmed.slice(0, separatorIndex + 1)}[redacted]`;
+        }
+        return '[redacted-sensitive-arg]';
+    }
+    return trimmed;
+}
+function createGuardDenial(command, args, reason) {
+    return {
+        surface: basenameCommand(command),
+        reason,
+        command: redactGuardToken(command),
+        args: args.map(redactGuardToken),
+    };
+}
+function recordGuardDenial(denial) {
+    if (!activeGuardContext || activeGuardContext.denials.length >= MAX_RECORDED_DENIALS) {
+        return;
+    }
+    activeGuardContext.denials.push(denial);
+}
+function createDeniedError(command, args, reason) {
+    const denial = createGuardDenial(command, args, reason);
+    recordGuardDenial(denial);
+    return new ScriptPackExecutionDeniedError(command, args, reason, denial);
+}
+export function getCurrentScriptPackGuardDenials() {
+    return activeGuardContext?.denials.map((denial) => ({
+        surface: denial.surface,
+        reason: denial.reason,
+        command: denial.command,
+        args: [...denial.args],
+    })) ?? [];
+}
+function isObjectRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function normalizeEnvName(value) {
+    return value.trim().toUpperCase();
+}
+function assertChildProcessOptionsAllowed(command, args, options) {
+    if (!isObjectRecord(options)) {
+        return;
+    }
+    if (options.shell === true || typeof options.shell === 'string') {
+        deny(command, args, 'shell option is not allowed for script-pack child processes');
+    }
+    if (isObjectRecord(options.env)) {
+        for (const key of Object.keys(options.env)) {
+            const normalized = normalizeEnvName(key);
+            if (FORBIDDEN_ENV_NAMES.has(normalized) || FORBIDDEN_ENV_PREFIXES.some((prefix) => normalized.startsWith(prefix))) {
+                deny(command, args, `environment override ${key} is not allowed`);
+            }
+        }
+    }
+}
+function assertNoForbiddenGitReadOptions(command, args) {
+    for (const arg of args) {
+        const normalized = normalizeArg(arg);
+        if (FORBIDDEN_GIT_READ_OPTIONS.has(normalized)) {
+            deny(command, args, 'git external diff or text conversion hooks are not allowed');
+        }
+    }
+}
+function firstNonOptionGitArg(command, args) {
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] ?? '';
+        const normalized = normalizeArg(arg);
+        if (arg === '-C') {
+            index += 1;
+            continue;
+        }
+        if (FORBIDDEN_GIT_GLOBAL_OPTIONS.has(normalized)) {
+            deny(command, args, `git global option ${arg} is not allowed`);
+        }
+        if (arg.startsWith('-')) {
+            deny(command, args, `git global option ${arg} is not allowed before the subcommand`);
+        }
+        if (normalized.length === 0) {
+            continue;
+        }
+        return normalizeArg(arg);
+    }
+    return null;
+}
+function deny(command, args, reason) {
+    throw createDeniedError(command, args, reason);
+}
+function denyCapability(surface, reason) {
+    throw createDeniedError(surface, [], reason);
+}
+function isWriteOpenFlags(value) {
+    if (value === undefined || value === null) {
+        return false;
+    }
+    if (typeof value === 'number') {
+        return (value & FS_WRITE_OPEN_FLAG_BITS) !== 0;
+    }
+    return FS_WRITE_OPEN_FLAGS.test(String(value));
+}
+export function assertScriptPackChildProcessAllowed(command, args) {
+    const executable = basenameCommand(command);
+    const normalizedArgs = args.map(normalizeArg);
+    if (SHELL_COMMANDS.has(executable)) {
+        if (normalizedArgs.some((arg) => SHELL_WRAPPER_ARGS.has(arg))) {
+            deny(command, args, 'shell wrapper execution is not allowed');
+        }
+        deny(command, args, 'shell execution is not allowed');
+    }
+    if (PACKAGE_MANAGER_COMMANDS.has(executable)) {
+        if (normalizedArgs.some((arg) => PACKAGE_MANAGER_DENIED_ARGS.has(arg))) {
+            deny(command, args, 'package manager, build, lint, or test execution is not allowed');
+        }
+        deny(command, args, 'package manager execution is not allowed');
+    }
+    if (PUBLISH_COMMANDS.has(executable)) {
+        deny(command, args, 'network publishing or remote automation commands are not allowed');
+    }
+    if (executable !== 'git' && executable !== 'git.exe') {
+        deny(command, args, 'only bounded read-only git probes are allowed');
+    }
+    const subcommand = firstNonOptionGitArg(command, args);
+    if (!subcommand) {
+        deny(command, args, 'git subcommand is missing');
+    }
+    if (GIT_WRITE_SUBCOMMANDS.has(subcommand)) {
+        deny(command, args, 'git write, network, or ref mutation is not allowed');
+    }
+    if (!READ_ONLY_GIT_SUBCOMMANDS.has(subcommand)) {
+        deny(command, args, 'git subcommand is not in the read-only allowlist');
+    }
+    assertNoForbiddenGitReadOptions(command, args);
+    if (subcommand === 'config') {
+        const nonOptionArgs = normalizedArgs.filter((arg) => !arg.startsWith('-'));
+        const allowed = normalizedArgs.includes('--get') &&
+            nonOptionArgs.length === 2 &&
+            nonOptionArgs[0] === 'config' &&
+            nonOptionArgs[1] === 'core.excludesfile' &&
+            !normalizedArgs.some((arg) => arg === '--global' || arg === '--system' || arg === '--local');
+        if (!allowed) {
+            deny(command, args, 'git config is limited to repository-neutral read-only --get core.excludesFile probes');
+        }
+    }
+}
+function deniedSpawnSyncResult(error) {
+    return {
+        pid: 0,
+        output: [null, '', `${error.message}\n`],
+        stdout: '',
+        stderr: `${error.message}\n`,
+        status: 1,
+        signal: null,
+        error,
+    };
+}
+function createGuardedFunctions(original) {
+    return {
+        exec(command, optionsOrCallback, maybeCallback) {
+            const commandText = String(command);
+            assertChildProcessOptionsAllowed(commandText, [], typeof optionsOrCallback === 'function' ? undefined : optionsOrCallback);
+            deny(commandText, [], 'shell string execution is not allowed');
+            return original.exec(command, optionsOrCallback, maybeCallback);
+        },
+        execFile(file, argsOrOptionsOrCallback, optionsOrCallback, maybeCallback) {
+            const args = normalizeArgs(argsOrOptionsOrCallback);
+            const options = Array.isArray(argsOrOptionsOrCallback) ? optionsOrCallback : argsOrOptionsOrCallback;
+            assertChildProcessOptionsAllowed(String(file), args, typeof options === 'function' ? undefined : options);
+            assertScriptPackChildProcessAllowed(String(file), args);
+            return original.execFile(file, argsOrOptionsOrCallback, optionsOrCallback, maybeCallback);
+        },
+        execFileSync(file, argsOrOptions, options) {
+            const args = normalizeArgs(argsOrOptions);
+            const childOptions = Array.isArray(argsOrOptions) ? options : argsOrOptions;
+            assertChildProcessOptionsAllowed(String(file), args, childOptions);
+            assertScriptPackChildProcessAllowed(String(file), args);
+            return original.execFileSync(file, argsOrOptions, options);
+        },
+        execSync(command, options) {
+            const commandText = String(command);
+            assertChildProcessOptionsAllowed(commandText, [], options);
+            deny(commandText, [], 'shell string execution is not allowed');
+            return original.execSync(command, options);
+        },
+        spawn(command, argsOrOptions, options) {
+            const args = normalizeArgs(argsOrOptions);
+            const childOptions = Array.isArray(argsOrOptions) ? options : argsOrOptions;
+            assertChildProcessOptionsAllowed(String(command), args, childOptions);
+            assertScriptPackChildProcessAllowed(String(command), args);
+            return original.spawn(command, argsOrOptions, options);
+        },
+        spawnSync(command, argsOrOptions, options) {
+            const args = normalizeArgs(argsOrOptions);
+            const childOptions = Array.isArray(argsOrOptions) ? options : argsOrOptions;
+            try {
+                assertChildProcessOptionsAllowed(String(command), args, childOptions);
+                assertScriptPackChildProcessAllowed(String(command), args);
+            }
+            catch (error) {
+                if (error instanceof ScriptPackExecutionDeniedError) {
+                    return deniedSpawnSyncResult(error);
+                }
+                throw error;
+            }
+            return original.spawnSync(command, argsOrOptions, options);
+        },
+    };
+}
+function patchFunction(target, key, replacement) {
+    const descriptor = Object.getOwnPropertyDescriptor(target, key);
+    const original = target[key];
+    Object.defineProperty(target, key, {
+        configurable: true,
+        enumerable: descriptor?.enumerable ?? true,
+        writable: true,
+        value: replacement,
+    });
+    return {
+        restore: () => {
+            if (descriptor) {
+                Object.defineProperty(target, key, descriptor);
+                return;
+            }
+            if (original === undefined) {
+                delete target[key];
+                return;
+            }
+            target[key] = original;
+        },
+    };
+}
+function createDeniedCapabilityFunction(surface, reason) {
+    return () => denyCapability(surface, reason);
+}
+function createDeniedAsyncCapabilityFunction(surface, reason) {
+    return () => Promise.reject(createDeniedError(surface, [], reason));
+}
+function createDeniedOpenFunction(surface, original) {
+    return (...args) => {
+        const flags = args[1];
+        if (isWriteOpenFlags(flags)) {
+            denyCapability(surface, 'filesystem write handles are not allowed during script-pack runs');
+        }
+        return original(...args);
+    };
+}
+function patchFilesystemGuards() {
+    const patches = [];
+    const fsRecord = fs;
+    for (const key of FS_WRITE_FUNCTIONS) {
+        const original = fsRecord[key];
+        if (typeof original !== 'function') {
+            continue;
+        }
+        patches.push(patchFunction(fsRecord, key, key === 'open' || key === 'openSync'
+            ? createDeniedOpenFunction(`fs.${key}`, original)
+            : createDeniedCapabilityFunction(`fs.${key}`, 'filesystem writes are not allowed during script-pack runs')));
+    }
+    const promisesRecord = fs.promises;
+    for (const key of FS_PROMISE_WRITE_FUNCTIONS) {
+        const original = promisesRecord[key];
+        if (typeof original !== 'function') {
+            continue;
+        }
+        patches.push(patchFunction(promisesRecord, key, key === 'open'
+            ? createDeniedOpenFunction(`fs.promises.${key}`, original)
+            : createDeniedAsyncCapabilityFunction(`fs.promises.${key}`, 'filesystem writes are not allowed during script-pack runs')));
+    }
+    return patches;
+}
+function patchNetworkGuards() {
+    const globalRecord = globalThis;
+    const patches = [];
+    if (typeof globalRecord.fetch === 'function') {
+        patches.push(patchFunction(globalRecord, 'fetch', createDeniedAsyncCapabilityFunction('fetch', 'network access is not allowed during script-pack runs')));
+    }
+    return patches;
+}
+function patchWorkerGuards() {
+    const workerRecord = workerThreads;
+    if (typeof workerRecord.Worker !== 'function') {
+        return [];
+    }
+    function deniedWorkerConstructor() {
+        return denyCapability('worker_threads.Worker', 'worker threads are not allowed during script-pack runs');
+    }
+    return [
+        patchFunction(workerRecord, 'Worker', deniedWorkerConstructor),
+    ];
+}
+function patchBunGuards() {
+    const globalRecord = globalThis;
+    const bunRecord = isObjectRecord(globalRecord.Bun) ? globalRecord.Bun : null;
+    if (!bunRecord) {
+        return [];
+    }
+    const patches = [];
+    for (const key of ['spawn', 'spawnSync', 'write', '$']) {
+        if (typeof bunRecord[key] === 'function') {
+            const reason = key === 'write'
+                ? 'Bun filesystem writes are not allowed during script-pack runs'
+                : 'Bun process or shell execution is not allowed during script-pack runs';
+            patches.push(patchFunction(bunRecord, key, createDeniedCapabilityFunction(`Bun.${key}`, reason)));
+        }
+    }
+    return patches;
+}
+function patchProcessStateGuards() {
+    const processRecord = process;
+    const patches = [];
+    for (const [key, reason] of [
+        ['chdir', 'process working-directory changes are not allowed during script-pack runs'],
+        ['umask', 'process umask changes are not allowed during script-pack runs'],
+    ]) {
+        if (typeof processRecord[key] === 'function') {
+            patches.push(patchFunction(processRecord, key, createDeniedCapabilityFunction(`process.${key}`, reason)));
+        }
+    }
+    return patches;
+}
+export async function withScriptPackChildProcessGuard(callback) {
+    const original = {
+        exec: childProcess.exec,
+        execFile: childProcess.execFile,
+        execFileSync: childProcess.execFileSync,
+        execSync: childProcess.execSync,
+        spawn: childProcess.spawn,
+        spawnSync: childProcess.spawnSync,
+    };
+    const guarded = createGuardedFunctions(original);
+    const patches = [
+        ...patchFilesystemGuards(),
+        ...patchNetworkGuards(),
+        ...patchWorkerGuards(),
+        ...patchBunGuards(),
+        ...patchProcessStateGuards(),
+    ];
+    const parentGuardContext = activeGuardContext;
+    const guardContext = { denials: [] };
+    Object.assign(childProcess, guarded);
+    syncBuiltinESMExports();
+    activeGuardContext = guardContext;
+    try {
+        return await callback();
+    }
+    finally {
+        activeGuardContext = parentGuardContext;
+        for (const patch of [...patches].reverse()) {
+            patch.restore();
+        }
+        Object.assign(childProcess, original);
+        syncBuiltinESMExports();
+    }
+}

package/dist/cli/lib/script-pack-registry.js

@@ -1,6 +1,16 @@
 function scriptRef(packId, scriptId) {
     return `${packId}/${scriptId}`;
 }
+export const SCRIPT_PACK_SAFETY_CONTRACT = {
+    authority_class: 'advisory_evidence',
+    execution_mode: 'suggestion_only',
+    command_authority: 'requires_configured_intent',
+    run_hint_authority: 'not_authority',
+    input_scope: 'explicit_or_changed_paths',
+    output_scope: 'bounded_report',
+    cannot_satisfy_intents: ['build', 'lint', 'test', 'typecheck', 'docs_validate', 'release'],
+    forbidden_actions: ['raw_shell', 'git_write', 'package_install', 'network_publish', 'secret_read'],
+};
 export const SCRIPT_PACKS = [
     {
         id: 'code',

package/dist/cli/script-packs/repo-skill-route-audit.js

@@ -50,6 +50,10 @@ function renderSkillRouteAuditSummary(report, lang) {
         `${t(lang, 'skillRouteAudit.label.indexRoutes')}: ${report.counts.index_routes}`,
         `${t(lang, 'skillRouteAudit.label.templateSkills')}: ${report.counts.template_skills}`,
         `${t(lang, 'skillRouteAudit.label.findings')}: ${report.findings.length}`,
+        `local_registry: ${report.resolution.local_registry.status}`,
+        `packaged_template_registry: ${report.resolution.packaged_template_registry.status}`,
+        `shared_workspace_registry: ${report.resolution.shared_workspace_registry.status}`,
+        `active_install_profile: ${report.resolution.active_install_profile.status}${report.resolution.active_install_profile.profile ? ` (${report.resolution.active_install_profile.profile})` : ''}`,
     ];
     if (report.findings.length > 0) {
         lines.push(t(lang, 'skillRouteAudit.label.findings'));

package/dist/core/script-pack-suggestions.js

@@ -12,6 +12,16 @@ const CODE_NAVIGATION_SCRIPT_REFS = new Set([
 ]);
 const CONFIG_CHAIN_SURFACES = new Set(['config', 'package', 'source', 'test']);
 const CONFIG_FILE_PATTERN = /(?:^|\/)(?:\.gitignore|\.env\.(?:example|sample|template|defaults)|\.dev\.vars\.example|\.nvmrc|\.node-version|\.python-version|\.tool-versions|mise\.toml|\.mise\.toml|pyproject\.toml|go\.mod|rust-toolchain(?:\.toml)?|Makefile|Taskfile\.ya?ml|justfile|Justfile|tsconfig(?:\..*)?\.json|eslint\.config\.[cm]?[jt]s|\.eslintrc(?:\.json)?|\.prettierrc(?:\.json)?|prettier\.config\.[cm]?[jt]s|vite\.config\.[cm]?[jt]s|vitest\.config\.[cm]?[jt]s|tailwind\.config\.[cm]?[jt]s|jest\.config\.[cm]?[jt]s|playwright\.config\.[cm]?[jt]s|astro\.config\.mjs|svelte\.config\.js|wrangler\.(?:toml|jsonc?)|vercel\.json|netlify\.toml|Dockerfile|docker-compose\.ya?ml|compose\.ya?ml)$/u;
+export const SCRIPT_PACK_SUGGESTION_SAFETY_CONTRACT = {
+    authority_class: 'advisory_evidence',
+    execution_mode: 'suggestion_only',
+    command_authority: 'requires_configured_intent',
+    run_hint_authority: 'not_authority',
+    input_scope: 'explicit_or_changed_paths',
+    output_scope: 'bounded_report',
+    cannot_satisfy_intents: ['build', 'lint', 'test', 'typecheck', 'docs_validate', 'release'],
+    forbidden_actions: ['raw_shell', 'git_write', 'package_install', 'network_publish', 'secret_read'],
+};
 export function isScriptPackSuggestionPhase(value) {
     return ['before_change', 'during_change', 'after_change', 'review'].includes(value);
 }
@@ -450,6 +460,7 @@ export function createScriptPackSuggestionReport(mustflowRoot, options) {
             risk_level: script.riskLevel,
             cost: script.cost,
             report_schema_file: script.reportSchemaFile,
+            safety_contract: SCRIPT_PACK_SUGGESTION_SAFETY_CONTRACT,
             run_hint: createRunHint(script, analyzedPaths),
         };
     })