nawabari 0.9.2 → 0.10.2

package/dist/cli-command-registry.js

@@ -1,7 +1,13 @@
 import { DEFAULT_SESSION_LIST_LIMIT, MAX_SESSION_LIST_LIMIT } from "./domain/session.js";
-import { OPERATION_VOCABULARY } from "./operation-authorization.js";
+import { claimModeOperationRequirements, OPERATION_VOCABULARY } from "./operation-authorization.js";
 import { EVIDENCE_MAX_DIFF_BYTES, EVIDENCE_MAX_DIFF_HUNKS } from "./repository-evidence.js";
 const CLI_NAME = "nawabari";
+function claimModeRequirementsNote() {
+    const mapping = claimModeOperationRequirements()
+        .map(({ mode, operations }) => `${mode}: ${operations.length === 0 ? "none" : operations.join(", ")}`)
+        .join("; ");
+    return `Claim modes are cumulative. Canonical operation requirements by granted mode: ${mapping}. This is derived from OPERATION_AUTHORIZATION_POLICY.`;
+}
 export const GLOBAL_HELP_OPTIONS = [
     { name: "--json", description: "Emit one stable JSON document on stdout" },
     { name: "--help", aliases: ["-h"], description: "Show command-specific help" },
@@ -25,17 +31,18 @@ export const CLI_COMMAND_REGISTRY = [
                 value: "<name>",
                 default: "nawabari/session/<session_id>",
             }),
-            option("--worktree", "Exact managed worktree path override; mutually exclusive with --worktree-root", {
+            option("--worktree", "Exact managed worktree path override; new paths must be under the managed root; historical absolute sibling paths remain compatible; mutually exclusive with --worktree-root", {
                 value: "<path>",
                 default: "<managed_worktree_root>/<repository>-<session_id>",
             }),
-            option("--worktree-root", "Managed root to place the worktree under; Nawabari derives the final path. Mutually exclusive with --worktree", { value: "<path>", default: "resolved repository-local root" }),
+            option("--worktree-root", "Managed root to place the worktree under; Nawabari derives the final path. Mutually exclusive with --worktree", { value: "<path>", default: "<repository-parent>/.nawabari/worktrees" }),
             option("--base", "Commit-resolving base ref for the new worktree", { value: "<ref>", default: "HEAD" }),
             option("--label", "Optional display label; never used as an identity", { value: "<text>", default: "omitted" }),
         ],
         notes: [
             "All create options are optional. Use status --json to discover managed_worktree_root.",
             "--worktree and --worktree-root cannot be combined.",
+            "Without an override, Nawabari creates the safe managed root <repository-parent>/.nawabari/worktrees on first use. Existing absolute worktree paths directly under the repository parent remain accepted for compatibility.",
         ],
     },
     {
@@ -72,13 +79,37 @@ export const CLI_COMMAND_REGISTRY = [
         name: "session run",
         aliases: ["session exec"],
         summary: "Run one command inside the protected session sandbox",
-        usage: `${CLI_NAME} session run [--session <id>] -- <command> [args...]`,
-        options: [option("--session", "Select the active owned session", { value: "<id>" })],
+        usage: `${CLI_NAME} session run [--session <id>] [--runtime-policy <strict|compatibility>] -- <command> [args...]`,
+        options: [
+            option("--session", "Select the active owned session", { value: "<id>" }),
+            option("--runtime-policy", "Select strict default-deny or explicit compatibility runtime visibility", {
+                value: "<strict|compatibility>",
+                default: "strict",
+                values: ["strict", "compatibility"],
+            }),
+        ],
         notes: [
             "The -- terminator is mandatory. The command is passed as argv without a shell, and protected execution is fail-closed.",
             "session exec is an alias.",
         ],
     },
+    {
+        name: "session shell",
+        summary: "Run an explicitly projected shell inside the protected session sandbox",
+        usage: `${CLI_NAME} session shell [--session <id>] [--runtime-policy <strict|compatibility>] -- <projected-shell> [args...]`,
+        options: [
+            option("--session", "Select the active owned session", { value: "<id>" }),
+            option("--runtime-policy", "Select strict default-deny or explicit compatibility runtime visibility", {
+                value: "<strict|compatibility>",
+                default: "strict",
+                values: ["strict", "compatibility"],
+            }),
+        ],
+        notes: [
+            "The -- terminator is mandatory. The projected shell is resolved only through /nawabari/bin and receives inherited stdio.",
+            "Nawabari does not parse shell syntax or select a host/default shell.",
+        ],
+    },
     {
         name: "session list",
         summary: "List bounded repository session records",
@@ -116,6 +147,7 @@ export const CLI_COMMAND_REGISTRY = [
         notes: [
             "Exactly one --resource/--mode pair is required; --mode must immediately follow its own --resource.",
             "Target grammar: optional first positional <session-id> is an alias for --session <id>; do not supply both.",
+            claimModeRequirementsNote(),
         ],
     },
     {
@@ -297,6 +329,10 @@ export const CLI_COMMAND_REGISTRY = [
                 repeatable: true,
             }),
         ],
+        notes: [
+            "Read-only claim decision: checks the canonical operation policy and concrete resource claims; it does not grant, persist, or mutate claims.",
+            "Use guard to verify current worktree/session ownership without an operation; use authorize for the canonical claim-aware operation decision. guard --operation is a compatibility convenience for the combined check.",
+        ],
     },
     {
         name: "checkpoint",
@@ -418,7 +454,7 @@ export const CLI_COMMAND_REGISTRY = [
     },
     {
         name: "guard",
-        summary: "Authorize the current worktree or operation",
+        summary: "Verify current worktree/session ownership",
         usage: `${CLI_NAME} guard [--session <id>] [--operation <name> --resource <path>]`,
         options: [
             option("--session", "Assert the current session identity", { value: "<id>" }),
@@ -428,6 +464,10 @@ export const CLI_COMMAND_REGISTRY = [
             }),
             option("--resource", "Concrete resource; repeatable with --operation", { value: "<path>" }),
         ],
+        notes: [
+            "Without --operation, verifies the current worktree, branch, and session ownership/context only; it does not evaluate resource claims.",
+            "With --operation and --resource, performs the combined claim-aware authorization check for compatibility. Use authorize when the operation decision is the intended boundary.",
+        ],
     },
     {
         name: "gc",

package/dist/cli-command-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-command-registry.js","sourceRoot":"","sources":["../src/cli-command-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,MAAM,QAAQ,GAAG,UAAU,CAAC;AA8B5B,MAAM,CAAC,MAAM,mBAAmB,GAAiC;IAC/D,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE;IAC1E,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,4BAA4B,EAAE;IAC9E,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,6BAA6B,EAAE;CAClE,CAAC;AAEF,MAAM,MAAM,GAAG,CACb,IAAY,EACZ,WAAmB,EACnB,UAaI,EAAE,EACa,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAoC;IACnE;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,GAAG,QAAQ,2BAA2B;QAC7C,OAAO,EAAE;YACP,MAAM,CAAC,UAAU,EAAE,6DAA6D,EAAE;gBAChF,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,+BAA+B;aACzC,CAAC;YACF,MAAM,CAAC,YAAY,EAAE,+EAA+E,EAAE;gBACpG,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,mDAAmD;aAC7D,CAAC;YACF,MAAM,CACJ,iBAAiB,EACjB,+GAA+G,EAC/G,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAC/D;YACD,MAAM,CAAC,QAAQ,EAAE,gDAAgD,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACvG,MAAM,CAAC,SAAS,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;SAChH;QACD,KAAK,EAAE;YACL,uFAAuF;YACvF,oDAAoD;SACrD;KACF;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,sCAAsC;QAC/C,KAAK,EAAE,GAAG,QAAQ,aAAa;QAC/B,OAAO,EAAE,EAAE;KACZ;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,sCAAsC;QAC/C,KAAK,EAAE,GAAG,QAAQ,6CAA6C;QAC/D,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,wDAAwD,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3G,KAAK,EAAE;YACL,6HAA6H;SAC9H;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,+DAA+D;QACxE,KAAK,EAAE,GAAG,QAAQ,8EAA8E;QAChG,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,wDAAwD,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAChG,MAAM,CACJ,uBAAuB,EACvB,4KAA4K,EAC5K,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB;SACF;QACD,KAAK,EAAE;YACL,mHAAmH;YACnH,iIAAiI;YACjI,+IAA+I;YAC/I,4GAA4G;SAC7G;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,CAAC,cAAc,CAAC;QACzB,OAAO,EAAE,sDAAsD;QAC/D,KAAK,EAAE,GAAG,QAAQ,sDAAsD;QACxE,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,KAAK,EAAE;YACL,wHAAwH;YACxH,2BAA2B;SAC5B;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,yCAAyC;QAClD,KAAK,EAAE,GAAG,QAAQ,8DAA8D;QAChF,OAAO,EAAE;YACP,MAAM,CAAC,OAAO,EAAE,8CAA8C,CAAC;YAC/D,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAC7D,MAAM,CAAC,SAAS,EAAE,mDAAmD,sBAAsB,EAAE,EAAE;gBAC7F,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,MAAM,CAAC,0BAA0B,CAAC;gBAC3C,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,sBAAsB;aAChC,CAAC;YACF,MAAM,CAAC,UAAU,EAAE,mEAAmE,EAAE;gBACtF,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,CAAC;aACX,CAAC;SACH;QACD,KAAK,EAAE;YACL,kIAAkI,0BAA0B,aAAa,sBAAsB,6BAA6B;SAC7N;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,GAAG,QAAQ,gIAAgI;QAClJ,OAAO,EAAE;YACP,MAAM,CAAC,YAAY,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACjG,MAAM,CAAC,QAAQ,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACjG,MAAM,CAAC,WAAW,EAAE,2DAA2D,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACnG,MAAM,CAAC,cAAc,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC1E;QACD,KAAK,EAAE;YACL,oGAAoG;YACpG,4GAA4G;SAC7G;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,CAAC,iBAAiB,CAAC;QAC5B,OAAO,EAAE,4DAA4D;QACrE,KAAK,EAAE,GAAG,QAAQ,qMAAqM;QACvN,OAAO,EAAE;YACP,MAAM,CACJ,YAAY,EACZ,4FAA4F,EAC5F;gBACE,KAAK,EAAE,gBAAgB;gBACvB,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;aACjB,CACF;YACD,MAAM,CAAC,QAAQ,EAAE,2DAA2D,EAAE;gBAC5E,KAAK,EAAE,8BAA8B;gBACrC,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,CAAC,iBAAiB,EAAE,wEAAwE,EAAE;gBAClG,KAAK,EAAE,wBAAwB;aAChC,CAAC;YACF,MAAM,CACJ,SAAS,EACT,+FAA+F,CAChG;YACD,MAAM,CAAC,WAAW,EAAE,2DAA2D,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACnG,MAAM,CAAC,cAAc,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC1E;QACD,KAAK,EAAE;YACL,sGAAsG;gBACpG,2GAA2G;gBAC3G,iIAAiI;YACnI,kHAAkH;YAClH,4GAA4G;SAC7G;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,CAAC,iBAAiB,CAAC;QAC5B,OAAO,EAAE,wEAAwE;QACjF,KAAK,EACH,GAAG,QAAQ,iEAAiE;YAC5E,8GAA8G;YAC9G,qDAAqD;QACvD,OAAO,EAAE;YACP,MAAM,CACJ,mBAAmB,EACnB,6GAA6G,EAC7G,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE,CAC9C;YACD,MAAM,CAAC,QAAQ,EAAE,sDAAsD,EAAE;gBACvE,KAAK,EAAE,8BAA8B;gBACrC,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,CAAC,oBAAoB,EAAE,2DAA2D,EAAE;gBACxF,KAAK,EAAE,gBAAgB;gBACvB,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,CAAC,iBAAiB,EAAE,wEAAwE,EAAE;gBAClG,KAAK,EAAE,yBAAyB;aACjC,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,0FAA0F,CAAC;YAC7G,MAAM,CAAC,WAAW,EAAE,2DAA2D,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACnG,MAAM,CAAC,cAAc,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC1E;QACD,KAAK,EAAE;YACL,yHAAyH;YACzH,qHAAqH;YACrH,yGAAyG;SAC1G;KACF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,qBAAqB,CAAC;QAChC,OAAO,EAAE,qDAAqD;QAC9D,KAAK,EACH,GAAG,QAAQ,qEAAqE;YAChF,gEAAgE;YAChE,qDAAqD;QACvD,OAAO,EAAE;YACP,MAAM,CAAC,YAAY,EAAE,yDAAyD,EAAE;gBAC9E,KAAK,EAAE,gBAAgB;gBACvB,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,MAAM,CAAC,QAAQ,EAAE,sDAAsD,EAAE;gBACvE,KAAK,EAAE,8BAA8B;gBACrC,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,MAAM,CAAC,iBAAiB,EAAE,wEAAwE,EAAE;gBAClG,KAAK,EAAE,yBAAyB;aACjC,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,0FAA0F,CAAC;YAC7G,MAAM,CAAC,WAAW,EAAE,2DAA2D,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACnG,MAAM,CAAC,cAAc,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC1E;QACD,KAAK,EAAE;YACL,2GAA2G;YAC3G,kGAAkG;YAClG,oGAAoG;SACrG;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC7C,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,GAAG,QAAQ,+CAA+C;QACjE,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,4CAA4C,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/F,KAAK,EAAE;YACL,4GAA4G;SAC7G;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,OAAO,EAAE,yBAAyB;QAClC,KAAK,EAAE,GAAG,QAAQ,8IAA8I;QAChK,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,oDAAoD,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC5F,MAAM,CAAC,YAAY,EAAE,kDAAkD,EAAE;gBACvE,KAAK,EAAE,gBAAgB;gBACvB,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,CAAC,YAAY,EAAE,wCAAwC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YACnG,MAAM,CAAC,OAAO,EAAE,2DAA2D,CAAC;YAC5E,MAAM,CAAC,iBAAiB,EAAE,4EAA4E,EAAE;gBACtG,KAAK,EAAE,yBAAyB;aACjC,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,iFAAiF,CAAC;SACrG;QACD,KAAK,EAAE;YACL,4GAA4G;YAC5G,uGAAuG;YACvG,6GAA6G;SAC9G;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,uCAAuC;QAChD,KAAK,EAAE,GAAG,QAAQ,4HAA4H;QAC9I,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,wDAAwD,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAChG,MAAM,CACJ,uBAAuB,EACvB,wKAAwK,EACxK,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB;YACD,MAAM,CAAC,gBAAgB,EAAE,4EAA4E,EAAE;gBACrG,KAAK,EAAE,QAAQ;aAChB,CAAC;YACF,MAAM,CAAC,gBAAgB,EAAE,sDAAsD,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;SACxG;QACD,KAAK,EAAE;YACL,qFAAqF;YACrF,wIAAwI;YACxI,+JAA+J;YAC/J,8IAA8I;YAC9I,4GAA4G;SAC7G;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,iEAAiE;QAC1E,KAAK,EAAE,GAAG,QAAQ,0DAA0D;QAC5E,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,iEAAiE,EAAE;gBACrF,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,MAAM,CAAC,WAAW,EAAE,4DAA4D,CAAC;SAClF;QACD,KAAK,EAAE;YACL,sHAAsH;YACtH,iGAAiG;YACjG,6FAA6F;YAC7F,yDAAyD;SAC1D;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,gDAAgD;QACzD,KAAK,EAAE,GAAG,QAAQ,sFAAsF;QACxG,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7E,MAAM,CAAC,aAAa,EAAE,4BAA4B,EAAE;gBAClD,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,oBAAoB;aAC7B,CAAC;YACF,MAAM,CAAC,YAAY,EAAE,+CAA+C,EAAE;gBACpE,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;aACjB,CAAC;SACH;KACF;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,wCAAwC;QACjD,KAAK,EAAE,GAAG,QAAQ,8BAA8B;QAChD,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;KACzF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,0DAA0D;QACnE,KAAK,EAAE,GAAG,QAAQ,mCAAmC;QACrD,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,mCAAmC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,KAAK,EAAE,CAAC,sGAAsG,CAAC;KAChH;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,iDAAiD;QAC1D,KAAK,EAAE,GAAG,QAAQ,8CAA8C;QAChE,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,mCAAmC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC3F,MAAM,CAAC,QAAQ,EAAE,+CAA+C,EAAE;gBAChE,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,CAAC,QAAQ,EAAE,sCAAsC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC7F,MAAM,CAAC,MAAM,EAAE,4DAA4D,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAChG,MAAM,CAAC,SAAS,EAAE,2DAA2D,CAAC;YAC9E,MAAM,CAAC,aAAa,EAAE,2BAA2B,EAAE;gBACjD,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,MAAM,CAAC,uBAAuB,CAAC;gBACxC,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,uBAAuB;aACjC,CAAC;YACF,MAAM,CAAC,aAAa,EAAE,qBAAqB,EAAE;gBAC3C,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,MAAM,CAAC,uBAAuB,CAAC;gBACxC,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,uBAAuB;aACjC,CAAC;SACH;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,4CAA4C;QACrD,KAAK,EAAE,GAAG,QAAQ,wIAAwI;QAC1J,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7E,MAAM,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACxG,MAAM,CAAC,YAAY,EAAE,yCAAyC,EAAE;gBAC9D,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;gBAChB,eAAe,EAAE,CAAC,eAAe,CAAC;aACnC,CAAC;YACF,MAAM,CAAC,eAAe,EAAE,kFAAkF,EAAE;gBAC1G,uBAAuB,EAAE,CAAC,YAAY,CAAC;aACxC,CAAC;YACF,MAAM,CAAC,mBAAmB,EAAE,mEAAmE,EAAE;gBAC/F,KAAK,EAAE,SAAS;aACjB,CAAC;SACH;QACD,KAAK,EAAE;YACL,wGAAwG;YACxG,4GAA4G;SAC7G;KACF;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,6CAA6C;QACtD,KAAK,EAAE,GAAG,QAAQ,yGAAyG;QAC3H,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7E,MAAM,CAAC,YAAY,EAAE,yCAAyC,EAAE;gBAC9D,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;gBAChB,eAAe,EAAE,CAAC,eAAe,CAAC;aACnC,CAAC;YACF,MAAM,CAAC,eAAe,EAAE,gFAAgF,EAAE;gBACxG,uBAAuB,EAAE,CAAC,YAAY,CAAC;aACxC,CAAC;YACF,MAAM,CAAC,UAAU,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC9E,MAAM,CAAC,UAAU,EAAE,wBAAwB,EAAE;gBAC3C,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,CAAC,iBAAiB,CAAC;aAC7B,CAAC;YACF,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,EAAE;gBACrE,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,UAAU;aACrB,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,kDAAkD,CAAC;YACrE,MAAM,CAAC,mBAAmB,EAAE,sCAAsC,CAAC;SACpE;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,oDAAoD;QAC7D,KAAK,EAAE,GAAG,QAAQ,wDAAwD;QAC1E,OAAO,EAAE;YACP,MAAM,CAAC,OAAO,EAAE,8CAA8C,CAAC;YAC/D,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAC7D,MAAM,CAAC,SAAS,EAAE,mDAAmD,sBAAsB,EAAE,EAAE;gBAC7F,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,MAAM,CAAC,0BAA0B,CAAC;gBAC3C,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,sBAAsB;aAChC,CAAC;YACF,MAAM,CAAC,UAAU,EAAE,mEAAmE,EAAE;gBACtF,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,CAAC;aACX,CAAC;SACH;QACD,KAAK,EAAE;YACL,4IAA4I,0BAA0B,aAAa,sBAAsB,yEAAyE;SACnR;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,6CAA6C;QACtD,KAAK,EAAE,GAAG,QAAQ,gEAAgE;QAClF,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7E,MAAM,CAAC,aAAa,EAAE,oDAAoD,EAAE;gBAC1E,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,oBAAoB;aAC7B,CAAC;YACF,MAAM,CAAC,YAAY,EAAE,gDAAgD,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAC5F;KACF;IACD;QACE,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,yCAAyC;QAClD,KAAK,EAAE,GAAG,QAAQ,yBAAyB;QAC3C,OAAO,EAAE;YACP,MAAM,CAAC,SAAS,EAAE,8CAA8C,CAAC;YACjE,MAAM,CAAC,WAAW,EAAE,mDAAmD,CAAC;SACzE;QACD,KAAK,EAAE;YACL,wOAAwO;SACzO;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,uDAAuD;QAChE,KAAK,EAAE,GAAG,QAAQ,SAAS;QAC3B,OAAO,EAAE,EAAE;KACZ;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,8CAA8C;QACvD,KAAK,EAAE,GAAG,QAAQ,UAAU;QAC5B,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,+GAA+G;YAC/G,gGAAgG;SACjG;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,2CAA2C;QACpD,KAAK,EAAE,GAAG,QAAQ,eAAe;QACjC,OAAO,EAAE,EAAE;KACZ;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,4CAA4C;IACrD,KAAK,EAAE,GAAG,QAAQ,sBAAsB;IACxC,OAAO,EAAE,mBAAmB;CAC7B,CAAC;AAEF,gEAAgE;AAChE,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACnH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QAClD,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAwB,EAAE,CAAC,CAAC;YAClE,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,GAAG,UAAU,CAAC,OAAO,UAAU;YACxC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;YACvD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,GAAG,CAAC,UAAU,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;SACvE,CAAC,CAAC;KACJ,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD,uEAAuE;AACvE,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,2BAA2B,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB;IACnC,OAAO,2BAA2B,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"cli-command-registry.js","sourceRoot":"","sources":["../src/cli-command-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpG,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,MAAM,QAAQ,GAAG,UAAU,CAAC;AAE5B,SAAS,yBAAyB;IAChC,MAAM,OAAO,GAAG,8BAA8B,EAAE;SAC7C,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACrG,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,iFAAiF,OAAO,wDAAwD,CAAC;AAC1J,CAAC;AA8BD,MAAM,CAAC,MAAM,mBAAmB,GAAiC;IAC/D,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE;IAC1E,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,4BAA4B,EAAE;IAC9E,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,6BAA6B,EAAE;CAClE,CAAC;AAEF,MAAM,MAAM,GAAG,CACb,IAAY,EACZ,WAAmB,EACnB,UAaI,EAAE,EACa,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAoC;IACnE;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,GAAG,QAAQ,2BAA2B;QAC7C,OAAO,EAAE;YACP,MAAM,CAAC,UAAU,EAAE,6DAA6D,EAAE;gBAChF,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,+BAA+B;aACzC,CAAC;YACF,MAAM,CACJ,YAAY,EACZ,8KAA8K,EAC9K;gBACE,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,mDAAmD;aAC7D,CACF;YACD,MAAM,CACJ,iBAAiB,EACjB,+GAA+G,EAC/G,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,yCAAyC,EAAE,CACxE;YACD,MAAM,CAAC,QAAQ,EAAE,gDAAgD,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACvG,MAAM,CAAC,SAAS,EAAE,mDAAmD,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;SAChH;QACD,KAAK,EAAE;YACL,uFAAuF;YACvF,oDAAoD;YACpD,4NAA4N;SAC7N;KACF;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,sCAAsC;QAC/C,KAAK,EAAE,GAAG,QAAQ,aAAa;QAC/B,OAAO,EAAE,EAAE;KACZ;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,sCAAsC;QAC/C,KAAK,EAAE,GAAG,QAAQ,6CAA6C;QAC/D,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,wDAAwD,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3G,KAAK,EAAE;YACL,6HAA6H;SAC9H;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,+DAA+D;QACxE,KAAK,EAAE,GAAG,QAAQ,8EAA8E;QAChG,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,wDAAwD,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAChG,MAAM,CACJ,uBAAuB,EACvB,4KAA4K,EAC5K,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB;SACF;QACD,KAAK,EAAE;YACL,mHAAmH;YACnH,iIAAiI;YACjI,+IAA+I;YAC/I,4GAA4G;SAC7G;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,CAAC,cAAc,CAAC;QACzB,OAAO,EAAE,sDAAsD;QAC/D,KAAK,EAAE,GAAG,QAAQ,gGAAgG;QAClH,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACzE,MAAM,CAAC,kBAAkB,EAAE,yEAAyE,EAAE;gBACpG,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;aACpC,CAAC;SACH;QACD,KAAK,EAAE;YACL,wHAAwH;YACxH,2BAA2B;SAC5B;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,wEAAwE;QACjF,KAAK,EAAE,GAAG,QAAQ,0GAA0G;QAC5H,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACzE,MAAM,CAAC,kBAAkB,EAAE,yEAAyE,EAAE;gBACpG,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;aACpC,CAAC;SACH;QACD,KAAK,EAAE;YACL,0HAA0H;YAC1H,sEAAsE;SACvE;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,yCAAyC;QAClD,KAAK,EAAE,GAAG,QAAQ,8DAA8D;QAChF,OAAO,EAAE;YACP,MAAM,CAAC,OAAO,EAAE,8CAA8C,CAAC;YAC/D,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAC7D,MAAM,CAAC,SAAS,EAAE,mDAAmD,sBAAsB,EAAE,EAAE;gBAC7F,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,MAAM,CAAC,0BAA0B,CAAC;gBAC3C,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,sBAAsB;aAChC,CAAC;YACF,MAAM,CAAC,UAAU,EAAE,mEAAmE,EAAE;gBACtF,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,CAAC;aACX,CAAC;SACH;QACD,KAAK,EAAE;YACL,kIAAkI,0BAA0B,aAAa,sBAAsB,6BAA6B;SAC7N;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,GAAG,QAAQ,gIAAgI;QAClJ,OAAO,EAAE;YACP,MAAM,CAAC,YAAY,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACjG,MAAM,CAAC,QAAQ,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACjG,MAAM,CAAC,WAAW,EAAE,2DAA2D,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACnG,MAAM,CAAC,cAAc,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC1E;QACD,KAAK,EAAE;YACL,oGAAoG;YACpG,4GAA4G;YAC5G,yBAAyB,EAAE;SAC5B;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,CAAC,iBAAiB,CAAC;QAC5B,OAAO,EAAE,4DAA4D;QACrE,KAAK,EAAE,GAAG,QAAQ,qMAAqM;QACvN,OAAO,EAAE;YACP,MAAM,CACJ,YAAY,EACZ,4FAA4F,EAC5F;gBACE,KAAK,EAAE,gBAAgB;gBACvB,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;aACjB,CACF;YACD,MAAM,CAAC,QAAQ,EAAE,2DAA2D,EAAE;gBAC5E,KAAK,EAAE,8BAA8B;gBACrC,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,CAAC,iBAAiB,EAAE,wEAAwE,EAAE;gBAClG,KAAK,EAAE,wBAAwB;aAChC,CAAC;YACF,MAAM,CACJ,SAAS,EACT,+FAA+F,CAChG;YACD,MAAM,CAAC,WAAW,EAAE,2DAA2D,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACnG,MAAM,CAAC,cAAc,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC1E;QACD,KAAK,EAAE;YACL,sGAAsG;gBACpG,2GAA2G;gBAC3G,iIAAiI;YACnI,kHAAkH;YAClH,4GAA4G;SAC7G;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,CAAC,iBAAiB,CAAC;QAC5B,OAAO,EAAE,wEAAwE;QACjF,KAAK,EACH,GAAG,QAAQ,iEAAiE;YAC5E,8GAA8G;YAC9G,qDAAqD;QACvD,OAAO,EAAE;YACP,MAAM,CACJ,mBAAmB,EACnB,6GAA6G,EAC7G,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE,CAC9C;YACD,MAAM,CAAC,QAAQ,EAAE,sDAAsD,EAAE;gBACvE,KAAK,EAAE,8BAA8B;gBACrC,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,CAAC,oBAAoB,EAAE,2DAA2D,EAAE;gBACxF,KAAK,EAAE,gBAAgB;gBACvB,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,CAAC,iBAAiB,EAAE,wEAAwE,EAAE;gBAClG,KAAK,EAAE,yBAAyB;aACjC,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,0FAA0F,CAAC;YAC7G,MAAM,CAAC,WAAW,EAAE,2DAA2D,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACnG,MAAM,CAAC,cAAc,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC1E;QACD,KAAK,EAAE;YACL,yHAAyH;YACzH,qHAAqH;YACrH,yGAAyG;SAC1G;KACF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,qBAAqB,CAAC;QAChC,OAAO,EAAE,qDAAqD;QAC9D,KAAK,EACH,GAAG,QAAQ,qEAAqE;YAChF,gEAAgE;YAChE,qDAAqD;QACvD,OAAO,EAAE;YACP,MAAM,CAAC,YAAY,EAAE,yDAAyD,EAAE;gBAC9E,KAAK,EAAE,gBAAgB;gBACvB,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,MAAM,CAAC,QAAQ,EAAE,sDAAsD,EAAE;gBACvE,KAAK,EAAE,8BAA8B;gBACrC,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,MAAM,CAAC,iBAAiB,EAAE,wEAAwE,EAAE;gBAClG,KAAK,EAAE,yBAAyB;aACjC,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,0FAA0F,CAAC;YAC7G,MAAM,CAAC,WAAW,EAAE,2DAA2D,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACnG,MAAM,CAAC,cAAc,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC1E;QACD,KAAK,EAAE;YACL,2GAA2G;YAC3G,kGAAkG;YAClG,oGAAoG;SACrG;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC7C,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,GAAG,QAAQ,+CAA+C;QACjE,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,4CAA4C,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/F,KAAK,EAAE;YACL,4GAA4G;SAC7G;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,OAAO,EAAE,yBAAyB;QAClC,KAAK,EAAE,GAAG,QAAQ,8IAA8I;QAChK,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,oDAAoD,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC5F,MAAM,CAAC,YAAY,EAAE,kDAAkD,EAAE;gBACvE,KAAK,EAAE,gBAAgB;gBACvB,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,CAAC,YAAY,EAAE,wCAAwC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YACnG,MAAM,CAAC,OAAO,EAAE,2DAA2D,CAAC;YAC5E,MAAM,CAAC,iBAAiB,EAAE,4EAA4E,EAAE;gBACtG,KAAK,EAAE,yBAAyB;aACjC,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,iFAAiF,CAAC;SACrG;QACD,KAAK,EAAE;YACL,4GAA4G;YAC5G,uGAAuG;YACvG,6GAA6G;SAC9G;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,uCAAuC;QAChD,KAAK,EAAE,GAAG,QAAQ,4HAA4H;QAC9I,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,wDAAwD,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAChG,MAAM,CACJ,uBAAuB,EACvB,wKAAwK,EACxK,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB;YACD,MAAM,CAAC,gBAAgB,EAAE,4EAA4E,EAAE;gBACrG,KAAK,EAAE,QAAQ;aAChB,CAAC;YACF,MAAM,CAAC,gBAAgB,EAAE,sDAAsD,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;SACxG;QACD,KAAK,EAAE;YACL,qFAAqF;YACrF,wIAAwI;YACxI,+JAA+J;YAC/J,8IAA8I;YAC9I,4GAA4G;SAC7G;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,iEAAiE;QAC1E,KAAK,EAAE,GAAG,QAAQ,0DAA0D;QAC5E,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,iEAAiE,EAAE;gBACrF,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,MAAM,CAAC,WAAW,EAAE,4DAA4D,CAAC;SAClF;QACD,KAAK,EAAE;YACL,sHAAsH;YACtH,iGAAiG;YACjG,6FAA6F;YAC7F,yDAAyD;SAC1D;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,gDAAgD;QACzD,KAAK,EAAE,GAAG,QAAQ,sFAAsF;QACxG,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7E,MAAM,CAAC,aAAa,EAAE,4BAA4B,EAAE;gBAClD,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,oBAAoB;aAC7B,CAAC;YACF,MAAM,CAAC,YAAY,EAAE,+CAA+C,EAAE;gBACpE,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;aACjB,CAAC;SACH;QACD,KAAK,EAAE;YACL,6IAA6I;YAC7I,uNAAuN;SACxN;KACF;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,wCAAwC;QACjD,KAAK,EAAE,GAAG,QAAQ,8BAA8B;QAChD,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;KACzF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,0DAA0D;QACnE,KAAK,EAAE,GAAG,QAAQ,mCAAmC;QACrD,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,mCAAmC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,KAAK,EAAE,CAAC,sGAAsG,CAAC;KAChH;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,iDAAiD;QAC1D,KAAK,EAAE,GAAG,QAAQ,8CAA8C;QAChE,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,mCAAmC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC3F,MAAM,CAAC,QAAQ,EAAE,+CAA+C,EAAE;gBAChE,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,CAAC,QAAQ,EAAE,sCAAsC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC7F,MAAM,CAAC,MAAM,EAAE,4DAA4D,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAChG,MAAM,CAAC,SAAS,EAAE,2DAA2D,CAAC;YAC9E,MAAM,CAAC,aAAa,EAAE,2BAA2B,EAAE;gBACjD,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,MAAM,CAAC,uBAAuB,CAAC;gBACxC,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,uBAAuB;aACjC,CAAC;YACF,MAAM,CAAC,aAAa,EAAE,qBAAqB,EAAE;gBAC3C,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,MAAM,CAAC,uBAAuB,CAAC;gBACxC,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,uBAAuB;aACjC,CAAC;SACH;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,4CAA4C;QACrD,KAAK,EAAE,GAAG,QAAQ,wIAAwI;QAC1J,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7E,MAAM,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACxG,MAAM,CAAC,YAAY,EAAE,yCAAyC,EAAE;gBAC9D,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;gBAChB,eAAe,EAAE,CAAC,eAAe,CAAC;aACnC,CAAC;YACF,MAAM,CAAC,eAAe,EAAE,kFAAkF,EAAE;gBAC1G,uBAAuB,EAAE,CAAC,YAAY,CAAC;aACxC,CAAC;YACF,MAAM,CAAC,mBAAmB,EAAE,mEAAmE,EAAE;gBAC/F,KAAK,EAAE,SAAS;aACjB,CAAC;SACH;QACD,KAAK,EAAE;YACL,wGAAwG;YACxG,4GAA4G;SAC7G;KACF;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,6CAA6C;QACtD,KAAK,EAAE,GAAG,QAAQ,yGAAyG;QAC3H,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7E,MAAM,CAAC,YAAY,EAAE,yCAAyC,EAAE;gBAC9D,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;gBAChB,eAAe,EAAE,CAAC,eAAe,CAAC;aACnC,CAAC;YACF,MAAM,CAAC,eAAe,EAAE,gFAAgF,EAAE;gBACxG,uBAAuB,EAAE,CAAC,YAAY,CAAC;aACxC,CAAC;YACF,MAAM,CAAC,UAAU,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC9E,MAAM,CAAC,UAAU,EAAE,wBAAwB,EAAE;gBAC3C,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,CAAC,iBAAiB,CAAC;aAC7B,CAAC;YACF,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,EAAE;gBACrE,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,UAAU;aACrB,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,kDAAkD,CAAC;YACrE,MAAM,CAAC,mBAAmB,EAAE,sCAAsC,CAAC;SACpE;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,oDAAoD;QAC7D,KAAK,EAAE,GAAG,QAAQ,wDAAwD;QAC1E,OAAO,EAAE;YACP,MAAM,CAAC,OAAO,EAAE,8CAA8C,CAAC;YAC/D,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAC7D,MAAM,CAAC,SAAS,EAAE,mDAAmD,sBAAsB,EAAE,EAAE;gBAC7F,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,MAAM,CAAC,0BAA0B,CAAC;gBAC3C,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,sBAAsB;aAChC,CAAC;YACF,MAAM,CAAC,UAAU,EAAE,mEAAmE,EAAE;gBACtF,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,CAAC;aACX,CAAC;SACH;QACD,KAAK,EAAE;YACL,4IAA4I,0BAA0B,aAAa,sBAAsB,yEAAyE;SACnR;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,2CAA2C;QACpD,KAAK,EAAE,GAAG,QAAQ,gEAAgE;QAClF,OAAO,EAAE;YACP,MAAM,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7E,MAAM,CAAC,aAAa,EAAE,oDAAoD,EAAE;gBAC1E,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,oBAAoB;aAC7B,CAAC;YACF,MAAM,CAAC,YAAY,EAAE,gDAAgD,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAC5F;QACD,KAAK,EAAE;YACL,uIAAuI;YACvI,+KAA+K;SAChL;KACF;IACD;QACE,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,yCAAyC;QAClD,KAAK,EAAE,GAAG,QAAQ,yBAAyB;QAC3C,OAAO,EAAE;YACP,MAAM,CAAC,SAAS,EAAE,8CAA8C,CAAC;YACjE,MAAM,CAAC,WAAW,EAAE,mDAAmD,CAAC;SACzE;QACD,KAAK,EAAE;YACL,wOAAwO;SACzO;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,uDAAuD;QAChE,KAAK,EAAE,GAAG,QAAQ,SAAS;QAC3B,OAAO,EAAE,EAAE;KACZ;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,8CAA8C;QACvD,KAAK,EAAE,GAAG,QAAQ,UAAU;QAC5B,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,+GAA+G;YAC/G,gGAAgG;SACjG;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,2CAA2C;QACpD,KAAK,EAAE,GAAG,QAAQ,eAAe;QACjC,OAAO,EAAE,EAAE;KACZ;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,4CAA4C;IACrD,KAAK,EAAE,GAAG,QAAQ,sBAAsB;IACxC,OAAO,EAAE,mBAAmB;CAC7B,CAAC;AAEF,gEAAgE;AAChE,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACnH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QAClD,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAwB,EAAE,CAAC,CAAC;YAClE,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,GAAG,UAAU,CAAC,OAAO,UAAU;YACxC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;YACvD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,GAAG,CAAC,UAAU,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;SACvE,CAAC,CAAC;KACJ,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD,uEAAuE;AACvE,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,2BAA2B,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB;IACnC,OAAO,2BAA2B,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC"}

package/dist/cli.d.ts

@@ -1,7 +1,7 @@
 import { type DomainResult } from "./domain/errors.js";
 import { type SessionBackend } from "./domain/session.js";
 import { type CliIO } from "./presentation.js";
-import { type SandboxCommand, type SandboxExecutionResult, type SandboxProbe, type SandboxRuntimeLayout } from "./domain/sandbox.js";
+import { type SandboxCommand, type SandboxExecutionResult, type SandboxLauncherOptions, type SandboxProbe, type SandboxRuntimeLayout } from "./domain/sandbox.js";
 export { CLI_COMMAND_REGISTRY, COMMAND_REGISTRY, publicCliCommandDefinitions, publicCliCommandNames, resolveCliCommandDefinition, canonicalCommandForName, } from "./cli-command-registry.js";
 export type { CliCommandDefinition, CliHelpOptionSpec } from "./cli-command-registry.js";
 /**
@@ -9,7 +9,7 @@ export type { CliCommandDefinition, CliHelpOptionSpec } from "./cli-command-regi
  * this inventory makes the executable surface explicit for structural parity
  * checks. Aliases are listed because they are public entry points too.
  */
-export declare const DISPATCHER_COMMAND_INVENTORY: readonly ["session create", "session id", "session show", "session inspect", "session run", "session exec", "session list", "session claim", "resource claim", "session update", "resource update", "session mutate", "resource mutate", "session transition", "resource transition", "session claims", "resource list", "resource claims", "session release", "resource release", "session close", "session discard", "authorize", "checkpoint", "evidence snapshot", "diff", "commit", "push", "status", "guard", "gc", "doctor", "migrate", "capabilities"];
+export declare const DISPATCHER_COMMAND_INVENTORY: readonly ["session create", "session id", "session show", "session inspect", "session run", "session exec", "session shell", "session list", "session claim", "resource claim", "session update", "resource update", "session mutate", "resource mutate", "session transition", "resource transition", "session claims", "resource list", "resource claims", "session release", "resource release", "session close", "session discard", "authorize", "checkpoint", "evidence snapshot", "diff", "commit", "push", "status", "guard", "gc", "doctor", "migrate", "capabilities"];
 /** Dispatcher option inventory, keyed by canonical registry command identity. */
 export declare const DISPATCHER_OPTION_INVENTORY: Readonly<Record<string, readonly string[]>>;
 /** Return the registry-backed option set used by a specialized dispatcher parser. */
@@ -25,8 +25,10 @@ export type CliDependencies = {
     cwd?: string;
     io?: CliIO;
     version?: string;
-    sandboxRunner?: (request: import("./domain/sandbox.js").SandboxExecutionRequest, command: SandboxCommand) => Promise<DomainResult<SandboxExecutionResult>>;
+    sandboxRunner?: (request: import("./domain/sandbox.js").SandboxExecutionRequest, command: SandboxCommand, options?: SandboxLauncherOptions) => Promise<DomainResult<SandboxExecutionResult>>;
     sandboxProbe?: SandboxProbe;
     sandboxRuntimeLayout?: SandboxRuntimeLayout;
+    /** Validated runtime projection forwarded to sandbox resolution; test/integration seam. */
+    sandboxRuntimeProjection?: import("./domain/sandbox.js").SandboxExecutionOptions["runtime_projection"];
 };
 export declare function runCli(argv: string[], dependencies?: CliDependencies): Promise<number>;

package/dist/cli.js

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import { runDoctor } from "./domain/doctor.js";
-import { DomainError, EXIT_CODES, failure } from "./domain/errors.js";
+import { DomainError, EXIT_CODES, failure, } from "./domain/errors.js";
 import { MAX_SESSION_LIST_LIMIT, } from "./domain/session.js";
 import { EVIDENCE_MAX_DIFF_BYTES, EVIDENCE_MAX_DIFF_HUNKS, EVIDENCE_MAX_DIFF_PATHS } from "./repository-evidence.js";
 import { isResourceClaimMode } from "./resource-claims.js";
@@ -8,7 +8,8 @@ import { OPERATION_VOCABULARY } from "./operation-authorization.js";
 import { createLocalSessionBackend } from "./domain/session-backend.js";
 import { defaultCliIO, renderFailure, renderSuccess } from "./presentation.js";
 import { MACHINE_CONTRACT_ID, MACHINE_CONTRACT_SCHEMA_VERSION, machineContract } from "./contract.js";
-import { resolveSandboxExecutionRequest, runSandboxedCommand, } from "./domain/sandbox.js";
+import { resolveSandboxExecutionRequest, runSandboxedCommand, CANONICAL_EXECUTABLE_ROOT, } from "./domain/sandbox.js";
+import { EXPLICIT_COMPATIBILITY_RUNTIME_POLICY, STRICT_RUNTIME_POLICY, } from "./domain/runtime-projection.js";
 const CLI_NAME = "nawabari";
 const packageMetadata = createRequire(import.meta.url)("../package.json");
 const VERSION = packageMetadata.version;
@@ -26,6 +27,7 @@ export const DISPATCHER_COMMAND_INVENTORY = [
     "session inspect",
     "session run",
     "session exec",
+    "session shell",
     "session list",
     "session claim",
     "resource claim",
@@ -61,7 +63,8 @@ export const DISPATCHER_OPTION_INVENTORY = {
     "session id": [],
     "session show": ["--session"],
     "session inspect": ["--session", "--integrated-revision"],
-    "session run": ["--session"],
+    "session run": ["--session", "--runtime-policy"],
+    "session shell": ["--session", "--runtime-policy"],
     "session list": ["--all", "--history", "--limit", "--offset"],
     "session claim": ["--resource", "--mode", "--session", "--repository"],
     "session update": ["--resource", "--mode", "--if-generation", "--force", "--session", "--repository"],
@@ -275,6 +278,14 @@ const HELP_TEXT = helpText(ROOT_HELP_SPEC);
 function usageError(code, message, details = null) {
     return new DomainError(code, message, details);
 }
+function projectedShellPath(shell) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9+._-]*$/u.test(shell)) {
+        return failure(usageError("INVALID_ARGUMENT", "session shell requires a projected shell executable basename after --.", {
+            shell,
+        }));
+    }
+    return { ok: true, value: `${CANONICAL_EXECUTABLE_ROOT}/${shell}` };
+}
 function parseGlobalArguments(argv) {
     let json = false;
     let help = false;
@@ -354,6 +365,7 @@ function parseOptions(arguments_, allowed) {
         fetch_remote: null,
         fetch_branch: null,
         preview: false,
+        runtime_policy: null,
     };
     let dryRun = false;
     for (let index = 0; index < arguments_.length; index += 1) {
@@ -401,6 +413,19 @@ function parseOptions(arguments_, allowed) {
             index += 1;
         if (name === "--session")
             options.session_id = value;
+        else if (name === "--runtime-policy") {
+            if (options.runtime_policy !== null) {
+                return failure(usageError("INVALID_ARGUMENT", "--runtime-policy may be supplied only once.", { option: name }));
+            }
+            if (value !== "strict" && value !== "compatibility") {
+                return failure(usageError("INVALID_ARGUMENT", "--runtime-policy requires strict or compatibility.", {
+                    option: name,
+                    value,
+                    values: ["strict", "compatibility"],
+                }));
+            }
+            options.runtime_policy = value;
+        }
         else if (name === "--branch")
             options.branch = value;
         else if (name === "--worktree")
@@ -1004,29 +1029,52 @@ async function executeRelease(arguments_, backend, context, operation) {
  * there is no ambient child-process path to select when resolution or launch
  * fails.
  */
-async function executeProtectedSessionCommand(arguments_, dependencies, context) {
+async function executeProtectedSessionCommand(arguments_, dependencies, context, interactive = false) {
+    const commandName = interactive ? "session shell" : "session run";
     const delimiter = arguments_.indexOf("--");
     if (delimiter === -1) {
-        return failure(usageError("MISSING_ARGUMENT", "session run requires a -- terminator before the command."));
+        return failure(usageError("MISSING_ARGUMENT", `${commandName} requires a -- terminator before the command.`));
     }
-    const parsed = parseOptions(arguments_.slice(0, delimiter), new Set(["--session"]));
+    const parsed = parseOptions(arguments_.slice(0, delimiter), new Set(["--session", "--runtime-policy"]));
     if (!parsed.ok)
         return parsed;
     const command = arguments_[delimiter + 1];
     if (command === undefined || command.length === 0) {
-        return failure(usageError("MISSING_ARGUMENT", "session run requires a command after --."));
+        return failure(usageError("MISSING_ARGUMENT", `${commandName} requires a command after --.`));
     }
-    const request = await resolveSandboxExecutionRequest(dependencies.backend, context, { session_id: parsed.value.session_id, enforce: true }, dependencies.sandboxProbe, dependencies.sandboxRuntimeLayout);
+    const executable = interactive && parsed.value.runtime_policy !== "compatibility"
+        ? projectedShellPath(command)
+        : { ok: true, value: command };
+    if (!executable.ok)
+        return executable;
+    const request = await resolveSandboxExecutionRequest(dependencies.backend, context, {
+        session_id: parsed.value.session_id,
+        enforce: true,
+        runtime_policy: parsed.value.runtime_policy === "compatibility" ? EXPLICIT_COMPATIBILITY_RUNTIME_POLICY : STRICT_RUNTIME_POLICY,
+        ...(dependencies.sandboxRuntimeProjection === undefined
+            ? {}
+            : { runtime_projection: dependencies.sandboxRuntimeProjection }),
+    }, dependencies.sandboxProbe, dependencies.sandboxRuntimeLayout);
     if (!request.ok)
         return request;
     // `sandboxRunner` is an injection seam for unit tests. Production always
     // reaches the canonical protected launcher exported by #145.
     const runner = dependencies.sandboxRunner ?? runSandboxedCommand;
     const result = await runner(request.value, {
-        command,
+        command: executable.value,
         args: arguments_.slice(delimiter + 2),
-    });
-    return result.ok ? { ok: true, value: result.value } : result;
+    }, interactive ? { interactive: true } : undefined);
+    if (!result.ok)
+        return result;
+    return {
+        ok: true,
+        value: {
+            ...result.value,
+            ...(result.value.runtime_resolution === undefined && request.value.runtime_resolution === undefined
+                ? {}
+                : { runtime_resolution: result.value.runtime_resolution ?? request.value.runtime_resolution }),
+        },
+    };
 }
 async function executeCommand(commandArguments, dependencies) {
     const [command, subcommand, ...rest] = commandArguments;
@@ -1035,6 +1083,9 @@ async function executeCommand(commandArguments, dependencies) {
         if (subcommand === undefined) {
             return failure(usageError("MISSING_ARGUMENT", "session requires a subcommand."));
         }
+        if (canonicalCommandForName(`session ${subcommand}`)?.name === "session shell") {
+            return executeProtectedSessionCommand(rest, dependencies, context, true);
+        }
         // Resolve the subcommand through the canonical registry before dispatch.
         // This keeps `session exec` an alias of the same protected route instead
         // of creating a second launch path.
@@ -1431,17 +1482,7 @@ async function executeCommand(commandArguments, dependencies) {
         if (result.value.allowed)
             return { ok: true, value: result.value };
         const code = result.value.code === "ALLOWED" ? "OPERATION_REJECTED" : result.value.code;
-        return failure(new DomainError(code, `Guard denied the current worktree: ${code}.`, {
-            allowed: false,
-            repository: result.value.repository,
-            worktree: result.value.worktree,
-            branch: result.value.branch,
-            session_id: result.value.session_id,
-            owner_session_id: result.value.owner_session_id,
-            requested_session_id: result.value.requested_session_id,
-            state: result.value.state,
-            details: result.value.details,
-        }));
+        return failure(new DomainError(code, `Guard denied the current worktree: ${code}.`, guardRejectionDetails(result.value)));
     }
     if (command === "gc") {
         const parsed = parseOptions([subcommand, ...rest].filter((argument) => argument !== undefined), dispatcherAllowedOptions("gc"));
@@ -1455,7 +1496,7 @@ async function executeCommand(commandArguments, dependencies) {
         const parsed = noOptions([subcommand, ...rest].filter((argument) => argument !== undefined));
         if (!parsed.ok)
             return parsed;
-        const report = await runDoctor(dependencies.cwd, dependencies.sandboxProbe);
+        const report = await runDoctor(dependencies.cwd, dependencies.sandboxProbe, undefined, dependencies.sandboxRuntimeLayout);
         if (!report.ok)
             return report;
         if (report.value.ok)
@@ -1530,13 +1571,41 @@ function mutationCapabilityUnavailable(operation) {
 }
 function deniedAuthorization(decision) {
     const code = decision.code === "ALLOWED" ? "OPERATION_REJECTED" : decision.code;
-    const diagnosticDetails = code === "INSUFFICIENT_CLAIM_MODE"
-        ? {
-            resource: decision.details.resource,
-            granted_modes: decision.details.grantedModes,
-        }
-        : {};
     return failure(new DomainError(code, `Operation denied: ${code}.`, {
+        ...authorizationRejectionDetails(decision, code === "RESOURCE_CLAIM_CONFLICT"),
+    }));
+}
+const AUTHORIZATION_DETAIL_KEYS = new Set([
+    "allowed",
+    "schema_version",
+    "operation",
+    "required_access",
+    "repository",
+    "worktree",
+    "branch",
+    "session_id",
+    "owner_session_id",
+    "requested_session_id",
+    "state",
+    "resources",
+    "details",
+    "mode",
+]);
+function guardRejectionDetails(decision) {
+    return {
+        allowed: false,
+        repository: decision.repository,
+        worktree: decision.worktree,
+        branch: decision.branch,
+        session_id: decision.session_id,
+        owner_session_id: decision.owner_session_id,
+        requested_session_id: decision.requested_session_id,
+        state: decision.state,
+        ...normalizeRejectionDetails(decision.details, false),
+    };
+}
+function authorizationRejectionDetails(decision, mapConflictOwner) {
+    return {
         allowed: false,
         schema_version: decision.schema_version,
         operation: decision.operation,
@@ -1549,9 +1618,60 @@ function deniedAuthorization(decision) {
         requested_session_id: decision.requested_session_id,
         state: decision.state,
         resources: decision.resources,
-        ...diagnosticDetails,
-        details: decision.details,
-    }));
+        ...normalizeRejectionDetails(decision.details, mapConflictOwner),
+    };
+}
+function normalizeRejectionDetails(details, mapConflictOwner) {
+    const normalized = {};
+    const visit = (source) => {
+        for (const [key, value] of Object.entries(source).sort(([left], [right]) => compareCliKeys(left, right))) {
+            const snakeKey = snakeCaseCliKey(key);
+            if (snakeKey === "details" && value !== null && typeof value === "object" && !Array.isArray(value)) {
+                visit(value);
+                continue;
+            }
+            const canonicalKey = mapConflictOwner ? conflictOwnerKey(snakeKey) : snakeKey;
+            if (AUTHORIZATION_DETAIL_KEYS.has(canonicalKey) || canonicalKey === "allowed")
+                continue;
+            if (!(canonicalKey in normalized))
+                normalized[canonicalKey] = normalizeRejectionValue(value);
+        }
+    };
+    visit(details);
+    return normalized;
+}
+function conflictOwnerKey(key) {
+    return ({
+        owner_session_id: "blocking_session_id",
+        owner_claim_id: "blocking_claim_id",
+        owner_resource: "blocking_resource",
+        owner_mode: "blocking_mode",
+        owner_worktree: "blocking_worktree",
+        owner_branch: "blocking_branch",
+        owner_state: "blocking_state",
+        owner_label: "blocking_label",
+    }[key] ?? key);
+}
+function normalizeRejectionValue(value) {
+    if (Array.isArray(value))
+        return value.map(normalizeRejectionValue);
+    if (value === null || typeof value !== "object")
+        return value;
+    const normalized = {};
+    for (const [key, child] of Object.entries(value).sort(([left], [right]) => compareCliKeys(left, right))) {
+        normalized[snakeCaseCliKey(key)] = normalizeRejectionValue(child);
+    }
+    return normalized;
+}
+function snakeCaseCliKey(key) {
+    return key
+        .replace(/([A-Z]+)([A-Z][a-z])/gu, "$1_$2")
+        .replace(/([a-z0-9])([A-Z])/gu, "$1_$2")
+        .replace(/[\s-]+/gu, "_")
+        .toLowerCase();
+}
+function compareCliKeys(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
 }
 function emitFailure(mode, command, error, io) {
     io[mode === "json" ? "stdout" : "stderr"](renderFailure(mode, command, error));
@@ -1659,6 +1779,7 @@ export async function runCli(argv, dependencies = {}) {
             sandboxRunner: dependencies.sandboxRunner,
             sandboxProbe: dependencies.sandboxProbe,
             sandboxRuntimeLayout: dependencies.sandboxRuntimeLayout,
+            sandboxRuntimeProjection: dependencies.sandboxRuntimeProjection,
         });
         if (!result.ok) {
             const enriched = await enrichInvalidSessionIdError(result.error, backend, sessionContext(cwd));
@@ -1666,8 +1787,10 @@ export async function runCli(argv, dependencies = {}) {
         }
         const childExitCode = result.value.exit_code;
         const childSignal = result.value.signal;
-        io.stdout(renderSuccess(mode, command, result.value));
-        if ((command === "session run" || command === "session exec") &&
+        const interactive = command === "session shell";
+        if (!interactive)
+            io.stdout(renderSuccess(mode, command, result.value));
+        if ((command === "session run" || command === "session exec" || interactive) &&
             (childSignal !== null || (typeof childExitCode === "number" && childExitCode !== 0))) {
             if (childSignal !== null)
                 return EXIT_CODES.rejected;