open-multi-agent-kit 0.80.5 → 0.80.7

package/dist/core/loadout-runtime.js

@@ -0,0 +1,157 @@
+/**
+ * Loadout runtime wiring — pure algorithms.
+ *
+ * Converts the pure loadout decisions in `loadouts.ts` into runtime-ready
+ * capability inventories, lane grants, and scheduler fields without mutating
+ * `AgentSession`.
+ */
+import { loadHookInventory } from "./hook-inventory.js";
+import { createLoadoutAccessPolicy } from "./loadout-access-policy.js";
+import { applyLoadoutProfile, deriveSchedulerFields, validateLoadoutProfile, } from "./loadouts.js";
+import { loadMcpInventory } from "./mcp-inventory.js";
+export function buildLoadoutAccessPolicy(state, options) {
+    return createLoadoutAccessPolicy({
+        cwd: options.cwd,
+        activeTools: state.activeTools,
+        readSet: state.schedulerFields.readSet,
+        writeSet: state.schedulerFields.writeSet,
+        blockedPaths: options.blockedPaths,
+        commands: options.commands,
+    });
+}
+export function buildCapabilityInventory(session, resourceLoader, cwd, hookInventory) {
+    const tools = [];
+    for (const [name] of session._baseToolDefinitions) {
+        tools.push({
+            kind: "tool",
+            name,
+            source: "builtin",
+            scope: "temporary",
+            origin: "top-level",
+        });
+    }
+    for (const registered of session._extensionRunner.getAllRegisteredTools()) {
+        const { sourceInfo } = registered;
+        tools.push({
+            kind: "tool",
+            name: registered.definition.name,
+            source: sourceInfo.source,
+            scope: sourceInfo.scope,
+            origin: sourceInfo.origin,
+            path: sourceInfo.path,
+        });
+    }
+    for (const definition of session._customTools) {
+        tools.push({
+            kind: "tool",
+            name: definition.name,
+            source: "sdk",
+            scope: "temporary",
+            origin: "top-level",
+        });
+    }
+    const skills = resourceLoader.getSkills().skills.map((skill) => ({
+        kind: "skill",
+        name: skill.name,
+        source: skill.sourceInfo.source,
+        scope: skill.sourceInfo.scope,
+        origin: skill.sourceInfo.origin,
+        path: skill.filePath,
+    }));
+    const mcp = loadMcpInventory(cwd).entries.map((entry) => ({
+        kind: "mcp",
+        name: entry.name,
+        source: entry.source,
+        scope: "project",
+        origin: "top-level",
+    }));
+    const hooks = hookInventory.hooks.map((descriptor) => ({
+        kind: "hook",
+        name: descriptor.name,
+        source: descriptor.scriptPath ?? "builtin",
+        scope: "builtin",
+        origin: "top-level",
+    }));
+    return { tools, skills, mcp, hooks };
+}
+export function applyLoadoutToRuntime(session, resourceLoader, cwd, agentDir, request) {
+    const validation = validateLoadoutProfile(request.profile);
+    if (!validation.valid) {
+        return {
+            profileName: request.profile.name,
+            authority: request.profile.authority,
+            activeTools: [],
+            activeSkills: [],
+            activeMcp: [],
+            activeHooks: [],
+            schedulerFields: { readSet: [], writeSet: [], parallelizable: true },
+            blockers: validation.errors,
+            warnings: [],
+        };
+    }
+    const hookInventory = loadHookInventory(agentDir);
+    const inventory = buildCapabilityInventory(session, resourceLoader, cwd, hookInventory);
+    const applied = applyLoadoutProfile(request.profile, inventory, { grantAuthority: request.grantAuthority });
+    if (applied.blockers.length > 0) {
+        return {
+            profileName: applied.profileName,
+            authority: applied.authority,
+            activeTools: applied.activeTools,
+            activeSkills: applied.activeSkills,
+            activeMcp: applied.activeMcp,
+            activeHooks: applied.activeHooks,
+            schedulerFields: { readSet: [], writeSet: [], parallelizable: true },
+            blockers: applied.blockers,
+            warnings: applied.warnings,
+        };
+    }
+    const schedulerFields = deriveSchedulerFields({
+        role: request.role,
+        assignedReadPaths: request.assignedReadPaths,
+        assignedWritePaths: request.assignedWritePaths,
+    });
+    return {
+        profileName: applied.profileName,
+        authority: applied.authority,
+        activeTools: applied.activeTools,
+        activeSkills: applied.activeSkills,
+        activeMcp: applied.activeMcp,
+        activeHooks: applied.activeHooks,
+        schedulerFields,
+        blockers: applied.blockers,
+        warnings: applied.warnings,
+    };
+}
+export function buildSubagentLaneGrant(nodeId, role, task, applied, schedulerFields, options = {}) {
+    const allowedPaths = uniqueSorted([...(options.allowedReadPaths ?? []), ...(options.allowedWritePaths ?? [])]);
+    const blockedPaths = ["**/.env*", "**/*secret*", "**/*key*", "**/.git/*"];
+    let evidenceOutput;
+    if (options.evidenceOutputPattern) {
+        evidenceOutput = options.runId
+            ? options.evidenceOutputPattern.replace("<goal>", options.runId)
+            : options.evidenceOutputPattern;
+    }
+    const commands = options.profile?.commands ?? { mode: "none" };
+    return {
+        laneId: nodeId,
+        agent: `omk-${role}`,
+        task,
+        scope: "loadout-derived lane grant",
+        authority: applied.authority,
+        allowedPaths,
+        blockedPaths,
+        skills: applied.activeSkills,
+        mcp: applied.activeMcp,
+        hooks: applied.activeHooks,
+        commands,
+        evidenceOutput,
+        scheduler: schedulerFields,
+    };
+}
+function uniqueSorted(values) {
+    return [...new Set(values)]
+        .map((value) => value.trim())
+        .filter((value) => value !== "")
+        .sort();
+}
+//# sourceMappingURL=loadout-runtime.js.map

package/dist/core/loadout-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadout-runtime.js","sourceRoot":"","sources":["../../src/core/loadout-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAsB,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAA4B,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAEN,mBAAmB,EAEnB,qBAAqB,EAOrB,sBAAsB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAqCtD,MAAM,UAAU,wBAAwB,CACvC,KAA0B,EAC1B,OAAwC,EAClB;IACtB,OAAO,yBAAyB,CAAC;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,OAAO;QACtC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,QAAQ;QACxC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC,CAAC;AAAA,CACH;AAkBD,MAAM,UAAU,wBAAwB,CACvC,OAA8B,EAC9B,cAA8B,EAC9B,GAAW,EACX,aAA4B,EACN;IACtB,MAAM,KAAK,GAAoB,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,WAAW;SACnB,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC3E,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI;YAChC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,IAAI,EAAE,UAAU,CAAC,IAAI;SACrB,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,WAAW;SACnB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAoB,cAAc,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjF,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;QAC/B,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK;QAC7B,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;QAC/B,IAAI,EAAE,KAAK,CAAC,QAAQ;KACpB,CAAC,CAAC,CAAC;IAEJ,MAAM,GAAG,GAAoB,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,WAAW;KACnB,CAAC,CAAC,CAAC;IAEJ,MAAM,KAAK,GAAoB,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,UAAU,CAAC,UAAU,IAAI,SAAS;QAC1C,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,WAAW;KACnB,CAAC,CAAC,CAAC;IAEJ,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAAA,CACrC;AAUD,MAAM,UAAU,qBAAqB,CACpC,OAA8B,EAC9B,cAA8B,EAC9B,GAAW,EACX,QAAgB,EAChB,OAAqC,EACf;IACtB,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACvB,OAAO;YACN,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YACjC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;YACpC,WAAW,EAAE,EAAE;YACf,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,EAAE;YACf,eAAe,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;YACpE,QAAQ,EAAE,UAAU,CAAC,MAAM;YAC3B,QAAQ,EAAE,EAAE;SACZ,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,wBAAwB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5G,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,eAAe,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;YACpE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC1B,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,qBAAqB,CAAC;QAC7C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC9C,CAAC,CAAC;IAEH,OAAO;QACN,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,eAAe;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC;AAAA,CACF;AAUD,MAAM,UAAU,sBAAsB,CACrC,MAAc,EACd,IAAiB,EACjB,IAAY,EACZ,OAAuB,EACvB,eAAgC,EAChC,OAAO,GAAkC,EAAE,EACvB;IACpB,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAE1E,IAAI,cAAkC,CAAC;IACvC,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACnC,cAAc,GAAG,OAAO,CAAC,KAAK;YAC7B,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;YAChE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAClC,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAE/D,OAAO;QACN,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,OAAO,IAAI,EAAE;QACpB,IAAI;QACJ,KAAK,EAAE,4BAA4B;QACnC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY;QACZ,YAAY;QACZ,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,GAAG,EAAE,OAAO,CAAC,SAAS;QACtB,KAAK,EAAE,OAAO,CAAC,WAAW;QAC1B,QAAQ;QACR,cAAc;QACd,SAAS,EAAE,eAAe;KAC1B,CAAC;AAAA,CACF;AAED,SAAS,YAAY,CAAC,MAAyB,EAAY;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;SAC/B,IAAI,EAAE,CAAC;AAAA,CACT","sourcesContent":["/**\n * Loadout runtime wiring — pure algorithms.\n *\n * Converts the pure loadout decisions in `loadouts.ts` into runtime-ready\n * capability inventories, lane grants, and scheduler fields without mutating\n * `AgentSession`.\n */\n\nimport type { ToolDefinition } from \"./extensions/types.ts\";\nimport { type HookInventory, loadHookInventory } from \"./hook-inventory.ts\";\nimport { createLoadoutAccessPolicy, type LoadoutAccessPolicy } from \"./loadout-access-policy.ts\";\nimport {\n\ttype AppliedLoadout,\n\tapplyLoadoutProfile,\n\ttype CapabilityInventory,\n\tderiveSchedulerFields,\n\ttype LoadoutAuthority,\n\ttype LoadoutCommands,\n\ttype LoadoutProfile,\n\ttype LoadoutRole,\n\ttype NamedResource,\n\ttype SchedulerFields,\n\tvalidateLoadoutProfile,\n} from \"./loadouts.ts\";\nimport { loadMcpInventory } from \"./mcp-inventory.ts\";\nimport type { ResourceLoader } from \"./resource-loader.ts\";\nimport type { SourceInfo } from \"./source-info.ts\";\n\ninterface ExtensionRunnerLike {\n\tgetAllRegisteredTools(): Array<{ definition: { name: string }; sourceInfo: SourceInfo }>;\n}\n\n/**\n * Subset of `AgentSession` fields needed to build a capability inventory.\n * Callers (including `AgentSession` itself) can cast the session to this\n * interface because the fields are read-only for inventory construction.\n */\nexport interface LoadoutRuntimeSession {\n\t_baseToolDefinitions: Map<string, ToolDefinition>;\n\t_extensionRunner: ExtensionRunnerLike;\n\t_customTools: ToolDefinition[];\n}\n\nexport interface LoadoutRuntimeState {\n\tprofileName: string;\n\tauthority: LoadoutAuthority;\n\tactiveTools: string[];\n\tactiveSkills: string[];\n\tactiveMcp: string[];\n\tactiveHooks: string[];\n\tschedulerFields: SchedulerFields;\n\tblockers: string[];\n\twarnings: string[];\n}\n\nexport interface BuildLoadoutAccessPolicyOptions {\n\tcwd: string;\n\tblockedPaths?: readonly string[];\n\tcommands?: LoadoutCommands;\n}\n\nexport function buildLoadoutAccessPolicy(\n\tstate: LoadoutRuntimeState,\n\toptions: BuildLoadoutAccessPolicyOptions,\n): LoadoutAccessPolicy {\n\treturn createLoadoutAccessPolicy({\n\t\tcwd: options.cwd,\n\t\tactiveTools: state.activeTools,\n\t\treadSet: state.schedulerFields.readSet,\n\t\twriteSet: state.schedulerFields.writeSet,\n\t\tblockedPaths: options.blockedPaths,\n\t\tcommands: options.commands,\n\t});\n}\n\nexport interface SubagentLaneGrant {\n\tlaneId: string;\n\tagent: string;\n\ttask: string;\n\tscope: string;\n\tauthority: LoadoutAuthority;\n\tallowedPaths: string[];\n\tblockedPaths: string[];\n\tskills: string[];\n\tmcp: string[];\n\thooks: string[];\n\tcommands: LoadoutCommands;\n\tevidenceOutput?: string;\n\tscheduler: SchedulerFields;\n}\n\nexport function buildCapabilityInventory(\n\tsession: LoadoutRuntimeSession,\n\tresourceLoader: ResourceLoader,\n\tcwd: string,\n\thookInventory: HookInventory,\n): CapabilityInventory {\n\tconst tools: NamedResource[] = [];\n\n\tfor (const [name] of session._baseToolDefinitions) {\n\t\ttools.push({\n\t\t\tkind: \"tool\",\n\t\t\tname,\n\t\t\tsource: \"builtin\",\n\t\t\tscope: \"temporary\",\n\t\t\torigin: \"top-level\",\n\t\t});\n\t}\n\n\tfor (const registered of session._extensionRunner.getAllRegisteredTools()) {\n\t\tconst { sourceInfo } = registered;\n\t\ttools.push({\n\t\t\tkind: \"tool\",\n\t\t\tname: registered.definition.name,\n\t\t\tsource: sourceInfo.source,\n\t\t\tscope: sourceInfo.scope,\n\t\t\torigin: sourceInfo.origin,\n\t\t\tpath: sourceInfo.path,\n\t\t});\n\t}\n\n\tfor (const definition of session._customTools) {\n\t\ttools.push({\n\t\t\tkind: \"tool\",\n\t\t\tname: definition.name,\n\t\t\tsource: \"sdk\",\n\t\t\tscope: \"temporary\",\n\t\t\torigin: \"top-level\",\n\t\t});\n\t}\n\n\tconst skills: NamedResource[] = resourceLoader.getSkills().skills.map((skill) => ({\n\t\tkind: \"skill\",\n\t\tname: skill.name,\n\t\tsource: skill.sourceInfo.source,\n\t\tscope: skill.sourceInfo.scope,\n\t\torigin: skill.sourceInfo.origin,\n\t\tpath: skill.filePath,\n\t}));\n\n\tconst mcp: NamedResource[] = loadMcpInventory(cwd).entries.map((entry) => ({\n\t\tkind: \"mcp\",\n\t\tname: entry.name,\n\t\tsource: entry.source,\n\t\tscope: \"project\",\n\t\torigin: \"top-level\",\n\t}));\n\n\tconst hooks: NamedResource[] = hookInventory.hooks.map((descriptor) => ({\n\t\tkind: \"hook\",\n\t\tname: descriptor.name,\n\t\tsource: descriptor.scriptPath ?? \"builtin\",\n\t\tscope: \"builtin\",\n\t\torigin: \"top-level\",\n\t}));\n\n\treturn { tools, skills, mcp, hooks };\n}\n\nexport interface ApplyLoadoutToRuntimeRequest {\n\tprofile: LoadoutProfile;\n\trole: LoadoutRole;\n\tgrantAuthority?: LoadoutAuthority;\n\tassignedReadPaths?: readonly string[];\n\tassignedWritePaths?: readonly string[];\n}\n\nexport function applyLoadoutToRuntime(\n\tsession: LoadoutRuntimeSession,\n\tresourceLoader: ResourceLoader,\n\tcwd: string,\n\tagentDir: string,\n\trequest: ApplyLoadoutToRuntimeRequest,\n): LoadoutRuntimeState {\n\tconst validation = validateLoadoutProfile(request.profile);\n\tif (!validation.valid) {\n\t\treturn {\n\t\t\tprofileName: request.profile.name,\n\t\t\tauthority: request.profile.authority,\n\t\t\tactiveTools: [],\n\t\t\tactiveSkills: [],\n\t\t\tactiveMcp: [],\n\t\t\tactiveHooks: [],\n\t\t\tschedulerFields: { readSet: [], writeSet: [], parallelizable: true },\n\t\t\tblockers: validation.errors,\n\t\t\twarnings: [],\n\t\t};\n\t}\n\n\tconst hookInventory = loadHookInventory(agentDir);\n\tconst inventory = buildCapabilityInventory(session, resourceLoader, cwd, hookInventory);\n\tconst applied = applyLoadoutProfile(request.profile, inventory, { grantAuthority: request.grantAuthority });\n\tif (applied.blockers.length > 0) {\n\t\treturn {\n\t\t\tprofileName: applied.profileName,\n\t\t\tauthority: applied.authority,\n\t\t\tactiveTools: applied.activeTools,\n\t\t\tactiveSkills: applied.activeSkills,\n\t\t\tactiveMcp: applied.activeMcp,\n\t\t\tactiveHooks: applied.activeHooks,\n\t\t\tschedulerFields: { readSet: [], writeSet: [], parallelizable: true },\n\t\t\tblockers: applied.blockers,\n\t\t\twarnings: applied.warnings,\n\t\t};\n\t}\n\n\tconst schedulerFields = deriveSchedulerFields({\n\t\trole: request.role,\n\t\tassignedReadPaths: request.assignedReadPaths,\n\t\tassignedWritePaths: request.assignedWritePaths,\n\t});\n\n\treturn {\n\t\tprofileName: applied.profileName,\n\t\tauthority: applied.authority,\n\t\tactiveTools: applied.activeTools,\n\t\tactiveSkills: applied.activeSkills,\n\t\tactiveMcp: applied.activeMcp,\n\t\tactiveHooks: applied.activeHooks,\n\t\tschedulerFields,\n\t\tblockers: applied.blockers,\n\t\twarnings: applied.warnings,\n\t};\n}\n\nexport interface BuildSubagentLaneGrantOptions {\n\tallowedReadPaths?: readonly string[];\n\tallowedWritePaths?: readonly string[];\n\tevidenceOutputPattern?: string;\n\trunId?: string;\n\tprofile?: { commands?: LoadoutCommands };\n}\n\nexport function buildSubagentLaneGrant(\n\tnodeId: string,\n\trole: LoadoutRole,\n\ttask: string,\n\tapplied: AppliedLoadout,\n\tschedulerFields: SchedulerFields,\n\toptions: BuildSubagentLaneGrantOptions = {},\n): SubagentLaneGrant {\n\tconst allowedPaths = uniqueSorted([...(options.allowedReadPaths ?? []), ...(options.allowedWritePaths ?? [])]);\n\tconst blockedPaths = [\"**/.env*\", \"**/*secret*\", \"**/*key*\", \"**/.git/*\"];\n\n\tlet evidenceOutput: string | undefined;\n\tif (options.evidenceOutputPattern) {\n\t\tevidenceOutput = options.runId\n\t\t\t? options.evidenceOutputPattern.replace(\"<goal>\", options.runId)\n\t\t\t: options.evidenceOutputPattern;\n\t}\n\n\tconst commands = options.profile?.commands ?? { mode: \"none\" };\n\n\treturn {\n\t\tlaneId: nodeId,\n\t\tagent: `omk-${role}`,\n\t\ttask,\n\t\tscope: \"loadout-derived lane grant\",\n\t\tauthority: applied.authority,\n\t\tallowedPaths,\n\t\tblockedPaths,\n\t\tskills: applied.activeSkills,\n\t\tmcp: applied.activeMcp,\n\t\thooks: applied.activeHooks,\n\t\tcommands,\n\t\tevidenceOutput,\n\t\tscheduler: schedulerFields,\n\t};\n}\n\nfunction uniqueSorted(values: readonly string[]): string[] {\n\treturn [...new Set(values)]\n\t\t.map((value) => value.trim())\n\t\t.filter((value) => value !== \"\")\n\t\t.sort();\n}\n"]}

package/dist/core/loadouts.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Pure loadout / lane-profile algorithms for the OMK control plane.
+ *
+ * This module is I/O-free. It owns the loadout schema, built-in presets,
+ * capability gating (allow/exclude/require selectors), profile validation, and
+ * the derivation of scheduler read/write/parallelizable fields from a lane's
+ * optional assigned paths. Runtime wiring (AgentSession tool registry, skill
+ * prompt construction, MCP runtime, scheduler admission) lives in sibling
+ * modules and consumes the decisions made here.
+ *
+ * Schema and presets follow `.omk/runs/omk-pi-package-hardening-plan/loadout.md`.
+ *
+ * Erasable TypeScript only (no enum/namespace/parameter properties).
+ */
+export type LoadoutAuthority = "advisory" | "read-only" | "execute-tests" | "write-scoped" | "review-only" | "security-review";
+export type LoadoutRole = "planner" | "explorer" | "coder" | "tester" | "reviewer" | "security" | "synthesizer" | "package-maintainer";
+/** Resource kinds the loadout layer can describe. Only the last four are gated here. */
+export type ResourceKind = "extension" | "skill" | "prompt" | "theme" | "tool" | "mcp" | "hook";
+export type ResourceOrigin = "package" | "top-level";
+export type SourceScope = "user" | "project" | "temporary" | "builtin";
+export type CommandMode = "none" | "read-only-shell" | "tests-only" | "scoped-shell";
+export type ToolDefaultMode = "default-builtins" | "no-tools" | "no-builtin-tools";
+export interface NamedResource {
+    kind: ResourceKind;
+    name: string;
+    source?: string;
+    scope?: SourceScope;
+    /** Package-relative or absolute resource path, when meaningful (skills/prompts). */
+    path?: string;
+    origin?: ResourceOrigin;
+}
+/**
+ * A selector matches inventory resources by name and/or provenance criteria.
+ * A resource matches when its kind equals `kind` and every defined criterion
+ * matches (names is an OR over the listed names; paths/sources are OR over globs).
+ */
+export interface ResourceSelector {
+    kind: ResourceKind;
+    names?: readonly string[];
+    /** Glob patterns matched against `NamedResource.path`. */
+    paths?: readonly string[];
+    /** Glob patterns matched against `NamedResource.source`. */
+    sources?: readonly string[];
+    scopes?: readonly SourceScope[];
+    origins?: readonly ResourceOrigin[];
+    /** Marker only; requirement is expressed by placement in `CapabilityGate.require`. */
+    required?: boolean;
+}
+/** Tool gating uses flat name arrays (mapped to SDK tools / setActiveTools). */
+export interface ToolGate {
+    allow?: readonly string[];
+    exclude?: readonly string[];
+    require?: readonly string[];
+    defaultMode?: ToolDefaultMode;
+}
+/** Skills / MCP / hooks gating uses selector arrays. */
+export interface CapabilityGate {
+    allow?: readonly ResourceSelector[];
+    exclude?: readonly ResourceSelector[];
+    require?: readonly ResourceSelector[];
+}
+export interface LoadoutCommands {
+    mode: CommandMode;
+    allowPatterns?: readonly string[];
+    blockPatterns?: readonly string[];
+}
+export interface LoadoutEvidence {
+    required: boolean;
+    outputPattern: string;
+}
+export interface LoadoutProfile {
+    schemaVersion: "omk.loadout.v1";
+    name: string;
+    description?: string;
+    authority: LoadoutAuthority;
+    tools: ToolGate;
+    skills?: CapabilityGate;
+    mcp?: CapabilityGate;
+    hooks?: CapabilityGate;
+    commands?: LoadoutCommands;
+    evidence?: LoadoutEvidence;
+}
+export interface CapabilityInventory {
+    tools: readonly NamedResource[];
+    skills: readonly NamedResource[];
+    mcp: readonly NamedResource[];
+    hooks: readonly NamedResource[];
+}
+export interface LaneDefaults {
+    loadout: string;
+    authority: LoadoutAuthority;
+    parallelizable: boolean;
+    readOnly: boolean;
+    writesProductFiles: boolean;
+}
+export interface AppliedLoadout {
+    profileName: string;
+    authority: LoadoutAuthority;
+    activeTools: string[];
+    activeSkills: string[];
+    activeMcp: string[];
+    activeHooks: string[];
+    blockers: string[];
+    warnings: string[];
+}
+export interface LoadoutValidation {
+    valid: boolean;
+    errors: string[];
+}
+/** A scheduler access entry; shape matches `AccessSetEntry` in the orchestration layer. */
+export interface LoadoutAccessEntry {
+    path: string;
+    symbols?: readonly string[];
+}
+export interface SchedulerFields {
+    readSet: LoadoutAccessEntry[];
+    writeSet: LoadoutAccessEntry[];
+    parallelizable: boolean;
+}
+export interface SchedulerDerivationInput {
+    role: LoadoutRole;
+    assignedReadPaths?: readonly string[];
+    assignedWritePaths?: readonly string[];
+}
+export declare const BUILTIN_LOADOUTS: Readonly<Record<string, LoadoutProfile>>;
+export declare function inferLoadoutForRole(role: LoadoutRole): string;
+export declare function authorityWithinGrant(requested: LoadoutAuthority, grant: LoadoutAuthority): boolean;
+export declare function laneDefaultsForRole(role: LoadoutRole): LaneDefaults;
+export declare function applyLoadoutProfile(profile: LoadoutProfile, inventory: CapabilityInventory, options?: {
+    grantAuthority?: LoadoutAuthority;
+}): AppliedLoadout;
+/**
+ * Fail-closed structural validation of a loadout profile. Errors are returned
+ * in a deterministic order: schemaVersion, name, authority, tools, skills, mcp,
+ * hooks, commands.
+ */
+export declare function validateLoadoutProfile(profile: LoadoutProfile): LoadoutValidation;
+/**
+ * Derive scheduler readSet/writeSet/parallelizable from a lane role plus the
+ * optional paths granted to that lane. Non-writing roles never produce a
+ * writeSet. parallelizable is false when a write-scoped lane writes anything,
+ * or when any write touches a lockfile, package config, snapshot, or git index.
+ */
+export declare function deriveSchedulerFields(input: SchedulerDerivationInput): SchedulerFields;
+/** Lockfile, package config, snapshot, or git-index writes force serialization. */
+export declare function isSerializeTriggerPath(path: string): boolean;
+//# sourceMappingURL=loadouts.d.ts.map

package/dist/core/loadouts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadouts.d.ts","sourceRoot":"","sources":["../../src/core/loadouts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,gBAAgB,GACzB,UAAU,GACV,WAAW,GACX,eAAe,GACf,cAAc,GACd,aAAa,GACb,iBAAiB,CAAC;AAErB,MAAM,MAAM,WAAW,GACpB,SAAS,GACT,UAAU,GACV,OAAO,GACP,QAAQ,GACR,UAAU,GACV,UAAU,GACV,aAAa,GACb,oBAAoB,CAAC;AAExB,wFAAwF;AACxF,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;AAChG,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,CAAC;AACrD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AACvE,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,iBAAiB,GAAG,YAAY,GAAG,cAAc,CAAC;AACrF,MAAM,MAAM,eAAe,GAAG,kBAAkB,GAAG,UAAU,GAAG,kBAAkB,CAAC;AAEnF,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,0DAA0D;IAC1D,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACpC,sFAAsF;IACtF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,QAAQ;IACxB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC9B,KAAK,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,WAAW,CAAC;IAClB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC9B,aAAa,EAAE,gBAAgB,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,QAAQ,CAAC;IAChB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IACjC,GAAG,EAAE,SAAS,aAAa,EAAE,CAAC;IAC9B,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,cAAc,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,WAAW,CAAC;IAClB,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAsDD,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CA2ErE,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAmB7D;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAElG;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,YAAY,CAWnE;AAED,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,mBAAmB,EAC9B,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,gBAAgB,CAAA;CAAO,GACjD,cAAc,CAuBhB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,GAAG,iBAAiB,CAwBjF;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,wBAAwB,GAAG,eAAe,CAMtF;AASD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ5D","sourcesContent":["/**\n * Pure loadout / lane-profile algorithms for the OMK control plane.\n *\n * This module is I/O-free. It owns the loadout schema, built-in presets,\n * capability gating (allow/exclude/require selectors), profile validation, and\n * the derivation of scheduler read/write/parallelizable fields from a lane's\n * optional assigned paths. Runtime wiring (AgentSession tool registry, skill\n * prompt construction, MCP runtime, scheduler admission) lives in sibling\n * modules and consumes the decisions made here.\n *\n * Schema and presets follow `.omk/runs/omk-pi-package-hardening-plan/loadout.md`.\n *\n * Erasable TypeScript only (no enum/namespace/parameter properties).\n */\n\nexport type LoadoutAuthority =\n\t| \"advisory\"\n\t| \"read-only\"\n\t| \"execute-tests\"\n\t| \"write-scoped\"\n\t| \"review-only\"\n\t| \"security-review\";\n\nexport type LoadoutRole =\n\t| \"planner\"\n\t| \"explorer\"\n\t| \"coder\"\n\t| \"tester\"\n\t| \"reviewer\"\n\t| \"security\"\n\t| \"synthesizer\"\n\t| \"package-maintainer\";\n\n/** Resource kinds the loadout layer can describe. Only the last four are gated here. */\nexport type ResourceKind = \"extension\" | \"skill\" | \"prompt\" | \"theme\" | \"tool\" | \"mcp\" | \"hook\";\nexport type ResourceOrigin = \"package\" | \"top-level\";\nexport type SourceScope = \"user\" | \"project\" | \"temporary\" | \"builtin\";\nexport type CommandMode = \"none\" | \"read-only-shell\" | \"tests-only\" | \"scoped-shell\";\nexport type ToolDefaultMode = \"default-builtins\" | \"no-tools\" | \"no-builtin-tools\";\n\nexport interface NamedResource {\n\tkind: ResourceKind;\n\tname: string;\n\tsource?: string;\n\tscope?: SourceScope;\n\t/** Package-relative or absolute resource path, when meaningful (skills/prompts). */\n\tpath?: string;\n\torigin?: ResourceOrigin;\n}\n\n/**\n * A selector matches inventory resources by name and/or provenance criteria.\n * A resource matches when its kind equals `kind` and every defined criterion\n * matches (names is an OR over the listed names; paths/sources are OR over globs).\n */\nexport interface ResourceSelector {\n\tkind: ResourceKind;\n\tnames?: readonly string[];\n\t/** Glob patterns matched against `NamedResource.path`. */\n\tpaths?: readonly string[];\n\t/** Glob patterns matched against `NamedResource.source`. */\n\tsources?: readonly string[];\n\tscopes?: readonly SourceScope[];\n\torigins?: readonly ResourceOrigin[];\n\t/** Marker only; requirement is expressed by placement in `CapabilityGate.require`. */\n\trequired?: boolean;\n}\n\n/** Tool gating uses flat name arrays (mapped to SDK tools / setActiveTools). */\nexport interface ToolGate {\n\tallow?: readonly string[];\n\texclude?: readonly string[];\n\trequire?: readonly string[];\n\tdefaultMode?: ToolDefaultMode;\n}\n\n/** Skills / MCP / hooks gating uses selector arrays. */\nexport interface CapabilityGate {\n\tallow?: readonly ResourceSelector[];\n\texclude?: readonly ResourceSelector[];\n\trequire?: readonly ResourceSelector[];\n}\n\nexport interface LoadoutCommands {\n\tmode: CommandMode;\n\tallowPatterns?: readonly string[];\n\tblockPatterns?: readonly string[];\n}\n\nexport interface LoadoutEvidence {\n\trequired: boolean;\n\toutputPattern: string;\n}\n\nexport interface LoadoutProfile {\n\tschemaVersion: \"omk.loadout.v1\";\n\tname: string;\n\tdescription?: string;\n\tauthority: LoadoutAuthority;\n\ttools: ToolGate;\n\tskills?: CapabilityGate;\n\tmcp?: CapabilityGate;\n\thooks?: CapabilityGate;\n\tcommands?: LoadoutCommands;\n\tevidence?: LoadoutEvidence;\n}\n\nexport interface CapabilityInventory {\n\ttools: readonly NamedResource[];\n\tskills: readonly NamedResource[];\n\tmcp: readonly NamedResource[];\n\thooks: readonly NamedResource[];\n}\n\nexport interface LaneDefaults {\n\tloadout: string;\n\tauthority: LoadoutAuthority;\n\tparallelizable: boolean;\n\treadOnly: boolean;\n\twritesProductFiles: boolean;\n}\n\nexport interface AppliedLoadout {\n\tprofileName: string;\n\tauthority: LoadoutAuthority;\n\tactiveTools: string[];\n\tactiveSkills: string[];\n\tactiveMcp: string[];\n\tactiveHooks: string[];\n\tblockers: string[];\n\twarnings: string[];\n}\n\nexport interface LoadoutValidation {\n\tvalid: boolean;\n\terrors: string[];\n}\n\n/** A scheduler access entry; shape matches `AccessSetEntry` in the orchestration layer. */\nexport interface LoadoutAccessEntry {\n\tpath: string;\n\tsymbols?: readonly string[];\n}\n\nexport interface SchedulerFields {\n\treadSet: LoadoutAccessEntry[];\n\twriteSet: LoadoutAccessEntry[];\n\tparallelizable: boolean;\n}\n\nexport interface SchedulerDerivationInput {\n\trole: LoadoutRole;\n\tassignedReadPaths?: readonly string[];\n\tassignedWritePaths?: readonly string[];\n}\n\nconst AUTHORITY_RANK: Record<LoadoutAuthority, number> = {\n\tadvisory: 0,\n\t\"read-only\": 1,\n\t\"review-only\": 1,\n\t\"security-review\": 2,\n\t\"execute-tests\": 3,\n\t\"write-scoped\": 4,\n};\n\nconst KNOWN_RESOURCE_KINDS: ReadonlySet<ResourceKind> = new Set([\n\t\"extension\",\n\t\"skill\",\n\t\"prompt\",\n\t\"theme\",\n\t\"tool\",\n\t\"mcp\",\n\t\"hook\",\n]);\n\nconst KNOWN_COMMAND_MODES: ReadonlySet<CommandMode> = new Set([\n\t\"none\",\n\t\"read-only-shell\",\n\t\"tests-only\",\n\t\"scoped-shell\",\n]);\n\nconst KNOWN_TOOL_DEFAULT_MODES: ReadonlySet<ToolDefaultMode> = new Set([\n\t\"default-builtins\",\n\t\"no-tools\",\n\t\"no-builtin-tools\",\n]);\n\n/** Roles permitted to declare a non-empty writeSet during scheduler derivation. */\nconst WRITING_ROLES: ReadonlySet<LoadoutRole> = new Set([\n\t\"coder\",\n\t\"tester\",\n\t\"security\",\n\t\"synthesizer\",\n\t\"package-maintainer\",\n]);\n\nconst LOCKFILE_BASENAMES: ReadonlySet<string> = new Set([\n\t\"package-lock.json\",\n\t\"npm-shrinkwrap.json\",\n\t\"yarn.lock\",\n\t\"pnpm-lock.yaml\",\n]);\n\nfunction allowNames(kind: ResourceKind, names: readonly string[]): CapabilityGate {\n\treturn { allow: [{ kind, names }] };\n}\n\nexport const BUILTIN_LOADOUTS: Readonly<Record<string, LoadoutProfile>> = {\n\tinspect: {\n\t\tschemaVersion: \"omk.loadout.v1\",\n\t\tname: \"inspect\",\n\t\tauthority: \"read-only\",\n\t\ttools: { allow: [\"read\", \"grep\", \"find\", \"ls\"] },\n\t\tskills: allowNames(\"skill\", [\"understand-chat\", \"analyze\"]),\n\t\tmcp: allowNames(\"mcp\", [\"filesystem-readonly\", \"memory\"]),\n\t\thooks: allowNames(\"hook\", [\"pre-shell-guard\", \"protect-secrets\"]),\n\t},\n\tplan: {\n\t\tschemaVersion: \"omk.loadout.v1\",\n\t\tname: \"plan\",\n\t\tauthority: \"advisory\",\n\t\ttools: { allow: [\"read\", \"grep\", \"find\", \"ls\"] },\n\t\tskills: allowNames(\"skill\", [\"adaptorch-route\", \"writing-plans\", \"ddd-software-architecture\"]),\n\t\tmcp: allowNames(\"mcp\", [\"memory\", \"adaptorch\"]),\n\t\thooks: allowNames(\"hook\", [\"session-context\", \"precompact-checkpoint\"]),\n\t},\n\tcode: {\n\t\tschemaVersion: \"omk.loadout.v1\",\n\t\tname: \"code\",\n\t\tauthority: \"write-scoped\",\n\t\ttools: { allow: [\"read\", \"grep\", \"find\", \"ls\", \"edit\", \"write\", \"bash\"] },\n\t\tskills: allowNames(\"skill\", [\"test-driven-development\", \"coding-standards\"]),\n\t\tmcp: allowNames(\"mcp\", [\"filesystem\", \"context7\"]),\n\t\thooks: allowNames(\"hook\", [\"pre-shell-guard\", \"protect-secrets\", \"typecheck-after-edit\"]),\n\t\tcommands: { mode: \"scoped-shell\" },\n\t},\n\ttest: {\n\t\tschemaVersion: \"omk.loadout.v1\",\n\t\tname: \"test\",\n\t\tauthority: \"execute-tests\",\n\t\ttools: { allow: [\"read\", \"grep\", \"find\", \"ls\", \"bash\"] },\n\t\tskills: allowNames(\"skill\", [\"verification-before-completion\"]),\n\t\tmcp: allowNames(\"mcp\", [\"filesystem\"]),\n\t\thooks: allowNames(\"hook\", [\"pre-shell-guard\", \"stop-verify\"]),\n\t\tcommands: { mode: \"tests-only\" },\n\t},\n\treview: {\n\t\tschemaVersion: \"omk.loadout.v1\",\n\t\tname: \"review\",\n\t\tauthority: \"review-only\",\n\t\ttools: { allow: [\"read\", \"grep\", \"find\", \"ls\"] },\n\t\tskills: allowNames(\"skill\", [\"code-review\", \"differential-review\"]),\n\t\tmcp: allowNames(\"mcp\", [\"memory\"]),\n\t\thooks: allowNames(\"hook\", [\"stop-verify\", \"subagent-stop-audit\"]),\n\t},\n\tsecurity: {\n\t\tschemaVersion: \"omk.loadout.v1\",\n\t\tname: \"security\",\n\t\tauthority: \"security-review\",\n\t\ttools: { allow: [\"read\", \"grep\", \"find\", \"ls\", \"bash\"] },\n\t\tskills: allowNames(\"skill\", [\"security-review\", \"differential-review\"]),\n\t\tmcp: allowNames(\"mcp\", [\"filesystem-readonly\", \"memory\"]),\n\t\thooks: allowNames(\"hook\", [\"pre-shell-guard\", \"protect-secrets\", \"stop-verify\"]),\n\t\tcommands: { mode: \"read-only-shell\" },\n\t},\n\t\"package-maintainer\": {\n\t\tschemaVersion: \"omk.loadout.v1\",\n\t\tname: \"package-maintainer\",\n\t\tauthority: \"write-scoped\",\n\t\ttools: { allow: [\"read\", \"grep\", \"find\", \"ls\", \"edit\", \"write\", \"bash\"] },\n\t\tskills: allowNames(\"skill\", [\"security-review\", \"verification-before-completion\"]),\n\t\tmcp: allowNames(\"mcp\", [\"filesystem\"]),\n\t\thooks: allowNames(\"hook\", [\"pre-shell-guard\", \"protect-secrets\", \"npm-audit-summary\"]),\n\t\tcommands: { mode: \"scoped-shell\" },\n\t},\n\tnone: {\n\t\tschemaVersion: \"omk.loadout.v1\",\n\t\tname: \"none\",\n\t\tauthority: \"advisory\",\n\t\ttools: { allow: [], defaultMode: \"no-tools\" },\n\t\tcommands: { mode: \"none\" },\n\t},\n};\n\nexport function inferLoadoutForRole(role: LoadoutRole): string {\n\tswitch (role) {\n\t\tcase \"planner\":\n\t\t\treturn \"plan\";\n\t\tcase \"explorer\":\n\t\t\treturn \"inspect\";\n\t\tcase \"coder\":\n\t\t\treturn \"code\";\n\t\tcase \"tester\":\n\t\t\treturn \"test\";\n\t\tcase \"reviewer\":\n\t\t\treturn \"review\";\n\t\tcase \"security\":\n\t\t\treturn \"security\";\n\t\tcase \"package-maintainer\":\n\t\t\treturn \"package-maintainer\";\n\t\tcase \"synthesizer\":\n\t\t\treturn \"plan\";\n\t}\n}\n\nexport function authorityWithinGrant(requested: LoadoutAuthority, grant: LoadoutAuthority): boolean {\n\treturn AUTHORITY_RANK[requested] <= AUTHORITY_RANK[grant];\n}\n\nexport function laneDefaultsForRole(role: LoadoutRole): LaneDefaults {\n\tconst loadout = inferLoadoutForRole(role);\n\tconst profile = BUILTIN_LOADOUTS[loadout];\n\treturn {\n\t\tloadout,\n\t\tauthority: profile.authority,\n\t\tparallelizable: profile.authority !== \"write-scoped\",\n\t\treadOnly:\n\t\t\tprofile.authority === \"read-only\" || profile.authority === \"review-only\" || profile.authority === \"advisory\",\n\t\twritesProductFiles: profile.authority === \"write-scoped\",\n\t};\n}\n\nexport function applyLoadoutProfile(\n\tprofile: LoadoutProfile,\n\tinventory: CapabilityInventory,\n\toptions: { grantAuthority?: LoadoutAuthority } = {},\n): AppliedLoadout {\n\tconst blockers: string[] = [];\n\tconst warnings: string[] = [];\n\t// Deterministic blocker order: authority, then tool/skill/mcp/hook requires.\n\tif (options.grantAuthority && !authorityWithinGrant(profile.authority, options.grantAuthority)) {\n\t\tblockers.push(`loadout authority ${profile.authority} exceeds grant ${options.grantAuthority}`);\n\t}\n\n\tconst activeTools = applyToolGate(profile.tools, inventory.tools, blockers, warnings);\n\tconst activeSkills = applyCapabilityGate(\"skill\", profile.skills, inventory.skills, blockers, warnings);\n\tconst activeMcp = applyCapabilityGate(\"mcp\", profile.mcp, inventory.mcp, blockers, warnings);\n\tconst activeHooks = applyCapabilityGate(\"hook\", profile.hooks, inventory.hooks, blockers, warnings);\n\n\treturn {\n\t\tprofileName: profile.name,\n\t\tauthority: profile.authority,\n\t\tactiveTools,\n\t\tactiveSkills,\n\t\tactiveMcp,\n\t\tactiveHooks,\n\t\tblockers,\n\t\twarnings,\n\t};\n}\n\n/**\n * Fail-closed structural validation of a loadout profile. Errors are returned\n * in a deterministic order: schemaVersion, name, authority, tools, skills, mcp,\n * hooks, commands.\n */\nexport function validateLoadoutProfile(profile: LoadoutProfile): LoadoutValidation {\n\tconst errors: string[] = [];\n\tif (profile.schemaVersion !== \"omk.loadout.v1\") {\n\t\terrors.push(`unknown schemaVersion: ${String(profile.schemaVersion)}`);\n\t}\n\tif (typeof profile.name !== \"string\" || profile.name.trim() === \"\") {\n\t\terrors.push(\"missing loadout name\");\n\t}\n\tif (!(profile.authority in AUTHORITY_RANK)) {\n\t\terrors.push(`unknown authority: ${String(profile.authority)}`);\n\t}\n\tvalidateToolGate(profile.tools, errors);\n\tvalidateCapabilityGate(\"skills\", \"skill\", profile.skills, errors);\n\tvalidateCapabilityGate(\"mcp\", \"mcp\", profile.mcp, errors);\n\tvalidateCapabilityGate(\"hooks\", \"hook\", profile.hooks, errors);\n\tif (profile.commands) {\n\t\tif (!KNOWN_COMMAND_MODES.has(profile.commands.mode)) {\n\t\t\terrors.push(`unknown command mode: ${String(profile.commands.mode)}`);\n\t\t} else if (profile.authority in AUTHORITY_RANK) {\n\t\t\tconst conflict = commandModeAuthorityConflict(profile.commands.mode, profile.authority);\n\t\t\tif (conflict) errors.push(conflict);\n\t\t}\n\t}\n\treturn { valid: errors.length === 0, errors };\n}\n\n/**\n * Derive scheduler readSet/writeSet/parallelizable from a lane role plus the\n * optional paths granted to that lane. Non-writing roles never produce a\n * writeSet. parallelizable is false when a write-scoped lane writes anything,\n * or when any write touches a lockfile, package config, snapshot, or git index.\n */\nexport function deriveSchedulerFields(input: SchedulerDerivationInput): SchedulerFields {\n\tconst defaults = laneDefaultsForRole(input.role);\n\tconst readSet = toAccessSet(input.assignedReadPaths);\n\tconst writeSet = WRITING_ROLES.has(input.role) ? toAccessSet(input.assignedWritePaths) : [];\n\tconst parallelizable = deriveParallelizable(defaults.authority, writeSet);\n\treturn { readSet, writeSet, parallelizable };\n}\n\nfunction deriveParallelizable(authority: LoadoutAuthority, writeSet: readonly LoadoutAccessEntry[]): boolean {\n\tif (writeSet.length === 0) return true;\n\tif (authority === \"write-scoped\") return false;\n\tif (writeSet.some((entry) => isSerializeTriggerPath(entry.path))) return false;\n\treturn true;\n}\n\n/** Lockfile, package config, snapshot, or git-index writes force serialization. */\nexport function isSerializeTriggerPath(path: string): boolean {\n\tconst normalized = path.replaceAll(\"\\\\\", \"/\");\n\tconst base = normalized.slice(normalized.lastIndexOf(\"/\") + 1);\n\tif (LOCKFILE_BASENAMES.has(base)) return true;\n\tif (base === \"package.json\") return true;\n\tif (base.endsWith(\".snap\")) return true;\n\tif (normalized === \".git/index\" || normalized.startsWith(\".git/\") || normalized.includes(\"/.git/\")) return true;\n\treturn false;\n}\n\nfunction toAccessSet(paths: readonly string[] | undefined): LoadoutAccessEntry[] {\n\tif (!paths) return [];\n\tconst seen = new Set<string>();\n\tconst entries: LoadoutAccessEntry[] = [];\n\tfor (const raw of paths) {\n\t\tconst path = raw.trim();\n\t\tif (path === \"\" || seen.has(path)) continue;\n\t\tseen.add(path);\n\t\tentries.push({ path });\n\t}\n\tentries.sort((a, b) => compareString(a.path, b.path));\n\treturn entries;\n}\n\nfunction resourceNames(resources: readonly NamedResource[]): Set<string> {\n\treturn new Set(resources.map((resource) => resource.name));\n}\n\nfunction applyToolGate(\n\tgate: ToolGate,\n\tresources: readonly NamedResource[],\n\tblockers: string[],\n\twarnings: string[],\n): string[] {\n\tconst available = resourceNames(resources);\n\tfor (const required of gate.require ?? []) {\n\t\tif (!available.has(required)) blockers.push(`missing required tool: ${required}`);\n\t}\n\tconst base = gate.defaultMode === \"no-tools\" ? [] : (gate.allow ?? resources.map((resource) => resource.name));\n\tconst excluded = new Set(gate.exclude ?? []);\n\tconst active: string[] = [];\n\tfor (const tool of base) {\n\t\tif (!available.has(tool)) {\n\t\t\twarnings.push(`optional tool not available: ${tool}`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (!excluded.has(tool)) active.push(tool);\n\t}\n\treturn [...new Set(active)].sort(compareString);\n}\n\nfunction applyCapabilityGate(\n\tkind: ResourceKind,\n\tgate: CapabilityGate | undefined,\n\tresources: readonly NamedResource[],\n\tblockers: string[],\n\twarnings: string[],\n): string[] {\n\tif (!gate) return [];\n\tconst active = new Set<string>();\n\n\t// require: every required selector must resolve, else a deterministic blocker.\n\tfor (const selector of gate.require ?? []) {\n\t\tresolveRequireSelector(kind, selector, resources, blockers, active);\n\t}\n\n\t// allow: union of matches; warn on named-but-missing optional capabilities.\n\tfor (const selector of gate.allow ?? []) {\n\t\tfor (const match of matchSelector(selector, resources)) active.add(match.name);\n\t\tfor (const name of selector.names ?? []) {\n\t\t\tif (!resources.some((resource) => resource.name === name && matchesCriteria(selector, resource))) {\n\t\t\t\twarnings.push(`optional ${kind} not available: ${name}`);\n\t\t\t}\n\t\t}\n\t}\n\n\t// exclude: applied last.\n\tconst excluded = new Set<string>();\n\tfor (const selector of gate.exclude ?? []) {\n\t\tfor (const match of matchSelector(selector, resources)) excluded.add(match.name);\n\t}\n\n\tconst result = [...active].filter((name) => !excluded.has(name));\n\treturn [...new Set(result)].sort(compareString);\n}\n\nfunction resolveRequireSelector(\n\tkind: ResourceKind,\n\tselector: ResourceSelector,\n\tresources: readonly NamedResource[],\n\tblockers: string[],\n\tactive: Set<string>,\n): void {\n\tif (selector.names && selector.names.length > 0) {\n\t\tfor (const name of selector.names) {\n\t\t\tconst matched = resources.some((resource) => resource.name === name && matchesCriteria(selector, resource));\n\t\t\tif (matched) active.add(name);\n\t\t\telse blockers.push(`missing required ${kind}: ${name}`);\n\t\t}\n\t\treturn;\n\t}\n\tconst matches = matchSelector(selector, resources);\n\tif (matches.length === 0) {\n\t\tblockers.push(`missing required ${kind}: ${describeSelector(selector)}`);\n\t\treturn;\n\t}\n\tfor (const match of matches) active.add(match.name);\n}\n\nfunction matchSelector(selector: ResourceSelector, resources: readonly NamedResource[]): NamedResource[] {\n\treturn resources.filter((resource) => {\n\t\tif (selector.names && !selector.names.includes(resource.name)) return false;\n\t\treturn matchesCriteria(selector, resource);\n\t});\n}\n\nfunction matchesCriteria(selector: ResourceSelector, resource: NamedResource): boolean {\n\tif (resource.kind !== selector.kind) return false;\n\tif (selector.scopes && (resource.scope === undefined || !selector.scopes.includes(resource.scope))) return false;\n\tif (selector.origins && (resource.origin === undefined || !selector.origins.includes(resource.origin))) return false;\n\tif (selector.sources && !selector.sources.some((glob) => globMatch(glob, resource.source ?? \"\"))) return false;\n\tif (selector.paths && !selector.paths.some((glob) => globMatch(glob, resource.path ?? \"\"))) return false;\n\treturn true;\n}\n\nfunction describeSelector(selector: ResourceSelector): string {\n\tconst parts: string[] = [`kind=${selector.kind}`];\n\tif (selector.paths) parts.push(`paths=${selector.paths.join(\",\")}`);\n\tif (selector.sources) parts.push(`sources=${selector.sources.join(\",\")}`);\n\tif (selector.scopes) parts.push(`scopes=${selector.scopes.join(\",\")}`);\n\tif (selector.origins) parts.push(`origins=${selector.origins.join(\",\")}`);\n\treturn parts.join(\" \");\n}\n\nfunction validateToolGate(gate: ToolGate | undefined, errors: string[]): void {\n\tif (!gate) {\n\t\terrors.push(\"missing tools gate\");\n\t\treturn;\n\t}\n\tif (gate.defaultMode !== undefined && !KNOWN_TOOL_DEFAULT_MODES.has(gate.defaultMode)) {\n\t\terrors.push(`unknown tool defaultMode: ${String(gate.defaultMode)}`);\n\t}\n}\n\nfunction validateCapabilityGate(\n\tgateName: string,\n\texpectedKind: ResourceKind,\n\tgate: CapabilityGate | undefined,\n\terrors: string[],\n): void {\n\tif (!gate) return;\n\tfor (const group of [\"allow\", \"exclude\", \"require\"] as const) {\n\t\tconst selectors = gate[group];\n\t\tif (!selectors) continue;\n\t\tfor (const selector of selectors) {\n\t\t\tif (!KNOWN_RESOURCE_KINDS.has(selector.kind)) {\n\t\t\t\terrors.push(`unknown resource kind in ${gateName}.${group}: ${String(selector.kind)}`);\n\t\t\t} else if (selector.kind !== expectedKind) {\n\t\t\t\terrors.push(\n\t\t\t\t\t`mismatched selector kind in ${gateName}.${group}: expected ${expectedKind}, got ${selector.kind}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n}\n\nfunction commandModeAuthorityConflict(mode: CommandMode, authority: LoadoutAuthority): string | undefined {\n\tif (mode === \"scoped-shell\" && authority !== \"write-scoped\") {\n\t\treturn `command mode scoped-shell requires write-scoped authority, got ${authority}`;\n\t}\n\tif (mode === \"tests-only\" && authority !== \"execute-tests\" && authority !== \"write-scoped\") {\n\t\treturn `command mode tests-only requires execute-tests or write-scoped authority, got ${authority}`;\n\t}\n\treturn undefined;\n}\n\nfunction globMatch(glob: string, value: string): boolean {\n\treturn globToRegExp(glob).test(value);\n}\n\nfunction globToRegExp(glob: string): RegExp {\n\tlet pattern = \"\";\n\tfor (let index = 0; index < glob.length; index++) {\n\t\tconst char = glob[index];\n\t\tif (char === \"*\") {\n\t\t\tif (glob[index + 1] === \"*\") {\n\t\t\t\tpattern += \".*\";\n\t\t\t\tindex++;\n\t\t\t} else {\n\t\t\t\tpattern += \"[^/]*\";\n\t\t\t}\n\t\t} else if (char === \"?\") {\n\t\t\tpattern += \".\";\n\t\t} else {\n\t\t\tpattern += char.replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\");\n\t\t}\n\t}\n\treturn new RegExp(`^${pattern}$`);\n}\n\nfunction compareString(a: string, b: string): number {\n\tif (a < b) return -1;\n\tif (a > b) return 1;\n\treturn 0;\n}\n"]}