open-multi-agent-kit 0.80.6 → 0.80.7

package/dist/core/freedom/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/core/freedom/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAcjC,MAAM,CAAC,MAAM,uBAAuB,GAAkB,MAAM,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,iBAAiB;IACjC,QAAQ,EAAE,KAAK;IACf,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAuB;IACpE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAG7D;IACD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAI/F;IACD,eAAe,EAAE,gBAAgB;CACjC,CAAkB,CAAC;AAMpB,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACnC,IAAI,CAAU;IACvB,YAAY,OAAe,EAAE,IAAa,EAAE;QAC3C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CACjB;CACD;AAED,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAiB;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,uBAAuB,CAAC;IAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAAA,CACxC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAiB;IACxE,OAAO,wBAAwB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AAAA,CAChD;AAED,SAAS,SAAS,CAAC,GAAW,EAAa;IAC1C,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAc,IAAI,CAAC;IAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,IAAI,GAAG,IAAI;iBACf,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;iBACZ,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACzB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5C,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC;gBAC5E,CAAC;YACF,CAAC;YACD,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClC,SAAS;QACV,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,GAAG,GAAG,EAAE,UAAU,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,WAAW,CAAC,IAAe,EAAE,IAAuB,EAAa;IACzE,IAAI,MAAM,GAAc,IAAI,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAc,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YACvB,MAAM,GAAG,OAAO,CAAC;YACjB,SAAS;QACV,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/C,MAAM,IAAI,kBAAkB,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,GAAG,IAAiB,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAU;IACjD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,IAAI,CAAC,KAAK,KAAK;gBAAE,QAAQ,GAAG,KAAK,CAAC;YAClC,SAAS;QACV,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,GAAG,CAAC,CAAC;YACV,SAAS;QACV,CAAC;QACD,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,UAAkB,EAAa;IAC/D,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9F,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,GAAG,GAAG,EAAE,UAAU,CAAC,CAAC;AAAA,CACvE;AAED,SAAS,wBAAwB,CAAC,MAAiB,EAAiB;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,KAAkB,CAAC;IAEnC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAClF,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,eAAe,CAAC,CAAC;IAEzG,IAAI,QAAQ,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,kBAAkB,CAAC,gDAAgD,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAc,CAAC;IACnE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7D,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAC3B,2BAA2B,GAAG,6BAA6B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAClF,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAc,CAAC;IACxD,MAAM,MAAM,GAAG;QACd,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC;QACxE,aAAa,EAAE,iBAAiB,CAAC,WAAW,CAAC;KAC7C,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAc,CAAC;IACtD,MAAM,KAAK,GAAG;QACb,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,aAAa,EAAE,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC;QACzF,WAAW,EAAE,QAAQ,CAAC,UAAU,EAAE,cAAc,EAAE,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC;QAC5F,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC;KAClF,CAAC;IAEF,OAAO;QACN,OAAO;QACP,cAAc;QACd,QAAQ;QACR,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/B,MAAM;QACN,KAAK;QACL,eAAe;KACf,CAAC;AAAA,CACF;AAED,SAAS,QAAQ,CAAC,KAAgB,EAAE,GAAW,EAAE,QAAiB,EAAW;IAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,kBAAkB,CAAC,IAAI,GAAG,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,UAAU,CAAC,KAAgB,EAAE,GAAW,EAAE,QAAgB,EAAU;IAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,IAAI,GAAG,2BAA2B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,kBAAkB,CAAC,KAAgB,EAAkB;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC,cAAc,CAAC;IACvE,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,IAAI,kBAAkB,CAAC,4DAA4D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAAA,CAClH;AAED,SAAS,iBAAiB,CAAC,KAAgB,EAAyB;IACnE,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC,MAAM,CAAC,aAAa,CAAC;IAC7E,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,IAAI,kBAAkB,CAAC,sDAAsD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAAA,CAC5G","sourcesContent":["/**\n * `.omk/config.toml` loader for the freedom block.\n *\n * Implements a tiny, deterministic TOML subset that is exactly enough for the\n * schema defined in `.omk/runs/freedom-plan-20260619/config-schema.md`:\n *\n *   - `# comment` lines and blank lines\n *   - `[section.subsection]` headers\n *   - `key = \"string\"` | `key = true` | `key = false`\n *\n * Anything outside that subset is treated as a malformed line and rejected\n * at parse time so users learn early that their config is wrong.\n *\n * Adding `@iarna/toml` would also work, but AGENTS.md keeps direct deps pinned\n * and reviewed; a 60-line hand parser avoids the dep-review cost for a config\n * shape this small.\n */\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nexport type ApprovalPolicy = \"yolo\" | \"prompt-per-tool\";\n\nexport interface FreedomConfig {\n\tenabled: boolean;\n\tapprovalPolicy: ApprovalPolicy;\n\tyoloMode: boolean;\n\tsafetyFloor: { enforced: true };\n\tbanner: { show: boolean; suppressAfter: \"session\" | \"forever\" };\n\taudit: { emitEvents: boolean; includeArgs: boolean; logPath: string };\n\tdoctrineVersion: string;\n}\n\nexport const FREEDOM_CONFIG_DEFAULTS: FreedomConfig = Object.freeze({\n\tenabled: false,\n\tapprovalPolicy: \"prompt-per-tool\",\n\tyoloMode: false,\n\tsafetyFloor: Object.freeze({ enforced: true }) as { enforced: true },\n\tbanner: Object.freeze({ show: true, suppressAfter: \"session\" }) as {\n\t\tshow: boolean;\n\t\tsuppressAfter: \"session\" | \"forever\";\n\t},\n\taudit: Object.freeze({ emitEvents: true, includeArgs: false, logPath: \".omk/audit/freedom.log\" }) as {\n\t\temitEvents: boolean;\n\t\tincludeArgs: boolean;\n\t\tlogPath: string;\n\t},\n\tdoctrineVersion: \"0.78.0-freedom\",\n}) as FreedomConfig;\n\ntype TomlValue = string | boolean | number;\n\ntype TomlTable = { [key: string]: TomlValue | TomlTable };\n\nexport class FreedomConfigError extends Error {\n\treadonly line?: number;\n\tconstructor(message: string, line?: number) {\n\t\tsuper(line ? `${message} (line ${line})` : message);\n\t\tthis.name = \"FreedomConfigError\";\n\t\tthis.line = line;\n\t}\n}\n\nexport function loadFreedomConfig(projectRoot: string): FreedomConfig {\n\tconst configPath = join(projectRoot, \".omk\", \"config.toml\");\n\tif (!existsSync(configPath)) return FREEDOM_CONFIG_DEFAULTS;\n\tconst raw = readFileSync(configPath, \"utf8\");\n\tconst parsed = parseToml(raw);\n\treturn materializeFreedomConfig(parsed);\n}\n\nexport function parseFreedomConfigFromString(raw: string): FreedomConfig {\n\treturn materializeFreedomConfig(parseToml(raw));\n}\n\nfunction parseToml(raw: string): TomlTable {\n\tconst root: TomlTable = {};\n\tlet current: TomlTable = root;\n\tconst normalized = raw.replace(/\\r\\n/g, \"\\n\");\n\tconst lines = normalized.split(\"\\n\");\n\tfor (let i = 0; i < lines.length; i++) {\n\t\tconst lineNumber = i + 1;\n\t\tconst line = stripInlineComment(lines[i]).trim();\n\t\tif (line.length === 0) continue;\n\t\tif (line.startsWith(\"[\")) {\n\t\t\tif (!line.endsWith(\"]\")) {\n\t\t\t\tthrow new FreedomConfigError(`Unterminated section header: ${line}`, lineNumber);\n\t\t\t}\n\t\t\tconst path = line\n\t\t\t\t.slice(1, -1)\n\t\t\t\t.split(\".\")\n\t\t\t\t.map((part) => part.trim());\n\t\t\tfor (const part of path) {\n\t\t\t\tif (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(part)) {\n\t\t\t\t\tthrow new FreedomConfigError(`Invalid section name '${part}'`, lineNumber);\n\t\t\t\t}\n\t\t\t}\n\t\t\tcurrent = ensureTable(root, path);\n\t\t\tcontinue;\n\t\t}\n\t\tconst eq = line.indexOf(\"=\");\n\t\tif (eq < 0) {\n\t\t\tthrow new FreedomConfigError(`Expected 'key = value' but got '${line}'`, lineNumber);\n\t\t}\n\t\tconst key = line.slice(0, eq).trim();\n\t\tconst value = line.slice(eq + 1).trim();\n\t\tif (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {\n\t\t\tthrow new FreedomConfigError(`Invalid key '${key}'`, lineNumber);\n\t\t}\n\t\tcurrent[key] = parseValue(value, lineNumber);\n\t}\n\treturn root;\n}\n\nfunction ensureTable(root: TomlTable, path: readonly string[]): TomlTable {\n\tlet cursor: TomlTable = root;\n\tfor (const part of path) {\n\t\tconst next = cursor[part];\n\t\tif (next === undefined) {\n\t\t\tconst created: TomlTable = {};\n\t\t\tcursor[part] = created;\n\t\t\tcursor = created;\n\t\t\tcontinue;\n\t\t}\n\t\tif (typeof next !== \"object\" || next === null) {\n\t\t\tthrow new FreedomConfigError(`Section '${path.join(\".\")}' collides with a value`);\n\t\t}\n\t\tcursor = next as TomlTable;\n\t}\n\treturn cursor;\n}\n\nfunction stripInlineComment(line: string): string {\n\tlet inString = false;\n\tlet quote = \"\";\n\tfor (let i = 0; i < line.length; i++) {\n\t\tconst c = line[i];\n\t\tif (inString) {\n\t\t\tif (c === \"\\\\\") {\n\t\t\t\ti += 1;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (c === quote) inString = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (c === '\"' || c === \"'\") {\n\t\t\tinString = true;\n\t\t\tquote = c;\n\t\t\tcontinue;\n\t\t}\n\t\tif (c === \"#\") return line.slice(0, i);\n\t}\n\treturn line;\n}\n\nfunction parseValue(raw: string, lineNumber: number): TomlValue {\n\tif (raw === \"true\") return true;\n\tif (raw === \"false\") return false;\n\tif (/^-?\\d+$/.test(raw)) return Number(raw);\n\tif ((raw.startsWith('\"') && raw.endsWith('\"')) || (raw.startsWith(\"'\") && raw.endsWith(\"'\"))) {\n\t\treturn raw.slice(1, -1).replace(/\\\\n/g, \"\\n\").replace(/\\\\t/g, \"\\t\").replace(/\\\\\"/g, '\"').replace(/\\\\\\\\/g, \"\\\\\");\n\t}\n\tthrow new FreedomConfigError(`Unsupported value '${raw}'`, lineNumber);\n}\n\nfunction materializeFreedomConfig(parsed: TomlTable): FreedomConfig {\n\tconst block = parsed.freedom;\n\tif (block === undefined) return FREEDOM_CONFIG_DEFAULTS;\n\tif (typeof block !== \"object\" || block === null) {\n\t\tthrow new FreedomConfigError(\"'[freedom]' must be a table\");\n\t}\n\tconst freedom = block as TomlTable;\n\n\tconst enabled = readBool(freedom, \"enabled\", FREEDOM_CONFIG_DEFAULTS.enabled);\n\tconst approvalPolicy = readApprovalPolicy(freedom);\n\tconst yoloMode = readBool(freedom, \"yolo_mode\", FREEDOM_CONFIG_DEFAULTS.yoloMode);\n\tconst doctrineVersion = readString(freedom, \"doctrine_version\", FREEDOM_CONFIG_DEFAULTS.doctrineVersion);\n\n\tif (yoloMode && approvalPolicy !== \"yolo\") {\n\t\tthrow new FreedomConfigError('yolo_mode=true requires approval_policy=\"yolo\"');\n\t}\n\n\tconst safetyFloorBlock = (freedom.safety_floor ?? {}) as TomlTable;\n\tfor (const [key, value] of Object.entries(safetyFloorBlock)) {\n\t\tif (value !== \"enforced\") {\n\t\t\tthrow new FreedomConfigError(\n\t\t\t\t`[freedom.safety_floor] '${key}' must be \"enforced\", got ${JSON.stringify(value)}`,\n\t\t\t);\n\t\t}\n\t}\n\n\tconst bannerBlock = (freedom.banner ?? {}) as TomlTable;\n\tconst banner = {\n\t\tshow: readBool(bannerBlock, \"show\", FREEDOM_CONFIG_DEFAULTS.banner.show),\n\t\tsuppressAfter: readSuppressAfter(bannerBlock),\n\t};\n\n\tconst auditBlock = (freedom.audit ?? {}) as TomlTable;\n\tconst audit = {\n\t\temitEvents: readBool(auditBlock, \"emit_events\", FREEDOM_CONFIG_DEFAULTS.audit.emitEvents),\n\t\tincludeArgs: readBool(auditBlock, \"include_args\", FREEDOM_CONFIG_DEFAULTS.audit.includeArgs),\n\t\tlogPath: readString(auditBlock, \"log_path\", FREEDOM_CONFIG_DEFAULTS.audit.logPath),\n\t};\n\n\treturn {\n\t\tenabled,\n\t\tapprovalPolicy,\n\t\tyoloMode,\n\t\tsafetyFloor: { enforced: true },\n\t\tbanner,\n\t\taudit,\n\t\tdoctrineVersion,\n\t};\n}\n\nfunction readBool(table: TomlTable, key: string, fallback: boolean): boolean {\n\tconst value = table[key];\n\tif (value === undefined) return fallback;\n\tif (typeof value !== \"boolean\") {\n\t\tthrow new FreedomConfigError(`'${key}' must be a boolean, got ${JSON.stringify(value)}`);\n\t}\n\treturn value;\n}\n\nfunction readString(table: TomlTable, key: string, fallback: string): string {\n\tconst value = table[key];\n\tif (value === undefined) return fallback;\n\tif (typeof value !== \"string\") {\n\t\tthrow new FreedomConfigError(`'${key}' must be a string, got ${JSON.stringify(value)}`);\n\t}\n\treturn value;\n}\n\nfunction readApprovalPolicy(table: TomlTable): ApprovalPolicy {\n\tconst value = table.approval_policy;\n\tif (value === undefined) return FREEDOM_CONFIG_DEFAULTS.approvalPolicy;\n\tif (value === \"yolo\" || value === \"prompt-per-tool\") return value;\n\tthrow new FreedomConfigError(`approval_policy must be \"yolo\" or \"prompt-per-tool\", got ${JSON.stringify(value)}`);\n}\n\nfunction readSuppressAfter(table: TomlTable): \"session\" | \"forever\" {\n\tconst value = table.suppress_after;\n\tif (value === undefined) return FREEDOM_CONFIG_DEFAULTS.banner.suppressAfter;\n\tif (value === \"session\" || value === \"forever\") return value;\n\tthrow new FreedomConfigError(`suppress_after must be \"session\" or \"forever\", got ${JSON.stringify(value)}`);\n}\n"]}

package/dist/core/freedom/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Public surface for the OMK freedom-mode runtime.
+ *
+ * Tool dispatchers import `gate`. The interactive TUI imports `badgeText` and
+ * `bannerOnce`. Subprocess spawners import `applyFreedomEnv`. Everything else
+ * is implementation detail and stays inside this directory.
+ *
+ * Design: every doctrine clause from AGENTS.md §0 has exactly one owner here.
+ *   - §0.1 safety floor  → safety-floor.ts (always-on, never downgradable)
+ *   - §0.2 defaults      → config.ts (parsed from .omk/config.toml)
+ *   - §0.3 no moralizing → not enforced at runtime (system prompt only)
+ *   - banner & badge     → banner.ts + policy.badgeText
+ *   - subprocess env     → policy.applyFreedomEnv
+ */
+export type { BannerMemo } from "./banner.ts";
+export { bannerOnce } from "./banner.ts";
+export type { ApprovalPolicy, FreedomConfig } from "./config.ts";
+export { FREEDOM_CONFIG_DEFAULTS, FreedomConfigError, loadFreedomConfig, parseFreedomConfigFromString, } from "./config.ts";
+export type { PolicyDecision, ToolCallContext } from "./policy.ts";
+export { applyFreedomEnv, badgeText, gate } from "./policy.ts";
+export type { MatcherVerdict } from "./safety-floor.ts";
+export { redactSecrets, runSafetyFloor } from "./safety-floor.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/core/freedom/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/freedom/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACN,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,4BAA4B,GAC5B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAC/D,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC","sourcesContent":["/**\n * Public surface for the OMK freedom-mode runtime.\n *\n * Tool dispatchers import `gate`. The interactive TUI imports `badgeText` and\n * `bannerOnce`. Subprocess spawners import `applyFreedomEnv`. Everything else\n * is implementation detail and stays inside this directory.\n *\n * Design: every doctrine clause from AGENTS.md §0 has exactly one owner here.\n *   - §0.1 safety floor  → safety-floor.ts (always-on, never downgradable)\n *   - §0.2 defaults      → config.ts (parsed from .omk/config.toml)\n *   - §0.3 no moralizing → not enforced at runtime (system prompt only)\n *   - banner & badge     → banner.ts + policy.badgeText\n *   - subprocess env     → policy.applyFreedomEnv\n */\n\nexport type { BannerMemo } from \"./banner.ts\";\nexport { bannerOnce } from \"./banner.ts\";\nexport type { ApprovalPolicy, FreedomConfig } from \"./config.ts\";\nexport {\n\tFREEDOM_CONFIG_DEFAULTS,\n\tFreedomConfigError,\n\tloadFreedomConfig,\n\tparseFreedomConfigFromString,\n} from \"./config.ts\";\nexport type { PolicyDecision, ToolCallContext } from \"./policy.ts\";\nexport { applyFreedomEnv, badgeText, gate } from \"./policy.ts\";\nexport type { MatcherVerdict } from \"./safety-floor.ts\";\nexport { redactSecrets, runSafetyFloor } from \"./safety-floor.ts\";\n"]}

package/dist/core/freedom/index.js

@@ -0,0 +1,19 @@
+/**
+ * Public surface for the OMK freedom-mode runtime.
+ *
+ * Tool dispatchers import `gate`. The interactive TUI imports `badgeText` and
+ * `bannerOnce`. Subprocess spawners import `applyFreedomEnv`. Everything else
+ * is implementation detail and stays inside this directory.
+ *
+ * Design: every doctrine clause from AGENTS.md §0 has exactly one owner here.
+ *   - §0.1 safety floor  → safety-floor.ts (always-on, never downgradable)
+ *   - §0.2 defaults      → config.ts (parsed from .omk/config.toml)
+ *   - §0.3 no moralizing → not enforced at runtime (system prompt only)
+ *   - banner & badge     → banner.ts + policy.badgeText
+ *   - subprocess env     → policy.applyFreedomEnv
+ */
+export { bannerOnce } from "./banner.js";
+export { FREEDOM_CONFIG_DEFAULTS, FreedomConfigError, loadFreedomConfig, parseFreedomConfigFromString, } from "./config.js";
+export { applyFreedomEnv, badgeText, gate } from "./policy.js";
+export { redactSecrets, runSafetyFloor } from "./safety-floor.js";
+//# sourceMappingURL=index.js.map

package/dist/core/freedom/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/freedom/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACN,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,4BAA4B,GAC5B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC","sourcesContent":["/**\n * Public surface for the OMK freedom-mode runtime.\n *\n * Tool dispatchers import `gate`. The interactive TUI imports `badgeText` and\n * `bannerOnce`. Subprocess spawners import `applyFreedomEnv`. Everything else\n * is implementation detail and stays inside this directory.\n *\n * Design: every doctrine clause from AGENTS.md §0 has exactly one owner here.\n *   - §0.1 safety floor  → safety-floor.ts (always-on, never downgradable)\n *   - §0.2 defaults      → config.ts (parsed from .omk/config.toml)\n *   - §0.3 no moralizing → not enforced at runtime (system prompt only)\n *   - banner & badge     → banner.ts + policy.badgeText\n *   - subprocess env     → policy.applyFreedomEnv\n */\n\nexport type { BannerMemo } from \"./banner.ts\";\nexport { bannerOnce } from \"./banner.ts\";\nexport type { ApprovalPolicy, FreedomConfig } from \"./config.ts\";\nexport {\n\tFREEDOM_CONFIG_DEFAULTS,\n\tFreedomConfigError,\n\tloadFreedomConfig,\n\tparseFreedomConfigFromString,\n} from \"./config.ts\";\nexport type { PolicyDecision, ToolCallContext } from \"./policy.ts\";\nexport { applyFreedomEnv, badgeText, gate } from \"./policy.ts\";\nexport type { MatcherVerdict } from \"./safety-floor.ts\";\nexport { redactSecrets, runSafetyFloor } from \"./safety-floor.ts\";\n"]}

package/dist/core/freedom/policy.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Freedom-mode policy gate.
+ *
+ * The dispatcher wraps every tool call in `gate(call, cfg)`. Three outcomes:
+ *
+ *   - `allow`: dispatcher runs the tool without an interactive prompt.
+ *   - `require-confirm`: dispatcher falls back to its existing confirm UI.
+ *   - `deny-hard`: dispatcher returns a FailClosedToolResult and never runs.
+ *
+ * The safety floor (`safety-floor.ts`) is always consulted first. Only when
+ * the floor passes do we look at the approval policy from `.omk/config.toml`.
+ * Freedom mode can flip the second decision (approval) but never the first
+ * (safety floor), which matches AGENTS.md §0.1 ("non-negotiable").
+ */
+import type { HookFailureCode } from "../hooks/types.ts";
+import type { FreedomConfig } from "./config.ts";
+import { type ToolCallContext } from "./safety-floor.ts";
+export type { ToolCallContext } from "./safety-floor.ts";
+export type PolicyDecision = {
+    kind: "allow";
+} | {
+    kind: "require-confirm";
+    reason: string;
+} | {
+    kind: "deny-hard";
+    code: HookFailureCode;
+    reason: string;
+};
+export declare function gate(call: ToolCallContext, cfg: FreedomConfig): PolicyDecision;
+/**
+ * UI surface: returns a short badge string when freedom mode is on, otherwise
+ * undefined. Used by the interactive footer.
+ */
+export declare function badgeText(cfg: FreedomConfig): string | undefined;
+/**
+ * Environment passthrough for child processes spawned under freedom mode.
+ * Mirrors the legacy shell hook's exports for code that still reads them, but
+ * never auto-sets the advanced flags (TOS bypass / dark-web crawl); those must
+ * be enabled explicitly via a future [freedom.advanced] block.
+ */
+export declare function applyFreedomEnv(env: NodeJS.ProcessEnv, cfg: FreedomConfig): NodeJS.ProcessEnv;
+//# sourceMappingURL=policy.d.ts.map

package/dist/core/freedom/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/core/freedom/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,MAAM,cAAc,GACvB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,wBAAgB,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,GAAG,cAAc,CAiB9E;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAGhE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,UAAU,CAS7F","sourcesContent":["/**\n * Freedom-mode policy gate.\n *\n * The dispatcher wraps every tool call in `gate(call, cfg)`. Three outcomes:\n *\n *   - `allow`: dispatcher runs the tool without an interactive prompt.\n *   - `require-confirm`: dispatcher falls back to its existing confirm UI.\n *   - `deny-hard`: dispatcher returns a FailClosedToolResult and never runs.\n *\n * The safety floor (`safety-floor.ts`) is always consulted first. Only when\n * the floor passes do we look at the approval policy from `.omk/config.toml`.\n * Freedom mode can flip the second decision (approval) but never the first\n * (safety floor), which matches AGENTS.md §0.1 (\"non-negotiable\").\n */\nimport type { HookFailureCode } from \"../hooks/types.ts\";\nimport type { FreedomConfig } from \"./config.ts\";\nimport { runSafetyFloor, type ToolCallContext } from \"./safety-floor.ts\";\n\nexport type { ToolCallContext } from \"./safety-floor.ts\";\n\nexport type PolicyDecision =\n\t| { kind: \"allow\" }\n\t| { kind: \"require-confirm\"; reason: string }\n\t| { kind: \"deny-hard\"; code: HookFailureCode; reason: string };\n\nexport function gate(call: ToolCallContext, cfg: FreedomConfig): PolicyDecision {\n\t// §0.1 floor first. The floor can hard-deny or upgrade to require-confirm\n\t// (privilege escalation). It never returns 'allow' on its own.\n\tconst floor = runSafetyFloor(call);\n\tif (floor.kind === \"deny-hard\") return floor;\n\tif (floor.kind === \"require-confirm\") return floor;\n\n\t// Floor passed. Now consult the approval policy.\n\tif (cfg.enabled && cfg.approvalPolicy === \"yolo\" && cfg.yoloMode) {\n\t\treturn { kind: \"allow\" };\n\t}\n\treturn {\n\t\tkind: \"require-confirm\",\n\t\treason: cfg.enabled\n\t\t\t? \"approval_policy is not 'yolo'; falling back to per-tool confirmation.\"\n\t\t\t: \"Freedom mode disabled; per-tool confirmation required.\",\n\t};\n}\n\n/**\n * UI surface: returns a short badge string when freedom mode is on, otherwise\n * undefined. Used by the interactive footer.\n */\nexport function badgeText(cfg: FreedomConfig): string | undefined {\n\tif (!cfg.enabled) return undefined;\n\treturn cfg.approvalPolicy === \"yolo\" && cfg.yoloMode ? \"freedom·yolo\" : \"freedom·prompt\";\n}\n\n/**\n * Environment passthrough for child processes spawned under freedom mode.\n * Mirrors the legacy shell hook's exports for code that still reads them, but\n * never auto-sets the advanced flags (TOS bypass / dark-web crawl); those must\n * be enabled explicitly via a future [freedom.advanced] block.\n */\nexport function applyFreedomEnv(env: NodeJS.ProcessEnv, cfg: FreedomConfig): NodeJS.ProcessEnv {\n\tif (!cfg.enabled) return env;\n\tconst out: NodeJS.ProcessEnv = { ...env };\n\tout.OMK_FREEDOM_MODE = \"true\";\n\tout.OMK_DOCTRINE_VERSION = cfg.doctrineVersion;\n\tif (cfg.approvalPolicy === \"yolo\" && cfg.yoloMode) {\n\t\tout.OMK_EXECUTE_ALL = \"true\";\n\t}\n\treturn out;\n}\n"]}

package/dist/core/freedom/policy.js

@@ -0,0 +1,47 @@
+import { runSafetyFloor } from "./safety-floor.js";
+export function gate(call, cfg) {
+    // §0.1 floor first. The floor can hard-deny or upgrade to require-confirm
+    // (privilege escalation). It never returns 'allow' on its own.
+    const floor = runSafetyFloor(call);
+    if (floor.kind === "deny-hard")
+        return floor;
+    if (floor.kind === "require-confirm")
+        return floor;
+    // Floor passed. Now consult the approval policy.
+    if (cfg.enabled && cfg.approvalPolicy === "yolo" && cfg.yoloMode) {
+        return { kind: "allow" };
+    }
+    return {
+        kind: "require-confirm",
+        reason: cfg.enabled
+            ? "approval_policy is not 'yolo'; falling back to per-tool confirmation."
+            : "Freedom mode disabled; per-tool confirmation required.",
+    };
+}
+/**
+ * UI surface: returns a short badge string when freedom mode is on, otherwise
+ * undefined. Used by the interactive footer.
+ */
+export function badgeText(cfg) {
+    if (!cfg.enabled)
+        return undefined;
+    return cfg.approvalPolicy === "yolo" && cfg.yoloMode ? "freedom·yolo" : "freedom·prompt";
+}
+/**
+ * Environment passthrough for child processes spawned under freedom mode.
+ * Mirrors the legacy shell hook's exports for code that still reads them, but
+ * never auto-sets the advanced flags (TOS bypass / dark-web crawl); those must
+ * be enabled explicitly via a future [freedom.advanced] block.
+ */
+export function applyFreedomEnv(env, cfg) {
+    if (!cfg.enabled)
+        return env;
+    const out = { ...env };
+    out.OMK_FREEDOM_MODE = "true";
+    out.OMK_DOCTRINE_VERSION = cfg.doctrineVersion;
+    if (cfg.approvalPolicy === "yolo" && cfg.yoloMode) {
+        out.OMK_EXECUTE_ALL = "true";
+    }
+    return out;
+}
+//# sourceMappingURL=policy.js.map

package/dist/core/freedom/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/core/freedom/policy.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,cAAc,EAAwB,MAAM,mBAAmB,CAAC;AASzE,MAAM,UAAU,IAAI,CAAC,IAAqB,EAAE,GAAkB,EAAkB;IAC/E,2EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAEnD,iDAAiD;IACjD,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO;QACN,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,GAAG,CAAC,OAAO;YAClB,CAAC,CAAC,uEAAuE;YACzE,CAAC,CAAC,wDAAwD;KAC3D,CAAC;AAAA,CACF;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAkB,EAAsB;IACjE,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACnC,OAAO,GAAG,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAc,CAAC,CAAC,CAAC,iBAAgB,CAAC;AAAA,CACzF;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAsB,EAAE,GAAkB,EAAqB;IAC9F,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC;IAC7B,MAAM,GAAG,GAAsB,EAAE,GAAG,GAAG,EAAE,CAAC;IAC1C,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC;IAC9B,GAAG,CAAC,oBAAoB,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/C,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACnD,GAAG,CAAC,eAAe,GAAG,MAAM,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AAAA,CACX","sourcesContent":["/**\n * Freedom-mode policy gate.\n *\n * The dispatcher wraps every tool call in `gate(call, cfg)`. Three outcomes:\n *\n *   - `allow`: dispatcher runs the tool without an interactive prompt.\n *   - `require-confirm`: dispatcher falls back to its existing confirm UI.\n *   - `deny-hard`: dispatcher returns a FailClosedToolResult and never runs.\n *\n * The safety floor (`safety-floor.ts`) is always consulted first. Only when\n * the floor passes do we look at the approval policy from `.omk/config.toml`.\n * Freedom mode can flip the second decision (approval) but never the first\n * (safety floor), which matches AGENTS.md §0.1 (\"non-negotiable\").\n */\nimport type { HookFailureCode } from \"../hooks/types.ts\";\nimport type { FreedomConfig } from \"./config.ts\";\nimport { runSafetyFloor, type ToolCallContext } from \"./safety-floor.ts\";\n\nexport type { ToolCallContext } from \"./safety-floor.ts\";\n\nexport type PolicyDecision =\n\t| { kind: \"allow\" }\n\t| { kind: \"require-confirm\"; reason: string }\n\t| { kind: \"deny-hard\"; code: HookFailureCode; reason: string };\n\nexport function gate(call: ToolCallContext, cfg: FreedomConfig): PolicyDecision {\n\t// §0.1 floor first. The floor can hard-deny or upgrade to require-confirm\n\t// (privilege escalation). It never returns 'allow' on its own.\n\tconst floor = runSafetyFloor(call);\n\tif (floor.kind === \"deny-hard\") return floor;\n\tif (floor.kind === \"require-confirm\") return floor;\n\n\t// Floor passed. Now consult the approval policy.\n\tif (cfg.enabled && cfg.approvalPolicy === \"yolo\" && cfg.yoloMode) {\n\t\treturn { kind: \"allow\" };\n\t}\n\treturn {\n\t\tkind: \"require-confirm\",\n\t\treason: cfg.enabled\n\t\t\t? \"approval_policy is not 'yolo'; falling back to per-tool confirmation.\"\n\t\t\t: \"Freedom mode disabled; per-tool confirmation required.\",\n\t};\n}\n\n/**\n * UI surface: returns a short badge string when freedom mode is on, otherwise\n * undefined. Used by the interactive footer.\n */\nexport function badgeText(cfg: FreedomConfig): string | undefined {\n\tif (!cfg.enabled) return undefined;\n\treturn cfg.approvalPolicy === \"yolo\" && cfg.yoloMode ? \"freedom·yolo\" : \"freedom·prompt\";\n}\n\n/**\n * Environment passthrough for child processes spawned under freedom mode.\n * Mirrors the legacy shell hook's exports for code that still reads them, but\n * never auto-sets the advanced flags (TOS bypass / dark-web crawl); those must\n * be enabled explicitly via a future [freedom.advanced] block.\n */\nexport function applyFreedomEnv(env: NodeJS.ProcessEnv, cfg: FreedomConfig): NodeJS.ProcessEnv {\n\tif (!cfg.enabled) return env;\n\tconst out: NodeJS.ProcessEnv = { ...env };\n\tout.OMK_FREEDOM_MODE = \"true\";\n\tout.OMK_DOCTRINE_VERSION = cfg.doctrineVersion;\n\tif (cfg.approvalPolicy === \"yolo\" && cfg.yoloMode) {\n\t\tout.OMK_EXECUTE_ALL = \"true\";\n\t}\n\treturn out;\n}\n"]}

package/dist/core/freedom/safety-floor.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Non-negotiable §0.1 safety floor matchers.
+ *
+ * These are deterministic, pure functions used by `policy.ts:gate()`. They
+ * implement the four runtime-enforceable clauses from AGENTS.md §0.1:
+ *
+ *   1. Secrets must never be read, logged, or transmitted.
+ *   2. Privilege escalation must require an explicit per-command user confirm.
+ *   3. Filesystem-destructive commands at root or home are hard-denied.
+ *   4. Tool calls must stay inside the lane grant's writeScope / executeScope.
+ *
+ * Clause 5 (§0.3 "no moralizing") is an LLM behavior clause and lives in the
+ * orchestrator system prompt; there is no runtime matcher for it.
+ *
+ * Every matcher fails closed: if its internal regex throws, the call is
+ * treated as a hard deny instead of an implicit allow. This is enforced by
+ * the wrapper helpers in `policy.ts`, not here, so the matchers themselves
+ * can stay tiny and testable.
+ */
+import type { HookFailureCode } from "../hooks/types.ts";
+export interface ToolCallContext {
+    tool: "bash" | "edit" | "write" | "read";
+    args: {
+        path?: string;
+        command?: string;
+        [key: string]: unknown;
+    };
+    laneGrant?: {
+        writeScope?: readonly string[];
+        executeScope?: readonly string[];
+    };
+}
+export type MatcherVerdict = {
+    kind: "pass";
+} | {
+    kind: "require-confirm";
+    reason: string;
+} | {
+    kind: "deny-hard";
+    code: HookFailureCode;
+    reason: string;
+};
+/**
+ * Clause 1 — secrets. Block reads/writes/edits targeting credential files.
+ * Bash matchers check the command's argv for known credential paths too.
+ */
+export declare function checkSecretsClause(call: ToolCallContext): MatcherVerdict;
+/**
+ * Clause 2 — privilege escalation. Even under yolo mode, sudo/su require an
+ * explicit confirm. Never auto-approved.
+ */
+export declare function checkPrivilegeClause(call: ToolCallContext): MatcherVerdict;
+/**
+ * Clause 3 — filesystem destruction. Hard deny. No override path.
+ */
+export declare function checkFsDestructionClause(call: ToolCallContext): MatcherVerdict;
+/**
+ * Clause 4 — scope. Edits/writes must land inside writeScope; bash must stay
+ * inside executeScope when configured. Empty/undefined scope = no constraint
+ * (e.g. local CLI usage without a lane grant).
+ */
+export declare function checkScopeClause(call: ToolCallContext): MatcherVerdict;
+/**
+ * Redact bearer tokens and other secret-looking substrings before any sink
+ * (logger, audit event, tool result returned to the LLM).
+ */
+export declare function redactSecrets(input: string): string;
+/**
+ * Run every clause in order. First non-pass verdict wins; deny-hard beats
+ * require-confirm in the rare case both fire (privilege + fs-destruction).
+ */
+export declare function runSafetyFloor(call: ToolCallContext): MatcherVerdict;
+//# sourceMappingURL=safety-floor.d.ts.map

package/dist/core/freedom/safety-floor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety-floor.d.ts","sourceRoot":"","sources":["../../../src/core/freedom/safety-floor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACzC,IAAI,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACvB,CAAC;IACF,SAAS,CAAC,EAAE;QACX,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC/B,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACjC,CAAC;CACF;AAED,MAAM,MAAM,cAAc,GACvB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAgGhE;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAsBxE;AAuBD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAa1E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAc9E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAiCtE;AAsBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAiBpE","sourcesContent":["/**\n * Non-negotiable §0.1 safety floor matchers.\n *\n * These are deterministic, pure functions used by `policy.ts:gate()`. They\n * implement the four runtime-enforceable clauses from AGENTS.md §0.1:\n *\n *   1. Secrets must never be read, logged, or transmitted.\n *   2. Privilege escalation must require an explicit per-command user confirm.\n *   3. Filesystem-destructive commands at root or home are hard-denied.\n *   4. Tool calls must stay inside the lane grant's writeScope / executeScope.\n *\n * Clause 5 (§0.3 \"no moralizing\") is an LLM behavior clause and lives in the\n * orchestrator system prompt; there is no runtime matcher for it.\n *\n * Every matcher fails closed: if its internal regex throws, the call is\n * treated as a hard deny instead of an implicit allow. This is enforced by\n * the wrapper helpers in `policy.ts`, not here, so the matchers themselves\n * can stay tiny and testable.\n */\nimport type { HookFailureCode } from \"../hooks/types.ts\";\n\nexport interface ToolCallContext {\n\ttool: \"bash\" | \"edit\" | \"write\" | \"read\";\n\targs: {\n\t\tpath?: string;\n\t\tcommand?: string;\n\t\t[key: string]: unknown;\n\t};\n\tlaneGrant?: {\n\t\twriteScope?: readonly string[];\n\t\texecuteScope?: readonly string[];\n\t};\n}\n\nexport type MatcherVerdict =\n\t| { kind: \"pass\" }\n\t| { kind: \"require-confirm\"; reason: string }\n\t| { kind: \"deny-hard\"; code: HookFailureCode; reason: string };\n\nconst SECRET_PATH_PATTERNS: readonly RegExp[] = [\n\t/(^|\\/)\\.env(\\.|$)/i,\n\t/(^|\\/)\\.env$/i,\n\t/(^|\\/)auth\\.json$/i,\n\t/(^|\\/)\\.netrc$/i,\n\t/(^|\\/)\\.aws\\/credentials$/i,\n\t/(^|\\/)\\.ssh\\/(id_[a-z0-9]+|[a-z0-9_-]+_(rsa|ed25519|ecdsa|dsa))$/i,\n\t/\\.pem$/i,\n\t/\\.key$/i,\n\t/(^|\\/)[^/]*secret[^/]*$/i,\n\t/(^|\\/)[^/]*token[^/]*$/i,\n];\n\nconst SECRET_CONTENT_PATTERNS: readonly RegExp[] = [\n\t/npm_[A-Za-z0-9_-]{16,}/g,\n\t/\\bgh[pousr]_[A-Za-z0-9]{36}\\b/g,\n\t/\\bxox[bpars]-[A-Za-z0-9-]+\\b/g,\n\t/\\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\\b/g,\n\t/\\bAKIA[0-9A-Z]{16}\\b/g,\n];\n\nconst PRIVILEGE_ESCALATION_PATTERNS: readonly RegExp[] = [\n\t/^\\s*sudo(\\s|$)/,\n\t/^\\s*su(\\s|$)/,\n\t/(^|\\s|;|&&|\\|\\|)sudo\\s/,\n\t/(^|\\s|;|&&|\\|\\|)su\\s/,\n\t/(^|\\s)doas(\\s|$)/,\n\t/chmod\\s+[ug]\\+s\\b/,\n\t/\\bsetcap\\s/,\n];\n\nconst FS_DESTRUCTION_PATTERNS: readonly RegExp[] = [\n\t/\\brm\\s+(-[a-zA-Z]*[rRfF][a-zA-Z]*\\s+)+(\\/|~|\\$HOME|\"\\/\"|'\\/')(\\s|$)/,\n\t/\\bmkfs(\\.\\w+)?\\s/,\n\t/\\bdd\\b[^|;&]*\\bof=\\/dev\\//,\n\t/:\\(\\)\\s*\\{\\s*:\\s*\\|\\s*:\\s*&\\s*\\}\\s*;\\s*:/,\n\t/\\bchmod\\s+-R\\s+0+\\s+\\/(\\s|$)/,\n];\n\nconst REDACTION_PLACEHOLDER = \"***REDACTED***\";\n\nfunction normalizePath(input: string): string {\n\treturn input.replace(/\\\\/g, \"/\");\n}\n\nfunction basename(input: string): string {\n\tconst normalized = normalizePath(input);\n\tconst idx = normalized.lastIndexOf(\"/\");\n\treturn idx >= 0 ? normalized.slice(idx + 1) : normalized;\n}\n\nfunction matchesAnyGlob(path: string, scope: readonly string[]): boolean {\n\tif (scope.length === 0) return false;\n\tconst normalized = normalizePath(path);\n\tfor (const glob of scope) {\n\t\tconst re = globToRegex(glob);\n\t\tif (re.test(normalized)) return true;\n\t}\n\treturn false;\n}\n\nfunction globToRegex(glob: string): RegExp {\n\t// Minimal glob: ** -> .*, * -> [^/]*, ? -> [^/]. Other regex metachars escaped.\n\tconst normalized = normalizePath(glob);\n\tlet pattern = \"\";\n\tlet i = 0;\n\twhile (i < normalized.length) {\n\t\tconst c = normalized[i];\n\t\tif (c === \"*\" && normalized[i + 1] === \"*\") {\n\t\t\tpattern += \".*\";\n\t\t\ti += 2;\n\t\t\tcontinue;\n\t\t}\n\t\tif (c === \"*\") {\n\t\t\tpattern += \"[^/]*\";\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (c === \"?\") {\n\t\t\tpattern += \"[^/]\";\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (/[.+^${}()|[\\]\\\\]/.test(c)) {\n\t\t\tpattern += `\\\\${c}`;\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tpattern += c;\n\t\ti += 1;\n\t}\n\treturn new RegExp(`^${pattern}$`);\n}\n\n/**\n * Clause 1 — secrets. Block reads/writes/edits targeting credential files.\n * Bash matchers check the command's argv for known credential paths too.\n */\nexport function checkSecretsClause(call: ToolCallContext): MatcherVerdict {\n\tif (call.tool === \"read\" || call.tool === \"edit\" || call.tool === \"write\") {\n\t\tconst path = typeof call.args.path === \"string\" ? call.args.path : \"\";\n\t\tif (path && pathLooksLikeSecret(path)) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\treason: `Secrets clause blocks ${call.tool} on '${path}'.`,\n\t\t\t};\n\t\t}\n\t}\n\tif (call.tool === \"bash\") {\n\t\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\t\tif (cmd && bashTouchesSecret(cmd)) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\treason: \"Secrets clause blocks bash command that reads a credential file.\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\nfunction pathLooksLikeSecret(path: string): boolean {\n\tconst normalized = normalizePath(path);\n\tconst base = basename(normalized);\n\tfor (const re of SECRET_PATH_PATTERNS) {\n\t\tif (re.test(normalized) || re.test(base)) return true;\n\t}\n\treturn false;\n}\n\nfunction bashTouchesSecret(cmd: string): boolean {\n\t// Catch the obvious cat / cp / mv / less / head / tail / source <secret-path>.\n\tconst readVerbs = /\\b(cat|less|more|head|tail|tac|nl|od|hexdump|xxd|cp|mv|source|\\.)\\b\\s+([^\\s|;&<>]+)/g;\n\tlet match: RegExpExecArray | null = readVerbs.exec(cmd);\n\twhile (match !== null) {\n\t\tconst target = match[2];\n\t\tif (target && pathLooksLikeSecret(target)) return true;\n\t\tmatch = readVerbs.exec(cmd);\n\t}\n\treturn false;\n}\n\n/**\n * Clause 2 — privilege escalation. Even under yolo mode, sudo/su require an\n * explicit confirm. Never auto-approved.\n */\nexport function checkPrivilegeClause(call: ToolCallContext): MatcherVerdict {\n\tif (call.tool !== \"bash\") return { kind: \"pass\" };\n\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\tif (!cmd) return { kind: \"pass\" };\n\tfor (const re of PRIVILEGE_ESCALATION_PATTERNS) {\n\t\tif (re.test(cmd)) {\n\t\t\treturn {\n\t\t\t\tkind: \"require-confirm\",\n\t\t\t\treason: \"Privilege escalation requires explicit confirmation under §0.1.\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\n/**\n * Clause 3 — filesystem destruction. Hard deny. No override path.\n */\nexport function checkFsDestructionClause(call: ToolCallContext): MatcherVerdict {\n\tif (call.tool !== \"bash\") return { kind: \"pass\" };\n\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\tif (!cmd) return { kind: \"pass\" };\n\tfor (const re of FS_DESTRUCTION_PATTERNS) {\n\t\tif (re.test(cmd)) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\treason: \"Filesystem-destructive command is blocked by §0.1.\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\n/**\n * Clause 4 — scope. Edits/writes must land inside writeScope; bash must stay\n * inside executeScope when configured. Empty/undefined scope = no constraint\n * (e.g. local CLI usage without a lane grant).\n */\nexport function checkScopeClause(call: ToolCallContext): MatcherVerdict {\n\tconst grant = call.laneGrant;\n\tif (!grant) return { kind: \"pass\" };\n\tif (call.tool === \"write\" || call.tool === \"edit\") {\n\t\tconst writeScope = grant.writeScope;\n\t\tif (writeScope && writeScope.length > 0) {\n\t\t\tconst path = typeof call.args.path === \"string\" ? call.args.path : \"\";\n\t\t\tif (path && !matchesAnyGlob(path, writeScope)) {\n\t\t\t\treturn {\n\t\t\t\t\tkind: \"deny-hard\",\n\t\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\t\treason: `Path '${path}' is outside writeScope.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\tif (call.tool === \"bash\") {\n\t\tconst executeScope = grant.executeScope;\n\t\tif (executeScope && executeScope.length > 0) {\n\t\t\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\t\t\tconst touched = extractMutatingTargets(cmd);\n\t\t\tfor (const target of touched) {\n\t\t\t\tif (!matchesAnyGlob(target, executeScope)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tkind: \"deny-hard\",\n\t\t\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\t\t\treason: `Bash mutates '${target}' outside executeScope.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\nfunction extractMutatingTargets(cmd: string): string[] {\n\t// Heuristic: top-level >, >>, tee target; ignore quoted forms inside strings.\n\tconst targets: string[] = [];\n\tconst redirectRe = />>?\\s*([^\\s|;&<>'\"]+)/g;\n\tlet m: RegExpExecArray | null = redirectRe.exec(cmd);\n\twhile (m !== null) {\n\t\tconst t = m[1];\n\t\tif (t && t !== \"/dev/null\") targets.push(t);\n\t\tm = redirectRe.exec(cmd);\n\t}\n\tconst teeRe = /\\btee\\s+(?:-a\\s+)?([^\\s|;&<>'\"]+)/g;\n\tm = teeRe.exec(cmd);\n\twhile (m !== null) {\n\t\tconst t = m[1];\n\t\tif (t) targets.push(t);\n\t\tm = teeRe.exec(cmd);\n\t}\n\treturn targets;\n}\n\n/**\n * Redact bearer tokens and other secret-looking substrings before any sink\n * (logger, audit event, tool result returned to the LLM).\n */\nexport function redactSecrets(input: string): string {\n\tif (!input) return input;\n\tlet out = input;\n\tfor (const re of SECRET_CONTENT_PATTERNS) {\n\t\tout = out.replace(re, REDACTION_PLACEHOLDER);\n\t}\n\treturn out;\n}\n\n/**\n * Run every clause in order. First non-pass verdict wins; deny-hard beats\n * require-confirm in the rare case both fire (privilege + fs-destruction).\n */\nexport function runSafetyFloor(call: ToolCallContext): MatcherVerdict {\n\tconst checks = [checkSecretsClause, checkFsDestructionClause, checkScopeClause, checkPrivilegeClause];\n\tlet firstConfirm: MatcherVerdict | null = null;\n\tfor (const check of checks) {\n\t\ttry {\n\t\t\tconst verdict = check(call);\n\t\t\tif (verdict.kind === \"deny-hard\") return verdict;\n\t\t\tif (verdict.kind === \"require-confirm\" && !firstConfirm) firstConfirm = verdict;\n\t\t} catch (error) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_failed\",\n\t\t\t\treason: `Safety floor matcher threw: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t};\n\t\t}\n\t}\n\treturn firstConfirm ?? { kind: \"pass\" };\n}\n"]}

package/dist/core/freedom/safety-floor.js

@@ -0,0 +1,275 @@
+const SECRET_PATH_PATTERNS = [
+    /(^|\/)\.env(\.|$)/i,
+    /(^|\/)\.env$/i,
+    /(^|\/)auth\.json$/i,
+    /(^|\/)\.netrc$/i,
+    /(^|\/)\.aws\/credentials$/i,
+    /(^|\/)\.ssh\/(id_[a-z0-9]+|[a-z0-9_-]+_(rsa|ed25519|ecdsa|dsa))$/i,
+    /\.pem$/i,
+    /\.key$/i,
+    /(^|\/)[^/]*secret[^/]*$/i,
+    /(^|\/)[^/]*token[^/]*$/i,
+];
+const SECRET_CONTENT_PATTERNS = [
+    /npm_[A-Za-z0-9_-]{16,}/g,
+    /\bgh[pousr]_[A-Za-z0-9]{36}\b/g,
+    /\bxox[bpars]-[A-Za-z0-9-]+\b/g,
+    /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+];
+const PRIVILEGE_ESCALATION_PATTERNS = [
+    /^\s*sudo(\s|$)/,
+    /^\s*su(\s|$)/,
+    /(^|\s|;|&&|\|\|)sudo\s/,
+    /(^|\s|;|&&|\|\|)su\s/,
+    /(^|\s)doas(\s|$)/,
+    /chmod\s+[ug]\+s\b/,
+    /\bsetcap\s/,
+];
+const FS_DESTRUCTION_PATTERNS = [
+    /\brm\s+(-[a-zA-Z]*[rRfF][a-zA-Z]*\s+)+(\/|~|\$HOME|"\/"|'\/')(\s|$)/,
+    /\bmkfs(\.\w+)?\s/,
+    /\bdd\b[^|;&]*\bof=\/dev\//,
+    /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/,
+    /\bchmod\s+-R\s+0+\s+\/(\s|$)/,
+];
+const REDACTION_PLACEHOLDER = "***REDACTED***";
+function normalizePath(input) {
+    return input.replace(/\\/g, "/");
+}
+function basename(input) {
+    const normalized = normalizePath(input);
+    const idx = normalized.lastIndexOf("/");
+    return idx >= 0 ? normalized.slice(idx + 1) : normalized;
+}
+function matchesAnyGlob(path, scope) {
+    if (scope.length === 0)
+        return false;
+    const normalized = normalizePath(path);
+    for (const glob of scope) {
+        const re = globToRegex(glob);
+        if (re.test(normalized))
+            return true;
+    }
+    return false;
+}
+function globToRegex(glob) {
+    // Minimal glob: ** -> .*, * -> [^/]*, ? -> [^/]. Other regex metachars escaped.
+    const normalized = normalizePath(glob);
+    let pattern = "";
+    let i = 0;
+    while (i < normalized.length) {
+        const c = normalized[i];
+        if (c === "*" && normalized[i + 1] === "*") {
+            pattern += ".*";
+            i += 2;
+            continue;
+        }
+        if (c === "*") {
+            pattern += "[^/]*";
+            i += 1;
+            continue;
+        }
+        if (c === "?") {
+            pattern += "[^/]";
+            i += 1;
+            continue;
+        }
+        if (/[.+^${}()|[\]\\]/.test(c)) {
+            pattern += `\\${c}`;
+            i += 1;
+            continue;
+        }
+        pattern += c;
+        i += 1;
+    }
+    return new RegExp(`^${pattern}$`);
+}
+/**
+ * Clause 1 — secrets. Block reads/writes/edits targeting credential files.
+ * Bash matchers check the command's argv for known credential paths too.
+ */
+export function checkSecretsClause(call) {
+    if (call.tool === "read" || call.tool === "edit" || call.tool === "write") {
+        const path = typeof call.args.path === "string" ? call.args.path : "";
+        if (path && pathLooksLikeSecret(path)) {
+            return {
+                kind: "deny-hard",
+                code: "hook_rejected",
+                reason: `Secrets clause blocks ${call.tool} on '${path}'.`,
+            };
+        }
+    }
+    if (call.tool === "bash") {
+        const cmd = typeof call.args.command === "string" ? call.args.command : "";
+        if (cmd && bashTouchesSecret(cmd)) {
+            return {
+                kind: "deny-hard",
+                code: "hook_rejected",
+                reason: "Secrets clause blocks bash command that reads a credential file.",
+            };
+        }
+    }
+    return { kind: "pass" };
+}
+function pathLooksLikeSecret(path) {
+    const normalized = normalizePath(path);
+    const base = basename(normalized);
+    for (const re of SECRET_PATH_PATTERNS) {
+        if (re.test(normalized) || re.test(base))
+            return true;
+    }
+    return false;
+}
+function bashTouchesSecret(cmd) {
+    // Catch the obvious cat / cp / mv / less / head / tail / source <secret-path>.
+    const readVerbs = /\b(cat|less|more|head|tail|tac|nl|od|hexdump|xxd|cp|mv|source|\.)\b\s+([^\s|;&<>]+)/g;
+    let match = readVerbs.exec(cmd);
+    while (match !== null) {
+        const target = match[2];
+        if (target && pathLooksLikeSecret(target))
+            return true;
+        match = readVerbs.exec(cmd);
+    }
+    return false;
+}
+/**
+ * Clause 2 — privilege escalation. Even under yolo mode, sudo/su require an
+ * explicit confirm. Never auto-approved.
+ */
+export function checkPrivilegeClause(call) {
+    if (call.tool !== "bash")
+        return { kind: "pass" };
+    const cmd = typeof call.args.command === "string" ? call.args.command : "";
+    if (!cmd)
+        return { kind: "pass" };
+    for (const re of PRIVILEGE_ESCALATION_PATTERNS) {
+        if (re.test(cmd)) {
+            return {
+                kind: "require-confirm",
+                reason: "Privilege escalation requires explicit confirmation under §0.1.",
+            };
+        }
+    }
+    return { kind: "pass" };
+}
+/**
+ * Clause 3 — filesystem destruction. Hard deny. No override path.
+ */
+export function checkFsDestructionClause(call) {
+    if (call.tool !== "bash")
+        return { kind: "pass" };
+    const cmd = typeof call.args.command === "string" ? call.args.command : "";
+    if (!cmd)
+        return { kind: "pass" };
+    for (const re of FS_DESTRUCTION_PATTERNS) {
+        if (re.test(cmd)) {
+            return {
+                kind: "deny-hard",
+                code: "hook_rejected",
+                reason: "Filesystem-destructive command is blocked by §0.1.",
+            };
+        }
+    }
+    return { kind: "pass" };
+}
+/**
+ * Clause 4 — scope. Edits/writes must land inside writeScope; bash must stay
+ * inside executeScope when configured. Empty/undefined scope = no constraint
+ * (e.g. local CLI usage without a lane grant).
+ */
+export function checkScopeClause(call) {
+    const grant = call.laneGrant;
+    if (!grant)
+        return { kind: "pass" };
+    if (call.tool === "write" || call.tool === "edit") {
+        const writeScope = grant.writeScope;
+        if (writeScope && writeScope.length > 0) {
+            const path = typeof call.args.path === "string" ? call.args.path : "";
+            if (path && !matchesAnyGlob(path, writeScope)) {
+                return {
+                    kind: "deny-hard",
+                    code: "hook_rejected",
+                    reason: `Path '${path}' is outside writeScope.`,
+                };
+            }
+        }
+    }
+    if (call.tool === "bash") {
+        const executeScope = grant.executeScope;
+        if (executeScope && executeScope.length > 0) {
+            const cmd = typeof call.args.command === "string" ? call.args.command : "";
+            const touched = extractMutatingTargets(cmd);
+            for (const target of touched) {
+                if (!matchesAnyGlob(target, executeScope)) {
+                    return {
+                        kind: "deny-hard",
+                        code: "hook_rejected",
+                        reason: `Bash mutates '${target}' outside executeScope.`,
+                    };
+                }
+            }
+        }
+    }
+    return { kind: "pass" };
+}
+function extractMutatingTargets(cmd) {
+    // Heuristic: top-level >, >>, tee target; ignore quoted forms inside strings.
+    const targets = [];
+    const redirectRe = />>?\s*([^\s|;&<>'"]+)/g;
+    let m = redirectRe.exec(cmd);
+    while (m !== null) {
+        const t = m[1];
+        if (t && t !== "/dev/null")
+            targets.push(t);
+        m = redirectRe.exec(cmd);
+    }
+    const teeRe = /\btee\s+(?:-a\s+)?([^\s|;&<>'"]+)/g;
+    m = teeRe.exec(cmd);
+    while (m !== null) {
+        const t = m[1];
+        if (t)
+            targets.push(t);
+        m = teeRe.exec(cmd);
+    }
+    return targets;
+}
+/**
+ * Redact bearer tokens and other secret-looking substrings before any sink
+ * (logger, audit event, tool result returned to the LLM).
+ */
+export function redactSecrets(input) {
+    if (!input)
+        return input;
+    let out = input;
+    for (const re of SECRET_CONTENT_PATTERNS) {
+        out = out.replace(re, REDACTION_PLACEHOLDER);
+    }
+    return out;
+}
+/**
+ * Run every clause in order. First non-pass verdict wins; deny-hard beats
+ * require-confirm in the rare case both fire (privilege + fs-destruction).
+ */
+export function runSafetyFloor(call) {
+    const checks = [checkSecretsClause, checkFsDestructionClause, checkScopeClause, checkPrivilegeClause];
+    let firstConfirm = null;
+    for (const check of checks) {
+        try {
+            const verdict = check(call);
+            if (verdict.kind === "deny-hard")
+                return verdict;
+            if (verdict.kind === "require-confirm" && !firstConfirm)
+                firstConfirm = verdict;
+        }
+        catch (error) {
+            return {
+                kind: "deny-hard",
+                code: "hook_failed",
+                reason: `Safety floor matcher threw: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+    }
+    return firstConfirm ?? { kind: "pass" };
+}
+//# sourceMappingURL=safety-floor.js.map

package/dist/core/freedom/safety-floor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety-floor.js","sourceRoot":"","sources":["../../../src/core/freedom/safety-floor.ts"],"names":[],"mappings":"AAuCA,MAAM,oBAAoB,GAAsB;IAC/C,oBAAoB;IACpB,eAAe;IACf,oBAAoB;IACpB,iBAAiB;IACjB,4BAA4B;IAC5B,mEAAmE;IACnE,SAAS;IACT,SAAS;IACT,0BAA0B;IAC1B,yBAAyB;CACzB,CAAC;AAEF,MAAM,uBAAuB,GAAsB;IAClD,yBAAyB;IACzB,gCAAgC;IAChC,+BAA+B;IAC/B,sCAAsC;IACtC,uBAAuB;CACvB,CAAC;AAEF,MAAM,6BAA6B,GAAsB;IACxD,gBAAgB;IAChB,cAAc;IACd,wBAAwB;IACxB,sBAAsB;IACtB,kBAAkB;IAClB,mBAAmB;IACnB,YAAY;CACZ,CAAC;AAEF,MAAM,uBAAuB,GAAsB;IAClD,qEAAqE;IACrE,kBAAkB;IAClB,2BAA2B;IAC3B,0CAA0C;IAC1C,8BAA8B;CAC9B,CAAC;AAEF,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAE/C,SAAS,aAAa,CAAC,KAAa,EAAU;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAAA,CACjC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAU;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;AAAA,CACzD;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAwB,EAAW;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,WAAW,CAAC,IAAY,EAAU;IAC1C,gFAAgF;IAChF,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC5C,OAAO,IAAI,IAAI,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,IAAI,OAAO,CAAC;YACnB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,IAAI,MAAM,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QACD,OAAO,IAAI,CAAC,CAAC;QACb,CAAC,IAAI,CAAC,CAAC;IACR,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;AAAA,CAClC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAqB,EAAkB;IACzE,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO;gBACN,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,yBAAyB,IAAI,CAAC,IAAI,QAAQ,IAAI,IAAI;aAC1D,CAAC;QACH,CAAC;IACF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO;gBACN,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,kEAAkE;aAC1E,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAAA,CACxB;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAW;IACnD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,oBAAoB,EAAE,CAAC;QACvC,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAW;IAChD,+EAA+E;IAC/E,MAAM,SAAS,GAAG,sFAAsF,CAAC;IACzG,IAAI,KAAK,GAA2B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,KAAK,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqB,EAAkB;IAC3E,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,6BAA6B,EAAE,CAAC;QAChD,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO;gBACN,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,kEAAiE;aACzE,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAAA,CACxB;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAqB,EAAkB;IAC/E,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,uBAAuB,EAAE,CAAC;QAC1C,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO;gBACN,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,qDAAoD;aAC5D,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAAA,CACxB;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAqB,EAAkB;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC/C,OAAO;oBACN,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,eAAe;oBACrB,MAAM,EAAE,SAAS,IAAI,0BAA0B;iBAC/C,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;oBAC3C,OAAO;wBACN,IAAI,EAAE,WAAW;wBACjB,IAAI,EAAE,eAAe;wBACrB,MAAM,EAAE,iBAAiB,MAAM,yBAAyB;qBACxD,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAAA,CACxB;AAED,SAAS,sBAAsB,CAAC,GAAW,EAAY;IACtD,8EAA8E;IAC9E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,wBAAwB,CAAC;IAC5C,IAAI,CAAC,GAA2B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,KAAK,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,oCAAoC,CAAC;IACnD,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAU;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,uBAAuB,EAAE,CAAC;QAC1C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AAAA,CACX;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAqB,EAAkB;IACrE,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;IACtG,IAAI,YAAY,GAA0B,IAAI,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,OAAO,CAAC;YACjD,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,YAAY;gBAAE,YAAY,GAAG,OAAO,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO;gBACN,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/F,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,YAAY,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAAA,CACxC","sourcesContent":["/**\n * Non-negotiable §0.1 safety floor matchers.\n *\n * These are deterministic, pure functions used by `policy.ts:gate()`. They\n * implement the four runtime-enforceable clauses from AGENTS.md §0.1:\n *\n *   1. Secrets must never be read, logged, or transmitted.\n *   2. Privilege escalation must require an explicit per-command user confirm.\n *   3. Filesystem-destructive commands at root or home are hard-denied.\n *   4. Tool calls must stay inside the lane grant's writeScope / executeScope.\n *\n * Clause 5 (§0.3 \"no moralizing\") is an LLM behavior clause and lives in the\n * orchestrator system prompt; there is no runtime matcher for it.\n *\n * Every matcher fails closed: if its internal regex throws, the call is\n * treated as a hard deny instead of an implicit allow. This is enforced by\n * the wrapper helpers in `policy.ts`, not here, so the matchers themselves\n * can stay tiny and testable.\n */\nimport type { HookFailureCode } from \"../hooks/types.ts\";\n\nexport interface ToolCallContext {\n\ttool: \"bash\" | \"edit\" | \"write\" | \"read\";\n\targs: {\n\t\tpath?: string;\n\t\tcommand?: string;\n\t\t[key: string]: unknown;\n\t};\n\tlaneGrant?: {\n\t\twriteScope?: readonly string[];\n\t\texecuteScope?: readonly string[];\n\t};\n}\n\nexport type MatcherVerdict =\n\t| { kind: \"pass\" }\n\t| { kind: \"require-confirm\"; reason: string }\n\t| { kind: \"deny-hard\"; code: HookFailureCode; reason: string };\n\nconst SECRET_PATH_PATTERNS: readonly RegExp[] = [\n\t/(^|\\/)\\.env(\\.|$)/i,\n\t/(^|\\/)\\.env$/i,\n\t/(^|\\/)auth\\.json$/i,\n\t/(^|\\/)\\.netrc$/i,\n\t/(^|\\/)\\.aws\\/credentials$/i,\n\t/(^|\\/)\\.ssh\\/(id_[a-z0-9]+|[a-z0-9_-]+_(rsa|ed25519|ecdsa|dsa))$/i,\n\t/\\.pem$/i,\n\t/\\.key$/i,\n\t/(^|\\/)[^/]*secret[^/]*$/i,\n\t/(^|\\/)[^/]*token[^/]*$/i,\n];\n\nconst SECRET_CONTENT_PATTERNS: readonly RegExp[] = [\n\t/npm_[A-Za-z0-9_-]{16,}/g,\n\t/\\bgh[pousr]_[A-Za-z0-9]{36}\\b/g,\n\t/\\bxox[bpars]-[A-Za-z0-9-]+\\b/g,\n\t/\\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\\b/g,\n\t/\\bAKIA[0-9A-Z]{16}\\b/g,\n];\n\nconst PRIVILEGE_ESCALATION_PATTERNS: readonly RegExp[] = [\n\t/^\\s*sudo(\\s|$)/,\n\t/^\\s*su(\\s|$)/,\n\t/(^|\\s|;|&&|\\|\\|)sudo\\s/,\n\t/(^|\\s|;|&&|\\|\\|)su\\s/,\n\t/(^|\\s)doas(\\s|$)/,\n\t/chmod\\s+[ug]\\+s\\b/,\n\t/\\bsetcap\\s/,\n];\n\nconst FS_DESTRUCTION_PATTERNS: readonly RegExp[] = [\n\t/\\brm\\s+(-[a-zA-Z]*[rRfF][a-zA-Z]*\\s+)+(\\/|~|\\$HOME|\"\\/\"|'\\/')(\\s|$)/,\n\t/\\bmkfs(\\.\\w+)?\\s/,\n\t/\\bdd\\b[^|;&]*\\bof=\\/dev\\//,\n\t/:\\(\\)\\s*\\{\\s*:\\s*\\|\\s*:\\s*&\\s*\\}\\s*;\\s*:/,\n\t/\\bchmod\\s+-R\\s+0+\\s+\\/(\\s|$)/,\n];\n\nconst REDACTION_PLACEHOLDER = \"***REDACTED***\";\n\nfunction normalizePath(input: string): string {\n\treturn input.replace(/\\\\/g, \"/\");\n}\n\nfunction basename(input: string): string {\n\tconst normalized = normalizePath(input);\n\tconst idx = normalized.lastIndexOf(\"/\");\n\treturn idx >= 0 ? normalized.slice(idx + 1) : normalized;\n}\n\nfunction matchesAnyGlob(path: string, scope: readonly string[]): boolean {\n\tif (scope.length === 0) return false;\n\tconst normalized = normalizePath(path);\n\tfor (const glob of scope) {\n\t\tconst re = globToRegex(glob);\n\t\tif (re.test(normalized)) return true;\n\t}\n\treturn false;\n}\n\nfunction globToRegex(glob: string): RegExp {\n\t// Minimal glob: ** -> .*, * -> [^/]*, ? -> [^/]. Other regex metachars escaped.\n\tconst normalized = normalizePath(glob);\n\tlet pattern = \"\";\n\tlet i = 0;\n\twhile (i < normalized.length) {\n\t\tconst c = normalized[i];\n\t\tif (c === \"*\" && normalized[i + 1] === \"*\") {\n\t\t\tpattern += \".*\";\n\t\t\ti += 2;\n\t\t\tcontinue;\n\t\t}\n\t\tif (c === \"*\") {\n\t\t\tpattern += \"[^/]*\";\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (c === \"?\") {\n\t\t\tpattern += \"[^/]\";\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (/[.+^${}()|[\\]\\\\]/.test(c)) {\n\t\t\tpattern += `\\\\${c}`;\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tpattern += c;\n\t\ti += 1;\n\t}\n\treturn new RegExp(`^${pattern}$`);\n}\n\n/**\n * Clause 1 — secrets. Block reads/writes/edits targeting credential files.\n * Bash matchers check the command's argv for known credential paths too.\n */\nexport function checkSecretsClause(call: ToolCallContext): MatcherVerdict {\n\tif (call.tool === \"read\" || call.tool === \"edit\" || call.tool === \"write\") {\n\t\tconst path = typeof call.args.path === \"string\" ? call.args.path : \"\";\n\t\tif (path && pathLooksLikeSecret(path)) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\treason: `Secrets clause blocks ${call.tool} on '${path}'.`,\n\t\t\t};\n\t\t}\n\t}\n\tif (call.tool === \"bash\") {\n\t\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\t\tif (cmd && bashTouchesSecret(cmd)) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\treason: \"Secrets clause blocks bash command that reads a credential file.\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\nfunction pathLooksLikeSecret(path: string): boolean {\n\tconst normalized = normalizePath(path);\n\tconst base = basename(normalized);\n\tfor (const re of SECRET_PATH_PATTERNS) {\n\t\tif (re.test(normalized) || re.test(base)) return true;\n\t}\n\treturn false;\n}\n\nfunction bashTouchesSecret(cmd: string): boolean {\n\t// Catch the obvious cat / cp / mv / less / head / tail / source <secret-path>.\n\tconst readVerbs = /\\b(cat|less|more|head|tail|tac|nl|od|hexdump|xxd|cp|mv|source|\\.)\\b\\s+([^\\s|;&<>]+)/g;\n\tlet match: RegExpExecArray | null = readVerbs.exec(cmd);\n\twhile (match !== null) {\n\t\tconst target = match[2];\n\t\tif (target && pathLooksLikeSecret(target)) return true;\n\t\tmatch = readVerbs.exec(cmd);\n\t}\n\treturn false;\n}\n\n/**\n * Clause 2 — privilege escalation. Even under yolo mode, sudo/su require an\n * explicit confirm. Never auto-approved.\n */\nexport function checkPrivilegeClause(call: ToolCallContext): MatcherVerdict {\n\tif (call.tool !== \"bash\") return { kind: \"pass\" };\n\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\tif (!cmd) return { kind: \"pass\" };\n\tfor (const re of PRIVILEGE_ESCALATION_PATTERNS) {\n\t\tif (re.test(cmd)) {\n\t\t\treturn {\n\t\t\t\tkind: \"require-confirm\",\n\t\t\t\treason: \"Privilege escalation requires explicit confirmation under §0.1.\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\n/**\n * Clause 3 — filesystem destruction. Hard deny. No override path.\n */\nexport function checkFsDestructionClause(call: ToolCallContext): MatcherVerdict {\n\tif (call.tool !== \"bash\") return { kind: \"pass\" };\n\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\tif (!cmd) return { kind: \"pass\" };\n\tfor (const re of FS_DESTRUCTION_PATTERNS) {\n\t\tif (re.test(cmd)) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\treason: \"Filesystem-destructive command is blocked by §0.1.\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\n/**\n * Clause 4 — scope. Edits/writes must land inside writeScope; bash must stay\n * inside executeScope when configured. Empty/undefined scope = no constraint\n * (e.g. local CLI usage without a lane grant).\n */\nexport function checkScopeClause(call: ToolCallContext): MatcherVerdict {\n\tconst grant = call.laneGrant;\n\tif (!grant) return { kind: \"pass\" };\n\tif (call.tool === \"write\" || call.tool === \"edit\") {\n\t\tconst writeScope = grant.writeScope;\n\t\tif (writeScope && writeScope.length > 0) {\n\t\t\tconst path = typeof call.args.path === \"string\" ? call.args.path : \"\";\n\t\t\tif (path && !matchesAnyGlob(path, writeScope)) {\n\t\t\t\treturn {\n\t\t\t\t\tkind: \"deny-hard\",\n\t\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\t\treason: `Path '${path}' is outside writeScope.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\tif (call.tool === \"bash\") {\n\t\tconst executeScope = grant.executeScope;\n\t\tif (executeScope && executeScope.length > 0) {\n\t\t\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\t\t\tconst touched = extractMutatingTargets(cmd);\n\t\t\tfor (const target of touched) {\n\t\t\t\tif (!matchesAnyGlob(target, executeScope)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tkind: \"deny-hard\",\n\t\t\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\t\t\treason: `Bash mutates '${target}' outside executeScope.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\nfunction extractMutatingTargets(cmd: string): string[] {\n\t// Heuristic: top-level >, >>, tee target; ignore quoted forms inside strings.\n\tconst targets: string[] = [];\n\tconst redirectRe = />>?\\s*([^\\s|;&<>'\"]+)/g;\n\tlet m: RegExpExecArray | null = redirectRe.exec(cmd);\n\twhile (m !== null) {\n\t\tconst t = m[1];\n\t\tif (t && t !== \"/dev/null\") targets.push(t);\n\t\tm = redirectRe.exec(cmd);\n\t}\n\tconst teeRe = /\\btee\\s+(?:-a\\s+)?([^\\s|;&<>'\"]+)/g;\n\tm = teeRe.exec(cmd);\n\twhile (m !== null) {\n\t\tconst t = m[1];\n\t\tif (t) targets.push(t);\n\t\tm = teeRe.exec(cmd);\n\t}\n\treturn targets;\n}\n\n/**\n * Redact bearer tokens and other secret-looking substrings before any sink\n * (logger, audit event, tool result returned to the LLM).\n */\nexport function redactSecrets(input: string): string {\n\tif (!input) return input;\n\tlet out = input;\n\tfor (const re of SECRET_CONTENT_PATTERNS) {\n\t\tout = out.replace(re, REDACTION_PLACEHOLDER);\n\t}\n\treturn out;\n}\n\n/**\n * Run every clause in order. First non-pass verdict wins; deny-hard beats\n * require-confirm in the rare case both fire (privilege + fs-destruction).\n */\nexport function runSafetyFloor(call: ToolCallContext): MatcherVerdict {\n\tconst checks = [checkSecretsClause, checkFsDestructionClause, checkScopeClause, checkPrivilegeClause];\n\tlet firstConfirm: MatcherVerdict | null = null;\n\tfor (const check of checks) {\n\t\ttry {\n\t\t\tconst verdict = check(call);\n\t\t\tif (verdict.kind === \"deny-hard\") return verdict;\n\t\t\tif (verdict.kind === \"require-confirm\" && !firstConfirm) firstConfirm = verdict;\n\t\t} catch (error) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_failed\",\n\t\t\t\treason: `Safety floor matcher threw: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t};\n\t\t}\n\t}\n\treturn firstConfirm ?? { kind: \"pass\" };\n}\n"]}