open-multi-agent-kit 0.80.6 → 0.80.8

package/dist/core/loadout-access-policy.js

@@ -0,0 +1,182 @@
+import { existsSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
+export function assertLoadoutAccess(guard, request) {
+    if (!guard)
+        return;
+    const decision = guard(request);
+    if (!decision.allowed) {
+        throw new Error(`loadout: ${decision.reason}`);
+    }
+}
+const DEFAULT_BLOCKED_PATHS = ["**/.env*", "**/*secret*", "**/*key*", "**/.git", "**/.git/*"];
+export function createLoadoutAccessPolicy(options) {
+    const cwd = normalizeRootPath(options.cwd);
+    return {
+        cwd,
+        activeTools: uniqueSorted(options.activeTools.map((toolName) => toolName.trim()).filter((toolName) => toolName !== "")),
+        readRoots: normalizeAccessSet(cwd, options.readSet),
+        writeRoots: normalizeAccessSet(cwd, options.writeSet),
+        blockedPaths: uniqueSorted(options.blockedPaths ?? DEFAULT_BLOCKED_PATHS),
+        commands: options.commands ?? { mode: "none" },
+    };
+}
+export function isActiveLoadoutTool(policy, toolName) {
+    return policy.activeTools.includes(toolName.trim());
+}
+export function decideLoadoutAccess(policy, request) {
+    if (!isActiveLoadoutTool(policy, request.toolName)) {
+        return deny(`inactive tool: ${request.toolName}`);
+    }
+    if (request.operation === "execute")
+        return decideCommandAccess(policy, request);
+    return decidePathAccess(policy, request);
+}
+function decidePathAccess(policy, request) {
+    const normalizedPath = normalizeRequestPath(policy.cwd, request.path);
+    if (!normalizedPath)
+        return deny("invalid path");
+    if (isBlockedPath(policy, normalizedPath))
+        return deny("blocked path", normalizedPath);
+    if (request.operation === "read") {
+        const roots = uniqueSorted([...policy.readRoots, ...policy.writeRoots]);
+        if (roots.length === 0)
+            return deny("outside read scope: empty read/write set", normalizedPath);
+        if (roots.some((root) => containsPath(root, normalizedPath)))
+            return allow(normalizedPath);
+        return deny("outside read scope", normalizedPath);
+    }
+    if (policy.writeRoots.length === 0)
+        return deny("outside write scope: empty write set", normalizedPath);
+    if (policy.writeRoots.some((root) => containsPath(root, normalizedPath)))
+        return allow(normalizedPath);
+    return deny("outside write scope", normalizedPath);
+}
+function decideCommandAccess(policy, request) {
+    const normalizedCommand = request.command.trim();
+    if (normalizedCommand === "" || normalizedCommand.includes("\0"))
+        return denyCommand("invalid command");
+    if (policy.commands.mode === "none")
+        return denyCommand("command mode none");
+    if (policy.commands.blockPatterns?.some((pattern) => commandMatchesPattern(pattern, normalizedCommand))) {
+        return denyCommand("blocked command pattern");
+    }
+    if (policy.commands.allowPatterns?.some((pattern) => commandMatchesPattern(pattern, normalizedCommand))) {
+        return { allowed: true, reason: "allowed", normalizedCommand };
+    }
+    return denyCommand(`command mode ${policy.commands.mode} requires an explicit allow pattern`);
+}
+function allow(normalizedPath) {
+    return { allowed: true, reason: "allowed", normalizedPath };
+}
+function deny(reason, normalizedPath) {
+    return { allowed: false, reason, normalizedPath };
+}
+function denyCommand(reason) {
+    return { allowed: false, reason };
+}
+function normalizeRootPath(path) {
+    const normalized = normalizePathSeparators(path);
+    if (normalized.trim() === "" || normalized.includes("\0")) {
+        throw new Error("loadout access policy cwd must be a non-empty path");
+    }
+    return stripTrailingSeparator(canonicalizeExistingPrefix(resolve(normalized)));
+}
+function normalizeRequestPath(cwd, requestedPath) {
+    const normalized = normalizePathSeparators(requestedPath);
+    if (normalized.trim() === "" || normalized.includes("\0"))
+        return undefined;
+    return stripTrailingSeparator(canonicalizeExistingPrefix(resolve(cwd, normalized)));
+}
+function normalizeAccessSet(cwd, accessSet) {
+    if (!accessSet)
+        return [];
+    const roots = [];
+    for (const entry of accessSet) {
+        if (entry.symbols && entry.symbols.length > 0)
+            continue;
+        const normalized = normalizePathSeparators(entry.path);
+        if (normalized.trim() === "" || normalized.includes("\0"))
+            continue;
+        roots.push(stripTrailingSeparator(canonicalizeExistingPrefix(resolve(cwd, normalized))));
+    }
+    return uniqueSorted(roots);
+}
+function canonicalizeExistingPrefix(path) {
+    try {
+        return realpathSync.native(path);
+    }
+    catch {
+        if (existsSync(path))
+            return resolve(path);
+        const parent = dirname(path);
+        if (parent === path)
+            return resolve(path);
+        return resolve(canonicalizeExistingPrefix(parent), basename(path));
+    }
+}
+function containsPath(root, candidate) {
+    if (candidate === root)
+        return true;
+    const relativePath = relative(root, candidate);
+    return relativePath !== "" && !relativePath.startsWith("..") && !isAbsolute(relativePath);
+}
+function isBlockedPath(policy, normalizedPath) {
+    const relativeCandidate = toForwardSlashes(relative(policy.cwd, normalizedPath));
+    const candidates = uniqueSorted([toForwardSlashes(normalizedPath), relativeCandidate]);
+    return policy.blockedPaths.some((pattern) => candidates.some((candidate) => globMatch(pattern, candidate)));
+}
+function commandMatchesPattern(pattern, command) {
+    return pattern === command || globMatch(pattern, command);
+}
+function normalizePathSeparators(path) {
+    return path.replaceAll("\\", "/");
+}
+function stripTrailingSeparator(path) {
+    if (path === "/")
+        return path;
+    return path.endsWith("/") ? path.slice(0, -1) : path;
+}
+function toForwardSlashes(path) {
+    return path.replaceAll("\\", "/");
+}
+function globMatch(glob, value) {
+    return globToRegExp(normalizePathSeparators(glob)).test(toForwardSlashes(value));
+}
+function globToRegExp(glob) {
+    let pattern = "";
+    for (let index = 0; index < glob.length; index++) {
+        const char = glob[index];
+        if (char === "*") {
+            if (glob[index + 1] === "*") {
+                if (glob[index + 2] === "/") {
+                    pattern += "(?:.*/)?";
+                    index += 2;
+                }
+                else {
+                    pattern += ".*";
+                    index++;
+                }
+            }
+            else {
+                pattern += "[^/]*";
+            }
+        }
+        else if (char === "?") {
+            pattern += "[^/]";
+        }
+        else {
+            pattern += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${pattern}$`);
+}
+function uniqueSorted(values) {
+    return [...new Set(values)].sort((a, b) => {
+        if (a < b)
+            return -1;
+        if (a > b)
+            return 1;
+        return 0;
+    });
+}
+//# sourceMappingURL=loadout-access-policy.js.map

package/dist/core/loadout-access-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadout-access-policy.js","sourceRoot":"","sources":["../../src/core/loadout-access-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8C7E,MAAM,UAAU,mBAAmB,CAAC,KAAqC,EAAE,OAA6B,EAAQ;IAC/G,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;AAAA,CACD;AAED,MAAM,qBAAqB,GAAG,CAAC,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAU,CAAC;AAEvG,MAAM,UAAU,yBAAyB,CAAC,OAAyC,EAAuB;IACzG,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO;QACN,GAAG;QACH,WAAW,EAAE,YAAY,CACxB,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAC,CAC5F;QACD,SAAS,EAAE,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC;QACnD,UAAU,EAAE,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC;QACrD,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;QACzE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;KAC9C,CAAC;AAAA,CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAgD,EAAE,QAAgB,EAAW;IAChH,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAAA,CACpD;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA2B,EAAE,OAA6B,EAAyB;IACtH,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,kBAAkB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjF,OAAO,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAAA,CACzC;AAED,SAAS,gBAAgB,CAAC,MAA2B,EAAE,OAAiC,EAAyB;IAChH,MAAM,cAAc,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IACjD,IAAI,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAEvF,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,0CAA0C,EAAE,cAAc,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,cAAc,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,sCAAsC,EAAE,cAAc,CAAC,CAAC;IACxG,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,cAAc,CAAC,CAAC;IACvG,OAAO,IAAI,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;AAAA,CACnD;AAED,SAAS,mBAAmB,CAAC,MAA2B,EAAE,OAAoC,EAAyB;IACtH,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,iBAAiB,KAAK,EAAE,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACxG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;QACzG,OAAO,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;QACzG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,WAAW,CAAC,gBAAgB,MAAM,CAAC,QAAQ,CAAC,IAAI,qCAAqC,CAAC,CAAC;AAAA,CAC9F;AAED,SAAS,KAAK,CAAC,cAAsB,EAAyB;IAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AAAA,CAC5D;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,cAAuB,EAAyB;IAC7E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AAAA,CAClD;AAED,SAAS,WAAW,CAAC,MAAc,EAAyB;IAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAAA,CAClC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAU;IAChD,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,sBAAsB,CAAC,0BAA0B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAAA,CAC/E;AAED,SAAS,oBAAoB,CAAC,GAAW,EAAE,aAAqB,EAAsB;IACrF,MAAM,UAAU,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,OAAO,sBAAsB,CAAC,0BAA0B,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AAAA,CACpF;AAED,SAAS,kBAAkB,CAAC,GAAW,EAAE,SAAoD,EAAY;IACxG,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACxD,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACpE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAAA,CAC3B;AAED,SAAS,0BAA0B,CAAC,IAAY,EAAU;IACzD,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC;AAAA,CACD;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB,EAAW;IAC/D,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/C,OAAO,YAAY,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAAA,CAC1F;AAED,SAAS,aAAa,CAAC,MAA2B,EAAE,cAAsB,EAAW;IACpF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AAAA,CAC5G;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,OAAe,EAAW;IACzE,OAAO,OAAO,KAAK,OAAO,IAAI,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAAA,CAC1D;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAU;IACtD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAAA,CAClC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAU;IACrD,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACrD;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAU;IAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAAA,CAClC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa,EAAW;IACxD,OAAO,YAAY,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;AAAA,CACjF;AAED,SAAS,YAAY,CAAC,IAAY,EAAU;IAC3C,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC7B,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC7B,OAAO,IAAI,UAAU,CAAC;oBACtB,KAAK,IAAI,CAAC,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACP,OAAO,IAAI,IAAI,CAAC;oBAChB,KAAK,EAAE,CAAC;gBACT,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,OAAO,IAAI,OAAO,CAAC;YACpB,CAAC;QACF,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO,IAAI,MAAM,CAAC;QACnB,CAAC;aAAM,CAAC;YACP,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;AAAA,CAClC;AAED,SAAS,YAAY,CAAC,MAAyB,EAAY;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QACpB,OAAO,CAAC,CAAC;IAAA,CACT,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { existsSync, realpathSync } from \"node:fs\";\nimport { basename, dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport type { LoadoutAccessEntry, LoadoutCommands } from \"./loadouts.ts\";\n\nexport type LoadoutAccessOperation = \"read\" | \"write\" | \"execute\";\n\nexport interface CreateLoadoutAccessPolicyOptions {\n\tcwd: string;\n\tactiveTools: readonly string[];\n\treadSet?: readonly LoadoutAccessEntry[];\n\twriteSet?: readonly LoadoutAccessEntry[];\n\tblockedPaths?: readonly string[];\n\tcommands?: LoadoutCommands;\n}\n\nexport interface LoadoutAccessPolicy {\n\tcwd: string;\n\tactiveTools: readonly string[];\n\treadRoots: readonly string[];\n\twriteRoots: readonly string[];\n\tblockedPaths: readonly string[];\n\tcommands: LoadoutCommands;\n}\n\nexport interface LoadoutPathAccessRequest {\n\toperation: \"read\" | \"write\";\n\ttoolName: string;\n\tpath: string;\n}\n\nexport interface LoadoutCommandAccessRequest {\n\toperation: \"execute\";\n\ttoolName: string;\n\tcommand: string;\n}\n\nexport type LoadoutAccessRequest = LoadoutPathAccessRequest | LoadoutCommandAccessRequest;\n\nexport interface LoadoutAccessDecision {\n\tallowed: boolean;\n\treason: string;\n\tnormalizedPath?: string;\n\tnormalizedCommand?: string;\n}\n\nexport type LoadoutAccessGuard = (request: LoadoutAccessRequest) => LoadoutAccessDecision;\n\nexport function assertLoadoutAccess(guard: LoadoutAccessGuard | undefined, request: LoadoutAccessRequest): void {\n\tif (!guard) return;\n\tconst decision = guard(request);\n\tif (!decision.allowed) {\n\t\tthrow new Error(`loadout: ${decision.reason}`);\n\t}\n}\n\nconst DEFAULT_BLOCKED_PATHS = [\"**/.env*\", \"**/*secret*\", \"**/*key*\", \"**/.git\", \"**/.git/*\"] as const;\n\nexport function createLoadoutAccessPolicy(options: CreateLoadoutAccessPolicyOptions): LoadoutAccessPolicy {\n\tconst cwd = normalizeRootPath(options.cwd);\n\treturn {\n\t\tcwd,\n\t\tactiveTools: uniqueSorted(\n\t\t\toptions.activeTools.map((toolName) => toolName.trim()).filter((toolName) => toolName !== \"\"),\n\t\t),\n\t\treadRoots: normalizeAccessSet(cwd, options.readSet),\n\t\twriteRoots: normalizeAccessSet(cwd, options.writeSet),\n\t\tblockedPaths: uniqueSorted(options.blockedPaths ?? DEFAULT_BLOCKED_PATHS),\n\t\tcommands: options.commands ?? { mode: \"none\" },\n\t};\n}\n\nexport function isActiveLoadoutTool(policy: Pick<LoadoutAccessPolicy, \"activeTools\">, toolName: string): boolean {\n\treturn policy.activeTools.includes(toolName.trim());\n}\n\nexport function decideLoadoutAccess(policy: LoadoutAccessPolicy, request: LoadoutAccessRequest): LoadoutAccessDecision {\n\tif (!isActiveLoadoutTool(policy, request.toolName)) {\n\t\treturn deny(`inactive tool: ${request.toolName}`);\n\t}\n\tif (request.operation === \"execute\") return decideCommandAccess(policy, request);\n\treturn decidePathAccess(policy, request);\n}\n\nfunction decidePathAccess(policy: LoadoutAccessPolicy, request: LoadoutPathAccessRequest): LoadoutAccessDecision {\n\tconst normalizedPath = normalizeRequestPath(policy.cwd, request.path);\n\tif (!normalizedPath) return deny(\"invalid path\");\n\tif (isBlockedPath(policy, normalizedPath)) return deny(\"blocked path\", normalizedPath);\n\n\tif (request.operation === \"read\") {\n\t\tconst roots = uniqueSorted([...policy.readRoots, ...policy.writeRoots]);\n\t\tif (roots.length === 0) return deny(\"outside read scope: empty read/write set\", normalizedPath);\n\t\tif (roots.some((root) => containsPath(root, normalizedPath))) return allow(normalizedPath);\n\t\treturn deny(\"outside read scope\", normalizedPath);\n\t}\n\n\tif (policy.writeRoots.length === 0) return deny(\"outside write scope: empty write set\", normalizedPath);\n\tif (policy.writeRoots.some((root) => containsPath(root, normalizedPath))) return allow(normalizedPath);\n\treturn deny(\"outside write scope\", normalizedPath);\n}\n\nfunction decideCommandAccess(policy: LoadoutAccessPolicy, request: LoadoutCommandAccessRequest): LoadoutAccessDecision {\n\tconst normalizedCommand = request.command.trim();\n\tif (normalizedCommand === \"\" || normalizedCommand.includes(\"\\0\")) return denyCommand(\"invalid command\");\n\tif (policy.commands.mode === \"none\") return denyCommand(\"command mode none\");\n\tif (policy.commands.blockPatterns?.some((pattern) => commandMatchesPattern(pattern, normalizedCommand))) {\n\t\treturn denyCommand(\"blocked command pattern\");\n\t}\n\tif (policy.commands.allowPatterns?.some((pattern) => commandMatchesPattern(pattern, normalizedCommand))) {\n\t\treturn { allowed: true, reason: \"allowed\", normalizedCommand };\n\t}\n\treturn denyCommand(`command mode ${policy.commands.mode} requires an explicit allow pattern`);\n}\n\nfunction allow(normalizedPath: string): LoadoutAccessDecision {\n\treturn { allowed: true, reason: \"allowed\", normalizedPath };\n}\n\nfunction deny(reason: string, normalizedPath?: string): LoadoutAccessDecision {\n\treturn { allowed: false, reason, normalizedPath };\n}\n\nfunction denyCommand(reason: string): LoadoutAccessDecision {\n\treturn { allowed: false, reason };\n}\n\nfunction normalizeRootPath(path: string): string {\n\tconst normalized = normalizePathSeparators(path);\n\tif (normalized.trim() === \"\" || normalized.includes(\"\\0\")) {\n\t\tthrow new Error(\"loadout access policy cwd must be a non-empty path\");\n\t}\n\treturn stripTrailingSeparator(canonicalizeExistingPrefix(resolve(normalized)));\n}\n\nfunction normalizeRequestPath(cwd: string, requestedPath: string): string | undefined {\n\tconst normalized = normalizePathSeparators(requestedPath);\n\tif (normalized.trim() === \"\" || normalized.includes(\"\\0\")) return undefined;\n\treturn stripTrailingSeparator(canonicalizeExistingPrefix(resolve(cwd, normalized)));\n}\n\nfunction normalizeAccessSet(cwd: string, accessSet: readonly LoadoutAccessEntry[] | undefined): string[] {\n\tif (!accessSet) return [];\n\tconst roots: string[] = [];\n\tfor (const entry of accessSet) {\n\t\tif (entry.symbols && entry.symbols.length > 0) continue;\n\t\tconst normalized = normalizePathSeparators(entry.path);\n\t\tif (normalized.trim() === \"\" || normalized.includes(\"\\0\")) continue;\n\t\troots.push(stripTrailingSeparator(canonicalizeExistingPrefix(resolve(cwd, normalized))));\n\t}\n\treturn uniqueSorted(roots);\n}\n\nfunction canonicalizeExistingPrefix(path: string): string {\n\ttry {\n\t\treturn realpathSync.native(path);\n\t} catch {\n\t\tif (existsSync(path)) return resolve(path);\n\t\tconst parent = dirname(path);\n\t\tif (parent === path) return resolve(path);\n\t\treturn resolve(canonicalizeExistingPrefix(parent), basename(path));\n\t}\n}\n\nfunction containsPath(root: string, candidate: string): boolean {\n\tif (candidate === root) return true;\n\tconst relativePath = relative(root, candidate);\n\treturn relativePath !== \"\" && !relativePath.startsWith(\"..\") && !isAbsolute(relativePath);\n}\n\nfunction isBlockedPath(policy: LoadoutAccessPolicy, normalizedPath: string): boolean {\n\tconst relativeCandidate = toForwardSlashes(relative(policy.cwd, normalizedPath));\n\tconst candidates = uniqueSorted([toForwardSlashes(normalizedPath), relativeCandidate]);\n\treturn policy.blockedPaths.some((pattern) => candidates.some((candidate) => globMatch(pattern, candidate)));\n}\n\nfunction commandMatchesPattern(pattern: string, command: string): boolean {\n\treturn pattern === command || globMatch(pattern, command);\n}\n\nfunction normalizePathSeparators(path: string): string {\n\treturn path.replaceAll(\"\\\\\", \"/\");\n}\n\nfunction stripTrailingSeparator(path: string): string {\n\tif (path === \"/\") return path;\n\treturn path.endsWith(\"/\") ? path.slice(0, -1) : path;\n}\n\nfunction toForwardSlashes(path: string): string {\n\treturn path.replaceAll(\"\\\\\", \"/\");\n}\n\nfunction globMatch(glob: string, value: string): boolean {\n\treturn globToRegExp(normalizePathSeparators(glob)).test(toForwardSlashes(value));\n}\n\nfunction globToRegExp(glob: string): RegExp {\n\tlet pattern = \"\";\n\tfor (let index = 0; index < glob.length; index++) {\n\t\tconst char = glob[index];\n\t\tif (char === \"*\") {\n\t\t\tif (glob[index + 1] === \"*\") {\n\t\t\t\tif (glob[index + 2] === \"/\") {\n\t\t\t\t\tpattern += \"(?:.*/)?\";\n\t\t\t\t\tindex += 2;\n\t\t\t\t} else {\n\t\t\t\t\tpattern += \".*\";\n\t\t\t\t\tindex++;\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tpattern += \"[^/]*\";\n\t\t\t}\n\t\t} else if (char === \"?\") {\n\t\t\tpattern += \"[^/]\";\n\t\t} else {\n\t\t\tpattern += char.replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\");\n\t\t}\n\t}\n\treturn new RegExp(`^${pattern}$`);\n}\n\nfunction uniqueSorted(values: readonly string[]): string[] {\n\treturn [...new Set(values)].sort((a, b) => {\n\t\tif (a < b) return -1;\n\t\tif (a > b) return 1;\n\t\treturn 0;\n\t});\n}\n"]}

package/dist/core/loadout-compose.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Role + domain loadout composition.
+ *
+ * The composer is pure and additive: it never mutates built-in role loadouts or
+ * domain profiles. It can only narrow authority and active tools, while forcing
+ * baseline security hooks and downgrading writable filesystem MCP access for
+ * read-only authorities.
+ */
+import { type DomainProfile } from "./domain-loadouts.ts";
+import { type StrippedCapability } from "./loadout-safety.ts";
+import { type LoadoutAuthority, type LoadoutProfile, type LoadoutRole } from "./loadouts.ts";
+export interface SamplingProfile {
+    readonly temperature?: number;
+    readonly topP?: number;
+    readonly topK?: number;
+}
+export interface ScopeHints {
+    readonly readScope?: readonly string[];
+    readonly writeScope?: readonly string[];
+    readonly executeScope?: readonly string[];
+}
+export interface CompositionTrace {
+    readonly roleAuthority: LoadoutAuthority;
+    readonly domainAuthority: LoadoutAuthority;
+    readonly grantAuthority?: LoadoutAuthority;
+    readonly composedAuthority: LoadoutAuthority;
+    readonly stripped: readonly StrippedCapability[];
+    readonly downgraded: readonly {
+        readonly mcp: string;
+        readonly to: string;
+    }[];
+    readonly warnings: readonly string[];
+}
+export interface ComposedLoadout extends LoadoutProfile {
+    readonly role: LoadoutRole;
+    readonly domainId: string;
+    readonly domainResolvedFromFallback: boolean;
+    readonly routingPrompt?: string;
+    readonly samplingProfile?: SamplingProfile;
+    readonly scopeHints?: ScopeHints;
+    readonly composition: CompositionTrace;
+}
+export interface ComposeLoadoutOptions {
+    readonly grantAuthority?: LoadoutAuthority;
+    readonly preserveRoleAuthority?: boolean;
+    readonly scopeHints?: ScopeHints;
+    readonly forcedSecurityHooks?: readonly string[];
+    readonly roleProfileOverride?: LoadoutProfile;
+    readonly samplingProfile?: SamplingProfile;
+}
+export type ComposeOptions = ComposeLoadoutOptions;
+export declare function composeLoadout(role: LoadoutRole, domain: DomainProfile | string, options?: ComposeLoadoutOptions): ComposedLoadout;
+//# sourceMappingURL=loadout-compose.d.ts.map

package/dist/core/loadout-compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadout-compose.d.ts","sourceRoot":"","sources":["../../src/core/loadout-compose.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAoB,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAKN,KAAK,kBAAkB,EAMvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAIN,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAGhB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAC3C,QAAQ,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,SAAS;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACtD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAC3C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,cAAc,CAAC;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;CAC3C;AAED,MAAM,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAYnD,wBAAgB,cAAc,CAC7B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,aAAa,GAAG,MAAM,EAC9B,OAAO,GAAE,qBAA0B,GACjC,eAAe,CA0DjB","sourcesContent":["/**\n * Role + domain loadout composition.\n *\n * The composer is pure and additive: it never mutates built-in role loadouts or\n * domain profiles. It can only narrow authority and active tools, while forcing\n * baseline security hooks and downgrading writable filesystem MCP access for\n * read-only authorities.\n */\n\nimport { type DomainProfile, getDomainProfile } from \"./domain-loadouts.ts\";\nimport {\n\tcapabilityGateNames,\n\tdowngradeMcpForAuthority,\n\tforceSecurityHooks,\n\tminAuthority,\n\ttype StrippedCapability,\n\tselectSafestCommandMode,\n\tstripWriteSkillsForAuthority,\n\tstripWriteToolsForAuthority,\n\tunionCapabilityGateNames,\n\tuniqueSorted,\n} from \"./loadout-safety.ts\";\nimport {\n\tBUILTIN_LOADOUTS,\n\ttype CapabilityGate,\n\tinferLoadoutForRole,\n\ttype LoadoutAuthority,\n\ttype LoadoutProfile,\n\ttype LoadoutRole,\n\ttype ToolGate,\n\tvalidateLoadoutProfile,\n} from \"./loadouts.ts\";\n\nexport interface SamplingProfile {\n\treadonly temperature?: number;\n\treadonly topP?: number;\n\treadonly topK?: number;\n}\n\nexport interface ScopeHints {\n\treadonly readScope?: readonly string[];\n\treadonly writeScope?: readonly string[];\n\treadonly executeScope?: readonly string[];\n}\n\nexport interface CompositionTrace {\n\treadonly roleAuthority: LoadoutAuthority;\n\treadonly domainAuthority: LoadoutAuthority;\n\treadonly grantAuthority?: LoadoutAuthority;\n\treadonly composedAuthority: LoadoutAuthority;\n\treadonly stripped: readonly StrippedCapability[];\n\treadonly downgraded: readonly { readonly mcp: string; readonly to: string }[];\n\treadonly warnings: readonly string[];\n}\n\nexport interface ComposedLoadout extends LoadoutProfile {\n\treadonly role: LoadoutRole;\n\treadonly domainId: string;\n\treadonly domainResolvedFromFallback: boolean;\n\treadonly routingPrompt?: string;\n\treadonly samplingProfile?: SamplingProfile;\n\treadonly scopeHints?: ScopeHints;\n\treadonly composition: CompositionTrace;\n}\n\nexport interface ComposeLoadoutOptions {\n\treadonly grantAuthority?: LoadoutAuthority;\n\treadonly preserveRoleAuthority?: boolean;\n\treadonly scopeHints?: ScopeHints;\n\treadonly forcedSecurityHooks?: readonly string[];\n\treadonly roleProfileOverride?: LoadoutProfile;\n\treadonly samplingProfile?: SamplingProfile;\n}\n\nexport type ComposeOptions = ComposeLoadoutOptions;\n\ninterface ResolvedDomainProfile {\n\treadonly profile: DomainProfile;\n\treadonly fallback: boolean;\n}\n\ninterface ComposedMcpGate {\n\treadonly gate: CapabilityGate;\n\treadonly downgraded: readonly { readonly mcp: string; readonly to: string }[];\n}\n\nexport function composeLoadout(\n\trole: LoadoutRole,\n\tdomain: DomainProfile | string,\n\toptions: ComposeLoadoutOptions = {},\n): ComposedLoadout {\n\tconst roleProfile = options.roleProfileOverride ?? BUILTIN_LOADOUTS[inferLoadoutForRole(role)];\n\tconst resolvedDomain = resolveDomainProfile(domain);\n\tconst domainProfile = resolvedDomain.profile;\n\tconst composedAuthority = minAuthority(roleProfile.authority, domainProfile.authority, options.grantAuthority);\n\n\tconst stripped: StrippedCapability[] = [];\n\tconst warnings: string[] = [];\n\n\tconst toolGate = composeToolGate(roleProfile.tools, domainProfile.tools, composedAuthority, stripped);\n\tconst skills = composeCapabilityGate(\"skill\", roleProfile.skills, domainProfile.skills, composedAuthority, stripped);\n\tconst mcp = composeMcpGate(roleProfile.mcp, domainProfile.mcp, composedAuthority);\n\tconst hooks = composeHookGate(roleProfile.hooks, domainProfile.hooks, options.forcedSecurityHooks);\n\tconst commands = selectSafestCommandMode(\n\t\tcomposedAuthority,\n\t\troleProfile.commands?.mode,\n\t\tdomainProfile.commands?.mode,\n\t);\n\n\twarnings.push(...selectorWarnings(\"role skills\", roleProfile.skills));\n\twarnings.push(...selectorWarnings(\"domain skills\", domainProfile.skills));\n\twarnings.push(...selectorWarnings(\"role mcp\", roleProfile.mcp));\n\twarnings.push(...selectorWarnings(\"domain mcp\", domainProfile.mcp));\n\twarnings.push(...selectorWarnings(\"role hooks\", roleProfile.hooks));\n\twarnings.push(...selectorWarnings(\"domain hooks\", domainProfile.hooks));\n\n\tconst composed: ComposedLoadout = {\n\t\tschemaVersion: \"omk.loadout.v1\",\n\t\tname: `${roleProfile.name}+${domainProfile.id}`,\n\t\tdescription: `Composed ${roleProfile.name} role loadout with ${domainProfile.id} domain profile`,\n\t\tauthority: composedAuthority,\n\t\ttools: toolGate,\n\t\tskills,\n\t\tmcp: mcp.gate,\n\t\thooks,\n\t\tcommands,\n\t\trole,\n\t\tdomainId: domainProfile.id,\n\t\tdomainResolvedFromFallback: resolvedDomain.fallback,\n\t\troutingPrompt: domainProfile.routingPrompt,\n\t\t...(options.samplingProfile ? { samplingProfile: options.samplingProfile } : {}),\n\t\t...(options.scopeHints ? { scopeHints: options.scopeHints } : {}),\n\t\tcomposition: {\n\t\t\troleAuthority: roleProfile.authority,\n\t\t\tdomainAuthority: domainProfile.authority,\n\t\t\t...(options.grantAuthority ? { grantAuthority: options.grantAuthority } : {}),\n\t\t\tcomposedAuthority,\n\t\t\tstripped: uniqueStripped(stripped),\n\t\t\tdowngraded: mcp.downgraded,\n\t\t\twarnings: uniqueSorted(warnings),\n\t\t},\n\t};\n\n\tconst validation = validateLoadoutProfile(composed);\n\tif (!validation.valid) {\n\t\tthrow new Error(`composed loadout is invalid: ${validation.errors.join(\"; \")}`);\n\t}\n\treturn composed;\n}\n\nfunction resolveDomainProfile(domain: DomainProfile | string): ResolvedDomainProfile {\n\tif (typeof domain !== \"string\") return { profile: domain, fallback: false };\n\tconst profile = getDomainProfile(domain);\n\treturn { profile, fallback: profile.id !== domain };\n}\n\nfunction composeToolGate(\n\troleGate: ToolGate,\n\tdomainGate: ToolGate,\n\tauthority: LoadoutAuthority,\n\tstripped: StrippedCapability[],\n): ToolGate {\n\tconst roleAllow = roleGate.allow ?? [];\n\tconst domainAllow = domainGate.allow ?? [];\n\tconst allowed = intersectNames(roleAllow, domainAllow);\n\tconst strippedTools = stripWriteToolsForAuthority(allowed, authority);\n\tstripped.push(...strippedTools.stripped);\n\tconst require = uniqueSorted([...(roleGate.require ?? []), ...(domainGate.require ?? [])]);\n\tconst exclude = uniqueSorted([...(roleGate.exclude ?? []), ...(domainGate.exclude ?? [])]);\n\treturn cleanToolGate({\n\t\tallow: strippedTools.names,\n\t\t...(require.length > 0 ? { require } : {}),\n\t\t...(exclude.length > 0 ? { exclude } : {}),\n\t});\n}\n\nfunction composeCapabilityGate(\n\tkind: \"skill\",\n\troleGate: CapabilityGate | undefined,\n\tdomainGate: CapabilityGate | undefined,\n\tauthority: LoadoutAuthority,\n\tstripped: StrippedCapability[],\n): CapabilityGate {\n\tconst allowNames = uniqueSorted([...capabilityGateNames(roleGate), ...capabilityGateNames(domainGate)]);\n\tconst requireNames = uniqueSorted([\n\t\t...capabilityGateNames(roleGate, \"require\"),\n\t\t...capabilityGateNames(domainGate, \"require\"),\n\t]);\n\tconst excludeNames = unionCapabilityGateNames(\"exclude\", roleGate, domainGate);\n\tconst strippedAllow = stripWriteSkillsForAuthority(allowNames, authority);\n\tconst strippedRequire = stripWriteSkillsForAuthority(requireNames, authority);\n\tstripped.push(...strippedAllow.stripped, ...strippedRequire.stripped);\n\treturn cleanCapabilityGate(kind, strippedAllow.names, strippedRequire.names, excludeNames);\n}\n\nfunction composeMcpGate(\n\troleGate: CapabilityGate | undefined,\n\tdomainGate: CapabilityGate | undefined,\n\tauthority: LoadoutAuthority,\n): ComposedMcpGate {\n\tconst allowDowngrade = downgradeMcpForAuthority(\n\t\tuniqueSorted([...capabilityGateNames(roleGate), ...capabilityGateNames(domainGate)]),\n\t\tauthority,\n\t);\n\tconst requireDowngrade = downgradeMcpForAuthority(\n\t\tuniqueSorted([...capabilityGateNames(roleGate, \"require\"), ...capabilityGateNames(domainGate, \"require\")]),\n\t\tauthority,\n\t);\n\tconst excludeNames = unionCapabilityGateNames(\"exclude\", roleGate, domainGate);\n\treturn {\n\t\tgate: cleanCapabilityGate(\"mcp\", allowDowngrade.names, requireDowngrade.names, excludeNames),\n\t\tdowngraded: uniqueMcpDowngrades([...allowDowngrade.downgraded, ...requireDowngrade.downgraded]),\n\t};\n}\n\nfunction composeHookGate(\n\troleGate: CapabilityGate | undefined,\n\tdomainGate: CapabilityGate | undefined,\n\tforcedSecurityHooks: readonly string[] | undefined,\n): CapabilityGate {\n\tconst allowNames = forceSecurityHooks(\n\t\tuniqueSorted([...capabilityGateNames(roleGate), ...capabilityGateNames(domainGate)]),\n\t\tforcedSecurityHooks,\n\t);\n\tconst requireNames = uniqueSorted([\n\t\t...capabilityGateNames(roleGate, \"require\"),\n\t\t...capabilityGateNames(domainGate, \"require\"),\n\t]);\n\tconst excludeNames = unionCapabilityGateNames(\"exclude\", roleGate, domainGate);\n\treturn cleanCapabilityGate(\"hook\", allowNames, requireNames, excludeNames);\n}\n\nfunction cleanToolGate(gate: ToolGate): ToolGate {\n\treturn {\n\t\tallow: uniqueSorted(gate.allow ?? []),\n\t\t...(gate.require && gate.require.length > 0 ? { require: uniqueSorted(gate.require) } : {}),\n\t\t...(gate.exclude && gate.exclude.length > 0 ? { exclude: uniqueSorted(gate.exclude) } : {}),\n\t};\n}\n\nfunction cleanCapabilityGate(\n\tkind: \"skill\" | \"mcp\" | \"hook\",\n\tallow: readonly string[],\n\trequire: readonly string[],\n\texclude: readonly string[],\n): CapabilityGate {\n\treturn {\n\t\tallow: [{ kind, names: uniqueSorted(allow) }],\n\t\t...(require.length > 0 ? { require: [{ kind, names: uniqueSorted(require) }] } : {}),\n\t\t...(exclude.length > 0 ? { exclude: [{ kind, names: uniqueSorted(exclude) }] } : {}),\n\t};\n}\n\nfunction intersectNames(left: readonly string[], right: readonly string[]): string[] {\n\tconst rightSet = new Set(right);\n\treturn uniqueSorted(left.filter((value) => rightSet.has(value)));\n}\n\nfunction selectorWarnings(label: string, gate: CapabilityGate | undefined): string[] {\n\tconst warnings: string[] = [];\n\tfor (const group of [\"allow\", \"exclude\", \"require\"] as const) {\n\t\tfor (const selector of gate?.[group] ?? []) {\n\t\t\tif (selector.names === undefined || selector.names.length === 0) {\n\t\t\t\twarnings.push(\n\t\t\t\t\t`${label}.${group} contains a non-name selector that cannot be represented by composed gates`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\treturn warnings;\n}\n\nfunction uniqueStripped(values: readonly StrippedCapability[]): StrippedCapability[] {\n\tconst seen = new Set<string>();\n\tconst result: StrippedCapability[] = [];\n\tfor (const value of values) {\n\t\tconst key = `${value.kind}\\0${value.name}\\0${value.reason}`;\n\t\tif (seen.has(key)) continue;\n\t\tseen.add(key);\n\t\tresult.push(value);\n\t}\n\treturn result.sort((a, b) => compareString(a.kind, b.kind) || compareString(a.name, b.name));\n}\n\nfunction uniqueMcpDowngrades(\n\tvalues: readonly { readonly mcp: string; readonly to: string }[],\n): { readonly mcp: string; readonly to: string }[] {\n\tconst seen = new Set<string>();\n\tconst result: { readonly mcp: string; readonly to: string }[] = [];\n\tfor (const value of values) {\n\t\tconst key = `${value.mcp}\\0${value.to}`;\n\t\tif (seen.has(key)) continue;\n\t\tseen.add(key);\n\t\tresult.push(value);\n\t}\n\treturn result.sort((a, b) => compareString(a.mcp, b.mcp) || compareString(a.to, b.to));\n}\n\nfunction compareString(a: string, b: string): number {\n\tif (a < b) return -1;\n\tif (a > b) return 1;\n\treturn 0;\n}\n"]}

package/dist/core/loadout-compose.js

@@ -0,0 +1,172 @@
+/**
+ * Role + domain loadout composition.
+ *
+ * The composer is pure and additive: it never mutates built-in role loadouts or
+ * domain profiles. It can only narrow authority and active tools, while forcing
+ * baseline security hooks and downgrading writable filesystem MCP access for
+ * read-only authorities.
+ */
+import { getDomainProfile } from "./domain-loadouts.js";
+import { capabilityGateNames, downgradeMcpForAuthority, forceSecurityHooks, minAuthority, selectSafestCommandMode, stripWriteSkillsForAuthority, stripWriteToolsForAuthority, unionCapabilityGateNames, uniqueSorted, } from "./loadout-safety.js";
+import { BUILTIN_LOADOUTS, inferLoadoutForRole, validateLoadoutProfile, } from "./loadouts.js";
+export function composeLoadout(role, domain, options = {}) {
+    const roleProfile = options.roleProfileOverride ?? BUILTIN_LOADOUTS[inferLoadoutForRole(role)];
+    const resolvedDomain = resolveDomainProfile(domain);
+    const domainProfile = resolvedDomain.profile;
+    const composedAuthority = minAuthority(roleProfile.authority, domainProfile.authority, options.grantAuthority);
+    const stripped = [];
+    const warnings = [];
+    const toolGate = composeToolGate(roleProfile.tools, domainProfile.tools, composedAuthority, stripped);
+    const skills = composeCapabilityGate("skill", roleProfile.skills, domainProfile.skills, composedAuthority, stripped);
+    const mcp = composeMcpGate(roleProfile.mcp, domainProfile.mcp, composedAuthority);
+    const hooks = composeHookGate(roleProfile.hooks, domainProfile.hooks, options.forcedSecurityHooks);
+    const commands = selectSafestCommandMode(composedAuthority, roleProfile.commands?.mode, domainProfile.commands?.mode);
+    warnings.push(...selectorWarnings("role skills", roleProfile.skills));
+    warnings.push(...selectorWarnings("domain skills", domainProfile.skills));
+    warnings.push(...selectorWarnings("role mcp", roleProfile.mcp));
+    warnings.push(...selectorWarnings("domain mcp", domainProfile.mcp));
+    warnings.push(...selectorWarnings("role hooks", roleProfile.hooks));
+    warnings.push(...selectorWarnings("domain hooks", domainProfile.hooks));
+    const composed = {
+        schemaVersion: "omk.loadout.v1",
+        name: `${roleProfile.name}+${domainProfile.id}`,
+        description: `Composed ${roleProfile.name} role loadout with ${domainProfile.id} domain profile`,
+        authority: composedAuthority,
+        tools: toolGate,
+        skills,
+        mcp: mcp.gate,
+        hooks,
+        commands,
+        role,
+        domainId: domainProfile.id,
+        domainResolvedFromFallback: resolvedDomain.fallback,
+        routingPrompt: domainProfile.routingPrompt,
+        ...(options.samplingProfile ? { samplingProfile: options.samplingProfile } : {}),
+        ...(options.scopeHints ? { scopeHints: options.scopeHints } : {}),
+        composition: {
+            roleAuthority: roleProfile.authority,
+            domainAuthority: domainProfile.authority,
+            ...(options.grantAuthority ? { grantAuthority: options.grantAuthority } : {}),
+            composedAuthority,
+            stripped: uniqueStripped(stripped),
+            downgraded: mcp.downgraded,
+            warnings: uniqueSorted(warnings),
+        },
+    };
+    const validation = validateLoadoutProfile(composed);
+    if (!validation.valid) {
+        throw new Error(`composed loadout is invalid: ${validation.errors.join("; ")}`);
+    }
+    return composed;
+}
+function resolveDomainProfile(domain) {
+    if (typeof domain !== "string")
+        return { profile: domain, fallback: false };
+    const profile = getDomainProfile(domain);
+    return { profile, fallback: profile.id !== domain };
+}
+function composeToolGate(roleGate, domainGate, authority, stripped) {
+    const roleAllow = roleGate.allow ?? [];
+    const domainAllow = domainGate.allow ?? [];
+    const allowed = intersectNames(roleAllow, domainAllow);
+    const strippedTools = stripWriteToolsForAuthority(allowed, authority);
+    stripped.push(...strippedTools.stripped);
+    const require = uniqueSorted([...(roleGate.require ?? []), ...(domainGate.require ?? [])]);
+    const exclude = uniqueSorted([...(roleGate.exclude ?? []), ...(domainGate.exclude ?? [])]);
+    return cleanToolGate({
+        allow: strippedTools.names,
+        ...(require.length > 0 ? { require } : {}),
+        ...(exclude.length > 0 ? { exclude } : {}),
+    });
+}
+function composeCapabilityGate(kind, roleGate, domainGate, authority, stripped) {
+    const allowNames = uniqueSorted([...capabilityGateNames(roleGate), ...capabilityGateNames(domainGate)]);
+    const requireNames = uniqueSorted([
+        ...capabilityGateNames(roleGate, "require"),
+        ...capabilityGateNames(domainGate, "require"),
+    ]);
+    const excludeNames = unionCapabilityGateNames("exclude", roleGate, domainGate);
+    const strippedAllow = stripWriteSkillsForAuthority(allowNames, authority);
+    const strippedRequire = stripWriteSkillsForAuthority(requireNames, authority);
+    stripped.push(...strippedAllow.stripped, ...strippedRequire.stripped);
+    return cleanCapabilityGate(kind, strippedAllow.names, strippedRequire.names, excludeNames);
+}
+function composeMcpGate(roleGate, domainGate, authority) {
+    const allowDowngrade = downgradeMcpForAuthority(uniqueSorted([...capabilityGateNames(roleGate), ...capabilityGateNames(domainGate)]), authority);
+    const requireDowngrade = downgradeMcpForAuthority(uniqueSorted([...capabilityGateNames(roleGate, "require"), ...capabilityGateNames(domainGate, "require")]), authority);
+    const excludeNames = unionCapabilityGateNames("exclude", roleGate, domainGate);
+    return {
+        gate: cleanCapabilityGate("mcp", allowDowngrade.names, requireDowngrade.names, excludeNames),
+        downgraded: uniqueMcpDowngrades([...allowDowngrade.downgraded, ...requireDowngrade.downgraded]),
+    };
+}
+function composeHookGate(roleGate, domainGate, forcedSecurityHooks) {
+    const allowNames = forceSecurityHooks(uniqueSorted([...capabilityGateNames(roleGate), ...capabilityGateNames(domainGate)]), forcedSecurityHooks);
+    const requireNames = uniqueSorted([
+        ...capabilityGateNames(roleGate, "require"),
+        ...capabilityGateNames(domainGate, "require"),
+    ]);
+    const excludeNames = unionCapabilityGateNames("exclude", roleGate, domainGate);
+    return cleanCapabilityGate("hook", allowNames, requireNames, excludeNames);
+}
+function cleanToolGate(gate) {
+    return {
+        allow: uniqueSorted(gate.allow ?? []),
+        ...(gate.require && gate.require.length > 0 ? { require: uniqueSorted(gate.require) } : {}),
+        ...(gate.exclude && gate.exclude.length > 0 ? { exclude: uniqueSorted(gate.exclude) } : {}),
+    };
+}
+function cleanCapabilityGate(kind, allow, require, exclude) {
+    return {
+        allow: [{ kind, names: uniqueSorted(allow) }],
+        ...(require.length > 0 ? { require: [{ kind, names: uniqueSorted(require) }] } : {}),
+        ...(exclude.length > 0 ? { exclude: [{ kind, names: uniqueSorted(exclude) }] } : {}),
+    };
+}
+function intersectNames(left, right) {
+    const rightSet = new Set(right);
+    return uniqueSorted(left.filter((value) => rightSet.has(value)));
+}
+function selectorWarnings(label, gate) {
+    const warnings = [];
+    for (const group of ["allow", "exclude", "require"]) {
+        for (const selector of gate?.[group] ?? []) {
+            if (selector.names === undefined || selector.names.length === 0) {
+                warnings.push(`${label}.${group} contains a non-name selector that cannot be represented by composed gates`);
+            }
+        }
+    }
+    return warnings;
+}
+function uniqueStripped(values) {
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        const key = `${value.kind}\0${value.name}\0${value.reason}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push(value);
+    }
+    return result.sort((a, b) => compareString(a.kind, b.kind) || compareString(a.name, b.name));
+}
+function uniqueMcpDowngrades(values) {
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        const key = `${value.mcp}\0${value.to}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push(value);
+    }
+    return result.sort((a, b) => compareString(a.mcp, b.mcp) || compareString(a.to, b.to));
+}
+function compareString(a, b) {
+    if (a < b)
+        return -1;
+    if (a > b)
+        return 1;
+    return 0;
+}
+//# sourceMappingURL=loadout-compose.js.map

package/dist/core/loadout-compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadout-compose.js","sourceRoot":"","sources":["../../src/core/loadout-compose.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAsB,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EACN,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,YAAY,EAEZ,uBAAuB,EACvB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,YAAY,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,gBAAgB,EAEhB,mBAAmB,EAKnB,sBAAsB,GACtB,MAAM,eAAe,CAAC;AAuDvB,MAAM,UAAU,cAAc,CAC7B,IAAiB,EACjB,MAA8B,EAC9B,OAAO,GAA0B,EAAE,EACjB;IAClB,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/F,MAAM,cAAc,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC;IAC7C,MAAM,iBAAiB,GAAG,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAE/G,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACrH,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,uBAAuB,CACvC,iBAAiB,EACjB,WAAW,CAAC,QAAQ,EAAE,IAAI,EAC1B,aAAa,CAAC,QAAQ,EAAE,IAAI,CAC5B,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,YAAY,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAExE,MAAM,QAAQ,GAAoB;QACjC,aAAa,EAAE,gBAAgB;QAC/B,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,IAAI,aAAa,CAAC,EAAE,EAAE;QAC/C,WAAW,EAAE,YAAY,WAAW,CAAC,IAAI,sBAAsB,aAAa,CAAC,EAAE,iBAAiB;QAChG,SAAS,EAAE,iBAAiB;QAC5B,KAAK,EAAE,QAAQ;QACf,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,IAAI;QACb,KAAK;QACL,QAAQ;QACR,IAAI;QACJ,QAAQ,EAAE,aAAa,CAAC,EAAE;QAC1B,0BAA0B,EAAE,cAAc,CAAC,QAAQ;QACnD,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,WAAW,EAAE;YACZ,aAAa,EAAE,WAAW,CAAC,SAAS;YACpC,eAAe,EAAE,aAAa,CAAC,SAAS;YACxC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,iBAAiB;YACjB,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC;SAChC;KACD,CAAC;IAEF,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,SAAS,oBAAoB,CAAC,MAA8B,EAAyB;IACpF,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC5E,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;AAAA,CACpD;AAED,SAAS,eAAe,CACvB,QAAkB,EAClB,UAAoB,EACpB,SAA2B,EAC3B,QAA8B,EACnB;IACX,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACtE,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,OAAO,aAAa,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;AAAA,CACH;AAED,SAAS,qBAAqB,CAC7B,IAAa,EACb,QAAoC,EACpC,UAAsC,EACtC,SAA2B,EAC3B,QAA8B,EACb;IACjB,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,GAAG,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxG,MAAM,YAAY,GAAG,YAAY,CAAC;QACjC,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC3C,GAAG,mBAAmB,CAAC,UAAU,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,4BAA4B,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC1E,MAAM,eAAe,GAAG,4BAA4B,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC9E,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACtE,OAAO,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAAA,CAC3F;AAED,SAAS,cAAc,CACtB,QAAoC,EACpC,UAAsC,EACtC,SAA2B,EACT;IAClB,MAAM,cAAc,GAAG,wBAAwB,CAC9C,YAAY,CAAC,CAAC,GAAG,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,EACpF,SAAS,CACT,CAAC;IACF,MAAM,gBAAgB,GAAG,wBAAwB,CAChD,YAAY,CAAC,CAAC,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,GAAG,mBAAmB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,EAC1G,SAAS,CACT,CAAC;IACF,MAAM,YAAY,GAAG,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/E,OAAO;QACN,IAAI,EAAE,mBAAmB,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC;QAC5F,UAAU,EAAE,mBAAmB,CAAC,CAAC,GAAG,cAAc,CAAC,UAAU,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;KAC/F,CAAC;AAAA,CACF;AAED,SAAS,eAAe,CACvB,QAAoC,EACpC,UAAsC,EACtC,mBAAkD,EACjC;IACjB,MAAM,UAAU,GAAG,kBAAkB,CACpC,YAAY,CAAC,CAAC,GAAG,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,EACpF,mBAAmB,CACnB,CAAC;IACF,MAAM,YAAY,GAAG,YAAY,CAAC;QACjC,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC3C,GAAG,mBAAmB,CAAC,UAAU,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/E,OAAO,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAAA,CAC3E;AAED,SAAS,aAAa,CAAC,IAAc,EAAY;IAChD,OAAO;QACN,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC;AAAA,CACF;AAED,SAAS,mBAAmB,CAC3B,IAA8B,EAC9B,KAAwB,EACxB,OAA0B,EAC1B,OAA0B,EACT;IACjB,OAAO;QACN,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;AAAA,CACF;AAED,SAAS,cAAc,CAAC,IAAuB,EAAE,KAAwB,EAAY;IACpF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAAA,CACjE;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,IAAgC,EAAY;IACpF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAU,EAAE,CAAC;QAC9D,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjE,QAAQ,CAAC,IAAI,CACZ,GAAG,KAAK,IAAI,KAAK,4EAA4E,CAC7F,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,SAAS,cAAc,CAAC,MAAqC,EAAwB;IACpF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAAA,CAC7F;AAED,SAAS,mBAAmB,CAC3B,MAAgE,EACd;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAoD,EAAE,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAAA,CACvF;AAED,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS,EAAU;IACpD,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,CAAC,CAAC;AAAA,CACT","sourcesContent":["/**\n * Role + domain loadout composition.\n *\n * The composer is pure and additive: it never mutates built-in role loadouts or\n * domain profiles. It can only narrow authority and active tools, while forcing\n * baseline security hooks and downgrading writable filesystem MCP access for\n * read-only authorities.\n */\n\nimport { type DomainProfile, getDomainProfile } from \"./domain-loadouts.ts\";\nimport {\n\tcapabilityGateNames,\n\tdowngradeMcpForAuthority,\n\tforceSecurityHooks,\n\tminAuthority,\n\ttype StrippedCapability,\n\tselectSafestCommandMode,\n\tstripWriteSkillsForAuthority,\n\tstripWriteToolsForAuthority,\n\tunionCapabilityGateNames,\n\tuniqueSorted,\n} from \"./loadout-safety.ts\";\nimport {\n\tBUILTIN_LOADOUTS,\n\ttype CapabilityGate,\n\tinferLoadoutForRole,\n\ttype LoadoutAuthority,\n\ttype LoadoutProfile,\n\ttype LoadoutRole,\n\ttype ToolGate,\n\tvalidateLoadoutProfile,\n} from \"./loadouts.ts\";\n\nexport interface SamplingProfile {\n\treadonly temperature?: number;\n\treadonly topP?: number;\n\treadonly topK?: number;\n}\n\nexport interface ScopeHints {\n\treadonly readScope?: readonly string[];\n\treadonly writeScope?: readonly string[];\n\treadonly executeScope?: readonly string[];\n}\n\nexport interface CompositionTrace {\n\treadonly roleAuthority: LoadoutAuthority;\n\treadonly domainAuthority: LoadoutAuthority;\n\treadonly grantAuthority?: LoadoutAuthority;\n\treadonly composedAuthority: LoadoutAuthority;\n\treadonly stripped: readonly StrippedCapability[];\n\treadonly downgraded: readonly { readonly mcp: string; readonly to: string }[];\n\treadonly warnings: readonly string[];\n}\n\nexport interface ComposedLoadout extends LoadoutProfile {\n\treadonly role: LoadoutRole;\n\treadonly domainId: string;\n\treadonly domainResolvedFromFallback: boolean;\n\treadonly routingPrompt?: string;\n\treadonly samplingProfile?: SamplingProfile;\n\treadonly scopeHints?: ScopeHints;\n\treadonly composition: CompositionTrace;\n}\n\nexport interface ComposeLoadoutOptions {\n\treadonly grantAuthority?: LoadoutAuthority;\n\treadonly preserveRoleAuthority?: boolean;\n\treadonly scopeHints?: ScopeHints;\n\treadonly forcedSecurityHooks?: readonly string[];\n\treadonly roleProfileOverride?: LoadoutProfile;\n\treadonly samplingProfile?: SamplingProfile;\n}\n\nexport type ComposeOptions = ComposeLoadoutOptions;\n\ninterface ResolvedDomainProfile {\n\treadonly profile: DomainProfile;\n\treadonly fallback: boolean;\n}\n\ninterface ComposedMcpGate {\n\treadonly gate: CapabilityGate;\n\treadonly downgraded: readonly { readonly mcp: string; readonly to: string }[];\n}\n\nexport function composeLoadout(\n\trole: LoadoutRole,\n\tdomain: DomainProfile | string,\n\toptions: ComposeLoadoutOptions = {},\n): ComposedLoadout {\n\tconst roleProfile = options.roleProfileOverride ?? BUILTIN_LOADOUTS[inferLoadoutForRole(role)];\n\tconst resolvedDomain = resolveDomainProfile(domain);\n\tconst domainProfile = resolvedDomain.profile;\n\tconst composedAuthority = minAuthority(roleProfile.authority, domainProfile.authority, options.grantAuthority);\n\n\tconst stripped: StrippedCapability[] = [];\n\tconst warnings: string[] = [];\n\n\tconst toolGate = composeToolGate(roleProfile.tools, domainProfile.tools, composedAuthority, stripped);\n\tconst skills = composeCapabilityGate(\"skill\", roleProfile.skills, domainProfile.skills, composedAuthority, stripped);\n\tconst mcp = composeMcpGate(roleProfile.mcp, domainProfile.mcp, composedAuthority);\n\tconst hooks = composeHookGate(roleProfile.hooks, domainProfile.hooks, options.forcedSecurityHooks);\n\tconst commands = selectSafestCommandMode(\n\t\tcomposedAuthority,\n\t\troleProfile.commands?.mode,\n\t\tdomainProfile.commands?.mode,\n\t);\n\n\twarnings.push(...selectorWarnings(\"role skills\", roleProfile.skills));\n\twarnings.push(...selectorWarnings(\"domain skills\", domainProfile.skills));\n\twarnings.push(...selectorWarnings(\"role mcp\", roleProfile.mcp));\n\twarnings.push(...selectorWarnings(\"domain mcp\", domainProfile.mcp));\n\twarnings.push(...selectorWarnings(\"role hooks\", roleProfile.hooks));\n\twarnings.push(...selectorWarnings(\"domain hooks\", domainProfile.hooks));\n\n\tconst composed: ComposedLoadout = {\n\t\tschemaVersion: \"omk.loadout.v1\",\n\t\tname: `${roleProfile.name}+${domainProfile.id}`,\n\t\tdescription: `Composed ${roleProfile.name} role loadout with ${domainProfile.id} domain profile`,\n\t\tauthority: composedAuthority,\n\t\ttools: toolGate,\n\t\tskills,\n\t\tmcp: mcp.gate,\n\t\thooks,\n\t\tcommands,\n\t\trole,\n\t\tdomainId: domainProfile.id,\n\t\tdomainResolvedFromFallback: resolvedDomain.fallback,\n\t\troutingPrompt: domainProfile.routingPrompt,\n\t\t...(options.samplingProfile ? { samplingProfile: options.samplingProfile } : {}),\n\t\t...(options.scopeHints ? { scopeHints: options.scopeHints } : {}),\n\t\tcomposition: {\n\t\t\troleAuthority: roleProfile.authority,\n\t\t\tdomainAuthority: domainProfile.authority,\n\t\t\t...(options.grantAuthority ? { grantAuthority: options.grantAuthority } : {}),\n\t\t\tcomposedAuthority,\n\t\t\tstripped: uniqueStripped(stripped),\n\t\t\tdowngraded: mcp.downgraded,\n\t\t\twarnings: uniqueSorted(warnings),\n\t\t},\n\t};\n\n\tconst validation = validateLoadoutProfile(composed);\n\tif (!validation.valid) {\n\t\tthrow new Error(`composed loadout is invalid: ${validation.errors.join(\"; \")}`);\n\t}\n\treturn composed;\n}\n\nfunction resolveDomainProfile(domain: DomainProfile | string): ResolvedDomainProfile {\n\tif (typeof domain !== \"string\") return { profile: domain, fallback: false };\n\tconst profile = getDomainProfile(domain);\n\treturn { profile, fallback: profile.id !== domain };\n}\n\nfunction composeToolGate(\n\troleGate: ToolGate,\n\tdomainGate: ToolGate,\n\tauthority: LoadoutAuthority,\n\tstripped: StrippedCapability[],\n): ToolGate {\n\tconst roleAllow = roleGate.allow ?? [];\n\tconst domainAllow = domainGate.allow ?? [];\n\tconst allowed = intersectNames(roleAllow, domainAllow);\n\tconst strippedTools = stripWriteToolsForAuthority(allowed, authority);\n\tstripped.push(...strippedTools.stripped);\n\tconst require = uniqueSorted([...(roleGate.require ?? []), ...(domainGate.require ?? [])]);\n\tconst exclude = uniqueSorted([...(roleGate.exclude ?? []), ...(domainGate.exclude ?? [])]);\n\treturn cleanToolGate({\n\t\tallow: strippedTools.names,\n\t\t...(require.length > 0 ? { require } : {}),\n\t\t...(exclude.length > 0 ? { exclude } : {}),\n\t});\n}\n\nfunction composeCapabilityGate(\n\tkind: \"skill\",\n\troleGate: CapabilityGate | undefined,\n\tdomainGate: CapabilityGate | undefined,\n\tauthority: LoadoutAuthority,\n\tstripped: StrippedCapability[],\n): CapabilityGate {\n\tconst allowNames = uniqueSorted([...capabilityGateNames(roleGate), ...capabilityGateNames(domainGate)]);\n\tconst requireNames = uniqueSorted([\n\t\t...capabilityGateNames(roleGate, \"require\"),\n\t\t...capabilityGateNames(domainGate, \"require\"),\n\t]);\n\tconst excludeNames = unionCapabilityGateNames(\"exclude\", roleGate, domainGate);\n\tconst strippedAllow = stripWriteSkillsForAuthority(allowNames, authority);\n\tconst strippedRequire = stripWriteSkillsForAuthority(requireNames, authority);\n\tstripped.push(...strippedAllow.stripped, ...strippedRequire.stripped);\n\treturn cleanCapabilityGate(kind, strippedAllow.names, strippedRequire.names, excludeNames);\n}\n\nfunction composeMcpGate(\n\troleGate: CapabilityGate | undefined,\n\tdomainGate: CapabilityGate | undefined,\n\tauthority: LoadoutAuthority,\n): ComposedMcpGate {\n\tconst allowDowngrade = downgradeMcpForAuthority(\n\t\tuniqueSorted([...capabilityGateNames(roleGate), ...capabilityGateNames(domainGate)]),\n\t\tauthority,\n\t);\n\tconst requireDowngrade = downgradeMcpForAuthority(\n\t\tuniqueSorted([...capabilityGateNames(roleGate, \"require\"), ...capabilityGateNames(domainGate, \"require\")]),\n\t\tauthority,\n\t);\n\tconst excludeNames = unionCapabilityGateNames(\"exclude\", roleGate, domainGate);\n\treturn {\n\t\tgate: cleanCapabilityGate(\"mcp\", allowDowngrade.names, requireDowngrade.names, excludeNames),\n\t\tdowngraded: uniqueMcpDowngrades([...allowDowngrade.downgraded, ...requireDowngrade.downgraded]),\n\t};\n}\n\nfunction composeHookGate(\n\troleGate: CapabilityGate | undefined,\n\tdomainGate: CapabilityGate | undefined,\n\tforcedSecurityHooks: readonly string[] | undefined,\n): CapabilityGate {\n\tconst allowNames = forceSecurityHooks(\n\t\tuniqueSorted([...capabilityGateNames(roleGate), ...capabilityGateNames(domainGate)]),\n\t\tforcedSecurityHooks,\n\t);\n\tconst requireNames = uniqueSorted([\n\t\t...capabilityGateNames(roleGate, \"require\"),\n\t\t...capabilityGateNames(domainGate, \"require\"),\n\t]);\n\tconst excludeNames = unionCapabilityGateNames(\"exclude\", roleGate, domainGate);\n\treturn cleanCapabilityGate(\"hook\", allowNames, requireNames, excludeNames);\n}\n\nfunction cleanToolGate(gate: ToolGate): ToolGate {\n\treturn {\n\t\tallow: uniqueSorted(gate.allow ?? []),\n\t\t...(gate.require && gate.require.length > 0 ? { require: uniqueSorted(gate.require) } : {}),\n\t\t...(gate.exclude && gate.exclude.length > 0 ? { exclude: uniqueSorted(gate.exclude) } : {}),\n\t};\n}\n\nfunction cleanCapabilityGate(\n\tkind: \"skill\" | \"mcp\" | \"hook\",\n\tallow: readonly string[],\n\trequire: readonly string[],\n\texclude: readonly string[],\n): CapabilityGate {\n\treturn {\n\t\tallow: [{ kind, names: uniqueSorted(allow) }],\n\t\t...(require.length > 0 ? { require: [{ kind, names: uniqueSorted(require) }] } : {}),\n\t\t...(exclude.length > 0 ? { exclude: [{ kind, names: uniqueSorted(exclude) }] } : {}),\n\t};\n}\n\nfunction intersectNames(left: readonly string[], right: readonly string[]): string[] {\n\tconst rightSet = new Set(right);\n\treturn uniqueSorted(left.filter((value) => rightSet.has(value)));\n}\n\nfunction selectorWarnings(label: string, gate: CapabilityGate | undefined): string[] {\n\tconst warnings: string[] = [];\n\tfor (const group of [\"allow\", \"exclude\", \"require\"] as const) {\n\t\tfor (const selector of gate?.[group] ?? []) {\n\t\t\tif (selector.names === undefined || selector.names.length === 0) {\n\t\t\t\twarnings.push(\n\t\t\t\t\t`${label}.${group} contains a non-name selector that cannot be represented by composed gates`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\treturn warnings;\n}\n\nfunction uniqueStripped(values: readonly StrippedCapability[]): StrippedCapability[] {\n\tconst seen = new Set<string>();\n\tconst result: StrippedCapability[] = [];\n\tfor (const value of values) {\n\t\tconst key = `${value.kind}\\0${value.name}\\0${value.reason}`;\n\t\tif (seen.has(key)) continue;\n\t\tseen.add(key);\n\t\tresult.push(value);\n\t}\n\treturn result.sort((a, b) => compareString(a.kind, b.kind) || compareString(a.name, b.name));\n}\n\nfunction uniqueMcpDowngrades(\n\tvalues: readonly { readonly mcp: string; readonly to: string }[],\n): { readonly mcp: string; readonly to: string }[] {\n\tconst seen = new Set<string>();\n\tconst result: { readonly mcp: string; readonly to: string }[] = [];\n\tfor (const value of values) {\n\t\tconst key = `${value.mcp}\\0${value.to}`;\n\t\tif (seen.has(key)) continue;\n\t\tseen.add(key);\n\t\tresult.push(value);\n\t}\n\treturn result.sort((a, b) => compareString(a.mcp, b.mcp) || compareString(a.to, b.to));\n}\n\nfunction compareString(a: string, b: string): number {\n\tif (a < b) return -1;\n\tif (a > b) return 1;\n\treturn 0;\n}\n"]}

package/dist/core/loadout-policy-bridge.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Bridge from runtime loadout state into the AgentSession access policy shape.
+ *
+ * This wrapper keeps policy creation fail-closed for blocker-bearing states and
+ * exposes a lightweight integrity check for SDK/domain-dispatch integration.
+ */
+import type { LoadoutAccessPolicy } from "./loadout-access-policy.ts";
+import { type LoadoutRuntimeState } from "./loadout-runtime.ts";
+import type { LoadoutCommands } from "./loadouts.ts";
+export interface PolicyBridgeOptions {
+    readonly cwd: string;
+    readonly blockedPaths?: readonly string[];
+    readonly commands?: LoadoutCommands;
+    readonly additionalSecurityChecks?: boolean;
+}
+export interface PolicyIntegrityResult {
+    readonly valid: boolean;
+    readonly warnings: readonly string[];
+}
+export declare function createLoadoutPolicyFromRuntimeState(state: LoadoutRuntimeState, options: PolicyBridgeOptions): LoadoutAccessPolicy;
+export declare function validatePolicyIntegrity(policy: LoadoutAccessPolicy, state: LoadoutRuntimeState): PolicyIntegrityResult;
+//# sourceMappingURL=loadout-policy-bridge.d.ts.map

package/dist/core/loadout-policy-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadout-policy-bridge.d.ts","sourceRoot":"","sources":["../../src/core/loadout-policy-bridge.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAA4B,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CAC5C;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,wBAAgB,mCAAmC,CAClD,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,mBAAmB,GAC1B,mBAAmB,CASrB;AAED,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,mBAAmB,GACxB,qBAAqB,CAcvB","sourcesContent":["/**\n * Bridge from runtime loadout state into the AgentSession access policy shape.\n *\n * This wrapper keeps policy creation fail-closed for blocker-bearing states and\n * exposes a lightweight integrity check for SDK/domain-dispatch integration.\n */\n\nimport type { LoadoutAccessPolicy } from \"./loadout-access-policy.ts\";\nimport { buildLoadoutAccessPolicy, type LoadoutRuntimeState } from \"./loadout-runtime.ts\";\nimport type { LoadoutCommands } from \"./loadouts.ts\";\n\nexport interface PolicyBridgeOptions {\n\treadonly cwd: string;\n\treadonly blockedPaths?: readonly string[];\n\treadonly commands?: LoadoutCommands;\n\treadonly additionalSecurityChecks?: boolean;\n}\n\nexport interface PolicyIntegrityResult {\n\treadonly valid: boolean;\n\treadonly warnings: readonly string[];\n}\n\nexport function createLoadoutPolicyFromRuntimeState(\n\tstate: LoadoutRuntimeState,\n\toptions: PolicyBridgeOptions,\n): LoadoutAccessPolicy {\n\tif (state.blockers.length > 0) {\n\t\tthrow new Error(`cannot create loadout access policy with blockers: ${state.blockers.join(\"; \")}`);\n\t}\n\treturn buildLoadoutAccessPolicy(state, {\n\t\tcwd: options.cwd,\n\t\tblockedPaths: options.blockedPaths,\n\t\tcommands: options.commands,\n\t});\n}\n\nexport function validatePolicyIntegrity(\n\tpolicy: LoadoutAccessPolicy,\n\tstate: LoadoutRuntimeState,\n): PolicyIntegrityResult {\n\tconst warnings: string[] = [];\n\tif (!sameStringSet(policy.activeTools, state.activeTools)) {\n\t\twarnings.push(\"policy active tools do not match runtime active tools\");\n\t}\n\tconst expectedReadRoots = countPathRoots(state.schedulerFields.readSet);\n\tconst expectedWriteRoots = countPathRoots(state.schedulerFields.writeSet);\n\tif (policy.readRoots.length !== expectedReadRoots) {\n\t\twarnings.push(\"policy read roots do not match runtime scheduler read set\");\n\t}\n\tif (policy.writeRoots.length !== expectedWriteRoots) {\n\t\twarnings.push(\"policy write roots do not match runtime scheduler write set\");\n\t}\n\treturn { valid: warnings.length === 0, warnings };\n}\n\nfunction countPathRoots(entries: readonly { readonly path: string; readonly symbols?: readonly string[] }[]): number {\n\treturn entries.filter((entry) => entry.symbols === undefined || entry.symbols.length === 0).length;\n}\n\nfunction sameStringSet(left: readonly string[], right: readonly string[]): boolean {\n\tconst normalizedLeft = uniqueSorted(left);\n\tconst normalizedRight = uniqueSorted(right);\n\tif (normalizedLeft.length !== normalizedRight.length) return false;\n\treturn normalizedLeft.every((value, index) => value === normalizedRight[index]);\n}\n\nfunction uniqueSorted(values: readonly string[]): string[] {\n\treturn [...new Set(values)].sort((a, b) => {\n\t\tif (a < b) return -1;\n\t\tif (a > b) return 1;\n\t\treturn 0;\n\t});\n}\n"]}

package/dist/core/loadout-policy-bridge.js

@@ -0,0 +1,52 @@
+/**
+ * Bridge from runtime loadout state into the AgentSession access policy shape.
+ *
+ * This wrapper keeps policy creation fail-closed for blocker-bearing states and
+ * exposes a lightweight integrity check for SDK/domain-dispatch integration.
+ */
+import { buildLoadoutAccessPolicy } from "./loadout-runtime.js";
+export function createLoadoutPolicyFromRuntimeState(state, options) {
+    if (state.blockers.length > 0) {
+        throw new Error(`cannot create loadout access policy with blockers: ${state.blockers.join("; ")}`);
+    }
+    return buildLoadoutAccessPolicy(state, {
+        cwd: options.cwd,
+        blockedPaths: options.blockedPaths,
+        commands: options.commands,
+    });
+}
+export function validatePolicyIntegrity(policy, state) {
+    const warnings = [];
+    if (!sameStringSet(policy.activeTools, state.activeTools)) {
+        warnings.push("policy active tools do not match runtime active tools");
+    }
+    const expectedReadRoots = countPathRoots(state.schedulerFields.readSet);
+    const expectedWriteRoots = countPathRoots(state.schedulerFields.writeSet);
+    if (policy.readRoots.length !== expectedReadRoots) {
+        warnings.push("policy read roots do not match runtime scheduler read set");
+    }
+    if (policy.writeRoots.length !== expectedWriteRoots) {
+        warnings.push("policy write roots do not match runtime scheduler write set");
+    }
+    return { valid: warnings.length === 0, warnings };
+}
+function countPathRoots(entries) {
+    return entries.filter((entry) => entry.symbols === undefined || entry.symbols.length === 0).length;
+}
+function sameStringSet(left, right) {
+    const normalizedLeft = uniqueSorted(left);
+    const normalizedRight = uniqueSorted(right);
+    if (normalizedLeft.length !== normalizedRight.length)
+        return false;
+    return normalizedLeft.every((value, index) => value === normalizedRight[index]);
+}
+function uniqueSorted(values) {
+    return [...new Set(values)].sort((a, b) => {
+        if (a < b)
+            return -1;
+        if (a > b)
+            return 1;
+        return 0;
+    });
+}
+//# sourceMappingURL=loadout-policy-bridge.js.map

package/dist/core/loadout-policy-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadout-policy-bridge.js","sourceRoot":"","sources":["../../src/core/loadout-policy-bridge.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,wBAAwB,EAA4B,MAAM,sBAAsB,CAAC;AAe1F,MAAM,UAAU,mCAAmC,CAClD,KAA0B,EAC1B,OAA4B,EACN;IACtB,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,sDAAsD,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE;QACtC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,uBAAuB,CACtC,MAA2B,EAC3B,KAA0B,EACF;IACxB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,iBAAiB,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AAAA,CAClD;AAED,SAAS,cAAc,CAAC,OAAmF,EAAU;IACpH,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;AAAA,CACnG;AAED,SAAS,aAAa,CAAC,IAAuB,EAAE,KAAwB,EAAW;IAClF,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,eAAe,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,cAAc,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AAAA,CAChF;AAED,SAAS,YAAY,CAAC,MAAyB,EAAY;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QACpB,OAAO,CAAC,CAAC;IAAA,CACT,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * Bridge from runtime loadout state into the AgentSession access policy shape.\n *\n * This wrapper keeps policy creation fail-closed for blocker-bearing states and\n * exposes a lightweight integrity check for SDK/domain-dispatch integration.\n */\n\nimport type { LoadoutAccessPolicy } from \"./loadout-access-policy.ts\";\nimport { buildLoadoutAccessPolicy, type LoadoutRuntimeState } from \"./loadout-runtime.ts\";\nimport type { LoadoutCommands } from \"./loadouts.ts\";\n\nexport interface PolicyBridgeOptions {\n\treadonly cwd: string;\n\treadonly blockedPaths?: readonly string[];\n\treadonly commands?: LoadoutCommands;\n\treadonly additionalSecurityChecks?: boolean;\n}\n\nexport interface PolicyIntegrityResult {\n\treadonly valid: boolean;\n\treadonly warnings: readonly string[];\n}\n\nexport function createLoadoutPolicyFromRuntimeState(\n\tstate: LoadoutRuntimeState,\n\toptions: PolicyBridgeOptions,\n): LoadoutAccessPolicy {\n\tif (state.blockers.length > 0) {\n\t\tthrow new Error(`cannot create loadout access policy with blockers: ${state.blockers.join(\"; \")}`);\n\t}\n\treturn buildLoadoutAccessPolicy(state, {\n\t\tcwd: options.cwd,\n\t\tblockedPaths: options.blockedPaths,\n\t\tcommands: options.commands,\n\t});\n}\n\nexport function validatePolicyIntegrity(\n\tpolicy: LoadoutAccessPolicy,\n\tstate: LoadoutRuntimeState,\n): PolicyIntegrityResult {\n\tconst warnings: string[] = [];\n\tif (!sameStringSet(policy.activeTools, state.activeTools)) {\n\t\twarnings.push(\"policy active tools do not match runtime active tools\");\n\t}\n\tconst expectedReadRoots = countPathRoots(state.schedulerFields.readSet);\n\tconst expectedWriteRoots = countPathRoots(state.schedulerFields.writeSet);\n\tif (policy.readRoots.length !== expectedReadRoots) {\n\t\twarnings.push(\"policy read roots do not match runtime scheduler read set\");\n\t}\n\tif (policy.writeRoots.length !== expectedWriteRoots) {\n\t\twarnings.push(\"policy write roots do not match runtime scheduler write set\");\n\t}\n\treturn { valid: warnings.length === 0, warnings };\n}\n\nfunction countPathRoots(entries: readonly { readonly path: string; readonly symbols?: readonly string[] }[]): number {\n\treturn entries.filter((entry) => entry.symbols === undefined || entry.symbols.length === 0).length;\n}\n\nfunction sameStringSet(left: readonly string[], right: readonly string[]): boolean {\n\tconst normalizedLeft = uniqueSorted(left);\n\tconst normalizedRight = uniqueSorted(right);\n\tif (normalizedLeft.length !== normalizedRight.length) return false;\n\treturn normalizedLeft.every((value, index) => value === normalizedRight[index]);\n}\n\nfunction uniqueSorted(values: readonly string[]): string[] {\n\treturn [...new Set(values)].sort((a, b) => {\n\t\tif (a < b) return -1;\n\t\tif (a > b) return 1;\n\t\treturn 0;\n\t});\n}\n"]}