open-multi-agent-kit 0.80.7 → 0.90.0

package/dist/core/freedom/index.js

@@ -1,19 +0,0 @@
-/**
- * Public surface for the OMK freedom-mode runtime.
- *
- * Tool dispatchers import `gate`. The interactive TUI imports `badgeText` and
- * `bannerOnce`. Subprocess spawners import `applyFreedomEnv`. Everything else
- * is implementation detail and stays inside this directory.
- *
- * Design: every doctrine clause from AGENTS.md §0 has exactly one owner here.
- *   - §0.1 safety floor  → safety-floor.ts (always-on, never downgradable)
- *   - §0.2 defaults      → config.ts (parsed from .omk/config.toml)
- *   - §0.3 no moralizing → not enforced at runtime (system prompt only)
- *   - banner & badge     → banner.ts + policy.badgeText
- *   - subprocess env     → policy.applyFreedomEnv
- */
-export { bannerOnce } from "./banner.js";
-export { FREEDOM_CONFIG_DEFAULTS, FreedomConfigError, loadFreedomConfig, parseFreedomConfigFromString, } from "./config.js";
-export { applyFreedomEnv, badgeText, gate } from "./policy.js";
-export { redactSecrets, runSafetyFloor } from "./safety-floor.js";
-//# sourceMappingURL=index.js.map

package/dist/core/freedom/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/freedom/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACN,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,4BAA4B,GAC5B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC","sourcesContent":["/**\n * Public surface for the OMK freedom-mode runtime.\n *\n * Tool dispatchers import `gate`. The interactive TUI imports `badgeText` and\n * `bannerOnce`. Subprocess spawners import `applyFreedomEnv`. Everything else\n * is implementation detail and stays inside this directory.\n *\n * Design: every doctrine clause from AGENTS.md §0 has exactly one owner here.\n *   - §0.1 safety floor  → safety-floor.ts (always-on, never downgradable)\n *   - §0.2 defaults      → config.ts (parsed from .omk/config.toml)\n *   - §0.3 no moralizing → not enforced at runtime (system prompt only)\n *   - banner & badge     → banner.ts + policy.badgeText\n *   - subprocess env     → policy.applyFreedomEnv\n */\n\nexport type { BannerMemo } from \"./banner.ts\";\nexport { bannerOnce } from \"./banner.ts\";\nexport type { ApprovalPolicy, FreedomConfig } from \"./config.ts\";\nexport {\n\tFREEDOM_CONFIG_DEFAULTS,\n\tFreedomConfigError,\n\tloadFreedomConfig,\n\tparseFreedomConfigFromString,\n} from \"./config.ts\";\nexport type { PolicyDecision, ToolCallContext } from \"./policy.ts\";\nexport { applyFreedomEnv, badgeText, gate } from \"./policy.ts\";\nexport type { MatcherVerdict } from \"./safety-floor.ts\";\nexport { redactSecrets, runSafetyFloor } from \"./safety-floor.ts\";\n"]}

package/dist/core/freedom/policy.d.ts

@@ -1,42 +0,0 @@
-/**
- * Freedom-mode policy gate.
- *
- * The dispatcher wraps every tool call in `gate(call, cfg)`. Three outcomes:
- *
- *   - `allow`: dispatcher runs the tool without an interactive prompt.
- *   - `require-confirm`: dispatcher falls back to its existing confirm UI.
- *   - `deny-hard`: dispatcher returns a FailClosedToolResult and never runs.
- *
- * The safety floor (`safety-floor.ts`) is always consulted first. Only when
- * the floor passes do we look at the approval policy from `.omk/config.toml`.
- * Freedom mode can flip the second decision (approval) but never the first
- * (safety floor), which matches AGENTS.md §0.1 ("non-negotiable").
- */
-import type { HookFailureCode } from "../hooks/types.ts";
-import type { FreedomConfig } from "./config.ts";
-import { type ToolCallContext } from "./safety-floor.ts";
-export type { ToolCallContext } from "./safety-floor.ts";
-export type PolicyDecision = {
-    kind: "allow";
-} | {
-    kind: "require-confirm";
-    reason: string;
-} | {
-    kind: "deny-hard";
-    code: HookFailureCode;
-    reason: string;
-};
-export declare function gate(call: ToolCallContext, cfg: FreedomConfig): PolicyDecision;
-/**
- * UI surface: returns a short badge string when freedom mode is on, otherwise
- * undefined. Used by the interactive footer.
- */
-export declare function badgeText(cfg: FreedomConfig): string | undefined;
-/**
- * Environment passthrough for child processes spawned under freedom mode.
- * Mirrors the legacy shell hook's exports for code that still reads them, but
- * never auto-sets the advanced flags (TOS bypass / dark-web crawl); those must
- * be enabled explicitly via a future [freedom.advanced] block.
- */
-export declare function applyFreedomEnv(env: NodeJS.ProcessEnv, cfg: FreedomConfig): NodeJS.ProcessEnv;
-//# sourceMappingURL=policy.d.ts.map

package/dist/core/freedom/policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/core/freedom/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,MAAM,cAAc,GACvB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,wBAAgB,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,GAAG,cAAc,CAiB9E;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAGhE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,UAAU,CAS7F","sourcesContent":["/**\n * Freedom-mode policy gate.\n *\n * The dispatcher wraps every tool call in `gate(call, cfg)`. Three outcomes:\n *\n *   - `allow`: dispatcher runs the tool without an interactive prompt.\n *   - `require-confirm`: dispatcher falls back to its existing confirm UI.\n *   - `deny-hard`: dispatcher returns a FailClosedToolResult and never runs.\n *\n * The safety floor (`safety-floor.ts`) is always consulted first. Only when\n * the floor passes do we look at the approval policy from `.omk/config.toml`.\n * Freedom mode can flip the second decision (approval) but never the first\n * (safety floor), which matches AGENTS.md §0.1 (\"non-negotiable\").\n */\nimport type { HookFailureCode } from \"../hooks/types.ts\";\nimport type { FreedomConfig } from \"./config.ts\";\nimport { runSafetyFloor, type ToolCallContext } from \"./safety-floor.ts\";\n\nexport type { ToolCallContext } from \"./safety-floor.ts\";\n\nexport type PolicyDecision =\n\t| { kind: \"allow\" }\n\t| { kind: \"require-confirm\"; reason: string }\n\t| { kind: \"deny-hard\"; code: HookFailureCode; reason: string };\n\nexport function gate(call: ToolCallContext, cfg: FreedomConfig): PolicyDecision {\n\t// §0.1 floor first. The floor can hard-deny or upgrade to require-confirm\n\t// (privilege escalation). It never returns 'allow' on its own.\n\tconst floor = runSafetyFloor(call);\n\tif (floor.kind === \"deny-hard\") return floor;\n\tif (floor.kind === \"require-confirm\") return floor;\n\n\t// Floor passed. Now consult the approval policy.\n\tif (cfg.enabled && cfg.approvalPolicy === \"yolo\" && cfg.yoloMode) {\n\t\treturn { kind: \"allow\" };\n\t}\n\treturn {\n\t\tkind: \"require-confirm\",\n\t\treason: cfg.enabled\n\t\t\t? \"approval_policy is not 'yolo'; falling back to per-tool confirmation.\"\n\t\t\t: \"Freedom mode disabled; per-tool confirmation required.\",\n\t};\n}\n\n/**\n * UI surface: returns a short badge string when freedom mode is on, otherwise\n * undefined. Used by the interactive footer.\n */\nexport function badgeText(cfg: FreedomConfig): string | undefined {\n\tif (!cfg.enabled) return undefined;\n\treturn cfg.approvalPolicy === \"yolo\" && cfg.yoloMode ? \"freedom·yolo\" : \"freedom·prompt\";\n}\n\n/**\n * Environment passthrough for child processes spawned under freedom mode.\n * Mirrors the legacy shell hook's exports for code that still reads them, but\n * never auto-sets the advanced flags (TOS bypass / dark-web crawl); those must\n * be enabled explicitly via a future [freedom.advanced] block.\n */\nexport function applyFreedomEnv(env: NodeJS.ProcessEnv, cfg: FreedomConfig): NodeJS.ProcessEnv {\n\tif (!cfg.enabled) return env;\n\tconst out: NodeJS.ProcessEnv = { ...env };\n\tout.OMK_FREEDOM_MODE = \"true\";\n\tout.OMK_DOCTRINE_VERSION = cfg.doctrineVersion;\n\tif (cfg.approvalPolicy === \"yolo\" && cfg.yoloMode) {\n\t\tout.OMK_EXECUTE_ALL = \"true\";\n\t}\n\treturn out;\n}\n"]}

package/dist/core/freedom/policy.js

@@ -1,47 +0,0 @@
-import { runSafetyFloor } from "./safety-floor.js";
-export function gate(call, cfg) {
-    // §0.1 floor first. The floor can hard-deny or upgrade to require-confirm
-    // (privilege escalation). It never returns 'allow' on its own.
-    const floor = runSafetyFloor(call);
-    if (floor.kind === "deny-hard")
-        return floor;
-    if (floor.kind === "require-confirm")
-        return floor;
-    // Floor passed. Now consult the approval policy.
-    if (cfg.enabled && cfg.approvalPolicy === "yolo" && cfg.yoloMode) {
-        return { kind: "allow" };
-    }
-    return {
-        kind: "require-confirm",
-        reason: cfg.enabled
-            ? "approval_policy is not 'yolo'; falling back to per-tool confirmation."
-            : "Freedom mode disabled; per-tool confirmation required.",
-    };
-}
-/**
- * UI surface: returns a short badge string when freedom mode is on, otherwise
- * undefined. Used by the interactive footer.
- */
-export function badgeText(cfg) {
-    if (!cfg.enabled)
-        return undefined;
-    return cfg.approvalPolicy === "yolo" && cfg.yoloMode ? "freedom·yolo" : "freedom·prompt";
-}
-/**
- * Environment passthrough for child processes spawned under freedom mode.
- * Mirrors the legacy shell hook's exports for code that still reads them, but
- * never auto-sets the advanced flags (TOS bypass / dark-web crawl); those must
- * be enabled explicitly via a future [freedom.advanced] block.
- */
-export function applyFreedomEnv(env, cfg) {
-    if (!cfg.enabled)
-        return env;
-    const out = { ...env };
-    out.OMK_FREEDOM_MODE = "true";
-    out.OMK_DOCTRINE_VERSION = cfg.doctrineVersion;
-    if (cfg.approvalPolicy === "yolo" && cfg.yoloMode) {
-        out.OMK_EXECUTE_ALL = "true";
-    }
-    return out;
-}
-//# sourceMappingURL=policy.js.map

package/dist/core/freedom/policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/core/freedom/policy.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,cAAc,EAAwB,MAAM,mBAAmB,CAAC;AASzE,MAAM,UAAU,IAAI,CAAC,IAAqB,EAAE,GAAkB,EAAkB;IAC/E,2EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAEnD,iDAAiD;IACjD,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO;QACN,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,GAAG,CAAC,OAAO;YAClB,CAAC,CAAC,uEAAuE;YACzE,CAAC,CAAC,wDAAwD;KAC3D,CAAC;AAAA,CACF;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAkB,EAAsB;IACjE,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACnC,OAAO,GAAG,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAc,CAAC,CAAC,CAAC,iBAAgB,CAAC;AAAA,CACzF;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAsB,EAAE,GAAkB,EAAqB;IAC9F,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC;IAC7B,MAAM,GAAG,GAAsB,EAAE,GAAG,GAAG,EAAE,CAAC;IAC1C,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC;IAC9B,GAAG,CAAC,oBAAoB,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/C,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACnD,GAAG,CAAC,eAAe,GAAG,MAAM,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AAAA,CACX","sourcesContent":["/**\n * Freedom-mode policy gate.\n *\n * The dispatcher wraps every tool call in `gate(call, cfg)`. Three outcomes:\n *\n *   - `allow`: dispatcher runs the tool without an interactive prompt.\n *   - `require-confirm`: dispatcher falls back to its existing confirm UI.\n *   - `deny-hard`: dispatcher returns a FailClosedToolResult and never runs.\n *\n * The safety floor (`safety-floor.ts`) is always consulted first. Only when\n * the floor passes do we look at the approval policy from `.omk/config.toml`.\n * Freedom mode can flip the second decision (approval) but never the first\n * (safety floor), which matches AGENTS.md §0.1 (\"non-negotiable\").\n */\nimport type { HookFailureCode } from \"../hooks/types.ts\";\nimport type { FreedomConfig } from \"./config.ts\";\nimport { runSafetyFloor, type ToolCallContext } from \"./safety-floor.ts\";\n\nexport type { ToolCallContext } from \"./safety-floor.ts\";\n\nexport type PolicyDecision =\n\t| { kind: \"allow\" }\n\t| { kind: \"require-confirm\"; reason: string }\n\t| { kind: \"deny-hard\"; code: HookFailureCode; reason: string };\n\nexport function gate(call: ToolCallContext, cfg: FreedomConfig): PolicyDecision {\n\t// §0.1 floor first. The floor can hard-deny or upgrade to require-confirm\n\t// (privilege escalation). It never returns 'allow' on its own.\n\tconst floor = runSafetyFloor(call);\n\tif (floor.kind === \"deny-hard\") return floor;\n\tif (floor.kind === \"require-confirm\") return floor;\n\n\t// Floor passed. Now consult the approval policy.\n\tif (cfg.enabled && cfg.approvalPolicy === \"yolo\" && cfg.yoloMode) {\n\t\treturn { kind: \"allow\" };\n\t}\n\treturn {\n\t\tkind: \"require-confirm\",\n\t\treason: cfg.enabled\n\t\t\t? \"approval_policy is not 'yolo'; falling back to per-tool confirmation.\"\n\t\t\t: \"Freedom mode disabled; per-tool confirmation required.\",\n\t};\n}\n\n/**\n * UI surface: returns a short badge string when freedom mode is on, otherwise\n * undefined. Used by the interactive footer.\n */\nexport function badgeText(cfg: FreedomConfig): string | undefined {\n\tif (!cfg.enabled) return undefined;\n\treturn cfg.approvalPolicy === \"yolo\" && cfg.yoloMode ? \"freedom·yolo\" : \"freedom·prompt\";\n}\n\n/**\n * Environment passthrough for child processes spawned under freedom mode.\n * Mirrors the legacy shell hook's exports for code that still reads them, but\n * never auto-sets the advanced flags (TOS bypass / dark-web crawl); those must\n * be enabled explicitly via a future [freedom.advanced] block.\n */\nexport function applyFreedomEnv(env: NodeJS.ProcessEnv, cfg: FreedomConfig): NodeJS.ProcessEnv {\n\tif (!cfg.enabled) return env;\n\tconst out: NodeJS.ProcessEnv = { ...env };\n\tout.OMK_FREEDOM_MODE = \"true\";\n\tout.OMK_DOCTRINE_VERSION = cfg.doctrineVersion;\n\tif (cfg.approvalPolicy === \"yolo\" && cfg.yoloMode) {\n\t\tout.OMK_EXECUTE_ALL = \"true\";\n\t}\n\treturn out;\n}\n"]}

package/dist/core/freedom/safety-floor.d.ts

@@ -1,73 +0,0 @@
-/**
- * Non-negotiable §0.1 safety floor matchers.
- *
- * These are deterministic, pure functions used by `policy.ts:gate()`. They
- * implement the four runtime-enforceable clauses from AGENTS.md §0.1:
- *
- *   1. Secrets must never be read, logged, or transmitted.
- *   2. Privilege escalation must require an explicit per-command user confirm.
- *   3. Filesystem-destructive commands at root or home are hard-denied.
- *   4. Tool calls must stay inside the lane grant's writeScope / executeScope.
- *
- * Clause 5 (§0.3 "no moralizing") is an LLM behavior clause and lives in the
- * orchestrator system prompt; there is no runtime matcher for it.
- *
- * Every matcher fails closed: if its internal regex throws, the call is
- * treated as a hard deny instead of an implicit allow. This is enforced by
- * the wrapper helpers in `policy.ts`, not here, so the matchers themselves
- * can stay tiny and testable.
- */
-import type { HookFailureCode } from "../hooks/types.ts";
-export interface ToolCallContext {
-    tool: "bash" | "edit" | "write" | "read";
-    args: {
-        path?: string;
-        command?: string;
-        [key: string]: unknown;
-    };
-    laneGrant?: {
-        writeScope?: readonly string[];
-        executeScope?: readonly string[];
-    };
-}
-export type MatcherVerdict = {
-    kind: "pass";
-} | {
-    kind: "require-confirm";
-    reason: string;
-} | {
-    kind: "deny-hard";
-    code: HookFailureCode;
-    reason: string;
-};
-/**
- * Clause 1 — secrets. Block reads/writes/edits targeting credential files.
- * Bash matchers check the command's argv for known credential paths too.
- */
-export declare function checkSecretsClause(call: ToolCallContext): MatcherVerdict;
-/**
- * Clause 2 — privilege escalation. Even under yolo mode, sudo/su require an
- * explicit confirm. Never auto-approved.
- */
-export declare function checkPrivilegeClause(call: ToolCallContext): MatcherVerdict;
-/**
- * Clause 3 — filesystem destruction. Hard deny. No override path.
- */
-export declare function checkFsDestructionClause(call: ToolCallContext): MatcherVerdict;
-/**
- * Clause 4 — scope. Edits/writes must land inside writeScope; bash must stay
- * inside executeScope when configured. Empty/undefined scope = no constraint
- * (e.g. local CLI usage without a lane grant).
- */
-export declare function checkScopeClause(call: ToolCallContext): MatcherVerdict;
-/**
- * Redact bearer tokens and other secret-looking substrings before any sink
- * (logger, audit event, tool result returned to the LLM).
- */
-export declare function redactSecrets(input: string): string;
-/**
- * Run every clause in order. First non-pass verdict wins; deny-hard beats
- * require-confirm in the rare case both fire (privilege + fs-destruction).
- */
-export declare function runSafetyFloor(call: ToolCallContext): MatcherVerdict;
-//# sourceMappingURL=safety-floor.d.ts.map

package/dist/core/freedom/safety-floor.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"safety-floor.d.ts","sourceRoot":"","sources":["../../../src/core/freedom/safety-floor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACzC,IAAI,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACvB,CAAC;IACF,SAAS,CAAC,EAAE;QACX,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC/B,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACjC,CAAC;CACF;AAED,MAAM,MAAM,cAAc,GACvB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAgGhE;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAsBxE;AAuBD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAa1E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAc9E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAiCtE;AAsBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAiBpE","sourcesContent":["/**\n * Non-negotiable §0.1 safety floor matchers.\n *\n * These are deterministic, pure functions used by `policy.ts:gate()`. They\n * implement the four runtime-enforceable clauses from AGENTS.md §0.1:\n *\n *   1. Secrets must never be read, logged, or transmitted.\n *   2. Privilege escalation must require an explicit per-command user confirm.\n *   3. Filesystem-destructive commands at root or home are hard-denied.\n *   4. Tool calls must stay inside the lane grant's writeScope / executeScope.\n *\n * Clause 5 (§0.3 \"no moralizing\") is an LLM behavior clause and lives in the\n * orchestrator system prompt; there is no runtime matcher for it.\n *\n * Every matcher fails closed: if its internal regex throws, the call is\n * treated as a hard deny instead of an implicit allow. This is enforced by\n * the wrapper helpers in `policy.ts`, not here, so the matchers themselves\n * can stay tiny and testable.\n */\nimport type { HookFailureCode } from \"../hooks/types.ts\";\n\nexport interface ToolCallContext {\n\ttool: \"bash\" | \"edit\" | \"write\" | \"read\";\n\targs: {\n\t\tpath?: string;\n\t\tcommand?: string;\n\t\t[key: string]: unknown;\n\t};\n\tlaneGrant?: {\n\t\twriteScope?: readonly string[];\n\t\texecuteScope?: readonly string[];\n\t};\n}\n\nexport type MatcherVerdict =\n\t| { kind: \"pass\" }\n\t| { kind: \"require-confirm\"; reason: string }\n\t| { kind: \"deny-hard\"; code: HookFailureCode; reason: string };\n\nconst SECRET_PATH_PATTERNS: readonly RegExp[] = [\n\t/(^|\\/)\\.env(\\.|$)/i,\n\t/(^|\\/)\\.env$/i,\n\t/(^|\\/)auth\\.json$/i,\n\t/(^|\\/)\\.netrc$/i,\n\t/(^|\\/)\\.aws\\/credentials$/i,\n\t/(^|\\/)\\.ssh\\/(id_[a-z0-9]+|[a-z0-9_-]+_(rsa|ed25519|ecdsa|dsa))$/i,\n\t/\\.pem$/i,\n\t/\\.key$/i,\n\t/(^|\\/)[^/]*secret[^/]*$/i,\n\t/(^|\\/)[^/]*token[^/]*$/i,\n];\n\nconst SECRET_CONTENT_PATTERNS: readonly RegExp[] = [\n\t/npm_[A-Za-z0-9_-]{16,}/g,\n\t/\\bgh[pousr]_[A-Za-z0-9]{36}\\b/g,\n\t/\\bxox[bpars]-[A-Za-z0-9-]+\\b/g,\n\t/\\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\\b/g,\n\t/\\bAKIA[0-9A-Z]{16}\\b/g,\n];\n\nconst PRIVILEGE_ESCALATION_PATTERNS: readonly RegExp[] = [\n\t/^\\s*sudo(\\s|$)/,\n\t/^\\s*su(\\s|$)/,\n\t/(^|\\s|;|&&|\\|\\|)sudo\\s/,\n\t/(^|\\s|;|&&|\\|\\|)su\\s/,\n\t/(^|\\s)doas(\\s|$)/,\n\t/chmod\\s+[ug]\\+s\\b/,\n\t/\\bsetcap\\s/,\n];\n\nconst FS_DESTRUCTION_PATTERNS: readonly RegExp[] = [\n\t/\\brm\\s+(-[a-zA-Z]*[rRfF][a-zA-Z]*\\s+)+(\\/|~|\\$HOME|\"\\/\"|'\\/')(\\s|$)/,\n\t/\\bmkfs(\\.\\w+)?\\s/,\n\t/\\bdd\\b[^|;&]*\\bof=\\/dev\\//,\n\t/:\\(\\)\\s*\\{\\s*:\\s*\\|\\s*:\\s*&\\s*\\}\\s*;\\s*:/,\n\t/\\bchmod\\s+-R\\s+0+\\s+\\/(\\s|$)/,\n];\n\nconst REDACTION_PLACEHOLDER = \"***REDACTED***\";\n\nfunction normalizePath(input: string): string {\n\treturn input.replace(/\\\\/g, \"/\");\n}\n\nfunction basename(input: string): string {\n\tconst normalized = normalizePath(input);\n\tconst idx = normalized.lastIndexOf(\"/\");\n\treturn idx >= 0 ? normalized.slice(idx + 1) : normalized;\n}\n\nfunction matchesAnyGlob(path: string, scope: readonly string[]): boolean {\n\tif (scope.length === 0) return false;\n\tconst normalized = normalizePath(path);\n\tfor (const glob of scope) {\n\t\tconst re = globToRegex(glob);\n\t\tif (re.test(normalized)) return true;\n\t}\n\treturn false;\n}\n\nfunction globToRegex(glob: string): RegExp {\n\t// Minimal glob: ** -> .*, * -> [^/]*, ? -> [^/]. Other regex metachars escaped.\n\tconst normalized = normalizePath(glob);\n\tlet pattern = \"\";\n\tlet i = 0;\n\twhile (i < normalized.length) {\n\t\tconst c = normalized[i];\n\t\tif (c === \"*\" && normalized[i + 1] === \"*\") {\n\t\t\tpattern += \".*\";\n\t\t\ti += 2;\n\t\t\tcontinue;\n\t\t}\n\t\tif (c === \"*\") {\n\t\t\tpattern += \"[^/]*\";\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (c === \"?\") {\n\t\t\tpattern += \"[^/]\";\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (/[.+^${}()|[\\]\\\\]/.test(c)) {\n\t\t\tpattern += `\\\\${c}`;\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tpattern += c;\n\t\ti += 1;\n\t}\n\treturn new RegExp(`^${pattern}$`);\n}\n\n/**\n * Clause 1 — secrets. Block reads/writes/edits targeting credential files.\n * Bash matchers check the command's argv for known credential paths too.\n */\nexport function checkSecretsClause(call: ToolCallContext): MatcherVerdict {\n\tif (call.tool === \"read\" || call.tool === \"edit\" || call.tool === \"write\") {\n\t\tconst path = typeof call.args.path === \"string\" ? call.args.path : \"\";\n\t\tif (path && pathLooksLikeSecret(path)) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\treason: `Secrets clause blocks ${call.tool} on '${path}'.`,\n\t\t\t};\n\t\t}\n\t}\n\tif (call.tool === \"bash\") {\n\t\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\t\tif (cmd && bashTouchesSecret(cmd)) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\treason: \"Secrets clause blocks bash command that reads a credential file.\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\nfunction pathLooksLikeSecret(path: string): boolean {\n\tconst normalized = normalizePath(path);\n\tconst base = basename(normalized);\n\tfor (const re of SECRET_PATH_PATTERNS) {\n\t\tif (re.test(normalized) || re.test(base)) return true;\n\t}\n\treturn false;\n}\n\nfunction bashTouchesSecret(cmd: string): boolean {\n\t// Catch the obvious cat / cp / mv / less / head / tail / source <secret-path>.\n\tconst readVerbs = /\\b(cat|less|more|head|tail|tac|nl|od|hexdump|xxd|cp|mv|source|\\.)\\b\\s+([^\\s|;&<>]+)/g;\n\tlet match: RegExpExecArray | null = readVerbs.exec(cmd);\n\twhile (match !== null) {\n\t\tconst target = match[2];\n\t\tif (target && pathLooksLikeSecret(target)) return true;\n\t\tmatch = readVerbs.exec(cmd);\n\t}\n\treturn false;\n}\n\n/**\n * Clause 2 — privilege escalation. Even under yolo mode, sudo/su require an\n * explicit confirm. Never auto-approved.\n */\nexport function checkPrivilegeClause(call: ToolCallContext): MatcherVerdict {\n\tif (call.tool !== \"bash\") return { kind: \"pass\" };\n\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\tif (!cmd) return { kind: \"pass\" };\n\tfor (const re of PRIVILEGE_ESCALATION_PATTERNS) {\n\t\tif (re.test(cmd)) {\n\t\t\treturn {\n\t\t\t\tkind: \"require-confirm\",\n\t\t\t\treason: \"Privilege escalation requires explicit confirmation under §0.1.\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\n/**\n * Clause 3 — filesystem destruction. Hard deny. No override path.\n */\nexport function checkFsDestructionClause(call: ToolCallContext): MatcherVerdict {\n\tif (call.tool !== \"bash\") return { kind: \"pass\" };\n\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\tif (!cmd) return { kind: \"pass\" };\n\tfor (const re of FS_DESTRUCTION_PATTERNS) {\n\t\tif (re.test(cmd)) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\treason: \"Filesystem-destructive command is blocked by §0.1.\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\n/**\n * Clause 4 — scope. Edits/writes must land inside writeScope; bash must stay\n * inside executeScope when configured. Empty/undefined scope = no constraint\n * (e.g. local CLI usage without a lane grant).\n */\nexport function checkScopeClause(call: ToolCallContext): MatcherVerdict {\n\tconst grant = call.laneGrant;\n\tif (!grant) return { kind: \"pass\" };\n\tif (call.tool === \"write\" || call.tool === \"edit\") {\n\t\tconst writeScope = grant.writeScope;\n\t\tif (writeScope && writeScope.length > 0) {\n\t\t\tconst path = typeof call.args.path === \"string\" ? call.args.path : \"\";\n\t\t\tif (path && !matchesAnyGlob(path, writeScope)) {\n\t\t\t\treturn {\n\t\t\t\t\tkind: \"deny-hard\",\n\t\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\t\treason: `Path '${path}' is outside writeScope.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\tif (call.tool === \"bash\") {\n\t\tconst executeScope = grant.executeScope;\n\t\tif (executeScope && executeScope.length > 0) {\n\t\t\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\t\t\tconst touched = extractMutatingTargets(cmd);\n\t\t\tfor (const target of touched) {\n\t\t\t\tif (!matchesAnyGlob(target, executeScope)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tkind: \"deny-hard\",\n\t\t\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\t\t\treason: `Bash mutates '${target}' outside executeScope.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\nfunction extractMutatingTargets(cmd: string): string[] {\n\t// Heuristic: top-level >, >>, tee target; ignore quoted forms inside strings.\n\tconst targets: string[] = [];\n\tconst redirectRe = />>?\\s*([^\\s|;&<>'\"]+)/g;\n\tlet m: RegExpExecArray | null = redirectRe.exec(cmd);\n\twhile (m !== null) {\n\t\tconst t = m[1];\n\t\tif (t && t !== \"/dev/null\") targets.push(t);\n\t\tm = redirectRe.exec(cmd);\n\t}\n\tconst teeRe = /\\btee\\s+(?:-a\\s+)?([^\\s|;&<>'\"]+)/g;\n\tm = teeRe.exec(cmd);\n\twhile (m !== null) {\n\t\tconst t = m[1];\n\t\tif (t) targets.push(t);\n\t\tm = teeRe.exec(cmd);\n\t}\n\treturn targets;\n}\n\n/**\n * Redact bearer tokens and other secret-looking substrings before any sink\n * (logger, audit event, tool result returned to the LLM).\n */\nexport function redactSecrets(input: string): string {\n\tif (!input) return input;\n\tlet out = input;\n\tfor (const re of SECRET_CONTENT_PATTERNS) {\n\t\tout = out.replace(re, REDACTION_PLACEHOLDER);\n\t}\n\treturn out;\n}\n\n/**\n * Run every clause in order. First non-pass verdict wins; deny-hard beats\n * require-confirm in the rare case both fire (privilege + fs-destruction).\n */\nexport function runSafetyFloor(call: ToolCallContext): MatcherVerdict {\n\tconst checks = [checkSecretsClause, checkFsDestructionClause, checkScopeClause, checkPrivilegeClause];\n\tlet firstConfirm: MatcherVerdict | null = null;\n\tfor (const check of checks) {\n\t\ttry {\n\t\t\tconst verdict = check(call);\n\t\t\tif (verdict.kind === \"deny-hard\") return verdict;\n\t\t\tif (verdict.kind === \"require-confirm\" && !firstConfirm) firstConfirm = verdict;\n\t\t} catch (error) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_failed\",\n\t\t\t\treason: `Safety floor matcher threw: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t};\n\t\t}\n\t}\n\treturn firstConfirm ?? { kind: \"pass\" };\n}\n"]}

package/dist/core/freedom/safety-floor.js

@@ -1,275 +0,0 @@
-const SECRET_PATH_PATTERNS = [
-    /(^|\/)\.env(\.|$)/i,
-    /(^|\/)\.env$/i,
-    /(^|\/)auth\.json$/i,
-    /(^|\/)\.netrc$/i,
-    /(^|\/)\.aws\/credentials$/i,
-    /(^|\/)\.ssh\/(id_[a-z0-9]+|[a-z0-9_-]+_(rsa|ed25519|ecdsa|dsa))$/i,
-    /\.pem$/i,
-    /\.key$/i,
-    /(^|\/)[^/]*secret[^/]*$/i,
-    /(^|\/)[^/]*token[^/]*$/i,
-];
-const SECRET_CONTENT_PATTERNS = [
-    /npm_[A-Za-z0-9_-]{16,}/g,
-    /\bgh[pousr]_[A-Za-z0-9]{36}\b/g,
-    /\bxox[bpars]-[A-Za-z0-9-]+\b/g,
-    /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g,
-    /\bAKIA[0-9A-Z]{16}\b/g,
-];
-const PRIVILEGE_ESCALATION_PATTERNS = [
-    /^\s*sudo(\s|$)/,
-    /^\s*su(\s|$)/,
-    /(^|\s|;|&&|\|\|)sudo\s/,
-    /(^|\s|;|&&|\|\|)su\s/,
-    /(^|\s)doas(\s|$)/,
-    /chmod\s+[ug]\+s\b/,
-    /\bsetcap\s/,
-];
-const FS_DESTRUCTION_PATTERNS = [
-    /\brm\s+(-[a-zA-Z]*[rRfF][a-zA-Z]*\s+)+(\/|~|\$HOME|"\/"|'\/')(\s|$)/,
-    /\bmkfs(\.\w+)?\s/,
-    /\bdd\b[^|;&]*\bof=\/dev\//,
-    /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/,
-    /\bchmod\s+-R\s+0+\s+\/(\s|$)/,
-];
-const REDACTION_PLACEHOLDER = "***REDACTED***";
-function normalizePath(input) {
-    return input.replace(/\\/g, "/");
-}
-function basename(input) {
-    const normalized = normalizePath(input);
-    const idx = normalized.lastIndexOf("/");
-    return idx >= 0 ? normalized.slice(idx + 1) : normalized;
-}
-function matchesAnyGlob(path, scope) {
-    if (scope.length === 0)
-        return false;
-    const normalized = normalizePath(path);
-    for (const glob of scope) {
-        const re = globToRegex(glob);
-        if (re.test(normalized))
-            return true;
-    }
-    return false;
-}
-function globToRegex(glob) {
-    // Minimal glob: ** -> .*, * -> [^/]*, ? -> [^/]. Other regex metachars escaped.
-    const normalized = normalizePath(glob);
-    let pattern = "";
-    let i = 0;
-    while (i < normalized.length) {
-        const c = normalized[i];
-        if (c === "*" && normalized[i + 1] === "*") {
-            pattern += ".*";
-            i += 2;
-            continue;
-        }
-        if (c === "*") {
-            pattern += "[^/]*";
-            i += 1;
-            continue;
-        }
-        if (c === "?") {
-            pattern += "[^/]";
-            i += 1;
-            continue;
-        }
-        if (/[.+^${}()|[\]\\]/.test(c)) {
-            pattern += `\\${c}`;
-            i += 1;
-            continue;
-        }
-        pattern += c;
-        i += 1;
-    }
-    return new RegExp(`^${pattern}$`);
-}
-/**
- * Clause 1 — secrets. Block reads/writes/edits targeting credential files.
- * Bash matchers check the command's argv for known credential paths too.
- */
-export function checkSecretsClause(call) {
-    if (call.tool === "read" || call.tool === "edit" || call.tool === "write") {
-        const path = typeof call.args.path === "string" ? call.args.path : "";
-        if (path && pathLooksLikeSecret(path)) {
-            return {
-                kind: "deny-hard",
-                code: "hook_rejected",
-                reason: `Secrets clause blocks ${call.tool} on '${path}'.`,
-            };
-        }
-    }
-    if (call.tool === "bash") {
-        const cmd = typeof call.args.command === "string" ? call.args.command : "";
-        if (cmd && bashTouchesSecret(cmd)) {
-            return {
-                kind: "deny-hard",
-                code: "hook_rejected",
-                reason: "Secrets clause blocks bash command that reads a credential file.",
-            };
-        }
-    }
-    return { kind: "pass" };
-}
-function pathLooksLikeSecret(path) {
-    const normalized = normalizePath(path);
-    const base = basename(normalized);
-    for (const re of SECRET_PATH_PATTERNS) {
-        if (re.test(normalized) || re.test(base))
-            return true;
-    }
-    return false;
-}
-function bashTouchesSecret(cmd) {
-    // Catch the obvious cat / cp / mv / less / head / tail / source <secret-path>.
-    const readVerbs = /\b(cat|less|more|head|tail|tac|nl|od|hexdump|xxd|cp|mv|source|\.)\b\s+([^\s|;&<>]+)/g;
-    let match = readVerbs.exec(cmd);
-    while (match !== null) {
-        const target = match[2];
-        if (target && pathLooksLikeSecret(target))
-            return true;
-        match = readVerbs.exec(cmd);
-    }
-    return false;
-}
-/**
- * Clause 2 — privilege escalation. Even under yolo mode, sudo/su require an
- * explicit confirm. Never auto-approved.
- */
-export function checkPrivilegeClause(call) {
-    if (call.tool !== "bash")
-        return { kind: "pass" };
-    const cmd = typeof call.args.command === "string" ? call.args.command : "";
-    if (!cmd)
-        return { kind: "pass" };
-    for (const re of PRIVILEGE_ESCALATION_PATTERNS) {
-        if (re.test(cmd)) {
-            return {
-                kind: "require-confirm",
-                reason: "Privilege escalation requires explicit confirmation under §0.1.",
-            };
-        }
-    }
-    return { kind: "pass" };
-}
-/**
- * Clause 3 — filesystem destruction. Hard deny. No override path.
- */
-export function checkFsDestructionClause(call) {
-    if (call.tool !== "bash")
-        return { kind: "pass" };
-    const cmd = typeof call.args.command === "string" ? call.args.command : "";
-    if (!cmd)
-        return { kind: "pass" };
-    for (const re of FS_DESTRUCTION_PATTERNS) {
-        if (re.test(cmd)) {
-            return {
-                kind: "deny-hard",
-                code: "hook_rejected",
-                reason: "Filesystem-destructive command is blocked by §0.1.",
-            };
-        }
-    }
-    return { kind: "pass" };
-}
-/**
- * Clause 4 — scope. Edits/writes must land inside writeScope; bash must stay
- * inside executeScope when configured. Empty/undefined scope = no constraint
- * (e.g. local CLI usage without a lane grant).
- */
-export function checkScopeClause(call) {
-    const grant = call.laneGrant;
-    if (!grant)
-        return { kind: "pass" };
-    if (call.tool === "write" || call.tool === "edit") {
-        const writeScope = grant.writeScope;
-        if (writeScope && writeScope.length > 0) {
-            const path = typeof call.args.path === "string" ? call.args.path : "";
-            if (path && !matchesAnyGlob(path, writeScope)) {
-                return {
-                    kind: "deny-hard",
-                    code: "hook_rejected",
-                    reason: `Path '${path}' is outside writeScope.`,
-                };
-            }
-        }
-    }
-    if (call.tool === "bash") {
-        const executeScope = grant.executeScope;
-        if (executeScope && executeScope.length > 0) {
-            const cmd = typeof call.args.command === "string" ? call.args.command : "";
-            const touched = extractMutatingTargets(cmd);
-            for (const target of touched) {
-                if (!matchesAnyGlob(target, executeScope)) {
-                    return {
-                        kind: "deny-hard",
-                        code: "hook_rejected",
-                        reason: `Bash mutates '${target}' outside executeScope.`,
-                    };
-                }
-            }
-        }
-    }
-    return { kind: "pass" };
-}
-function extractMutatingTargets(cmd) {
-    // Heuristic: top-level >, >>, tee target; ignore quoted forms inside strings.
-    const targets = [];
-    const redirectRe = />>?\s*([^\s|;&<>'"]+)/g;
-    let m = redirectRe.exec(cmd);
-    while (m !== null) {
-        const t = m[1];
-        if (t && t !== "/dev/null")
-            targets.push(t);
-        m = redirectRe.exec(cmd);
-    }
-    const teeRe = /\btee\s+(?:-a\s+)?([^\s|;&<>'"]+)/g;
-    m = teeRe.exec(cmd);
-    while (m !== null) {
-        const t = m[1];
-        if (t)
-            targets.push(t);
-        m = teeRe.exec(cmd);
-    }
-    return targets;
-}
-/**
- * Redact bearer tokens and other secret-looking substrings before any sink
- * (logger, audit event, tool result returned to the LLM).
- */
-export function redactSecrets(input) {
-    if (!input)
-        return input;
-    let out = input;
-    for (const re of SECRET_CONTENT_PATTERNS) {
-        out = out.replace(re, REDACTION_PLACEHOLDER);
-    }
-    return out;
-}
-/**
- * Run every clause in order. First non-pass verdict wins; deny-hard beats
- * require-confirm in the rare case both fire (privilege + fs-destruction).
- */
-export function runSafetyFloor(call) {
-    const checks = [checkSecretsClause, checkFsDestructionClause, checkScopeClause, checkPrivilegeClause];
-    let firstConfirm = null;
-    for (const check of checks) {
-        try {
-            const verdict = check(call);
-            if (verdict.kind === "deny-hard")
-                return verdict;
-            if (verdict.kind === "require-confirm" && !firstConfirm)
-                firstConfirm = verdict;
-        }
-        catch (error) {
-            return {
-                kind: "deny-hard",
-                code: "hook_failed",
-                reason: `Safety floor matcher threw: ${error instanceof Error ? error.message : String(error)}`,
-            };
-        }
-    }
-    return firstConfirm ?? { kind: "pass" };
-}
-//# sourceMappingURL=safety-floor.js.map

package/dist/core/freedom/safety-floor.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"safety-floor.js","sourceRoot":"","sources":["../../../src/core/freedom/safety-floor.ts"],"names":[],"mappings":"AAuCA,MAAM,oBAAoB,GAAsB;IAC/C,oBAAoB;IACpB,eAAe;IACf,oBAAoB;IACpB,iBAAiB;IACjB,4BAA4B;IAC5B,mEAAmE;IACnE,SAAS;IACT,SAAS;IACT,0BAA0B;IAC1B,yBAAyB;CACzB,CAAC;AAEF,MAAM,uBAAuB,GAAsB;IAClD,yBAAyB;IACzB,gCAAgC;IAChC,+BAA+B;IAC/B,sCAAsC;IACtC,uBAAuB;CACvB,CAAC;AAEF,MAAM,6BAA6B,GAAsB;IACxD,gBAAgB;IAChB,cAAc;IACd,wBAAwB;IACxB,sBAAsB;IACtB,kBAAkB;IAClB,mBAAmB;IACnB,YAAY;CACZ,CAAC;AAEF,MAAM,uBAAuB,GAAsB;IAClD,qEAAqE;IACrE,kBAAkB;IAClB,2BAA2B;IAC3B,0CAA0C;IAC1C,8BAA8B;CAC9B,CAAC;AAEF,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAE/C,SAAS,aAAa,CAAC,KAAa,EAAU;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAAA,CACjC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAU;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;AAAA,CACzD;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAwB,EAAW;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,WAAW,CAAC,IAAY,EAAU;IAC1C,gFAAgF;IAChF,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC5C,OAAO,IAAI,IAAI,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,IAAI,OAAO,CAAC;YACnB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,IAAI,MAAM,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QACD,OAAO,IAAI,CAAC,CAAC;QACb,CAAC,IAAI,CAAC,CAAC;IACR,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;AAAA,CAClC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAqB,EAAkB;IACzE,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO;gBACN,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,yBAAyB,IAAI,CAAC,IAAI,QAAQ,IAAI,IAAI;aAC1D,CAAC;QACH,CAAC;IACF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO;gBACN,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,kEAAkE;aAC1E,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAAA,CACxB;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAW;IACnD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,oBAAoB,EAAE,CAAC;QACvC,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAW;IAChD,+EAA+E;IAC/E,MAAM,SAAS,GAAG,sFAAsF,CAAC;IACzG,IAAI,KAAK,GAA2B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,KAAK,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqB,EAAkB;IAC3E,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,6BAA6B,EAAE,CAAC;QAChD,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO;gBACN,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,kEAAiE;aACzE,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAAA,CACxB;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAqB,EAAkB;IAC/E,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,uBAAuB,EAAE,CAAC;QAC1C,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO;gBACN,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,qDAAoD;aAC5D,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAAA,CACxB;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAqB,EAAkB;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC/C,OAAO;oBACN,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,eAAe;oBACrB,MAAM,EAAE,SAAS,IAAI,0BAA0B;iBAC/C,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;oBAC3C,OAAO;wBACN,IAAI,EAAE,WAAW;wBACjB,IAAI,EAAE,eAAe;wBACrB,MAAM,EAAE,iBAAiB,MAAM,yBAAyB;qBACxD,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAAA,CACxB;AAED,SAAS,sBAAsB,CAAC,GAAW,EAAY;IACtD,8EAA8E;IAC9E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,wBAAwB,CAAC;IAC5C,IAAI,CAAC,GAA2B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,KAAK,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,oCAAoC,CAAC;IACnD,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAU;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,uBAAuB,EAAE,CAAC;QAC1C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AAAA,CACX;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAqB,EAAkB;IACrE,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;IACtG,IAAI,YAAY,GAA0B,IAAI,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,OAAO,CAAC;YACjD,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,YAAY;gBAAE,YAAY,GAAG,OAAO,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO;gBACN,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/F,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,YAAY,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAAA,CACxC","sourcesContent":["/**\n * Non-negotiable §0.1 safety floor matchers.\n *\n * These are deterministic, pure functions used by `policy.ts:gate()`. They\n * implement the four runtime-enforceable clauses from AGENTS.md §0.1:\n *\n *   1. Secrets must never be read, logged, or transmitted.\n *   2. Privilege escalation must require an explicit per-command user confirm.\n *   3. Filesystem-destructive commands at root or home are hard-denied.\n *   4. Tool calls must stay inside the lane grant's writeScope / executeScope.\n *\n * Clause 5 (§0.3 \"no moralizing\") is an LLM behavior clause and lives in the\n * orchestrator system prompt; there is no runtime matcher for it.\n *\n * Every matcher fails closed: if its internal regex throws, the call is\n * treated as a hard deny instead of an implicit allow. This is enforced by\n * the wrapper helpers in `policy.ts`, not here, so the matchers themselves\n * can stay tiny and testable.\n */\nimport type { HookFailureCode } from \"../hooks/types.ts\";\n\nexport interface ToolCallContext {\n\ttool: \"bash\" | \"edit\" | \"write\" | \"read\";\n\targs: {\n\t\tpath?: string;\n\t\tcommand?: string;\n\t\t[key: string]: unknown;\n\t};\n\tlaneGrant?: {\n\t\twriteScope?: readonly string[];\n\t\texecuteScope?: readonly string[];\n\t};\n}\n\nexport type MatcherVerdict =\n\t| { kind: \"pass\" }\n\t| { kind: \"require-confirm\"; reason: string }\n\t| { kind: \"deny-hard\"; code: HookFailureCode; reason: string };\n\nconst SECRET_PATH_PATTERNS: readonly RegExp[] = [\n\t/(^|\\/)\\.env(\\.|$)/i,\n\t/(^|\\/)\\.env$/i,\n\t/(^|\\/)auth\\.json$/i,\n\t/(^|\\/)\\.netrc$/i,\n\t/(^|\\/)\\.aws\\/credentials$/i,\n\t/(^|\\/)\\.ssh\\/(id_[a-z0-9]+|[a-z0-9_-]+_(rsa|ed25519|ecdsa|dsa))$/i,\n\t/\\.pem$/i,\n\t/\\.key$/i,\n\t/(^|\\/)[^/]*secret[^/]*$/i,\n\t/(^|\\/)[^/]*token[^/]*$/i,\n];\n\nconst SECRET_CONTENT_PATTERNS: readonly RegExp[] = [\n\t/npm_[A-Za-z0-9_-]{16,}/g,\n\t/\\bgh[pousr]_[A-Za-z0-9]{36}\\b/g,\n\t/\\bxox[bpars]-[A-Za-z0-9-]+\\b/g,\n\t/\\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\\b/g,\n\t/\\bAKIA[0-9A-Z]{16}\\b/g,\n];\n\nconst PRIVILEGE_ESCALATION_PATTERNS: readonly RegExp[] = [\n\t/^\\s*sudo(\\s|$)/,\n\t/^\\s*su(\\s|$)/,\n\t/(^|\\s|;|&&|\\|\\|)sudo\\s/,\n\t/(^|\\s|;|&&|\\|\\|)su\\s/,\n\t/(^|\\s)doas(\\s|$)/,\n\t/chmod\\s+[ug]\\+s\\b/,\n\t/\\bsetcap\\s/,\n];\n\nconst FS_DESTRUCTION_PATTERNS: readonly RegExp[] = [\n\t/\\brm\\s+(-[a-zA-Z]*[rRfF][a-zA-Z]*\\s+)+(\\/|~|\\$HOME|\"\\/\"|'\\/')(\\s|$)/,\n\t/\\bmkfs(\\.\\w+)?\\s/,\n\t/\\bdd\\b[^|;&]*\\bof=\\/dev\\//,\n\t/:\\(\\)\\s*\\{\\s*:\\s*\\|\\s*:\\s*&\\s*\\}\\s*;\\s*:/,\n\t/\\bchmod\\s+-R\\s+0+\\s+\\/(\\s|$)/,\n];\n\nconst REDACTION_PLACEHOLDER = \"***REDACTED***\";\n\nfunction normalizePath(input: string): string {\n\treturn input.replace(/\\\\/g, \"/\");\n}\n\nfunction basename(input: string): string {\n\tconst normalized = normalizePath(input);\n\tconst idx = normalized.lastIndexOf(\"/\");\n\treturn idx >= 0 ? normalized.slice(idx + 1) : normalized;\n}\n\nfunction matchesAnyGlob(path: string, scope: readonly string[]): boolean {\n\tif (scope.length === 0) return false;\n\tconst normalized = normalizePath(path);\n\tfor (const glob of scope) {\n\t\tconst re = globToRegex(glob);\n\t\tif (re.test(normalized)) return true;\n\t}\n\treturn false;\n}\n\nfunction globToRegex(glob: string): RegExp {\n\t// Minimal glob: ** -> .*, * -> [^/]*, ? -> [^/]. Other regex metachars escaped.\n\tconst normalized = normalizePath(glob);\n\tlet pattern = \"\";\n\tlet i = 0;\n\twhile (i < normalized.length) {\n\t\tconst c = normalized[i];\n\t\tif (c === \"*\" && normalized[i + 1] === \"*\") {\n\t\t\tpattern += \".*\";\n\t\t\ti += 2;\n\t\t\tcontinue;\n\t\t}\n\t\tif (c === \"*\") {\n\t\t\tpattern += \"[^/]*\";\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (c === \"?\") {\n\t\t\tpattern += \"[^/]\";\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (/[.+^${}()|[\\]\\\\]/.test(c)) {\n\t\t\tpattern += `\\\\${c}`;\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tpattern += c;\n\t\ti += 1;\n\t}\n\treturn new RegExp(`^${pattern}$`);\n}\n\n/**\n * Clause 1 — secrets. Block reads/writes/edits targeting credential files.\n * Bash matchers check the command's argv for known credential paths too.\n */\nexport function checkSecretsClause(call: ToolCallContext): MatcherVerdict {\n\tif (call.tool === \"read\" || call.tool === \"edit\" || call.tool === \"write\") {\n\t\tconst path = typeof call.args.path === \"string\" ? call.args.path : \"\";\n\t\tif (path && pathLooksLikeSecret(path)) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\treason: `Secrets clause blocks ${call.tool} on '${path}'.`,\n\t\t\t};\n\t\t}\n\t}\n\tif (call.tool === \"bash\") {\n\t\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\t\tif (cmd && bashTouchesSecret(cmd)) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\treason: \"Secrets clause blocks bash command that reads a credential file.\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\nfunction pathLooksLikeSecret(path: string): boolean {\n\tconst normalized = normalizePath(path);\n\tconst base = basename(normalized);\n\tfor (const re of SECRET_PATH_PATTERNS) {\n\t\tif (re.test(normalized) || re.test(base)) return true;\n\t}\n\treturn false;\n}\n\nfunction bashTouchesSecret(cmd: string): boolean {\n\t// Catch the obvious cat / cp / mv / less / head / tail / source <secret-path>.\n\tconst readVerbs = /\\b(cat|less|more|head|tail|tac|nl|od|hexdump|xxd|cp|mv|source|\\.)\\b\\s+([^\\s|;&<>]+)/g;\n\tlet match: RegExpExecArray | null = readVerbs.exec(cmd);\n\twhile (match !== null) {\n\t\tconst target = match[2];\n\t\tif (target && pathLooksLikeSecret(target)) return true;\n\t\tmatch = readVerbs.exec(cmd);\n\t}\n\treturn false;\n}\n\n/**\n * Clause 2 — privilege escalation. Even under yolo mode, sudo/su require an\n * explicit confirm. Never auto-approved.\n */\nexport function checkPrivilegeClause(call: ToolCallContext): MatcherVerdict {\n\tif (call.tool !== \"bash\") return { kind: \"pass\" };\n\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\tif (!cmd) return { kind: \"pass\" };\n\tfor (const re of PRIVILEGE_ESCALATION_PATTERNS) {\n\t\tif (re.test(cmd)) {\n\t\t\treturn {\n\t\t\t\tkind: \"require-confirm\",\n\t\t\t\treason: \"Privilege escalation requires explicit confirmation under §0.1.\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\n/**\n * Clause 3 — filesystem destruction. Hard deny. No override path.\n */\nexport function checkFsDestructionClause(call: ToolCallContext): MatcherVerdict {\n\tif (call.tool !== \"bash\") return { kind: \"pass\" };\n\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\tif (!cmd) return { kind: \"pass\" };\n\tfor (const re of FS_DESTRUCTION_PATTERNS) {\n\t\tif (re.test(cmd)) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\treason: \"Filesystem-destructive command is blocked by §0.1.\",\n\t\t\t};\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\n/**\n * Clause 4 — scope. Edits/writes must land inside writeScope; bash must stay\n * inside executeScope when configured. Empty/undefined scope = no constraint\n * (e.g. local CLI usage without a lane grant).\n */\nexport function checkScopeClause(call: ToolCallContext): MatcherVerdict {\n\tconst grant = call.laneGrant;\n\tif (!grant) return { kind: \"pass\" };\n\tif (call.tool === \"write\" || call.tool === \"edit\") {\n\t\tconst writeScope = grant.writeScope;\n\t\tif (writeScope && writeScope.length > 0) {\n\t\t\tconst path = typeof call.args.path === \"string\" ? call.args.path : \"\";\n\t\t\tif (path && !matchesAnyGlob(path, writeScope)) {\n\t\t\t\treturn {\n\t\t\t\t\tkind: \"deny-hard\",\n\t\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\t\treason: `Path '${path}' is outside writeScope.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\tif (call.tool === \"bash\") {\n\t\tconst executeScope = grant.executeScope;\n\t\tif (executeScope && executeScope.length > 0) {\n\t\t\tconst cmd = typeof call.args.command === \"string\" ? call.args.command : \"\";\n\t\t\tconst touched = extractMutatingTargets(cmd);\n\t\t\tfor (const target of touched) {\n\t\t\t\tif (!matchesAnyGlob(target, executeScope)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tkind: \"deny-hard\",\n\t\t\t\t\t\tcode: \"hook_rejected\",\n\t\t\t\t\t\treason: `Bash mutates '${target}' outside executeScope.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn { kind: \"pass\" };\n}\n\nfunction extractMutatingTargets(cmd: string): string[] {\n\t// Heuristic: top-level >, >>, tee target; ignore quoted forms inside strings.\n\tconst targets: string[] = [];\n\tconst redirectRe = />>?\\s*([^\\s|;&<>'\"]+)/g;\n\tlet m: RegExpExecArray | null = redirectRe.exec(cmd);\n\twhile (m !== null) {\n\t\tconst t = m[1];\n\t\tif (t && t !== \"/dev/null\") targets.push(t);\n\t\tm = redirectRe.exec(cmd);\n\t}\n\tconst teeRe = /\\btee\\s+(?:-a\\s+)?([^\\s|;&<>'\"]+)/g;\n\tm = teeRe.exec(cmd);\n\twhile (m !== null) {\n\t\tconst t = m[1];\n\t\tif (t) targets.push(t);\n\t\tm = teeRe.exec(cmd);\n\t}\n\treturn targets;\n}\n\n/**\n * Redact bearer tokens and other secret-looking substrings before any sink\n * (logger, audit event, tool result returned to the LLM).\n */\nexport function redactSecrets(input: string): string {\n\tif (!input) return input;\n\tlet out = input;\n\tfor (const re of SECRET_CONTENT_PATTERNS) {\n\t\tout = out.replace(re, REDACTION_PLACEHOLDER);\n\t}\n\treturn out;\n}\n\n/**\n * Run every clause in order. First non-pass verdict wins; deny-hard beats\n * require-confirm in the rare case both fire (privilege + fs-destruction).\n */\nexport function runSafetyFloor(call: ToolCallContext): MatcherVerdict {\n\tconst checks = [checkSecretsClause, checkFsDestructionClause, checkScopeClause, checkPrivilegeClause];\n\tlet firstConfirm: MatcherVerdict | null = null;\n\tfor (const check of checks) {\n\t\ttry {\n\t\t\tconst verdict = check(call);\n\t\t\tif (verdict.kind === \"deny-hard\") return verdict;\n\t\t\tif (verdict.kind === \"require-confirm\" && !firstConfirm) firstConfirm = verdict;\n\t\t} catch (error) {\n\t\t\treturn {\n\t\t\t\tkind: \"deny-hard\",\n\t\t\t\tcode: \"hook_failed\",\n\t\t\t\treason: `Safety floor matcher threw: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t};\n\t\t}\n\t}\n\treturn firstConfirm ?? { kind: \"pass\" };\n}\n"]}

package/dist/core/harness-control-events.d.ts

@@ -1,91 +0,0 @@
-export type HarnessControlEventStatus = "prepared" | "started" | "applying" | "verifying" | "completed" | "failed" | "blocked" | "rolled_back" | "in_doubt";
-export type HarnessControlEventKind = "compaction.summary.generated" | "extension.migration.plan" | "extension.migration.apply" | "interactive.model_thinking.commit" | "interactive.theme.apply" | "keybinding.conflict" | "spec.compile" | "spec.verify" | "cli.contract.verify" | (string & {});
-export type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-export type JsonObject = {
-    [key: string]: JsonValue;
-};
-export interface HarnessControlArtifactManifestEntry {
-    path: string;
-    exists: boolean;
-    allowed: boolean;
-    sizeBytes?: number;
-    sha256?: string;
-    error?: string;
-}
-export interface HarnessControlEvent {
-    schemaVersion: "omk.harness-control.event.v2";
-    eventId: string;
-    runId: string;
-    sessionId: string;
-    operationId: string;
-    causationId: string | null;
-    correlationId: string;
-    sequence: number;
-    timestamp: string;
-    kind: HarnessControlEventKind;
-    status: HarnessControlEventStatus;
-    cwd: string;
-    beforeStateHash: string;
-    afterStateHash: string;
-    data: JsonObject;
-    dataHash: string;
-    artifacts: HarnessControlArtifactManifestEntry[];
-    previousEventHash: string;
-    eventHash: string;
-}
-export interface HarnessControlLedgerAnchor {
-    schemaVersion: "omk.harness-control.anchor.v1";
-    anchoredSequence: number;
-    anchoredEventHash: string;
-    rotatedFrom: string;
-    timestamp: string;
-}
-export interface HarnessControlEventWriteResult {
-    ok: boolean;
-    path?: string;
-    event?: HarnessControlEvent;
-    error?: string;
-}
-export interface HarnessControlEventOptions {
-    cwd?: string;
-    logPath?: string;
-    now?: Date;
-    id?: string;
-    eventId?: string;
-    runId?: string;
-    sessionId?: string;
-    operationId?: string;
-    causationId?: string | null;
-    correlationId?: string;
-    beforeState?: unknown;
-    afterState?: unknown;
-    artifactRefs?: string[];
-    allowedArtifactRoots?: string[];
-    lockTimeoutMs?: number;
-    maxLedgerBytes?: number;
-}
-export interface HarnessControlLedgerQuarantineEntry {
-    lineNumber: number;
-    reason: string;
-}
-export interface HarnessControlLedgerVerificationResult {
-    ok: boolean;
-    events: HarnessControlEvent[];
-    errors: string[];
-    quarantinedLines: HarnessControlLedgerQuarantineEntry[];
-}
-interface PreviousEventState {
-    sequence: number;
-    eventHash: string;
-}
-export declare function sanitizeHarnessControlEventData(data: unknown): JsonObject;
-export declare function canonicalJson(value: JsonValue): string;
-export declare function hashCanonical(value: unknown): string;
-export declare function resolveHarnessControlEventLogPath(options?: HarnessControlEventOptions): string | undefined;
-export declare function createHarnessControlEvent(kind: HarnessControlEventKind, status: HarnessControlEventStatus, data?: unknown, options?: HarnessControlEventOptions, previous?: PreviousEventState): HarnessControlEvent;
-export declare function recordHarnessControlEvent(kind: HarnessControlEventKind, status: HarnessControlEventStatus, data?: unknown, options?: HarnessControlEventOptions): HarnessControlEventWriteResult;
-export declare function verifyHarnessControlLedger(logPath: string): HarnessControlLedgerVerificationResult;
-export {};
-//# sourceMappingURL=harness-control-events.d.ts.map