open-multi-agent-kit 0.80.7 → 0.90.0

package/dist/guardrails/evidence-system.js

@@ -0,0 +1,302 @@
+// allow: SIZE_OK - legacy evidence ledger; this change only keeps typed import/check compatibility.
+import { createHash } from "node:crypto";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+function sha256(input) {
+    return createHash("sha256").update(input).digest("hex");
+}
+function ensureDir(path) {
+    const dir = dirname(path);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+}
+// ============================================================================
+// TaskContract
+// ============================================================================
+export class TaskContractBuilder {
+    goalId;
+    completionClaim = "";
+    requiredEvidence = [];
+    finalRisk = "";
+    verdict = "fail";
+    createdAt;
+    updatedAt;
+    constructor(goalId) {
+        this.goalId = goalId;
+        const now = new Date().toISOString();
+        this.createdAt = now;
+        this.updatedAt = now;
+    }
+    setClaim(claim) {
+        this.completionClaim = claim;
+        this.touch();
+        return this;
+    }
+    addRequiredEvidence(evidence) {
+        this.requiredEvidence.push({
+            ...evidence,
+            timestamp: new Date().toISOString(),
+            status: "pending",
+        });
+        this.touch();
+        return this;
+    }
+    setFinalRisk(risk) {
+        this.finalRisk = risk;
+        this.touch();
+        return this;
+    }
+    setVerdict(verdict) {
+        this.verdict = verdict;
+        this.touch();
+        return this;
+    }
+    updateEvidenceStatus(claim, status, gapReason) {
+        const item = this.requiredEvidence.find((e) => e.claim === claim);
+        if (item) {
+            item.status = status;
+            item.gapReason = gapReason;
+            item.timestamp = new Date().toISOString();
+            this.touch();
+        }
+        return this;
+    }
+    touch() {
+        this.updatedAt = new Date().toISOString();
+    }
+    build() {
+        return {
+            goalId: this.goalId,
+            completionClaim: this.completionClaim,
+            requiredEvidence: [...this.requiredEvidence],
+            finalRisk: this.finalRisk,
+            verdict: this.verdict,
+            createdAt: this.createdAt,
+            updatedAt: this.updatedAt,
+        };
+    }
+    static fromJSON(json) {
+        return JSON.parse(json);
+    }
+    static toJSON(contract) {
+        return JSON.stringify(contract, null, 2);
+    }
+}
+// ============================================================================
+// ReplayLedger
+// ============================================================================
+export class ReplayLedgerManager {
+    ledger;
+    nextSeq;
+    constructor(goalId, ledgerPath) {
+        ensureDir(ledgerPath);
+        this.ledger = {
+            goalId,
+            events: [],
+            ledgerPath,
+            lastPersistedSeq: 0,
+        };
+        this.nextSeq = 1;
+        if (existsSync(ledgerPath)) {
+            this.load();
+        }
+    }
+    append(event) {
+        const payloadStr = JSON.stringify(event.payload);
+        const fullEvent = {
+            ...event,
+            seq: this.nextSeq++,
+            timestamp: new Date().toISOString(),
+            payloadHash: sha256(payloadStr),
+        };
+        this.ledger.events.push(fullEvent);
+        return fullEvent;
+    }
+    persist() {
+        if (this.ledger.events.length === 0)
+            return;
+        const last = this.ledger.events[this.ledger.events.length - 1];
+        if (last.seq <= this.ledger.lastPersistedSeq)
+            return;
+        const newEvents = this.ledger.events.filter((e) => e.seq > this.ledger.lastPersistedSeq);
+        const lines = `${newEvents.map((e) => JSON.stringify(e)).join("\n")}\n`;
+        appendFileSync(this.ledger.ledgerPath, lines, "utf-8");
+        this.ledger.lastPersistedSeq = last.seq;
+    }
+    load() {
+        if (!existsSync(this.ledger.ledgerPath))
+            return;
+        const content = readFileSync(this.ledger.ledgerPath, "utf-8");
+        const events = content
+            .split("\n")
+            .filter((line) => line.trim().length > 0)
+            .map((line) => JSON.parse(line));
+        this.ledger.events = events;
+        this.ledger.lastPersistedSeq = events.length > 0 ? events[events.length - 1].seq : 0;
+        this.nextSeq = this.ledger.lastPersistedSeq + 1;
+    }
+    getEvents() {
+        return this.ledger.events;
+    }
+    getLedger() {
+        return { ...this.ledger };
+    }
+    replay(handler) {
+        const results = [];
+        for (const event of this.ledger.events) {
+            const result = handler(event);
+            if (result !== undefined) {
+                results.push(result);
+            }
+        }
+        return results;
+    }
+    exportToFile(path) {
+        ensureDir(path);
+        writeFileSync(path, JSON.stringify(this.ledger.events, null, 2), "utf-8");
+    }
+}
+export class EvidenceGate {
+    options;
+    constructor(options = {}) {
+        this.options = {
+            minEvidenceCount: 1,
+            requireHash: true,
+            requireVerificationCommand: true,
+            ...options,
+        };
+    }
+    check(contract) {
+        const evidence = contract.requiredEvidence;
+        const satisfied = evidence.filter((e) => e.status === "satisfied");
+        const failed = evidence.filter((e) => e.status === "failed");
+        const pending = evidence.filter((e) => e.status === "pending" || e.status === "gathering");
+        const checks = [];
+        // Check 1: minimum evidence count
+        if (satisfied.length < (this.options.minEvidenceCount ?? 1)) {
+            checks.push(`Only ${satisfied.length}/${this.options.minEvidenceCount} required evidence items satisfied.`);
+        }
+        // Check 2: no failed evidence
+        if (failed.length > 0) {
+            checks.push(`${failed.length} evidence item(s) failed.`);
+        }
+        // Check 3: require hash
+        if (this.options.requireHash) {
+            const hashed = satisfied.filter((e) => e.hash && e.hash.length > 0);
+            if (hashed.length === 0) {
+                checks.push("No satisfied evidence has a SHA-256 hash.");
+            }
+        }
+        // Check 4: require verification command
+        if (this.options.requireVerificationCommand) {
+            const withCommand = satisfied.filter((e) => e.verificationCommand && e.verificationCommand.length > 0);
+            if (withCommand.length === 0) {
+                checks.push("No satisfied evidence has a verification command.");
+            }
+        }
+        // Check 5: contract verdict
+        if (contract.verdict === "fail") {
+            checks.push("Task contract verdict is 'fail'.");
+        }
+        let status;
+        let reason;
+        let suggestion;
+        if (checks.length === 0) {
+            status = "open";
+            reason = `Evidence gate passed: ${satisfied.length}/${evidence.length} evidence items satisfied.`;
+        }
+        else {
+            // If there are pending items and no hard failures, it's conditional; otherwise blocked
+            const hasHardFailure = failed.length > 0 || contract.verdict === "fail";
+            status = pending.length > 0 && !hasHardFailure ? "conditional" : "blocked";
+            reason = checks.join("; ");
+            suggestion = `Gather remaining evidence (${pending.length} pending) and re-run verification.`;
+        }
+        return {
+            gateId: "evidence-gate",
+            status,
+            reason,
+            suggestion,
+            evidenceChecked: evidence,
+        };
+    }
+}
+// ============================================================================
+// FailClosedMergeGate
+// ============================================================================
+export class FailClosedMergeGate {
+    gates;
+    constructor(gates = [new EvidenceGate()]) {
+        this.gates = gates;
+    }
+    check(contract) {
+        const results = this.gates.map((gate) => gate.check(contract));
+        const blocked = results.filter((r) => r.status === "blocked");
+        const conditional = results.filter((r) => r.status === "conditional");
+        if (blocked.length > 0) {
+            return {
+                gateId: "fail-closed-merge-gate",
+                status: "blocked",
+                reason: `Blocked by ${blocked.length} gate(s): ${blocked.map((b) => b.reason).join("; ")}`,
+                suggestion: "Resolve all blocking conditions before merge.",
+                evidenceChecked: contract.requiredEvidence,
+            };
+        }
+        if (conditional.length > 0) {
+            return {
+                gateId: "fail-closed-merge-gate",
+                status: "conditional",
+                reason: `Conditional pass: ${conditional.length} gate(s) have pending conditions.`,
+                suggestion: "Complete pending evidence or waive with explicit approval.",
+                evidenceChecked: contract.requiredEvidence,
+            };
+        }
+        return {
+            gateId: "fail-closed-merge-gate",
+            status: "open",
+            reason: "All merge gates passed. Evidence verified and contract verdict is acceptable.",
+            evidenceChecked: contract.requiredEvidence,
+        };
+    }
+}
+export class VerifyReporterV2 {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    render(contract, mergeGate) {
+        const lines = [
+            `## OMK Verification Report v2 — ${contract.goalId}`,
+            "",
+            "### Contract",
+            "",
+            `| Field | Value |`,
+            `|-------|-------|`,
+            `| Claim | ${contract.completionClaim} |`,
+            `| Verdict | ${contract.verdict} |`,
+            `| Final Risk | ${contract.finalRisk} |`,
+            "",
+            "### Evidence",
+            "",
+            `| Claim | Status | Artifact | Command |`,
+            `|-------|--------|----------|----------|`,
+        ];
+        for (const ev of contract.requiredEvidence) {
+            lines.push(`| ${ev.claim} | ${ev.status} | ${ev.artifactPath ?? "—"} | ${ev.verificationCommand ?? "—"} |`);
+        }
+        lines.push("", "### Merge Gate", "", `| Gate | Status | Reason |`, `|------|--------|--------|`, `| ${mergeGate.gateId} | ${mergeGate.status} | ${mergeGate.reason} |`, "");
+        if (mergeGate.suggestion) {
+            lines.push(`**Suggestion:** ${mergeGate.suggestion}`, "");
+        }
+        return lines.join("\n");
+    }
+    write(contract, mergeGate) {
+        const markdown = this.render(contract, mergeGate);
+        const path = join(this.options.outputDir, `${this.options.goalId}.verify.md`);
+        ensureDir(path);
+        writeFileSync(path, markdown, "utf-8");
+        return path;
+    }
+}
+//# sourceMappingURL=evidence-system.js.map

package/dist/guardrails/evidence-system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-system.js","sourceRoot":"","sources":["../../src/guardrails/evidence-system.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAW1C,SAAS,MAAM,CAAC,KAAa,EAAU;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CACxD;AAED,SAAS,SAAS,CAAC,IAAY,EAAQ;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;AAAA,CACD;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,MAAM,OAAO,mBAAmB;IACvB,MAAM,CAAS;IACf,eAAe,GAAW,EAAE,CAAC;IAC7B,gBAAgB,GAAmB,EAAE,CAAC;IACtC,SAAS,GAAW,EAAE,CAAC;IACvB,OAAO,GAAoC,MAAM,CAAC;IAClD,SAAS,CAAS;IAClB,SAAS,CAAS;IAE1B,YAAY,MAAc,EAAE;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;IAAA,CACrB;IAED,QAAQ,CAAC,KAAa,EAAQ;QAC7B,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,mBAAmB,CAAC,QAAoD,EAAQ;QAC/E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAC1B,GAAG,QAAQ;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,YAAY,CAAC,IAAY,EAAQ;QAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,UAAU,CAAC,OAAwC,EAAQ;QAC1D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,oBAAoB,CAAC,KAAa,EAAE,MAAsB,EAAE,SAAkB,EAAQ;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAClE,IAAI,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IAAA,CACZ;IAEO,KAAK,GAAS;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAAA,CAC1C;IAED,KAAK,GAAiB;QACrB,OAAO;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;YAC5C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC;IAAA,CACF;IAED,MAAM,CAAC,QAAQ,CAAC,IAAY,EAAgB;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;IAAA,CACxC;IAED,MAAM,CAAC,MAAM,CAAC,QAAsB,EAAU;QAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAAA,CACzC;CACD;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,MAAM,OAAO,mBAAmB;IACvB,MAAM,CAAe;IACrB,OAAO,CAAS;IAExB,YAAY,MAAc,EAAE,UAAkB,EAAE;QAC/C,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG;YACb,MAAM;YACN,MAAM,EAAE,EAAE;YACV,UAAU;YACV,gBAAgB,EAAE,CAAC;SACnB,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;QACjB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;QACb,CAAC;IAAA,CACD;IAED,MAAM,CAAC,KAA6D,EAAe;QAClF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,SAAS,GAAgB;YAC9B,GAAG,KAAK;YACR,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE;YACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/B,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,SAAS,CAAC;IAAA,CACjB;IAED,OAAO,GAAS;QACf,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO;QAErD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACxE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC;IAAA,CACxC;IAED,IAAI,GAAS;QACZ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO;QAChD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,OAAO;aACpB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;aACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC;IAAA,CAChD;IAED,SAAS,GAA+B;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAAA,CAC1B;IAED,SAAS,GAA2B;QACnC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAAA,CAC1B;IAED,MAAM,CAAI,OAA8C,EAAO;QAC9D,MAAM,OAAO,GAAQ,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACF,CAAC;QACD,OAAO,OAAO,CAAC;IAAA,CACf;IAED,YAAY,CAAC,IAAY,EAAQ;QAChC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAAA,CAC1E;CACD;AAeD,MAAM,OAAO,YAAY;IAChB,OAAO,CAAsB;IAErC,YAAY,OAAO,GAAwB,EAAE,EAAE;QAC9C,IAAI,CAAC,OAAO,GAAG;YACd,gBAAgB,EAAE,CAAC;YACnB,WAAW,EAAE,IAAI;YACjB,0BAA0B,EAAE,IAAI;YAChC,GAAG,OAAO;SACV,CAAC;IAAA,CACF;IAED,KAAK,CAAC,QAAsB,EAAmB;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QAC3C,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;QAE3F,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,kCAAkC;QAClC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,QAAQ,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,qCAAqC,CAAC,CAAC;QAC7G,CAAC;QAED,8BAA8B;QAC9B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,2BAA2B,CAAC,CAAC;QAC1D,CAAC;QAED,wBAAwB;QACxB,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC1D,CAAC;QACF,CAAC;QAED,wCAAwC;QACxC,IAAI,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACvG,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YAClE,CAAC;QACF,CAAC;QAED,4BAA4B;QAC5B,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,MAAuB,CAAC;QAC5B,IAAI,MAAc,CAAC;QACnB,IAAI,UAA8B,CAAC;QAEnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,MAAM,CAAC;YAChB,MAAM,GAAG,yBAAyB,SAAS,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,4BAA4B,CAAC;QACnG,CAAC;aAAM,CAAC;YACP,uFAAuF;YACvF,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC;YACxE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,UAAU,GAAG,8BAA8B,OAAO,CAAC,MAAM,oCAAoC,CAAC;QAC/F,CAAC;QAED,OAAO;YACN,MAAM,EAAE,eAAe;YACvB,MAAM;YACN,MAAM;YACN,UAAU;YACV,eAAe,EAAE,QAAQ;SACzB,CAAC;IAAA,CACF;CACD;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,MAAM,OAAO,mBAAmB;IACvB,KAAK,CAAiB;IAE9B,YAAY,KAAK,GAAmB,CAAC,IAAI,YAAY,EAAE,CAAC,EAAE;QACzD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAAA,CACnB;IAED,KAAK,CAAC,QAAsB,EAAmB;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;QAEtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;gBACN,MAAM,EAAE,wBAAwB;gBAChC,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,cAAc,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC1F,UAAU,EAAE,+CAA+C;gBAC3D,eAAe,EAAE,QAAQ,CAAC,gBAAgB;aAC1C,CAAC;QACH,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACN,MAAM,EAAE,wBAAwB;gBAChC,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,qBAAqB,WAAW,CAAC,MAAM,mCAAmC;gBAClF,UAAU,EAAE,4DAA4D;gBACxE,eAAe,EAAE,QAAQ,CAAC,gBAAgB;aAC1C,CAAC;QACH,CAAC;QAED,OAAO;YACN,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,+EAA+E;YACvF,eAAe,EAAE,QAAQ,CAAC,gBAAgB;SAC1C,CAAC;IAAA,CACF;CACD;AAWD,MAAM,OAAO,gBAAgB;IACpB,OAAO,CAA0B;IAEzC,YAAY,OAAgC,EAAE;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAAA,CACvB;IAED,MAAM,CAAC,QAAsB,EAAE,SAA0B,EAAU;QAClE,MAAM,KAAK,GAAa;YACvB,qCAAmC,QAAQ,CAAC,MAAM,EAAE;YACpD,EAAE;YACF,cAAc;YACd,EAAE;YACF,mBAAmB;YACnB,mBAAmB;YACnB,aAAa,QAAQ,CAAC,eAAe,IAAI;YACzC,eAAe,QAAQ,CAAC,OAAO,IAAI;YACnC,kBAAkB,QAAQ,CAAC,SAAS,IAAI;YACxC,EAAE;YACF,cAAc;YACd,EAAE;YACF,yCAAyC;YACzC,0CAA0C;SAC1C,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC,MAAM,MAAM,EAAE,CAAC,YAAY,IAAI,KAAG,MAAM,EAAE,CAAC,mBAAmB,IAAI,KAAG,IAAI,CAAC,CAAC;QAC7G,CAAC;QAED,KAAK,CAAC,IAAI,CACT,EAAE,EACF,gBAAgB,EAChB,EAAE,EACF,4BAA4B,EAC5B,4BAA4B,EAC5B,KAAK,SAAS,CAAC,MAAM,MAAM,SAAS,CAAC,MAAM,MAAM,SAAS,CAAC,MAAM,IAAI,EACrE,EAAE,CACF,CAAC;QAEF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,mBAAmB,SAAS,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAAA,CACxB;IAED,KAAK,CAAC,QAAsB,EAAE,SAA0B,EAAU;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC;QAC9E,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IAAA,CACZ;CACD","sourcesContent":["// allow: SIZE_OK - legacy evidence ledger; this change only keeps typed import/check compatibility.\nimport { createHash } from \"node:crypto\";\nimport { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport type {\n\tEvidenceItem,\n\tEvidenceStatus,\n\tMergeGateResult,\n\tMergeGateStatus,\n\tReplayEvent,\n\tReplayLedger,\n\tTaskContract,\n} from \"../types/evidence.ts\";\n\nfunction sha256(input: string): string {\n\treturn createHash(\"sha256\").update(input).digest(\"hex\");\n}\n\nfunction ensureDir(path: string): void {\n\tconst dir = dirname(path);\n\tif (!existsSync(dir)) {\n\t\tmkdirSync(dir, { recursive: true });\n\t}\n}\n\n// ============================================================================\n// TaskContract\n// ============================================================================\n\nexport class TaskContractBuilder {\n\tprivate goalId: string;\n\tprivate completionClaim: string = \"\";\n\tprivate requiredEvidence: EvidenceItem[] = [];\n\tprivate finalRisk: string = \"\";\n\tprivate verdict: \"pass\" | \"fail\" | \"conditional\" = \"fail\";\n\tprivate createdAt: string;\n\tprivate updatedAt: string;\n\n\tconstructor(goalId: string) {\n\t\tthis.goalId = goalId;\n\t\tconst now = new Date().toISOString();\n\t\tthis.createdAt = now;\n\t\tthis.updatedAt = now;\n\t}\n\n\tsetClaim(claim: string): this {\n\t\tthis.completionClaim = claim;\n\t\tthis.touch();\n\t\treturn this;\n\t}\n\n\taddRequiredEvidence(evidence: Omit<EvidenceItem, \"timestamp\" | \"status\">): this {\n\t\tthis.requiredEvidence.push({\n\t\t\t...evidence,\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tstatus: \"pending\",\n\t\t});\n\t\tthis.touch();\n\t\treturn this;\n\t}\n\n\tsetFinalRisk(risk: string): this {\n\t\tthis.finalRisk = risk;\n\t\tthis.touch();\n\t\treturn this;\n\t}\n\n\tsetVerdict(verdict: \"pass\" | \"fail\" | \"conditional\"): this {\n\t\tthis.verdict = verdict;\n\t\tthis.touch();\n\t\treturn this;\n\t}\n\n\tupdateEvidenceStatus(claim: string, status: EvidenceStatus, gapReason?: string): this {\n\t\tconst item = this.requiredEvidence.find((e) => e.claim === claim);\n\t\tif (item) {\n\t\t\titem.status = status;\n\t\t\titem.gapReason = gapReason;\n\t\t\titem.timestamp = new Date().toISOString();\n\t\t\tthis.touch();\n\t\t}\n\t\treturn this;\n\t}\n\n\tprivate touch(): void {\n\t\tthis.updatedAt = new Date().toISOString();\n\t}\n\n\tbuild(): TaskContract {\n\t\treturn {\n\t\t\tgoalId: this.goalId,\n\t\t\tcompletionClaim: this.completionClaim,\n\t\t\trequiredEvidence: [...this.requiredEvidence],\n\t\t\tfinalRisk: this.finalRisk,\n\t\t\tverdict: this.verdict,\n\t\t\tcreatedAt: this.createdAt,\n\t\t\tupdatedAt: this.updatedAt,\n\t\t};\n\t}\n\n\tstatic fromJSON(json: string): TaskContract {\n\t\treturn JSON.parse(json) as TaskContract;\n\t}\n\n\tstatic toJSON(contract: TaskContract): string {\n\t\treturn JSON.stringify(contract, null, 2);\n\t}\n}\n\n// ============================================================================\n// ReplayLedger\n// ============================================================================\n\nexport class ReplayLedgerManager {\n\tprivate ledger: ReplayLedger;\n\tprivate nextSeq: number;\n\n\tconstructor(goalId: string, ledgerPath: string) {\n\t\tensureDir(ledgerPath);\n\t\tthis.ledger = {\n\t\t\tgoalId,\n\t\t\tevents: [],\n\t\t\tledgerPath,\n\t\t\tlastPersistedSeq: 0,\n\t\t};\n\t\tthis.nextSeq = 1;\n\t\tif (existsSync(ledgerPath)) {\n\t\t\tthis.load();\n\t\t}\n\t}\n\n\tappend(event: Omit<ReplayEvent, \"seq\" | \"timestamp\" | \"payloadHash\">): ReplayEvent {\n\t\tconst payloadStr = JSON.stringify(event.payload);\n\t\tconst fullEvent: ReplayEvent = {\n\t\t\t...event,\n\t\t\tseq: this.nextSeq++,\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tpayloadHash: sha256(payloadStr),\n\t\t};\n\t\tthis.ledger.events.push(fullEvent);\n\t\treturn fullEvent;\n\t}\n\n\tpersist(): void {\n\t\tif (this.ledger.events.length === 0) return;\n\t\tconst last = this.ledger.events[this.ledger.events.length - 1];\n\t\tif (last.seq <= this.ledger.lastPersistedSeq) return;\n\n\t\tconst newEvents = this.ledger.events.filter((e) => e.seq > this.ledger.lastPersistedSeq);\n\t\tconst lines = `${newEvents.map((e) => JSON.stringify(e)).join(\"\\n\")}\\n`;\n\t\tappendFileSync(this.ledger.ledgerPath, lines, \"utf-8\");\n\t\tthis.ledger.lastPersistedSeq = last.seq;\n\t}\n\n\tload(): void {\n\t\tif (!existsSync(this.ledger.ledgerPath)) return;\n\t\tconst content = readFileSync(this.ledger.ledgerPath, \"utf-8\");\n\t\tconst events = content\n\t\t\t.split(\"\\n\")\n\t\t\t.filter((line) => line.trim().length > 0)\n\t\t\t.map((line) => JSON.parse(line) as ReplayEvent);\n\t\tthis.ledger.events = events;\n\t\tthis.ledger.lastPersistedSeq = events.length > 0 ? events[events.length - 1].seq : 0;\n\t\tthis.nextSeq = this.ledger.lastPersistedSeq + 1;\n\t}\n\n\tgetEvents(): ReadonlyArray<ReplayEvent> {\n\t\treturn this.ledger.events;\n\t}\n\n\tgetLedger(): Readonly<ReplayLedger> {\n\t\treturn { ...this.ledger };\n\t}\n\n\treplay<T>(handler: (event: ReplayEvent) => T | undefined): T[] {\n\t\tconst results: T[] = [];\n\t\tfor (const event of this.ledger.events) {\n\t\t\tconst result = handler(event);\n\t\t\tif (result !== undefined) {\n\t\t\t\tresults.push(result);\n\t\t\t}\n\t\t}\n\t\treturn results;\n\t}\n\n\texportToFile(path: string): void {\n\t\tensureDir(path);\n\t\twriteFileSync(path, JSON.stringify(this.ledger.events, null, 2), \"utf-8\");\n\t}\n}\n\n// ============================================================================\n// EvidenceGate\n// ============================================================================\n\nexport interface EvidenceGateOptions {\n\t/** Minimum number of satisfied evidence items required. */\n\tminEvidenceCount?: number;\n\t/** Require at least one artifact with a SHA-256 hash. */\n\trequireHash?: boolean;\n\t/** Require at least one verification command. */\n\trequireVerificationCommand?: boolean;\n}\n\nexport class EvidenceGate {\n\tprivate options: EvidenceGateOptions;\n\n\tconstructor(options: EvidenceGateOptions = {}) {\n\t\tthis.options = {\n\t\t\tminEvidenceCount: 1,\n\t\t\trequireHash: true,\n\t\t\trequireVerificationCommand: true,\n\t\t\t...options,\n\t\t};\n\t}\n\n\tcheck(contract: TaskContract): MergeGateResult {\n\t\tconst evidence = contract.requiredEvidence;\n\t\tconst satisfied = evidence.filter((e) => e.status === \"satisfied\");\n\t\tconst failed = evidence.filter((e) => e.status === \"failed\");\n\t\tconst pending = evidence.filter((e) => e.status === \"pending\" || e.status === \"gathering\");\n\n\t\tconst checks: string[] = [];\n\n\t\t// Check 1: minimum evidence count\n\t\tif (satisfied.length < (this.options.minEvidenceCount ?? 1)) {\n\t\t\tchecks.push(`Only ${satisfied.length}/${this.options.minEvidenceCount} required evidence items satisfied.`);\n\t\t}\n\n\t\t// Check 2: no failed evidence\n\t\tif (failed.length > 0) {\n\t\t\tchecks.push(`${failed.length} evidence item(s) failed.`);\n\t\t}\n\n\t\t// Check 3: require hash\n\t\tif (this.options.requireHash) {\n\t\t\tconst hashed = satisfied.filter((e) => e.hash && e.hash.length > 0);\n\t\t\tif (hashed.length === 0) {\n\t\t\t\tchecks.push(\"No satisfied evidence has a SHA-256 hash.\");\n\t\t\t}\n\t\t}\n\n\t\t// Check 4: require verification command\n\t\tif (this.options.requireVerificationCommand) {\n\t\t\tconst withCommand = satisfied.filter((e) => e.verificationCommand && e.verificationCommand.length > 0);\n\t\t\tif (withCommand.length === 0) {\n\t\t\t\tchecks.push(\"No satisfied evidence has a verification command.\");\n\t\t\t}\n\t\t}\n\n\t\t// Check 5: contract verdict\n\t\tif (contract.verdict === \"fail\") {\n\t\t\tchecks.push(\"Task contract verdict is 'fail'.\");\n\t\t}\n\n\t\tlet status: MergeGateStatus;\n\t\tlet reason: string;\n\t\tlet suggestion: string | undefined;\n\n\t\tif (checks.length === 0) {\n\t\t\tstatus = \"open\";\n\t\t\treason = `Evidence gate passed: ${satisfied.length}/${evidence.length} evidence items satisfied.`;\n\t\t} else {\n\t\t\t// If there are pending items and no hard failures, it's conditional; otherwise blocked\n\t\t\tconst hasHardFailure = failed.length > 0 || contract.verdict === \"fail\";\n\t\t\tstatus = pending.length > 0 && !hasHardFailure ? \"conditional\" : \"blocked\";\n\t\t\treason = checks.join(\"; \");\n\t\t\tsuggestion = `Gather remaining evidence (${pending.length} pending) and re-run verification.`;\n\t\t}\n\n\t\treturn {\n\t\t\tgateId: \"evidence-gate\",\n\t\t\tstatus,\n\t\t\treason,\n\t\t\tsuggestion,\n\t\t\tevidenceChecked: evidence,\n\t\t};\n\t}\n}\n\n// ============================================================================\n// FailClosedMergeGate\n// ============================================================================\n\nexport class FailClosedMergeGate {\n\tprivate gates: EvidenceGate[];\n\n\tconstructor(gates: EvidenceGate[] = [new EvidenceGate()]) {\n\t\tthis.gates = gates;\n\t}\n\n\tcheck(contract: TaskContract): MergeGateResult {\n\t\tconst results = this.gates.map((gate) => gate.check(contract));\n\t\tconst blocked = results.filter((r) => r.status === \"blocked\");\n\t\tconst conditional = results.filter((r) => r.status === \"conditional\");\n\n\t\tif (blocked.length > 0) {\n\t\t\treturn {\n\t\t\t\tgateId: \"fail-closed-merge-gate\",\n\t\t\t\tstatus: \"blocked\",\n\t\t\t\treason: `Blocked by ${blocked.length} gate(s): ${blocked.map((b) => b.reason).join(\"; \")}`,\n\t\t\t\tsuggestion: \"Resolve all blocking conditions before merge.\",\n\t\t\t\tevidenceChecked: contract.requiredEvidence,\n\t\t\t};\n\t\t}\n\n\t\tif (conditional.length > 0) {\n\t\t\treturn {\n\t\t\t\tgateId: \"fail-closed-merge-gate\",\n\t\t\t\tstatus: \"conditional\",\n\t\t\t\treason: `Conditional pass: ${conditional.length} gate(s) have pending conditions.`,\n\t\t\t\tsuggestion: \"Complete pending evidence or waive with explicit approval.\",\n\t\t\t\tevidenceChecked: contract.requiredEvidence,\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tgateId: \"fail-closed-merge-gate\",\n\t\t\tstatus: \"open\",\n\t\t\treason: \"All merge gates passed. Evidence verified and contract verdict is acceptable.\",\n\t\t\tevidenceChecked: contract.requiredEvidence,\n\t\t};\n\t}\n}\n\n// ============================================================================\n// Verify Reporter v2\n// ============================================================================\n\nexport interface VerifyReporterV2Options {\n\toutputDir: string;\n\tgoalId: string;\n}\n\nexport class VerifyReporterV2 {\n\tprivate options: VerifyReporterV2Options;\n\n\tconstructor(options: VerifyReporterV2Options) {\n\t\tthis.options = options;\n\t}\n\n\trender(contract: TaskContract, mergeGate: MergeGateResult): string {\n\t\tconst lines: string[] = [\n\t\t\t`## OMK Verification Report v2 — ${contract.goalId}`,\n\t\t\t\"\",\n\t\t\t\"### Contract\",\n\t\t\t\"\",\n\t\t\t`| Field | Value |`,\n\t\t\t`|-------|-------|`,\n\t\t\t`| Claim | ${contract.completionClaim} |`,\n\t\t\t`| Verdict | ${contract.verdict} |`,\n\t\t\t`| Final Risk | ${contract.finalRisk} |`,\n\t\t\t\"\",\n\t\t\t\"### Evidence\",\n\t\t\t\"\",\n\t\t\t`| Claim | Status | Artifact | Command |`,\n\t\t\t`|-------|--------|----------|----------|`,\n\t\t];\n\n\t\tfor (const ev of contract.requiredEvidence) {\n\t\t\tlines.push(`| ${ev.claim} | ${ev.status} | ${ev.artifactPath ?? \"—\"} | ${ev.verificationCommand ?? \"—\"} |`);\n\t\t}\n\n\t\tlines.push(\n\t\t\t\"\",\n\t\t\t\"### Merge Gate\",\n\t\t\t\"\",\n\t\t\t`| Gate | Status | Reason |`,\n\t\t\t`|------|--------|--------|`,\n\t\t\t`| ${mergeGate.gateId} | ${mergeGate.status} | ${mergeGate.reason} |`,\n\t\t\t\"\",\n\t\t);\n\n\t\tif (mergeGate.suggestion) {\n\t\t\tlines.push(`**Suggestion:** ${mergeGate.suggestion}`, \"\");\n\t\t}\n\n\t\treturn lines.join(\"\\n\");\n\t}\n\n\twrite(contract: TaskContract, mergeGate: MergeGateResult): string {\n\t\tconst markdown = this.render(contract, mergeGate);\n\t\tconst path = join(this.options.outputDir, `${this.options.goalId}.verify.md`);\n\t\tensureDir(path);\n\t\twriteFileSync(path, markdown, \"utf-8\");\n\t\treturn path;\n\t}\n}\n"]}

package/dist/guardrails/freedomd-adapter.d.ts

@@ -0,0 +1,16 @@
+import type { FreedomdAdapter, GuardrailDecision } from "../types/guardrails.ts";
+export declare class UnifiedFreedomdAdapter implements FreedomdAdapter {
+    private policy;
+    private goalId?;
+    private auditPath?;
+    constructor(options?: {
+        policyPath?: string;
+        goalId?: string;
+        auditPath?: string;
+    });
+    evaluate(toolName: string, toolInput: unknown): Promise<GuardrailDecision>;
+    private sanitizeInput;
+    private suggestAlternative;
+    private log;
+}
+//# sourceMappingURL=freedomd-adapter.d.ts.map

package/dist/guardrails/freedomd-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"freedomd-adapter.d.ts","sourceRoot":"","sources":["../../src/guardrails/freedomd-adapter.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACX,eAAe,EAEf,iBAAiB,EAGjB,MAAM,wBAAwB,CAAC;AAahC,qBAAa,sBAAuB,YAAW,eAAe;IAC7D,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,SAAS,CAAC,CAAS;IAE3B,YAAY,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAMjF;IAEK,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqB/E;IAED,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,kBAAkB;YAeZ,GAAG;CAWjB","sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport YAML from \"yaml\";\nimport type {\n\tFreedomdAdapter,\n\tGuardrailAuditEvent,\n\tGuardrailDecision,\n\tGuardrailPolicy,\n\tGuardrailRule,\n} from \"../types/guardrails.ts\";\nimport { appendAuditEvent } from \"./audit-logger.ts\";\n\nfunction getCurrentDir(): string {\n\ttry {\n\t\treturn dirname(fileURLToPath(import.meta.url));\n\t} catch {\n\t\treturn __dirname;\n\t}\n}\n\nconst DEFAULT_POLICY_PATH = join(getCurrentDir(), \"policy.yaml\");\n\nexport class UnifiedFreedomdAdapter implements FreedomdAdapter {\n\tprivate policy: GuardrailPolicy;\n\tprivate goalId?: string;\n\tprivate auditPath?: string;\n\n\tconstructor(options?: { policyPath?: string; goalId?: string; auditPath?: string }) {\n\t\tconst path = options?.policyPath ?? DEFAULT_POLICY_PATH;\n\t\tconst raw = readFileSync(path, \"utf-8\");\n\t\tthis.policy = YAML.parse(raw) as GuardrailPolicy;\n\t\tthis.goalId = options?.goalId;\n\t\tthis.auditPath = options?.auditPath;\n\t}\n\n\tasync evaluate(toolName: string, toolInput: unknown): Promise<GuardrailDecision> {\n\t\tconst inputText = this.sanitizeInput(toolInput);\n\n\t\tfor (const rule of this.policy.rules) {\n\t\t\tif (!rule.enabled) continue;\n\t\t\tif (rule.toolName && rule.toolName !== toolName) continue;\n\t\t\tif (rule.pattern && !new RegExp(rule.pattern, \"i\").test(inputText)) continue;\n\n\t\t\tconst decision: GuardrailDecision = {\n\t\t\t\tallowed: false,\n\t\t\t\trule,\n\t\t\t\treason: `Blocked by rule \"${rule.id}\": ${rule.description}`,\n\t\t\t\tsuggestion: this.suggestAlternative(rule),\n\t\t\t};\n\t\t\tawait this.log(toolName, inputText, decision);\n\t\t\treturn decision;\n\t\t}\n\n\t\tconst allow: GuardrailDecision = { allowed: true };\n\t\tawait this.log(toolName, inputText, allow);\n\t\treturn allow;\n\t}\n\n\tprivate sanitizeInput(input: unknown): string {\n\t\tif (input === null || input === undefined) return \"\";\n\t\tif (typeof input === \"string\") return input;\n\t\ttry {\n\t\t\treturn JSON.stringify(input);\n\t\t} catch {\n\t\t\treturn String(input);\n\t\t}\n\t}\n\n\tprivate suggestAlternative(rule: GuardrailRule): string | undefined {\n\t\tswitch (rule.category) {\n\t\t\tcase \"network\":\n\t\t\t\treturn \"Use context-mode_ctx_fetch_and_index or context-mode_ctx_execute instead of shell networking.\";\n\t\t\tcase \"destructive\":\n\t\t\t\treturn \"Use targeted rm of specific files or confirm destructive operations interactively.\";\n\t\t\tcase \"privilege_escalation\":\n\t\t\t\treturn \"Run the command without sudo or use a dedicated privileged lane grant.\";\n\t\t\tcase \"secret_exposure\":\n\t\t\t\treturn \"Avoid reading secret files; use environment-variable references with $ prefix.\";\n\t\t\tdefault:\n\t\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tprivate async log(toolName: string, toolInput: string, decision: GuardrailDecision): Promise<void> {\n\t\tif (!this.auditPath) return;\n\t\tconst event: GuardrailAuditEvent = {\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tgoalId: this.goalId,\n\t\t\ttoolName,\n\t\t\ttoolInput,\n\t\t\tdecision,\n\t\t};\n\t\tawait appendAuditEvent(this.auditPath, event);\n\t}\n}\n"]}

package/dist/guardrails/freedomd-adapter.js

@@ -0,0 +1,87 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import YAML from "yaml";
+import { appendAuditEvent } from "./audit-logger.js";
+function getCurrentDir() {
+    try {
+        return dirname(fileURLToPath(import.meta.url));
+    }
+    catch {
+        return __dirname;
+    }
+}
+const DEFAULT_POLICY_PATH = join(getCurrentDir(), "policy.yaml");
+export class UnifiedFreedomdAdapter {
+    policy;
+    goalId;
+    auditPath;
+    constructor(options) {
+        const path = options?.policyPath ?? DEFAULT_POLICY_PATH;
+        const raw = readFileSync(path, "utf-8");
+        this.policy = YAML.parse(raw);
+        this.goalId = options?.goalId;
+        this.auditPath = options?.auditPath;
+    }
+    async evaluate(toolName, toolInput) {
+        const inputText = this.sanitizeInput(toolInput);
+        for (const rule of this.policy.rules) {
+            if (!rule.enabled)
+                continue;
+            if (rule.toolName && rule.toolName !== toolName)
+                continue;
+            if (rule.pattern && !new RegExp(rule.pattern, "i").test(inputText))
+                continue;
+            const decision = {
+                allowed: false,
+                rule,
+                reason: `Blocked by rule "${rule.id}": ${rule.description}`,
+                suggestion: this.suggestAlternative(rule),
+            };
+            await this.log(toolName, inputText, decision);
+            return decision;
+        }
+        const allow = { allowed: true };
+        await this.log(toolName, inputText, allow);
+        return allow;
+    }
+    sanitizeInput(input) {
+        if (input === null || input === undefined)
+            return "";
+        if (typeof input === "string")
+            return input;
+        try {
+            return JSON.stringify(input);
+        }
+        catch {
+            return String(input);
+        }
+    }
+    suggestAlternative(rule) {
+        switch (rule.category) {
+            case "network":
+                return "Use context-mode_ctx_fetch_and_index or context-mode_ctx_execute instead of shell networking.";
+            case "destructive":
+                return "Use targeted rm of specific files or confirm destructive operations interactively.";
+            case "privilege_escalation":
+                return "Run the command without sudo or use a dedicated privileged lane grant.";
+            case "secret_exposure":
+                return "Avoid reading secret files; use environment-variable references with $ prefix.";
+            default:
+                return undefined;
+        }
+    }
+    async log(toolName, toolInput, decision) {
+        if (!this.auditPath)
+            return;
+        const event = {
+            timestamp: new Date().toISOString(),
+            goalId: this.goalId,
+            toolName,
+            toolInput,
+            decision,
+        };
+        await appendAuditEvent(this.auditPath, event);
+    }
+}
+//# sourceMappingURL=freedomd-adapter.js.map

package/dist/guardrails/freedomd-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"freedomd-adapter.js","sourceRoot":"","sources":["../../src/guardrails/freedomd-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,MAAM,CAAC;AAQxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,SAAS,aAAa,GAAW;IAChC,IAAI,CAAC;QACJ,OAAO,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,aAAa,CAAC,CAAC;AAEjE,MAAM,OAAO,sBAAsB;IAC1B,MAAM,CAAkB;IACxB,MAAM,CAAU;IAChB,SAAS,CAAU;IAE3B,YAAY,OAAsE,EAAE;QACnF,MAAM,IAAI,GAAG,OAAO,EAAE,UAAU,IAAI,mBAAmB,CAAC;QACxD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;IAAA,CACpC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,SAAkB,EAA8B;QAChF,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAEhD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAC5B,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YAC1D,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,SAAS;YAE7E,MAAM,QAAQ,GAAsB;gBACnC,OAAO,EAAE,KAAK;gBACd,IAAI;gBACJ,MAAM,EAAE,oBAAoB,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE;gBAC3D,UAAU,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;aACzC,CAAC;YACF,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC9C,OAAO,QAAQ,CAAC;QACjB,CAAC;QAED,MAAM,KAAK,GAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IAAA,CACb;IAEO,aAAa,CAAC,KAAc,EAAU;QAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IAAA,CACD;IAEO,kBAAkB,CAAC,IAAmB,EAAsB;QACnE,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvB,KAAK,SAAS;gBACb,OAAO,+FAA+F,CAAC;YACxG,KAAK,aAAa;gBACjB,OAAO,oFAAoF,CAAC;YAC7F,KAAK,sBAAsB;gBAC1B,OAAO,wEAAwE,CAAC;YACjF,KAAK,iBAAiB;gBACrB,OAAO,gFAAgF,CAAC;YACzF;gBACC,OAAO,SAAS,CAAC;QACnB,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,SAAiB,EAAE,QAA2B,EAAiB;QAClG,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,MAAM,KAAK,GAAwB;YAClC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ;YACR,SAAS;YACT,QAAQ;SACR,CAAC;QACF,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAAA,CAC9C;CACD","sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport YAML from \"yaml\";\nimport type {\n\tFreedomdAdapter,\n\tGuardrailAuditEvent,\n\tGuardrailDecision,\n\tGuardrailPolicy,\n\tGuardrailRule,\n} from \"../types/guardrails.ts\";\nimport { appendAuditEvent } from \"./audit-logger.ts\";\n\nfunction getCurrentDir(): string {\n\ttry {\n\t\treturn dirname(fileURLToPath(import.meta.url));\n\t} catch {\n\t\treturn __dirname;\n\t}\n}\n\nconst DEFAULT_POLICY_PATH = join(getCurrentDir(), \"policy.yaml\");\n\nexport class UnifiedFreedomdAdapter implements FreedomdAdapter {\n\tprivate policy: GuardrailPolicy;\n\tprivate goalId?: string;\n\tprivate auditPath?: string;\n\n\tconstructor(options?: { policyPath?: string; goalId?: string; auditPath?: string }) {\n\t\tconst path = options?.policyPath ?? DEFAULT_POLICY_PATH;\n\t\tconst raw = readFileSync(path, \"utf-8\");\n\t\tthis.policy = YAML.parse(raw) as GuardrailPolicy;\n\t\tthis.goalId = options?.goalId;\n\t\tthis.auditPath = options?.auditPath;\n\t}\n\n\tasync evaluate(toolName: string, toolInput: unknown): Promise<GuardrailDecision> {\n\t\tconst inputText = this.sanitizeInput(toolInput);\n\n\t\tfor (const rule of this.policy.rules) {\n\t\t\tif (!rule.enabled) continue;\n\t\t\tif (rule.toolName && rule.toolName !== toolName) continue;\n\t\t\tif (rule.pattern && !new RegExp(rule.pattern, \"i\").test(inputText)) continue;\n\n\t\t\tconst decision: GuardrailDecision = {\n\t\t\t\tallowed: false,\n\t\t\t\trule,\n\t\t\t\treason: `Blocked by rule \"${rule.id}\": ${rule.description}`,\n\t\t\t\tsuggestion: this.suggestAlternative(rule),\n\t\t\t};\n\t\t\tawait this.log(toolName, inputText, decision);\n\t\t\treturn decision;\n\t\t}\n\n\t\tconst allow: GuardrailDecision = { allowed: true };\n\t\tawait this.log(toolName, inputText, allow);\n\t\treturn allow;\n\t}\n\n\tprivate sanitizeInput(input: unknown): string {\n\t\tif (input === null || input === undefined) return \"\";\n\t\tif (typeof input === \"string\") return input;\n\t\ttry {\n\t\t\treturn JSON.stringify(input);\n\t\t} catch {\n\t\t\treturn String(input);\n\t\t}\n\t}\n\n\tprivate suggestAlternative(rule: GuardrailRule): string | undefined {\n\t\tswitch (rule.category) {\n\t\t\tcase \"network\":\n\t\t\t\treturn \"Use context-mode_ctx_fetch_and_index or context-mode_ctx_execute instead of shell networking.\";\n\t\t\tcase \"destructive\":\n\t\t\t\treturn \"Use targeted rm of specific files or confirm destructive operations interactively.\";\n\t\t\tcase \"privilege_escalation\":\n\t\t\t\treturn \"Run the command without sudo or use a dedicated privileged lane grant.\";\n\t\t\tcase \"secret_exposure\":\n\t\t\t\treturn \"Avoid reading secret files; use environment-variable references with $ prefix.\";\n\t\t\tdefault:\n\t\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tprivate async log(toolName: string, toolInput: string, decision: GuardrailDecision): Promise<void> {\n\t\tif (!this.auditPath) return;\n\t\tconst event: GuardrailAuditEvent = {\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tgoalId: this.goalId,\n\t\t\ttoolName,\n\t\t\ttoolInput,\n\t\t\tdecision,\n\t\t};\n\t\tawait appendAuditEvent(this.auditPath, event);\n\t}\n}\n"]}

package/dist/index.d.ts

@@ -1,39 +1,25 @@
 export { type Args, parseArgs } from "./cli/args.ts";
-export { CONFIG_DIR_NAME, getAgentDir, VERSION } from "./config.ts";
+export { getAgentDir, VERSION } from "./config.ts";
 export { AgentSession, type AgentSessionConfig, type AgentSessionEvent, type AgentSessionEventListener, type ModelCycleResult, type ParsedSkillBlock, type PromptOptions, parseSkillBlock, type SessionStats, } from "./core/agent-session.ts";
 export { type ApiKeyCredential, type AuthCredential, type AuthStatus, AuthStorage, type AuthStorageBackend, FileAuthStorageBackend, InMemoryAuthStorageBackend, type OAuthCredential, } from "./core/auth-storage.ts";
+export { type ApiAction, ApiBroker, type ApiMethod, type ApiOutcome, AUTOPILOT_MAX, type AutomationHarnessScoreInput, AutomationHarnessScorer, type AutomationScoreBreakdown, type AutomationTrace, type AutomationTraceAction, type AutomationTraceContextPlan, type AutomationTraceEnvApiUse, type AutonomyProfile, type BrokerFetcher, type BrokerFetchRequest, type BrokerFetchResponse, type Capability, canonicalHash, classifyEnvKey, DynamicToolPortfolioOptimizer, EnvBroker, type EnvBrokerLedger, type EnvMode, type EnvRecord, type EnvResolutionRequest, type EnvUseEvent, type EvidenceActor, type EvidenceEvent, type EvidenceEventInput, EvidenceLedger, type EvidenceOutcome, type EvidencePointer, type ExecutionStrategy, type Postcondition, PostconditionVerifier, type RiskLevel, redactForModel, type Sensitivity, strategyForRisk, ToolExecutionBroker, type ToolExecutionCandidate, type ToolExecutionChoice, type ToolExecutionNeed, type VerificationContext, type VerificationResult, } from "./core/automation/index.ts";
 export { type BranchPreparation, type BranchSummaryResult, type CollectEntriesResult, type CompactionResult, type CutPointResult, calculateContextTokens, collectEntriesForBranchSummary, compact, DEFAULT_COMPACTION_SETTINGS, estimateTokens, type FileOperations, findCutPoint, findTurnStartIndex, type GenerateBranchSummaryOptions, generateBranchSummary, generateSummary, getLastAssistantUsage, prepareBranchEntries, serializeConversation, shouldCompact, } from "./core/compaction/index.ts";
-export { type CompactStackProfile, type CompactStackRecommendation, classifyContextPackageRole, type ExternalContextPackageRegistration, type ExternalContextPackageRole, type ExternalPrunerLicense, type ExternalPrunerMode, type ExternalPrunerRegistration, type ExternalSessionCompactorRegistration, getRecommendedCompactStack, getRecommendedPrunerDefaults, getRecommendedSessionCompactorDefaults, type NeverPruneTarget, type PrunerRecommendedDefaults, type PrunerTrigger, registerExternalPrunerOwner, type SessionCompactorPhase, type SessionCompactorRecommendedDefaults, type SessionCompactorTrigger, type ValidatedCompactPackageStack, type ValidatedExternalPrunerOwner, type ValidatedSessionCompactorOwner, validateCompactPackageStack, validateSingleExternalPrunerOwner, validateSingleSessionCompactorOwner, } from "./core/compaction/pruner-policy.ts";
-export * from "./core/context-graph-identity-resolution.ts";
-export * from "./core/context-graph-memory-store.ts";
-export * from "./core/context-graph-ontology-generation.ts";
-export * from "./core/context-graph-ontology-registry.ts";
-export { type ContextGraphAdoptionDecision, type ContextGraphAdoptionInput, type ContextGraphAdoptionReason, type ContextGraphLibraryCategory, type ContextGraphLibraryClassification, type ContextGraphProfile, type ContextGraphStackRecommendation, type ContextGraphVerdict, classifyContextGraphLibrary, getContextGraphToolSurface, getRecommendedContextGraphStack, getUnderstandAnythingIndexPlan, type MemoryFactCategory, type MemoryFactPolicyCandidate, type MemoryFactPolicyDecision, type MemoryFactPolicyReason, type Neo4jAdoptionCondition, type UnderstandAnythingIndexPlan, validateContextGraphAdoption, validateMemoryFactPolicy, } from "./core/context-graph-policy.ts";
-export * from "./core/context-graph-reasoning.ts";
-export * from "./core/context-graph-retrieval.ts";
 export { createEventBus, type EventBus, type EventBusController } from "./core/event-bus.ts";
-export { canCacheToolResult, canonicalizeJson, classifyToolResultCacheEligibility, createExactResponseCacheKey, createToolResultCacheKey, EXACT_CACHE_KEY_VERSION, type ExactResponseCacheKey, type ExactResponseCacheKeyInput, type ExactResponseCacheKeyMaterial, hashCanonicalJson, isBashToolName, isKnownMutatingToolName, type JsonObject, type JsonPrimitive, type JsonValue, MUTATING_TOOL_NAME_TERMS, type ToolResultCacheKey, type ToolResultCacheKeyInput, type ToolResultCacheKeyMaterial, type ToolResultCachePolicyCandidate, type ToolResultCachePolicyDecision, type ToolResultCachePolicyReason, type ToolResultCacheStatus, } from "./core/exact-cache-policy.ts";
 export type { AgentEndEvent, AgentStartEvent, AgentToolResult, AgentToolUpdateCallback, AppKeybinding, AutocompleteProviderFactory, BashToolCallEvent, BeforeAgentStartEvent, BeforeAgentStartEventResult, BeforeProviderRequestEvent, BeforeProviderRequestEventResult, BuildSystemPromptOptions, CompactOptions, ContextEvent, ContextUsage, CustomToolCallEvent, EditToolCallEvent, ExecOptions, ExecResult, Extension, ExtensionActions, ExtensionAPI, ExtensionCommandContext, ExtensionCommandContextActions, ExtensionContext, ExtensionContextActions, ExtensionError, ExtensionEvent, ExtensionFactory, ExtensionFlag, ExtensionHandler, ExtensionRuntime, ExtensionShortcut, ExtensionUIContext, ExtensionUIDialogOptions, ExtensionWidgetOptions, FindToolCallEvent, GrepToolCallEvent, InputEvent, InputEventResult, InputSource, KeybindingsManager, LoadExtensionsResult, LsToolCallEvent, MessageRenderer, MessageRenderOptions, ProviderConfig, ProviderModelConfig, ReadToolCallEvent, RegisteredCommand, RegisteredTool, ResolvedCommand, SessionBeforeCompactEvent, SessionBeforeForkEvent, SessionBeforeSwitchEvent, SessionBeforeTreeEvent, SessionCompactEvent, SessionShutdownEvent, SessionStartEvent, SessionTreeEvent, SlashCommandInfo, SlashCommandSource, SourceInfo, TerminalInputHandler, ToolCallEvent, ToolCallEventResult, ToolDefinition, ToolExecutionMode, ToolInfo, ToolRenderResultOptions, ToolResultEvent, TurnEndEvent, TurnStartEvent, UserBashEvent, UserBashEventResult, WidgetPlacement, WorkingIndicatorOptions, WriteToolCallEvent, } from "./core/extensions/index.ts";
 export { createExtensionRuntime, defineTool, discoverAndLoadExtensions, ExtensionRunner, isBashToolResult, isEditToolResult, isFindToolResult, isGrepToolResult, isLsToolResult, isReadToolResult, isToolCallEventType, isWriteToolResult, wrapRegisteredTool, wrapRegisteredTools, } from "./core/extensions/index.ts";
 export type { ReadonlyFooterDataProvider } from "./core/footer-data-provider.ts";
-export { createHeadroomBeforeProviderSend, type HeadroomBeforeProviderSend, type HeadroomBeforeProviderSendOptions, type HeadroomBeforeProviderSendStats, type HeadroomCompressText, type HeadroomCompressTextInput, } from "./core/headroom-middleware.ts";
-export { createLeanContextBeforeProviderSend, type LeanContextBeforeProviderSend, type LeanContextBeforeProviderSendOptions, } from "./core/lean-context-middleware.ts";
-export { createLeanContextPolicyState, decideLeanContextEmission, formatLeanContextUnchangedStub, getLeanContextTrackingHash, LEAN_CONTEXT_DEFAULT_MIN_STUB_TOKENS, LEAN_CONTEXT_NEVER_STUB_FILENAMES, type LeanContextDecisionReason, type LeanContextEmission, type LeanContextPolicyDecision, type LeanContextPolicyInput, type LeanContextPolicyOptions, type LeanContextPolicyState, } from "./core/lean-context-policy.ts";
 export { convertToLlm } from "./core/messages.ts";
 export { ModelRegistry } from "./core/model-registry.ts";
-export * from "./core/native-adoption-benchmark.ts";
-export { type CompositionConflict, type CompositionInput, type CompositionPromotionRecord, type CompositionResourceFilter, type CompositionReview, type CompositionSurface, type CompositionVerdict, checkCapabilitySurfaceMatch, checkOmkDomainMutation, checkSingleSurfaceOwner, composeCandidateBatch, composePackage, createDefaultCompositionPolicy, createPromotionRecord, inferRequestedSurfaces, type OmkOwnedDomain, type PackageCompositionPolicy, resolveResourceFilter, type SurfaceOwnerRule, toPackageSource, } from "./core/package-composition.ts";
 export type { PackageManager, PathMetadata, ProgressCallback, ProgressEvent, ResolvedPaths, ResolvedResource, } from "./core/package-manager.ts";
 export { DefaultPackageManager } from "./core/package-manager.ts";
-export type { ContextFile, ResourceCollision, ResourceDiagnostic, ResourceLoader } from "./core/resource-loader.ts";
-export { DefaultResourceLoader, loadProjectContextFiles, sanitizeContextForJailbreak } from "./core/resource-loader.ts";
+export type { ResourceCollision, ResourceDiagnostic, ResourceLoader } from "./core/resource-loader.ts";
+export { DefaultResourceLoader, loadProjectContextFiles } from "./core/resource-loader.ts";
 export { AgentSessionRuntime, type AgentSessionRuntimeDiagnostic, type AgentSessionServices, type CreateAgentSessionFromServicesOptions, type CreateAgentSessionOptions, type CreateAgentSessionResult, type CreateAgentSessionRuntimeFactory, type CreateAgentSessionRuntimeResult, type CreateAgentSessionServicesOptions, createAgentSession, createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createBashTool, createCodingTools, createEditTool, createFindTool, createGrepTool, createLsTool, createReadOnlyTools, createReadTool, createWriteTool, type PromptTemplate, } from "./core/sdk.ts";
-export { ALLOWED_SEMANTIC_CACHE_TASK_CLASSES, classifySemanticCacheEligibility, FORBIDDEN_SEMANTIC_CACHE_ACTION_TERMS, FORBIDDEN_SEMANTIC_CACHE_TASK_CLASS_TERMS, type SemanticCacheAttributePolicyReason, type SemanticCacheAttributeValidation, type SemanticCacheCandidate, type SemanticCacheContextAttributes, type SemanticCacheDependencyFlags, type SemanticCachePolicyDecision, type SemanticCachePolicyReason, type SemanticCacheResponseKind, type SemanticCacheTaskClass, validateSemanticCacheAttributes, } from "./core/semantic-cache-policy.ts";
 export { type BranchSummaryEntry, buildSessionContext, type CompactionEntry, CURRENT_SESSION_VERSION, type CustomEntry, type CustomMessageEntry, type FileEntry, getLatestCompactionEntry, type ModelChangeEntry, migrateSessionEntries, type NewSessionOptions, parseSessionEntries, type SessionContext, type SessionEntry, type SessionEntryBase, type SessionHeader, type SessionInfo, type SessionInfoEntry, SessionManager, type SessionMessageEntry, type ThinkingLevelChangeEntry, } from "./core/session-manager.ts";
 export { type CompactionSettings, type ImageSettings, type PackageSource, type RetrySettings, SettingsManager, } from "./core/settings-manager.ts";
 export { formatSkillsForPrompt, type LoadSkillsFromDirOptions, type LoadSkillsResult, loadSkills, loadSkillsFromDir, type Skill, type SkillFrontmatter, } from "./core/skills.ts";
 export { createSyntheticSourceInfo } from "./core/source-info.ts";
-export { type BashOperations, type BashSandboxPreflight, type BashSpawnContext, type BashSpawnHook, type BashToolDetails, type BashToolInput, type BashToolOptions, createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLocalBashOperations, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, type EditOperations, type EditToolDetails, type EditToolInput, type EditToolOptions, type FindOperations, type FindToolDetails, type FindToolInput, type FindToolOptions, formatSize, type GrepOperations, type GrepToolDetails, type GrepToolInput, type GrepToolOptions, type LsOperations, type LsToolDetails, type LsToolInput, type LsToolOptions, type ReadOperations, type ReadToolDetails, type ReadToolInput, type ReadToolOptions, type ToolsOptions, type TruncationOptions, type TruncationResult, truncateHead, truncateLine, truncateTail, type WriteOperations, type WriteToolInput, type WriteToolOptions, withFileMutationQueue, } from "./core/tools/index.ts";
+export { type BashOperations, type BashSpawnContext, type BashSpawnHook, type BashToolDetails, type BashToolInput, type BashToolOptions, createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLocalBashOperations, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, type EditOperations, type EditToolDetails, type EditToolInput, type EditToolOptions, type FindOperations, type FindToolDetails, type FindToolInput, type FindToolOptions, formatSize, type GrepOperations, type GrepToolDetails, type GrepToolInput, type GrepToolOptions, type LsOperations, type LsToolDetails, type LsToolInput, type LsToolOptions, type ReadOperations, type ReadToolDetails, type ReadToolInput, type ReadToolOptions, type ToolsOptions, type TruncationOptions, type TruncationResult, truncateHead, truncateLine, truncateTail, type WriteOperations, type WriteToolInput, type WriteToolOptions, withFileMutationQueue, } from "./core/tools/index.ts";
 export { type MainOptions, main } from "./main.ts";
 export { InteractiveMode, type InteractiveModeOptions, type ModelInfo, type PrintModeOptions, RpcClient, type RpcClientOptions, type RpcCommand, type RpcEventListener, type RpcResponse, type RpcSessionState, runPrintMode, runRpcMode, } from "./modes/index.ts";
 export { ArminComponent, AssistantMessageComponent, BashExecutionComponent, BorderedLoader, BranchSummaryMessageComponent, CompactionSummaryMessageComponent, CustomEditor, CustomMessageComponent, DynamicBorder, ExtensionEditorComponent, ExtensionInputComponent, ExtensionSelectorComponent, FooterComponent, keyHint, keyText, LoginDialogComponent, ModelSelectorComponent, OAuthSelectorComponent, type RenderDiffOptions, rawKeyHint, renderDiff, SessionSelectorComponent, type SettingsCallbacks, type SettingsConfig, SettingsSelectorComponent, ShowImagesSelectorComponent, SkillInvocationMessageComponent, ThemeSelectorComponent, ThinkingSelectorComponent, ToolExecutionComponent, type ToolExecutionOptions, TreeSelectorComponent, truncateToVisualLines, UserMessageComponent, UserMessageSelectorComponent, type VisualTruncateResult, } from "./modes/interactive/components/index.ts";