opencode-swarm 7.138.3 → 7.138.4

package/dist/cli/{index-gda7cwqz.js → index-e1kgxchq.js}

@@ -1,25 +1,25 @@
 // @bun
 import {
-  DC_SAFE_TARGETS,
   HUMAN_ONLY_SWARM_COMMANDS,
   dcCheckJunctionCreation,
+  dcEvaluateRecursiveDeleteTargets,
   dcExtractPowerShellTargets,
+  dcExtractRecursiveRmTargets,
   dcExtractWindowsCmdTargets,
   dcNormalizeCommand,
   dcSplitSegments,
   dcUnwrapWrappers,
-  dcValidateTargets,
   detectPosixWrites,
   detectWindowsWrites,
   resolveWriteTargets
-} from "./index-99af5gvd.js";
+} from "./index-a18hk2fw.js";
 import {
   checkFileAuthority,
   classifyFile,
   isInDeclaredScope,
   redactPath,
   redactShellCommand
-} from "./index-31vfewmn.js";
+} from "./index-gm3pjfhb.js";
 
 // src/services/guardrail-explain-service.ts
 import path from "path";
@@ -90,98 +90,60 @@ function evaluateDestructiveDecision(rawCommand, cwd, declaredScope) {
         firingRule: "destructive_block: junction creation"
       };
     }
-    const rmShortMatch = seg.match(/^rm\s+(-[rRfF]+(?:\s+-[rRfF]+)*|-r\s+-f|-f\s+-r)\s+(.+)$/);
-    const rmLongMatch = seg.match(/^rm\s+(?:--(?:recursive|force)\s+){1,2}(.+)$/);
-    const rmAnyMatch = rmShortMatch ?? rmLongMatch;
-    if (rmAnyMatch) {
-      const targetPart = rmAnyMatch[rmShortMatch ? 2 : 1].trim();
-      const targets = targetPart.split(/\s+/);
-      const validateBlock = dcValidateTargets(targets, cwd);
-      if (validateBlock) {
+    const targets = dcExtractRecursiveRmTargets(seg);
+    if (targets) {
+      const targetDecision = dcEvaluateRecursiveDeleteTargets({ targets, cwd });
+      if (!targetDecision.allowed) {
         return {
           decision: "block",
-          firingRule: `destructive_block: rm with unsafe target: ${redactPath(targetPart)}`
+          firingRule: `${targetDecision.code}: ${targetDecision.reason}`
         };
       }
-      const allSafe = targets.every((t) => DC_SAFE_TARGETS.has(t.replace(/^["']|["']$/g, "").trim()));
-      if (!allSafe) {
-        const scopeExempt = declaredScope != null && declaredScope.length > 0 && targets.every((t) => isInDeclaredScope(t.replace(/^["']|["']$/g, "").trim(), declaredScope, cwd));
-        if (!scopeExempt) {
-          return {
-            decision: "block",
-            firingRule: `destructive_block: rm recursive/force on unsafe path: ${redactPath(targetPart)}`
-          };
-        }
-      }
     }
     if (/^(?:rmdir|rd)(?:\.exe)?\s+.*\/[sS]/i.test(seg)) {
-      const targets = dcExtractWindowsCmdTargets(seg);
-      if (targets.length === 0) {
+      const targets2 = dcExtractWindowsCmdTargets(seg);
+      if (targets2.length === 0) {
         return {
           decision: "block",
           firingRule: "destructive_block: Windows recursive directory delete (rmdir /s)"
         };
       }
-      const validateBlock = dcValidateTargets(targets, cwd);
-      if (validateBlock) {
+      const targetDecision = dcEvaluateRecursiveDeleteTargets({ targets: targets2, cwd });
+      if (!targetDecision.allowed) {
         return {
           decision: "block",
-          firingRule: `destructive_block: rmdir /s unsafe: ${redactPath(targets.join(", "))}`
+          firingRule: `${targetDecision.code}: ${targetDecision.reason}`
         };
       }
-      const allSafe = targets.every((t) => DC_SAFE_TARGETS.has(t.trim()));
-      if (!allSafe) {
-        const scopeExempt = declaredScope != null && declaredScope.length > 0 && targets.every((t) => isInDeclaredScope(t.trim(), declaredScope, cwd));
-        if (!scopeExempt) {
-          return {
-            decision: "block",
-            firingRule: `destructive_block: rmdir /s on unsafe path: ${redactPath(targets.join(", "))}`
-          };
-        }
-      }
     }
     if (/^del(?:\.exe)?\s+.*\/[sS]/i.test(seg)) {
-      const targets = dcExtractWindowsCmdTargets(seg);
-      if (targets.length > 0) {
-        const validateBlock = dcValidateTargets(targets, cwd);
-        if (validateBlock) {
+      const targets2 = dcExtractWindowsCmdTargets(seg);
+      if (targets2.length > 0) {
+        const targetDecision = dcEvaluateRecursiveDeleteTargets({
+          targets: targets2,
+          cwd
+        });
+        if (!targetDecision.allowed) {
           return {
             decision: "block",
-            firingRule: `destructive_block: del /s unsafe: ${redactPath(targets.join(", "))}`
+            firingRule: `${targetDecision.code}: ${targetDecision.reason}`
           };
         }
-        const allSafe = targets.every((t) => DC_SAFE_TARGETS.has(t.trim()));
-        if (!allSafe) {
-          const scopeExempt = declaredScope != null && declaredScope.length > 0 && targets.every((t) => isInDeclaredScope(t.trim(), declaredScope, cwd));
-          if (!scopeExempt) {
-            return {
-              decision: "block",
-              firingRule: `destructive_block: del /s on unsafe path: ${redactPath(targets.join(", "))}`
-            };
-          }
-        }
       }
     }
     if (/^(?:Remove-Item|ri|rm|rmdir|del|erase|rd)\b.*-[Rr]ecurse\b/i.test(seg) || /^(?:Remove-Item|ri|rm|rmdir|del|erase|rd)\b.*-[Rr]\b/i.test(seg)) {
-      const targets = dcExtractPowerShellTargets(seg);
-      if (targets.length > 0) {
-        const validateBlock = dcValidateTargets(targets, cwd);
-        if (validateBlock) {
+      const targets2 = dcExtractPowerShellTargets(seg);
+      if (targets2.length > 0) {
+        const targetDecision = dcEvaluateRecursiveDeleteTargets({
+          targets: targets2,
+          cwd
+        });
+        if (!targetDecision.allowed) {
           return {
             decision: "block",
-            firingRule: `destructive_block: PowerShell recursive delete unsafe: ${redactPath(targets.join(", "))}`
+            firingRule: `${targetDecision.code}: ${targetDecision.reason}`
           };
         }
-        const allSafe = targets.every((t) => DC_SAFE_TARGETS.has(t.trim()));
-        if (!allSafe) {
-          const scopeExempt = declaredScope != null && declaredScope.length > 0 && targets.every((t) => isInDeclaredScope(t.trim(), declaredScope, cwd));
-          if (!scopeExempt) {
-            return {
-              decision: "block",
-              firingRule: `destructive_block: PowerShell recursive delete on unsafe path: ${redactPath(targets.join(", "))}`
-            };
-          }
-        }
       } else {
         return {
           decision: "block",

package/dist/cli/{index-31vfewmn.js → index-gm3pjfhb.js}

@@ -2,7 +2,16 @@
 import {
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-ab57h0yq.js";
+} from "./index-5q009kc4.js";
+import {
+  getPathFlavor,
+  isOnDifferentPathRoot,
+  isPathIdentityWithin,
+  isPathWithinDeclaredScope,
+  pathIdentitiesEqual,
+  sanitizeDiagnosticText,
+  unsafePathTextReason
+} from "./index-556ja8an.js";
 import {
   init_constants
 } from "./index-3jcyn8g6.js";
@@ -2095,11 +2104,41 @@ function getGlobMatcher(pattern, caseInsensitive = true) {
     return () => false;
   }
 }
+var AUTHORITY_ROLE_CAPABILITIES = {
+  architect: "direct-write",
+  coder: "direct-write",
+  reviewer: "direct-write",
+  critic: "direct-write",
+  critic_oversight: "dedicated-tool-only",
+  critic_finding_validator: "dedicated-tool-only",
+  explorer: "read-only",
+  sme: "read-only",
+  researcher: "read-only",
+  test_engineer: "direct-write",
+  docs: "direct-write",
+  docs_design: "direct-write",
+  designer: "direct-write",
+  critic_sounding_board: "read-only",
+  critic_drift_verifier: "read-only",
+  critic_hallucination_verifier: "read-only",
+  critic_architecture_supervisor: "read-only",
+  curator_init: "dedicated-tool-only",
+  curator_phase: "dedicated-tool-only",
+  curator_postmortem: "dedicated-tool-only",
+  curator_consolidation: "dedicated-tool-only",
+  council_generalist: "read-only",
+  council_skeptic: "read-only",
+  council_domain_expert: "read-only",
+  skill_improver: "dedicated-tool-only",
+  spec_writer: "dedicated-tool-only"
+};
+var NON_WRITING_SWARM_RULES = Object.fromEntries(Object.entries(AUTHORITY_ROLE_CAPABILITIES).filter(([, capability]) => capability === "read-only" || capability === "dedicated-tool-only").map(([agent]) => [agent, { readOnly: true }]));
 var DEFAULT_AGENT_AUTHORITY_RULES = {
   build: {},
   plan: {},
   general: {},
   explore: {},
+  ...NON_WRITING_SWARM_RULES,
   architect: {
     blockedExact: [".swarm/plan.md", ".swarm/plan.json"],
     blockedZones: ["generated", "config"],
@@ -2189,6 +2228,22 @@ var DEFAULT_AGENT_AUTHORITY_RULES = {
     blockedZones: ["generated"]
   }
 };
+function matchesAuthorityDenyPrefix(candidate, prefix, cwd, flavor = getPathFlavor()) {
+  const pathImpl = flavor === "win32" ? path.win32 : path.posix;
+  const normalizeInput = (value) => flavor === "win32" ? value.replace(/\//g, "\\") : value;
+  const normalizedPrefixInput = normalizeInput(prefix);
+  const requiresComponentBoundary = normalizedPrefixInput.endsWith(pathImpl.sep);
+  const root = pathImpl.resolve(normalizeInput(cwd));
+  const target = pathImpl.resolve(root, normalizeInput(candidate));
+  const denied = pathImpl.resolve(root, normalizedPrefixInput);
+  if (!isPathIdentityWithin(target, root, flavor) || !isPathIdentityWithin(denied, root, flavor)) {
+    return false;
+  }
+  const identity = (value) => flavor === "win32" ? value.toLowerCase() : value;
+  const targetIdentity = identity(target);
+  const deniedIdentity = identity(denied);
+  return requiresComponentBoundary ? targetIdentity === deniedIdentity || targetIdentity.startsWith(`${deniedIdentity}${pathImpl.sep}`) : targetIdentity.startsWith(deniedIdentity);
+}
 function buildEffectiveRules(authorityConfig) {
   if (authorityConfig?.enabled === false || !authorityConfig?.rules) {
     return { ...DEFAULT_AGENT_AUTHORITY_RULES };
@@ -2220,21 +2275,37 @@ function buildEffectiveRules(authorityConfig) {
   return merged;
 }
 function isOnDifferentFilesystemRoot(targetAbsolute, cwdAbsolute, pathLib = path) {
-  return pathLib.parse(targetAbsolute).root !== pathLib.parse(cwdAbsolute).root;
+  const flavor = pathLib === path.win32 || pathLib.parse("C:\\probe").root !== "" ? "win32" : "posix";
+  return isOnDifferentPathRoot(targetAbsolute, cwdAbsolute, flavor);
 }
-function isInDeclaredScope(filePath, scopeEntries, cwd) {
-  const dir = cwd ?? process.cwd();
-  const caseInsensitive = process.platform === "win32";
-  const resolvedFileRaw = path.resolve(dir, filePath);
-  const resolvedFile = caseInsensitive ? resolvedFileRaw.toLowerCase() : resolvedFileRaw;
-  return scopeEntries.some((scope) => {
-    const resolvedScopeRaw = path.resolve(dir, scope);
-    const resolvedScope = caseInsensitive ? resolvedScopeRaw.toLowerCase() : resolvedScopeRaw;
-    if (resolvedFile === resolvedScope)
-      return true;
-    const rel = path.relative(resolvedScope, resolvedFile);
-    return rel.length > 0 && !rel.startsWith("..") && !path.isAbsolute(rel);
-  });
+var BUILT_IN_VERIFIER_CONFIG_GLOBS = [
+  "**/oxlintrc*",
+  "**/.oxlintrc*",
+  "**/.eslintrc*",
+  "**/eslint.config.*",
+  "**/.prettierrc*",
+  "**/prettier.config.*",
+  "**/biome.json",
+  "**/biome.jsonc",
+  "**/tsconfig*.json",
+  "**/.secretscanignore",
+  "**/.golangci*"
+];
+function denyAuthority(agent, normalizedPath, input) {
+  const safeAgent = sanitizeDiagnosticText(agent, 96);
+  const safePath = sanitizeDiagnosticText(normalizedPath, 320);
+  const safeDetail = sanitizeDiagnosticText(input.detail, 640);
+  return {
+    allowed: false,
+    code: input.code,
+    layer: input.layer,
+    rule: sanitizeDiagnosticText(input.rule, 128),
+    path: safePath,
+    agent: safeAgent,
+    reason: sanitizeDiagnosticText(`${input.code}: Path blocked: ${safeDetail} [agent=${safeAgent}; path=${safePath}]`, 1024),
+    recovery: input.recovery,
+    zone: input.zone
+  };
 }
 var MAX_ALLOWED_HINT_ENTRIES = 20;
 function formatAllowedHints(rules) {
@@ -2258,10 +2329,19 @@ function formatAllowedHints(rules) {
   parts.push("Block rules (blocked zones/prefixes/globs/exact) and universal deny paths still apply.");
   return parts.join(" ");
 }
-function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, options) {
+function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, options = {}) {
   const normalizedAgent = agentName.toLowerCase();
   const strippedAgent = stripKnownSwarmPrefix(agentName).toLowerCase();
   const dir = cwd || process.cwd();
+  const unsafePathReason = unsafePathTextReason(filePath);
+  if (unsafePathReason) {
+    return denyAuthority(agentName, filePath, {
+      code: "AUTHORITY_INVALID_PATH",
+      layer: "path-validation",
+      rule: "safe-path-text",
+      detail: unsafePathReason
+    });
+  }
   let normalizedPath;
   let resolvedTarget;
   try {
@@ -2273,71 +2353,160 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
     normalizedPath = path.relative(dir, resolvedTarget).replace(/\\/g, "/");
   }
   if (isOnDifferentFilesystemRoot(resolvedTarget, dir)) {
-    return {
-      allowed: false,
-      reason: `Path blocked: ${filePath} is on a different drive/root than the working directory`
-    };
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_ROOT_ESCAPE",
+      layer: "containment",
+      rule: "same-filesystem-root",
+      detail: "target is on a different drive or filesystem root"
+    });
   }
   if (normalizedPath === ".." || normalizedPath.startsWith("../")) {
-    return {
-      allowed: false,
-      reason: `Path blocked: ${normalizedPath} resolves outside the working directory`
-    };
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_ROOT_ESCAPE",
+      layer: "containment",
+      rule: "workspace-containment",
+      detail: "target resolves outside the working directory"
+    });
   }
   const rules = effectiveRules[normalizedAgent] ?? effectiveRules[strippedAgent];
   if (!rules) {
-    return { allowed: false, reason: `Unknown agent: ${agentName}` };
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_UNKNOWN_AGENT",
+      layer: "role-capability",
+      rule: "known-agent-role",
+      detail: "Unknown agent: no authority classification exists"
+    });
+  }
+  const flavor = getPathFlavor();
+  const matchesPathPrefix = (candidate, prefix) => isPathIdentityWithin(path.resolve(dir, candidate), path.resolve(dir, prefix), flavor);
+  const matchesGlob = (glob) => getGlobMatcher(glob)(normalizedPath);
+  for (const prefix of options.universalDenyPrefixes ?? []) {
+    if (matchesAuthorityDenyPrefix(normalizedPath, prefix, dir, flavor)) {
+      return denyAuthority(agentName, normalizedPath, {
+        code: "AUTHORITY_UNIVERSAL_DENY",
+        layer: "universal-deny",
+        rule: `universal:${prefix}`,
+        detail: `target is under universal deny prefix ${prefix}`
+      });
+    }
+  }
+  const isCoderAgent = normalizedAgent === "coder" || strippedAgent === "coder";
+  if (isCoderAgent && matchesPathPrefix(normalizedPath, ".swarm")) {
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_PROTECTED_PATH",
+      layer: "protected-path",
+      rule: "coder-swarm-state-protection",
+      detail: "coder writes to .swarm are always protected"
+    });
+  }
+  const isSwarmRole = Object.hasOwn(AUTHORITY_ROLE_CAPABILITIES, strippedAgent);
+  if (isSwarmRole) {
+    const matchedVerifier = [
+      ...BUILT_IN_VERIFIER_CONFIG_GLOBS,
+      ...options.verifierConfigPaths ?? []
+    ].find(matchesGlob);
+    if (matchedVerifier) {
+      return denyAuthority(agentName, normalizedPath, {
+        code: "AUTHORITY_VERIFIER_CONFIG",
+        layer: "protected-path",
+        rule: `verifier-config:${matchedVerifier}`,
+        detail: `Path blocked (glob ${matchedVerifier}): swarm roles cannot write verifier-owned configuration in the config zone`
+      });
+    }
+  }
+  const canonicalCapability = AUTHORITY_ROLE_CAPABILITIES[strippedAgent];
+  if (canonicalCapability === "read-only" || canonicalCapability === "dedicated-tool-only") {
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_ROLE_READ_ONLY",
+      layer: "role-capability",
+      rule: `role-capability:${canonicalCapability}`,
+      detail: canonicalCapability === "dedicated-tool-only" ? "role may mutate state only through dedicated tools" : "agent role is read-only"
+    });
   }
   if (rules.readOnly) {
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_ROLE_READ_ONLY",
+      layer: "role-capability",
+      rule: "role-policy:read-only",
+      detail: "agent role is read-only"
+    });
+  }
+  const pathIsInDeclaredScope = isCoderAgent && options.declaredScope != null && options.declaredScope.length > 0 && isPathWithinDeclaredScope(normalizedPath, options.declaredScope, dir);
+  if (pathIsInDeclaredScope) {
     return {
-      allowed: false,
-      reason: `Path blocked: ${normalizedPath} (agent ${normalizedAgent} is read-only)`
+      allowed: true,
+      layer: "declared-scope",
+      path: sanitizeDiagnosticText(normalizedPath, 320),
+      agent: sanitizeDiagnosticText(agentName, 96)
+    };
+  }
+  if (options.authorityEnabled === false) {
+    return {
+      allowed: true,
+      layer: "role-policy",
+      path: sanitizeDiagnosticText(normalizedPath, 320),
+      agent: sanitizeDiagnosticText(agentName, 96)
     };
   }
   if (rules.blockedExact) {
     for (const blocked of rules.blockedExact) {
-      if (normalizedPath === blocked) {
-        return {
-          allowed: false,
-          reason: `Path blocked (exact): ${normalizedPath}`
-        };
+      if (pathIdentitiesEqual(normalizedPath, blocked, flavor)) {
+        return denyAuthority(agentName, normalizedPath, {
+          code: "AUTHORITY_POLICY_DENY",
+          layer: "role-policy",
+          rule: `blockedExact:${blocked}`,
+          detail: `path is blocked by exact role policy ${blocked}`,
+          recovery: isCoderAgent ? "declare_scope" : undefined
+        });
       }
     }
   }
   if (rules.blockedGlobs && rules.blockedGlobs.length > 0) {
     for (const glob of rules.blockedGlobs) {
-      const matcher = getGlobMatcher(glob);
-      if (matcher(normalizedPath)) {
-        return {
-          allowed: false,
-          reason: `Path blocked (glob ${glob}): ${normalizedPath}`
-        };
+      if (matchesGlob(glob)) {
+        return denyAuthority(agentName, normalizedPath, {
+          code: "AUTHORITY_POLICY_DENY",
+          layer: "role-policy",
+          rule: `blockedGlob:${glob}`,
+          detail: `Path blocked (glob ${glob}) by role policy`,
+          recovery: isCoderAgent ? "declare_scope" : undefined
+        });
       }
     }
   }
   if (rules.allowedExact && rules.allowedExact.length > 0) {
-    const isExplicitlyAllowed = rules.allowedExact.some((allowed) => normalizedPath === allowed);
+    const isExplicitlyAllowed = rules.allowedExact.some((allowed) => pathIdentitiesEqual(normalizedPath, allowed, flavor));
     if (isExplicitlyAllowed) {
-      return { allowed: true };
+      return {
+        allowed: true,
+        layer: "role-policy",
+        path: normalizedPath,
+        agent: agentName
+      };
     }
   }
   if (rules.blockedZones && rules.blockedZones.length > 0) {
     const { zone } = classifyFile(normalizedPath);
     if (rules.blockedZones.includes(zone)) {
-      return {
-        allowed: false,
-        reason: `Path blocked: ${normalizedPath} is in ${zone} zone`,
+      return denyAuthority(agentName, normalizedPath, {
+        code: "AUTHORITY_POLICY_DENY",
+        layer: "role-policy",
+        rule: `blockedZone:${zone}`,
+        detail: `path is in ${zone} zone`,
+        recovery: isCoderAgent ? "declare_scope" : undefined,
         zone
-      };
+      });
     }
   }
   if (rules.allowedGlobs && rules.allowedGlobs.length > 0) {
-    const isGlobAllowed = rules.allowedGlobs.some((glob) => {
-      const matcher = getGlobMatcher(glob);
-      return matcher(normalizedPath);
-    });
+    const isGlobAllowed = rules.allowedGlobs.some(matchesGlob);
     if (isGlobAllowed) {
-      return { allowed: true };
+      return {
+        allowed: true,
+        layer: "role-policy",
+        path: normalizedPath,
+        agent: agentName
+      };
     }
   }
   if (rules.allowedCaseSensitiveGlobs && rules.allowedCaseSensitiveGlobs.length > 0) {
@@ -2346,59 +2515,67 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
       return matcher(normalizedPath);
     });
     if (isCaseSensitiveGlobAllowed) {
-      return { allowed: true };
+      return {
+        allowed: true,
+        layer: "role-policy",
+        path: normalizedPath,
+        agent: agentName
+      };
     }
   }
   if (rules.blockedPrefix && rules.blockedPrefix.length > 0) {
     for (const prefix of rules.blockedPrefix) {
-      if (normalizedPath.startsWith(prefix)) {
-        return {
-          allowed: false,
-          reason: `Path blocked: ${normalizedPath} is under ${prefix}`
-        };
-      }
-    }
-  }
-  const isCoderAgent = normalizedAgent === "coder" || strippedAgent === "coder";
-  const pathIsInDeclaredScope = isCoderAgent && options?.declaredScope != null && options.declaredScope.length > 0 && isInDeclaredScope(normalizedPath, options.declaredScope, dir);
-  if (!pathIsInDeclaredScope) {
-    if (rules.allowedPrefix != null && rules.allowedPrefix.length > 0) {
-      const isAllowed = rules.allowedPrefix.some((prefix) => normalizedPath.startsWith(prefix));
-      if (!isAllowed) {
-        return {
-          allowed: false,
-          reason: `Path ${normalizedPath} not in allowed list for ${normalizedAgent}. ${formatAllowedHints(rules)}`
-        };
-      }
-    } else if (rules.allowedPrefix != null && rules.allowedPrefix.length === 0) {
-      return {
-        allowed: false,
-        reason: `Path ${normalizedPath} not in allowed list for ${normalizedAgent}. ${formatAllowedHints(rules)}`
-      };
+      if (matchesPathPrefix(normalizedPath, prefix)) {
+        return denyAuthority(agentName, normalizedPath, {
+          code: "AUTHORITY_POLICY_DENY",
+          layer: "role-policy",
+          rule: `blockedPrefix:${prefix}`,
+          detail: `path is under blocked role prefix ${prefix}`,
+          recovery: isCoderAgent ? "declare_scope" : undefined
+        });
+      }
+    }
+  }
+  if (rules.allowedPrefix != null && rules.allowedPrefix.length > 0) {
+    const isAllowed = rules.allowedPrefix.some((prefix) => matchesPathPrefix(normalizedPath, prefix));
+    if (!isAllowed) {
+      return denyAuthority(agentName, normalizedPath, {
+        code: "AUTHORITY_POLICY_DENY",
+        layer: "role-policy",
+        rule: "allowedPrefix",
+        detail: `path is not in allowed list for this role. ${formatAllowedHints(rules)}`,
+        recovery: isCoderAgent ? "declare_scope" : undefined
+      });
     }
+  } else if (rules.allowedPrefix != null && rules.allowedPrefix.length === 0) {
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_POLICY_DENY",
+      layer: "role-policy",
+      rule: "allowedPrefix:empty",
+      detail: `path is not in allowed list because the role allowlist is empty. ${formatAllowedHints(rules)}`,
+      recovery: isCoderAgent ? "declare_scope" : undefined
+    });
   }
-  return { allowed: true };
+  return {
+    allowed: true,
+    layer: "role-policy",
+    path: normalizedPath,
+    agent: agentName
+  };
 }
-function checkFileAuthority(agentName, filePath, cwd, authorityConfig, options) {
-  return checkFileAuthorityWithRules(agentName, filePath, cwd, buildEffectiveRules(authorityConfig), options);
+function checkFileAuthority(agentName, filePath, cwd, authorityConfig, options = {}) {
+  return checkFileAuthorityWithRules(agentName, filePath, cwd, buildEffectiveRules(authorityConfig), {
+    ...options,
+    authorityEnabled: authorityConfig?.enabled ?? options.authorityEnabled,
+    universalDenyPrefixes: authorityConfig?.universal_deny_prefixes ?? options.universalDenyPrefixes,
+    verifierConfigPaths: authorityConfig?.verifier_config_paths ?? options.verifierConfigPaths
+  });
 }
 
 // src/hooks/guardrails/helpers.ts
 init_constants();
-import * as path2 from "path";
-function isInDeclaredScope2(filePath, scopeEntries, cwd) {
-  const dir = cwd ?? process.cwd();
-  const caseInsensitive = process.platform === "win32";
-  const resolvedFileRaw = path2.resolve(dir, filePath);
-  const resolvedFile = caseInsensitive ? resolvedFileRaw.toLowerCase() : resolvedFileRaw;
-  return scopeEntries.some((scope) => {
-    const resolvedScopeRaw = path2.resolve(dir, scope);
-    const resolvedScope = caseInsensitive ? resolvedScopeRaw.toLowerCase() : resolvedScopeRaw;
-    if (resolvedFile === resolvedScope)
-      return true;
-    const rel = path2.relative(resolvedScope, resolvedFile);
-    return rel.length > 0 && !rel.startsWith("..") && !path2.isAbsolute(rel);
-  });
+function isInDeclaredScope(filePath, scopeEntries, cwd) {
+  return isPathWithinDeclaredScope(filePath, scopeEntries, cwd);
 }
 function redactShellCommand(cmd) {
   if (typeof cmd !== "string")
@@ -2414,7 +2591,7 @@ function redactShellCommand(cmd) {
 
 // src/hooks/guardrails/audit-log.ts
 init_logger();
-import * as path3 from "path";
+import * as path2 from "path";
 function redactPath(filePath) {
   if (typeof filePath !== "string" || filePath.length === 0)
     return filePath;
@@ -2426,7 +2603,7 @@ function redactPath(filePath) {
   if (rawMacHomeMatch) {
     return `~${rawMacHomeMatch[2]}`;
   }
-  const normalized = path3.normalize(filePath);
+  const normalized = path2.normalize(filePath);
   const windowsHomeMatch = normalized.match(/^([A-Za-z]:\\Users\\[^\\]+)(\\.*)$/);
   if (windowsHomeMatch) {
     return `~\\${windowsHomeMatch[2]}`;
@@ -2438,4 +2615,4 @@ function redactPath(filePath) {
   return normalized;
 }
 
-export { stableCanonicalStringify, classifyFile, checkFileAuthority, isInDeclaredScope2 as isInDeclaredScope, redactShellCommand, redactPath };
+export { stableCanonicalStringify, classifyFile, checkFileAuthority, isInDeclaredScope, redactShellCommand, redactPath };

package/dist/cli/{index-jhb8kjc5.js → index-jbge0dyh.js}

@@ -2,18 +2,18 @@
 import {
   ALLOWED_SKILL_PATH_PREFIXES,
   validateSkillPath
-} from "./index-tc61fybd.js";
+} from "./index-tjwz5tct.js";
 import {
   computeOutcomeSignal,
   readKnowledge,
   resolveHiveKnowledgePath,
   resolveSwarmKnowledgePath,
   transactKnowledge
-} from "./index-1djv5684.js";
+} from "./index-1g6xpjk3.js";
 import {
   effectiveRetrievalOutcomes,
   readKnowledgeCounterRollups
-} from "./index-93ky909v.js";
+} from "./index-57stye65.js";
 import {
   init_knowledge_types,
   isActiveStatus