opencode-telos 1.0.0

package/dist/sdd/enforcement/interceptor.js

@@ -0,0 +1,365 @@
+import { updateNode, getNodesByType } from "../graph/engine.js";
+import { computeImpact } from "../graph/traverse.js";
+import { createChange, classifyApprovalLevel } from "../changes/manager.js";
+import { validateGraph } from "../validation/validator.js";
+export function classifyChangeRequest(description) {
+    const lower = description.toLowerCase();
+    if (/adicionar|add|criar|create|nov[oa]/.test(lower)) {
+        return { type: "add_functionality", description };
+    }
+    if (/modificar|modify|alterar|change|atualizar|update|editar|edit/.test(lower)) {
+        return { type: "modify_functionality", description };
+    }
+    if (/deletar|delete|remover|remove|excluir|exclui/.test(lower)) {
+        return { type: "delete_functionality", description };
+    }
+    if (/corrigir|fix|bug|erro|error/.test(lower)) {
+        return { type: "bug_fix", description };
+    }
+    if (/refatorar|refactor|reorganizar|reorganize/.test(lower)) {
+        return { type: "refactor", description };
+    }
+    if (/migrar|migrate|trocar|replace|substituir|banco|database|auth|autenticação/.test(lower)) {
+        return { type: "architecture_change", description };
+    }
+    return { type: "modify_functionality", description };
+}
+export function enforceSddFirst(graph, request, options) {
+    const result = {
+        allowed: false,
+        reason: "",
+        validation_passed: false,
+        sdd_updated: false,
+        blocking_reasons: [],
+    };
+    // Step 1: Check if SDD is initialized
+    if (!graph.nodes.some((n) => n.type === "project")) {
+        result.reason = "SDD not initialized. Run sdd.initialize first.";
+        result.blocking_reasons = ["No project node in graph"];
+        return result;
+    }
+    // Step 2: Check if graph has enough specification
+    const entities = getNodesByType(graph, "entity");
+    const features = getNodesByType(graph, "feature");
+    if (entities.length === 0 && features.length === 0) {
+        result.reason = "SDD has no specification. Create features and entities before implementing.";
+        result.blocking_reasons = ["No entities or features defined"];
+        return result;
+    }
+    // Step 3: For delete/modify, check if target exists
+    if (request.type === "delete_functionality" || request.type === "modify_functionality") {
+        const found = graph.nodes.filter((n) => {
+            const nameMatch = request.description.toLowerCase().includes(n.name.toLowerCase());
+            const idMatch = request.description.toLowerCase().includes(n.id.toLowerCase());
+            return nameMatch || idMatch;
+        });
+        if (found.length === 0 && request.type === "delete_functionality") {
+            result.reason = `Cannot delete: no matching node found for "${request.description}". Specify the exact entity/feature name.`;
+            result.blocking_reasons = ["Target not found in SDD"];
+            return result;
+        }
+    }
+    // Step 4: Classify approval level
+    const proposal = {
+        title: request.description,
+        reason: request.description,
+        affected_node_ids: request.affected_entities || [],
+        new_nodes: [],
+        modified_nodes: [],
+        removed_node_ids: [],
+        affected_files: request.affected_files || [],
+        affected_tests: [],
+        implementation_tasks: [],
+    };
+    let approvalLevel = options?.forceApprovalLevel || classifyApprovalLevel(proposal, graph);
+    // Step 4b: Upgrade approval for cross-layer changes
+    if (approvalLevel !== "BLOCKED" && !options?.forceApprovalLevel && request.affected_files && request.affected_files.length > 0) {
+        const crossLayerDetected = detectCrossLayerChange(request.affected_files, graph);
+        if (crossLayerDetected) {
+            if (approvalLevel === "AUTO")
+                approvalLevel = "REVIEW";
+            else if (approvalLevel === "REVIEW")
+                approvalLevel = "APPROVAL";
+        }
+    }
+    // Step 5: Architecture changes need explicit approval
+    if (request.type === "architecture_change" || approvalLevel === "BLOCKED") {
+        result.reason = `This change requires explicit approval. Level: ${approvalLevel}. Description: ${request.description}`;
+        result.blocking_reasons = [
+            `Approval level: ${approvalLevel}`,
+            "Architecture changes require human confirmation",
+        ];
+        return result;
+    }
+    // Step 6: Create the change node
+    let changeNode;
+    try {
+        changeNode = createChange(graph, proposal);
+        result.change_id = changeNode.id;
+    }
+    catch (e) {
+        result.reason = `Failed to create change: ${e}`;
+        return result;
+    }
+    // Step 7: Validate SDD
+    if (options?.skipValidation) {
+        result.validation_passed = true; // Assume valid if skipped
+    }
+    else {
+        // Check validation cache
+        let validation;
+        const graphVersion = graph.metadata.updated_at;
+        const cachedValidation = options?.validationCache?.get(graphVersion);
+        const cacheMaxAge = 60000; // 1 minute
+        if (cachedValidation && (Date.now() - cachedValidation.timestamp) < cacheMaxAge) {
+            validation = cachedValidation;
+        }
+        else {
+            validation = validateGraph(graph);
+            if (options?.validationCache) {
+                options.validationCache.set(graphVersion, { ...validation, timestamp: Date.now() });
+            }
+        }
+        result.validation_passed = validation.valid;
+        if (!validation.valid) {
+            result.reason = `SDD validation failed with ${validation.errors.length} errors. Fix specification before implementing.`;
+            result.blocking_reasons = validation.errors.map((e) => `[${e.code}] ${e.message}`);
+            updateNode(graph, changeNode.id, { status: "BLOCKED" });
+            return result;
+        }
+    }
+    // Step 7b: Test-before-merge check for APPROVAL-level changes
+    if (approvalLevel === "APPROVAL") {
+        const affectedReqs = request.affected_entities || [];
+        const hasTestCoverage = checkTestCoverageForAffected(graph, affectedReqs);
+        if (!hasTestCoverage && affectedReqs.length > 0) {
+            result.blocking_reasons = result.blocking_reasons || [];
+            result.blocking_reasons.push(`APPROVAL-level change affects ${affectedReqs.length} entity(ies) but none have test coverage. ` +
+                `Add test nodes and link them with 'tested_by' relationships before proceeding.`);
+        }
+    }
+    // Step 8: Compute impact
+    if (!options?.skipImpactAnalysis && request.affected_entities && request.affected_entities.length > 0) {
+        const impactNodes = new Set();
+        const maxDepth = options?.maxImpactDepth ?? 3;
+        for (const entityId of request.affected_entities) {
+            const impact = computeImpact(graph, entityId, maxDepth);
+            for (const n of impact.direct)
+                impactNodes.add(n.id);
+            for (const n of impact.indirect)
+                impactNodes.add(n.id);
+        }
+        result.impact_summary = `Impact: ${impactNodes.size} nodes affected`;
+    }
+    else if (options?.skipImpactAnalysis) {
+        result.impact_summary = "Impact analysis skipped";
+    }
+    // Step 9: All checks passed
+    result.allowed = true;
+    result.reason = `SDD-first workflow: Change ${changeNode.id} created and validated. Proceed with implementation.`;
+    result.sdd_updated = true;
+    updateNode(graph, changeNode.id, { status: "APPROVED" });
+    return result;
+}
+/**
+ * Detect if a change affects files across different architecture layers
+ * (e.g., frontend files + backend files).
+ */
+function detectCrossLayerChange(files, graph) {
+    let hasFrontend = false;
+    let hasBackend = false;
+    let hasDatabase = false;
+    for (const file of files) {
+        const path = file.toLowerCase();
+        if (path.includes("client") || path.includes("frontend") || path.includes("pages/") || path.includes("components/")) {
+            hasFrontend = true;
+        }
+        else if (path.includes("server") || path.includes("backend") || path.includes("routes/") || path.includes("controllers/") || path.includes("services/") || path.includes("repositories/")) {
+            hasBackend = true;
+        }
+        else if (path.includes("database") || path.includes("migrations/") || path.includes("schema")) {
+            hasDatabase = true;
+        }
+    }
+    // Cross-layer if frontend+backend or frontend+database
+    return (hasFrontend && hasBackend) || (hasFrontend && hasDatabase) || (hasBackend && hasDatabase);
+}
+/**
+ * Check if affected entities have test coverage.
+ * Returns true if at least one entity has a test linked via 'tested_by'.
+ */
+function checkTestCoverageForAffected(graph, affectedEntities) {
+    if (affectedEntities.length === 0)
+        return true;
+    for (const entityName of affectedEntities) {
+        // Find entity node by name or ID
+        const entity = graph.nodes.find((n) => (n.type === "entity" || n.type === "requirement" || n.type === "feature") &&
+            (n.id === entityName || n.name.toLowerCase() === entityName.toLowerCase()));
+        if (!entity)
+            continue;
+        // Check if this entity has any test linked
+        const hasTest = graph.relationships.some((r) => r.from === entity.id && r.type === "tested_by");
+        if (!hasTest)
+            return false;
+    }
+    return true;
+}
+export function buildEnforcementPrompt(request, result) {
+    const lines = [
+        "## SDD Enforcement Status\n",
+        `**Request Type:** ${request.type}`,
+        `**Description:** ${request.description}`,
+        `**Allowed:** ${result.allowed ? "YES" : "NO"}`,
+        `**Change ID:** ${result.change_id || "N/A"}`,
+        `**Validation:** ${result.validation_passed ? "PASSED" : "FAILED"}`,
+        `**SDD Updated:** ${result.sdd_updated ? "YES" : "NO"}`,
+    ];
+    if (result.impact_summary) {
+        lines.push(`\n**Impact:** ${result.impact_summary}`);
+    }
+    if (result.blocking_reasons && result.blocking_reasons.length > 0) {
+        lines.push("\n### Blocking Reasons");
+        for (const reason of result.blocking_reasons) {
+            lines.push(`- ${reason}`);
+        }
+    }
+    if (result.allowed) {
+        lines.push("\n### Next Steps");
+        lines.push("1. Update the SDD specification with the changes");
+        lines.push("2. Validate the updated SDD");
+        lines.push("3. Implement the code changes");
+        lines.push("4. Run tests");
+        lines.push("5. Verify implementation against SDD");
+        lines.push("6. Update the Knowledge Graph");
+        lines.push(`7. Complete change ${result.change_id}`);
+    }
+    else {
+        lines.push("\n### Action Required");
+        lines.push("The SDD must be updated before code changes can proceed.");
+        lines.push("Use the discovery process to gather missing information.");
+    }
+    return lines.join("\n");
+}
+/**
+ * Smart batch enforcement: for AUTO-level changes, execute the full cycle
+ * (create change → validate → approve) in one call without user interaction.
+ */
+export function enforceSmartBatch(graph, request, affectedEntities = [], affectedFiles = [], options) {
+    // Share validation cache between enforceSddFirst and the post-check
+    // to avoid running validateGraph() twice
+    const sharedValidationCache = options?.validationCache ?? new Map();
+    const sharedOptions = { ...options, validationCache: sharedValidationCache };
+    const result = enforceSddFirst(graph, {
+        ...request,
+        affected_entities: affectedEntities,
+        affected_files: affectedFiles,
+    }, sharedOptions);
+    // If the change was auto-approved, reuse the cached validation result
+    if (result.allowed && result.change_id) {
+        const graphVersion = graph.metadata.updated_at;
+        const cachedValidation = sharedValidationCache.get(graphVersion);
+        const validation = cachedValidation || validateGraph(graph);
+        if (validation.valid) {
+            return { ...result, auto_completed: true };
+        }
+        else {
+            return {
+                ...result,
+                auto_completed: false,
+                reason: `Change created but validation failed: ${validation.errors.length} error(s). Fix spec before implementing.`,
+            };
+        }
+    }
+    return { ...result, auto_completed: false };
+}
+export function getSddEnforcementRules() {
+    return `
+## SDD-FIRST ENFORCEMENT RULES (MANDATORY)
+
+You are operating under STRICT Spec-Driven Development enforcement.
+
+### Rule 1: SDD is always first
+Before ANY code modification:
+- If SDD is not initialized: run sdd.initialize
+- If specification is incomplete: run sdd.discover and complete it
+- If specification exists: validate it with sdd.validate
+
+### Rule 2: Every change must go through SDD
+When the user requests ANY change:
+1. Classify the change (add/modify/delete/bug_fix/refactor/architecture)
+2. Create a Change node with sdd.create_change
+3. Perform impact analysis with sdd.analyze_impact
+4. Update the specification BEFORE writing code
+5. Validate the updated specification
+6. Only THEN implement the code
+7. After implementation, validate again
+8. Complete the change with sdd.complete_change
+
+### Rule 3: Never skip SDD for "simple" changes
+Even small changes must update the specification.
+A "typo fix" in a field name is a specification change.
+Renaming a variable that appears in the API is a specification change.
+
+### Rule 4: Specification validation is mandatory
+After EVERY specification update:
+- Run sdd.validate
+- If validation fails: fix the specification
+- Only proceed to implementation after validation passes
+
+### Rule 5: Code must match specification
+After implementation:
+- Run sdd.detect_drift
+- If drift detected: reconcile specification and code
+- The specification is always the source of truth
+
+### Rule 6: Changes must be traceable
+Every change must have:
+- A Change node in the graph
+- Affected nodes identified
+- Impact analysis performed
+- Validation before and after implementation
+
+### Rule 7: Architecture changes need approval
+Any change to:
+- Database engine
+- Authentication mechanism
+- Multi-tenancy model
+- API public contract
+- Core business rules
+Requires explicit user approval before implementation.
+
+### Rule 8: Discovery is mandatory for new areas
+When the user requests a new feature/area:
+- Check if SDD has enough information
+- If not: run sdd.discover
+- Never assume implementation details
+- Ask for missing information
+- Update SDD before implementing
+
+### Rule 9: Shell commands cannot bypass enforcement
+Using shell commands to write source files is PROHIBITED without SDD approval:
+- python3 heredocs (python3 - <<'EOF' ... open('file','w') ... EOF)
+- python3 -c with open().write()
+- node -e with fs.writeFileSync()
+- Shell redirects (> file.ts, >> file.ts)
+- cat >, tee, sed -i on source files
+- ANY command that creates or modifies .ts, .tsx, .js, .py, .go, .rs files
+
+All shell commands are monitored. The ONLY acceptable way to write code:
+sdd.enforce → sdd.update_from_answers → sdd.approve_change → Write/Edit tools
+
+### Enforcement Summary
+The workflow is ALWAYS:
+UNDERSTAND → MODEL → SPECIFY → ANALYZE IMPACT → APPROVE → PLAN → IMPLEMENT → TEST → VERIFY → SYNC
+
+NEVER: IMPLEMENT → DOCUMENT
+NEVER: Use shell commands to bypass SDD
+
+### Shell Command Monitoring
+All run_terminal_command calls are analyzed. Commands writing source files:
+- BLOCKED if no SDD Change node covers the target files
+- ALLOWED only after sdd.enforce → sdd.approve_change
+- Logged in audit trail regardless of outcome
+`;
+}
+//# sourceMappingURL=interceptor.js.map

package/dist/sdd/enforcement/interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interceptor.js","sourceRoot":"","sources":["../../../src/sdd/enforcement/interceptor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAmC1D,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAA;IAEvC,IAAI,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAA;IACnD,CAAC;IACD,IAAI,8DAA8D,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,WAAW,EAAE,CAAA;IACtD,CAAC;IACD,IAAI,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,WAAW,EAAE,CAAA;IACtD,CAAC;IACD,IAAI,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;IACzC,CAAC;IACD,IAAI,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;IAC1C,CAAC;IACD,IAAI,2EAA2E,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAA;IACrD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,WAAW,EAAE,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,KAAqB,EACrB,OAAsB,EACtB,OAA4B;IAE5B,MAAM,MAAM,GAAsB;QAChC,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,EAAE;QACV,iBAAiB,EAAE,KAAK;QACxB,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,EAAE;KACrB,CAAA;IAED,sCAAsC;IACtC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,GAAG,gDAAgD,CAAA;QAChE,MAAM,CAAC,gBAAgB,GAAG,CAAC,0BAA0B,CAAC,CAAA;QACtD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,kDAAkD;IAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,GAAG,6EAA6E,CAAA;QAC7F,MAAM,CAAC,gBAAgB,GAAG,CAAC,iCAAiC,CAAC,CAAA;QAC7D,OAAO,MAAM,CAAA;IACf,CAAC;IAED,oDAAoD;IACpD,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACvF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACrC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAClF,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;YAC9E,OAAO,SAAS,IAAI,OAAO,CAAA;QAC7B,CAAC,CAAC,CAAA;QAEF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAClE,MAAM,CAAC,MAAM,GAAG,8CAA8C,OAAO,CAAC,WAAW,2CAA2C,CAAA;YAC5H,MAAM,CAAC,gBAAgB,GAAG,CAAC,yBAAyB,CAAC,CAAA;YACrD,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,QAAQ,GAAG;QACf,KAAK,EAAE,OAAO,CAAC,WAAW;QAC1B,MAAM,EAAE,OAAO,CAAC,WAAW;QAC3B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;QAClD,SAAS,EAAE,EAAE;QACb,cAAc,EAAE,EAAE;QAClB,gBAAgB,EAAE,EAAE;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;QAC5C,cAAc,EAAE,EAAE;QAClB,oBAAoB,EAAE,EAAE;KACzB,CAAA;IAED,IAAI,aAAa,GAAG,OAAO,EAAE,kBAAkB,IAAI,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAEzF,oDAAoD;IACpD,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,kBAAkB,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/H,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;QAChF,IAAI,kBAAkB,EAAE,CAAC;YACvB,IAAI,aAAa,KAAK,MAAM;gBAAE,aAAa,GAAG,QAAQ,CAAA;iBACjD,IAAI,aAAa,KAAK,QAAQ;gBAAE,aAAa,GAAG,UAAU,CAAA;QACjE,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAqB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC1E,MAAM,CAAC,MAAM,GAAG,kDAAkD,aAAa,kBAAkB,OAAO,CAAC,WAAW,EAAE,CAAA;QACtH,MAAM,CAAC,gBAAgB,GAAG;YACxB,mBAAmB,aAAa,EAAE;YAClC,iDAAiD;SAClD,CAAA;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,iCAAiC;IACjC,IAAI,UAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAC1C,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,CAAA;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,MAAM,GAAG,4BAA4B,CAAC,EAAE,CAAA;QAC/C,OAAO,MAAM,CAAA;IACf,CAAC;IAED,uBAAuB;IACvB,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;QAC5B,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAA,CAAC,0BAA0B;IAC5D,CAAC;SAAM,CAAC;QACN,yBAAyB;QACzB,IAAI,UAA6C,CAAA;QACjD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAA;QAC9C,MAAM,gBAAgB,GAAG,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;QACpE,MAAM,WAAW,GAAG,KAAK,CAAA,CAAC,WAAW;QAErC,IAAI,gBAAgB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,WAAW,EAAE,CAAC;YAChF,UAAU,GAAG,gBAAgB,CAAA;QAC/B,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;YACjC,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;gBAC7B,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YACrF,CAAC;QACH,CAAC;QAED,MAAM,CAAC,iBAAiB,GAAG,UAAU,CAAC,KAAK,CAAA;QAE3C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,MAAM,GAAG,8BAA8B,UAAU,CAAC,MAAM,CAAC,MAAM,iDAAiD,CAAA;YACvH,MAAM,CAAC,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;YACvF,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;YACvD,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAA;QACpD,MAAM,eAAe,GAAG,4BAA4B,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;QACzE,IAAI,CAAC,eAAe,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAA;YACvD,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAC1B,iCAAiC,YAAY,CAAC,MAAM,4CAA4C;gBAChG,gFAAgF,CACjF,CAAA;QACH,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,OAAO,EAAE,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtG,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;QACrC,MAAM,QAAQ,GAAG,OAAO,EAAE,cAAc,IAAI,CAAC,CAAA;QAC7C,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;YACvD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACpD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACxD,CAAC;QACD,MAAM,CAAC,cAAc,GAAG,WAAW,WAAW,CAAC,IAAI,iBAAiB,CAAA;IACtE,CAAC;SAAM,IAAI,OAAO,EAAE,kBAAkB,EAAE,CAAC;QACvC,MAAM,CAAC,cAAc,GAAG,yBAAyB,CAAA;IACnD,CAAC;IAED,4BAA4B;IAC5B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;IACrB,MAAM,CAAC,MAAM,GAAG,8BAA8B,UAAU,CAAC,EAAE,sDAAsD,CAAA;IACjH,MAAM,CAAC,WAAW,GAAG,IAAI,CAAA;IAEzB,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;IAExD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,KAAe,EAAE,KAAqB;IACpE,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,IAAI,WAAW,GAAG,KAAK,CAAA;IAEvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACpH,WAAW,GAAG,IAAI,CAAA;QACpB,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5L,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChG,WAAW,GAAG,IAAI,CAAA;QACpB,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,CAAA;AACnG,CAAC;AAED;;;GAGG;AACH,SAAS,4BAA4B,CACnC,KAAqB,EACrB,gBAA0B;IAE1B,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAE9C,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC1C,iCAAiC;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;YAC9E,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC,CAC7E,CAAA;QACD,IAAI,CAAC,MAAM;YAAE,SAAQ;QAErB,2CAA2C;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CACtD,CAAA;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;IAC5B,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAsB,EACtB,MAAyB;IAEzB,MAAM,KAAK,GAAa;QACtB,6BAA6B;QAC7B,qBAAqB,OAAO,CAAC,IAAI,EAAE;QACnC,oBAAoB,OAAO,CAAC,WAAW,EAAE;QACzC,gBAAgB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAC/C,kBAAkB,MAAM,CAAC,SAAS,IAAI,KAAK,EAAE;QAC7C,mBAAmB,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;QACnE,oBAAoB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;KACxD,CAAA;IAED,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,cAAc,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACpC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC9B,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAA;QAC9D,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QACzC,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;QAC3C,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC1B,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;QAClD,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;QAC3C,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;IACtD,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QACnC,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;QACtE,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;IACxE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAqB,EACrB,OAAsB,EACtB,mBAA6B,EAAE,EAC/B,gBAA0B,EAAE,EAC5B,OAA4B;IAE5B,oEAAoE;IACpE,yCAAyC;IACzC,MAAM,qBAAqB,GAAG,OAAO,EAAE,eAAe,IAAI,IAAI,GAAG,EAAE,CAAA;IACnE,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAA;IAE5E,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE;QACpC,GAAG,OAAO;QACV,iBAAiB,EAAE,gBAAgB;QACnC,cAAc,EAAE,aAAa;KAC9B,EAAE,aAAa,CAAC,CAAA;IAEjB,sEAAsE;IACtE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAA;QAC9C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAChE,MAAM,UAAU,GAAG,gBAAgB,IAAI,aAAa,CAAC,KAAK,CAAC,CAAA;QAC3D,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAA;QAC5C,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,GAAG,MAAM;gBACT,cAAc,EAAE,KAAK;gBACrB,MAAM,EAAE,yCAAyC,UAAU,CAAC,MAAM,CAAC,MAAM,0CAA0C;aACpH,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuFR,CAAA;AACD,CAAC"}

package/dist/sdd/enforcement/workflow-tracker.d.ts

@@ -0,0 +1,66 @@
+/**
+ * SDD Workflow State Tracker (FEAT-087/FEAT-100)
+ *
+ * Tracks whether the current agent session is inside a valid SDD workflow.
+ * Graph mutation tools (add_node, update_node, etc.) are blocked unless
+ * the session has passed through sdd.enforce or an approved Change exists.
+ *
+ * Uses module-level state (not AsyncLocalStorage) because OpenCode tools
+ * execute synchronously within a single tool-call boundary.
+ */
+export interface WorkflowState {
+    /** Whether sdd.enforce has been called in this session */
+    enforced: boolean;
+    /** Change node ID created by sdd.enforce */
+    changeId: string | null;
+    /** Whether the current change has been approved */
+    approved: boolean;
+    /** Whether sdd.validate has passed since last enforce */
+    validated: boolean;
+    /** Timestamp of last enforce call */
+    enforcedAt: number;
+    /** Whether discovery is in progress (sdd.discover was called) */
+    discovering: boolean;
+    /** Whether the SDD spec has been updated since last enforce (add_node, update_node, update_from_answers) */
+    specUpdated: boolean;
+}
+/** Reset workflow state (called on session start or /sdd off) */
+export declare function resetWorkflowState(): void;
+/** Mark that sdd.enforce was called */
+export declare function markEnforced(changeId: string): void;
+/** Mark that the change was approved */
+export declare function markApproved(): void;
+/** Mark that sdd.validate passed */
+export declare function markValidated(): void;
+/** Mark that discovery is in progress */
+export declare function markDiscovering(discovering: boolean): void;
+/** Mark that the SDD spec has been updated (add_node, update_node, update_from_answers) */
+export declare function markSpecUpdated(): void;
+/** Mark that the change was completed (resets state) */
+export declare function markCompleted(): void;
+/** Check if workflow is in a valid state for graph mutations */
+export declare function isWorkflowValid(): {
+    valid: boolean;
+    reason?: string;
+};
+/** Get current workflow state (read-only) */
+export declare function getWorkflowState(): Readonly<WorkflowState>;
+/**
+ * Tools that are ALLOWED without workflow context.
+ * These are read-only or workflow-entry tools.
+ */
+export declare const WORKFLOW_EXEMPT_TOOLS: Set<string>;
+/**
+ * Tools that REQUIRE workflow context (graph mutations).
+ * These modify the SDD graph and must go through the workflow.
+ */
+export declare const WORKFLOW_REQUIRED_TOOLS: Set<string>;
+/**
+ * Check if a tool requires workflow context.
+ * Returns null if the tool is allowed, or an error message if blocked.
+ */
+export declare function checkToolAccess(toolName: string): {
+    allowed: boolean;
+    reason?: string;
+};
+//# sourceMappingURL=workflow-tracker.d.ts.map

package/dist/sdd/enforcement/workflow-tracker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-tracker.d.ts","sourceRoot":"","sources":["../../../src/sdd/enforcement/workflow-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,aAAa;IAC5B,0DAA0D;IAC1D,QAAQ,EAAE,OAAO,CAAA;IACjB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,mDAAmD;IACnD,QAAQ,EAAE,OAAO,CAAA;IACjB,yDAAyD;IACzD,SAAS,EAAE,OAAO,CAAA;IAClB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAA;IACpB,4GAA4G;IAC5G,WAAW,EAAE,OAAO,CAAA;CACrB;AAYD,iEAAiE;AACjE,wBAAgB,kBAAkB,IAAI,IAAI,CAQzC;AAED,uCAAuC;AACvC,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAOnD;AAED,wCAAwC;AACxC,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED,oCAAoC;AACpC,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAED,yCAAyC;AACzC,wBAAgB,eAAe,CAAC,WAAW,EAAE,OAAO,GAAG,IAAI,CAE1D;AAED,2FAA2F;AAC3F,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED,wDAAwD;AACxD,wBAAgB,aAAa,IAAI,IAAI,CAOpC;AAED,gEAAgE;AAChE,wBAAgB,eAAe,IAAI;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAkBrE;AAED,6CAA6C;AAC7C,wBAAgB,gBAAgB,IAAI,QAAQ,CAAC,aAAa,CAAC,CAE1D;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,aAkGhC,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,aAQlC,CAAA;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAyBvF"}

package/dist/sdd/enforcement/workflow-tracker.js

@@ -0,0 +1,229 @@
+/**
+ * SDD Workflow State Tracker (FEAT-087/FEAT-100)
+ *
+ * Tracks whether the current agent session is inside a valid SDD workflow.
+ * Graph mutation tools (add_node, update_node, etc.) are blocked unless
+ * the session has passed through sdd.enforce or an approved Change exists.
+ *
+ * Uses module-level state (not AsyncLocalStorage) because OpenCode tools
+ * execute synchronously within a single tool-call boundary.
+ */
+const state = {
+    enforced: false,
+    changeId: null,
+    approved: false,
+    validated: false,
+    enforcedAt: 0,
+    discovering: false,
+    specUpdated: false,
+};
+/** Reset workflow state (called on session start or /sdd off) */
+export function resetWorkflowState() {
+    state.enforced = false;
+    state.changeId = null;
+    state.approved = false;
+    state.validated = false;
+    state.enforcedAt = 0;
+    state.discovering = false;
+    state.specUpdated = false;
+}
+/** Mark that sdd.enforce was called */
+export function markEnforced(changeId) {
+    state.enforced = true;
+    state.changeId = changeId;
+    state.approved = false;
+    state.validated = false;
+    state.enforcedAt = Date.now();
+    state.specUpdated = false;
+}
+/** Mark that the change was approved */
+export function markApproved() {
+    state.approved = true;
+}
+/** Mark that sdd.validate passed */
+export function markValidated() {
+    state.validated = true;
+}
+/** Mark that discovery is in progress */
+export function markDiscovering(discovering) {
+    state.discovering = discovering;
+}
+/** Mark that the SDD spec has been updated (add_node, update_node, update_from_answers) */
+export function markSpecUpdated() {
+    state.specUpdated = true;
+}
+/** Mark that the change was completed (resets state) */
+export function markCompleted() {
+    state.enforced = false;
+    state.changeId = null;
+    state.approved = false;
+    state.validated = false;
+    state.enforcedAt = 0;
+    state.specUpdated = false;
+}
+/** Check if workflow is in a valid state for graph mutations */
+export function isWorkflowValid() {
+    if (!state.enforced) {
+        return {
+            valid: false,
+            reason: "No SDD workflow active. Call sdd.enforce first to classify the change and create a Change node.",
+        };
+    }
+    // Allow a 30-minute window for workflow completion
+    const maxAge = 30 * 60 * 1000;
+    if (Date.now() - state.enforcedAt > maxAge) {
+        return {
+            valid: false,
+            reason: "SDD workflow expired (>30 min). Call sdd.enforce again.",
+        };
+    }
+    return { valid: true };
+}
+/** Get current workflow state (read-only) */
+export function getWorkflowState() {
+    return { ...state };
+}
+/**
+ * Tools that are ALLOWED without workflow context.
+ * These are read-only or workflow-entry tools.
+ */
+export const WORKFLOW_EXEMPT_TOOLS = new Set([
+    "sdd.initialize",
+    "sdd.inspect",
+    "sdd.query_graph",
+    "sdd.list_nodes",
+    "sdd.count_nodes",
+    "sdd.get_nodes_by_status",
+    "sdd.get_context",
+    "sdd.find_path",
+    "sdd.analyze_impact",
+    "sdd.validate",
+    "sdd.detect_drift",
+    "sdd.config_drift",
+    "sdd.detect_sync_conflicts",
+    "sdd.quality",
+    "sdd.contradictions",
+    "sdd.verify_usage",
+    "sdd.find_dead_code",
+    "sdd.parse_symbols",
+    "sdd.analyze_complexity",
+    "sdd.code_metrics",
+    "sdd.detect_smells",
+    "sdd.analyze_dependencies",
+    "sdd.anti_patterns",
+    "sdd.clone_detection",
+    "sdd.promises",
+    "sdd.coverage",
+    "sdd.check_compliance",
+    "sdd.security_audit",
+    "sdd.analyze_scalability",
+    "sdd.traverse_outgoing",
+    "sdd.traverse_incoming",
+    "sdd.traverse_both",
+    "sdd.get_subgraph",
+    "sdd.pending_changes",
+    "sdd.list_snapshots",
+    "sdd.sync_status",
+    "sdd.remote_status",
+    "sdd.mcp_server_info",
+    "sdd.handle_mcp_tool",
+    // Workflow entry points (start the workflow)
+    "sdd.enforce",
+    "sdd.enforce_rules",
+    "sdd.discover",
+    "sdd.update_from_answers",
+    "sdd.create_change",
+    "sdd.approve_change",
+    "sdd.complete_change",
+    "sdd.verify_implementation",
+    // Enterprise workflows (they manage their own enforcement)
+    "sdd.bug_fix",
+    "sdd.hotfix",
+    "sdd.refactoring",
+    "sdd.deprecate",
+    "sdd.create_migration",
+    "sdd.create_experiment",
+    "sdd.create_flag",
+    "sdd.create_tenant",
+    "sdd.onboard_developer",
+    "sdd.report_incident",
+    "sdd.create_sla",
+    "sdd.estimate_cost",
+    "sdd.generate_docs",
+    "sdd.knowledge_transfer",
+    "sdd.disaster_recovery_plan",
+    "sdd.setup_monitoring",
+    "sdd.generate_dashboard",
+    // Toggle and config
+    "sdd.toggle",
+    "sdd.toggle_status",
+    "sdd.constitution",
+    // Session and export
+    "sdd.session_handoff",
+    "sdd.workflow_export",
+    // Permissions
+    "sdd.load_permissions_config",
+    "sdd.save_permissions_config",
+    "sdd.check_permission",
+    "sdd.check_change_approval",
+    "sdd.set_role",
+    "sdd.get_user_role",
+    "sdd.audit_log",
+    "sdd.detect_remote",
+    // Infrastructure
+    "sdd.install_hooks",
+    "sdd.brownfield_scan",
+    "sdd.start_dashboard",
+    "sdd.generate_cicd",
+    // Sync
+    "sdd.sync_pull",
+    "sdd.sync_push",
+    "sdd.merge_graphs",
+    // Rollback
+    "sdd.rollback",
+    "sdd.rollback_history",
+    "sdd.create_snapshot",
+    // Graph build
+    "sdd.build_graph",
+]);
+/**
+ * Tools that REQUIRE workflow context (graph mutations).
+ * These modify the SDD graph and must go through the workflow.
+ */
+export const WORKFLOW_REQUIRED_TOOLS = new Set([
+    "sdd.add_node",
+    "sdd.update_node",
+    "sdd.remove_node",
+    "sdd.add_relationship",
+    "sdd.remove_relationship",
+    "sdd.generate_code",
+    "sdd.remove_dead_code",
+]);
+/**
+ * Check if a tool requires workflow context.
+ * Returns null if the tool is allowed, or an error message if blocked.
+ */
+export function checkToolAccess(toolName) {
+    // SDD tools only
+    if (!toolName.startsWith("sdd.")) {
+        return { allowed: true };
+    }
+    // Exempt tools are always allowed
+    if (WORKFLOW_EXEMPT_TOOLS.has(toolName)) {
+        return { allowed: true };
+    }
+    // Required tools need workflow context
+    if (WORKFLOW_REQUIRED_TOOLS.has(toolName)) {
+        const workflow = isWorkflowValid();
+        if (!workflow.valid) {
+            return {
+                allowed: false,
+                reason: `[SDD BLOCKED] Tool "${toolName}" requires an active SDD workflow.\n\n${workflow.reason}\n\nWorkflow: sdd.enforce → sdd.update_from_answers → sdd.approve_change → THEN use ${toolName}`,
+            };
+        }
+        return { allowed: true };
+    }
+    // Unknown SDD tools are allowed (future tools)
+    return { allowed: true };
+}
+//# sourceMappingURL=workflow-tracker.js.map