opensquid 0.5.395

package/dist/runtime/bootstrap.js

@@ -0,0 +1,381 @@
+/**
+ * Runtime bootstrap — function registry + active-pack source for hook binaries.
+ *
+ * Two entry points every hook binary imports:
+ *
+ *   - `buildRegistry()` — assembles a `FunctionRegistry` with all primitive
+ *     families registered: event / state / verdict / llm. RAG is NOT
+ *     registered here (see "RAG omission" below).
+ *
+ *   - `loadActivePacks(sessionId)` — Phase 1 test seam. Returns whatever was
+ *     last `setActivePacks(...)`'d in-process, or — for subprocess-launched
+ *     hooks — packs serialized via the `OPENSQUID_TEST_PACK` env var. Phase 2
+ *     replaces this with a real YAML loader that reads `~/.opensquid/active.json`,
+ *     resolves pack sources, parses pack YAML, and respects per-skill load
+ *     modes. The `Promise<Pack[]>` signature is pinned now so the Phase 2
+ *     swap is body-only — call sites do not refactor.
+ *
+ * RAG wiring (T-loop-engine-reintegration / T.3 — first-ever production
+ * registration of recall/embed/store_lesson):
+ *   `registerRagFunctions(registry, backend)` is now called per-bootstrap
+ *   with a backend chosen by `resolveBackendConfig()` (env > config.json >
+ *   default = loop-engine if engine binary discoverable, else libsql-qwen3).
+ *   The cost concerns that justified Phase 1 omission are resolved: the
+ *   default `loop-engine` path connects to a shared UDS daemon (T.4), so
+ *   per-hook boot cost is one socket-connect + one ping, not a full libsql
+ *   open. `buildRegistry()` becomes async to accommodate `backend.init()`
+ *   (engine handshake / libsql CREATE TABLE depending on backend). All
+ *   four hook bins already await it.
+ *
+ * Two env-var test seams (subprocess hook bridge):
+ *
+ *   `OPENSQUID_TEST_PACK` (Phase-1 legacy seam, kept for backward compat):
+ *     A JSON-encoded `Pack` object the child self-seeds at module-load.
+ *     Phase 2.7 keeps this so existing call sites and any in-flight tests
+ *     that hand-build a pack still work. Malformed JSON is silently ignored
+ *     (returns `[]`) — fail-safe, test-only. NEVER document in user docs.
+ *
+ *   `OPENSQUID_TEST_PACK_DIR` (Phase-2.7 seam, preferred):
+ *     An absolute path to an on-disk YAML pack folder (`manifest.yaml` +
+ *     `skills/*\/skill.yaml`). The child invokes the real `loadPack` from
+ *     `src/packs/loader.ts` synchronously at module load via a promise +
+ *     `await` chain handed to `loadActivePacks`. Errors are swallowed at
+ *     the same fail-safe contract as the JSON seam — a missing folder or
+ *     malformed YAML yields `[]`, surfacing as the empty-active-packs
+ *     "allow everything" path. That keeps the seam a strict superset of
+ *     Phase-1 behavior so tests can flip from inline → on-disk without
+ *     changing assertions.
+ *
+ *   Both seams compose: if `OPENSQUID_TEST_PACK_DIR` is set, its loaded
+ *   pack is appended to whatever `OPENSQUID_TEST_PACK` produced. In
+ *   practice tests use exactly one of the two.
+ *
+ * Imports from: functions/, packs/loader.
+ * Imported by: runtime/hooks/*.ts (per-hook binaries), runtime/index.ts (re-export).
+ */
+import { promises as fsp } from 'node:fs';
+import { join } from 'node:path';
+import { wedgeLessonStore } from '../rag/wedge/store.js';
+import { wedgeLessonsDbUrl, wedgeLessonsDir } from '../rag/wedge/paths.js';
+import { registerDestinationCheckFunction } from '../functions/destination_check.js';
+import { registerCachedAuditFunction } from '../functions/cached_audit.js';
+import { registerEventFunctions } from '../functions/event.js';
+import { IsAutomationMode } from '../functions/is_automation_mode.js';
+import { registerLessonFunctions } from '../functions/lessons.js';
+import { registerLlmFunctions } from '../functions/llm.js';
+import { HasActiveTask, HasGeneratedSpec, OpenTaskCount, TaskListGenerated, WorkflowPhasesComplete, } from '../functions/active_task.js';
+import { CheckFlowHealth } from '../functions/check_flow_health.js';
+import { HandoffSessionStart } from '../functions/handoff_session_start.js';
+import { SessionStatusManifest } from '../functions/session_status_manifest.js';
+import { EffectiveContent } from '../functions/effective_content.js';
+import { ChatWatcherAutostart } from '../functions/chat_watcher_autostart.js';
+import { ScopeDwellTick } from '../functions/scope_dwell.js';
+import { PathExists } from '../functions/path_exists.js';
+import { registerRagFunctions } from '../functions/rag.js';
+import { registerRecallPreInjectFunction } from '../functions/recall_pre_inject.js';
+import { FunctionRegistry } from '../functions/registry.js';
+import { SessionToolHistory } from '../functions/session_tool_history.js';
+import { registerStateFunctions } from '../functions/state.js';
+import { registerFsmFunctions } from '../functions/fsm.js';
+import { registerSubagentFunction } from '../functions/subagent.js';
+import { registerCheckChatConnectionFunction } from '../functions/check_chat_connection.js';
+import { registerEnsureUmbrellaTopicFunction } from '../functions/ensure_umbrella_topic.js';
+import { TextPatternMatch } from '../functions/text_pattern_match.js';
+import { registerVerdictFunctions } from '../functions/verdict.js';
+import { discoverActivePacks } from '../packs/discovery.js';
+import {} from './detection.js';
+import { sortPacksByScope } from '../packs/load_order.js';
+import { loadPack } from '../packs/loader.js';
+import { createBackend } from '../rag/backend_factory.js';
+import { resolveBackendConfig } from '../rag/config.js';
+import { resolveBuiltinScopeRoot, resolveProjectScopeRoot, resolveUserScopeRoot } from './paths.js';
+export async function buildRegistry(opts = {}) {
+    const r = new FunctionRegistry();
+    registerEventFunctions(r);
+    registerStateFunctions(r);
+    registerFsmFunctions(r);
+    registerVerdictFunctions(r);
+    registerLlmFunctions(r);
+    registerCachedAuditFunction(r);
+    // Phase 4: `check_destination` is the destination-side anti-drift
+    // primitive. It composes `llm_classify` (registered just above) so the
+    // ordering matters — register it last among the LLM-dependent primitives.
+    // Future destination_check rules and the Phase-4.3 scheduler call into
+    // this primitive name.
+    registerDestinationCheckFunction(r);
+    // Phase 6: `spawn_subagent` is the Mode-A orchestration primitive. SDK is
+    // loaded lazily inside the primitive (optional peer dep), so registering
+    // here adds zero startup cost when no pack actually invokes it. Tests can
+    // override the SDK via `registerSubagentFunction(r, { sdk: stub })` against
+    // a separate registry; the production bootstrap always uses the lazy
+    // dynamic-import path.
+    registerSubagentFunction(r);
+    // T-HANDOFF-HARDENING HH6.2 — `check_chat_connection` is a read-only,
+    // fail-quiet primitive that the `session-connection-check` skill calls on
+    // `session_start` to surface the project's chat-connection state (+ generic
+    // umbrella-routing-drift) as an inject_context. No backend dep → sync
+    // registration here.
+    registerCheckChatConnectionFunction(r);
+    // T-CHAT-AS-TERMINAL CAT.7 — `ensure_umbrella_topic` is the SessionStart
+    // topic-assurance ACTION (sanctioned by the remote-terminal override). On
+    // `session_start`, IF a chat daemon is live and the session's umbrella owns a
+    // telegram chat_id but ZERO topic, it creates exactly one topic via the
+    // daemon `create_topic` RPC and writes topic_id back into channels.json. Once
+    // set, it's a no-op — the umbrella↔topic ≤1:1 invariant holds by
+    // construction. Fail-quiet (never blocks session start). Default seams dial
+    // the real daemon socket; tests inject stubs via a separate registry.
+    registerEnsureUmbrellaTopicFunction(r);
+    // G.5 — text-pattern matcher + per-turn tool-call ledger reader. Both are
+    // pure (no I/O for text_pattern_match; one read for session_tool_history)
+    // so they ship pre-registered as FunctionDef objects rather than via a
+    // dedicated registrar helper. The drift skill `verify-before-citing-memory`
+    // composes them in a process: text scan → tool-history lookup → verdict.
+    r.register(TextPatternMatch);
+    r.register(SessionToolHistory);
+    // Track SD.1 — `path_exists` is a pure read-only directory scan (one
+    // readdir, no content reads, cwd-subtree-confined). It backs the
+    // `scope-decomposer` hard gate's "no pre-research artifact on disk" check.
+    // memoizable:false so the gate sees an artifact the moment the agent
+    // creates it mid-session.
+    r.register(PathExists);
+    // G.12 — `is_automation_mode` returns whether the current session is in
+    // an automation loop (env var OR `~/.opensquid/sessions/<id>/automation.flag`).
+    // Skills like `d9-guard` gate `if: 'automation.value === true'` so their
+    // Stop-event llm_classify only fires inside `/loop`-style automation,
+    // preventing the politeness-reflex prompt from interrupting normal
+    // interactive use.
+    r.register(IsAutomationMode);
+    // AP.4 — workflow-gate read-side: `has_active_task` (is a task active +
+    // its provenance track id) and `workflow_phases_complete` (all 7 REQUIRED
+    // phases logged for the LIVE active task). Both read-only, memoizable:false
+    // (active task + phase ledger change mid-session). Back the personal-pack
+    // workflow gate (rule #8) + the scope→task Gate A (AP.5).
+    r.register(HasActiveTask);
+    r.register(WorkflowPhasesComplete);
+    // AP.5 — scope→task Gate A read-side: does the active task have generator
+    // provenance (a docs/tasks spec that resolves on disk)? H7: spec is absolute
+    // (cross-repo: spec in the planning repo, code-write in another).
+    r.register(HasGeneratedSpec);
+    // AP.5 — scope→task Gate B read-side: does the WHOLE open task list have
+    // provenance (every pending/in_progress task carries metadata.taskId)? Closes
+    // Gate A's smuggled-task loophole.
+    r.register(TaskListGenerated);
+    // AF.6 — open-task count; the pause-gates derive run-active (auto-off when the
+    // backlog is depleted) from this + the FSM state.
+    r.register(OpenTaskCount);
+    // T-FLOW-UNSKIPPABLE FU.3 (D3) — SessionStart health assurance: a loud
+    // inject_context when the opensquid hooks aren't wired or no gate pack is active
+    // (the F3 silent-un-gated case). Dispatched on session_start by coding-flow's
+    // flow-health-check skill.
+    r.register(CheckFlowHealth);
+    // T-SESSION-STATUS-MANIFEST — ONE consolidated "what opensquid is connected to"
+    // report on every session begin (chat + flow + packs + daemon + engine).
+    // Dispatched on session_start by default-discipline's session-connection-check
+    // skill; supersedes the fragmented chat/flow injects (DRY: reuses
+    // flowEnforcementProblems).
+    r.register(SessionStatusManifest);
+    r.register(HandoffSessionStart);
+    // T-FLOW-AUDIT-ARTIFACT — effective post-write content so the SCOPE/AUTHOR
+    // content audits evaluate the real resulting file (Edit-safe), not the
+    // Edit-empty `tool_args.content` that broke iterative refinement.
+    r.register(EffectiveContent);
+    // T-CHAT-REALTIME — make SessionStart actually set up chat: a session_start
+    // inject_context directing the agent to start the inbound watcher (Monitor +
+    // `chat watch`) so messages arrive in real time (no turn-boundary wait, no flag).
+    r.register(ChatWatcherAutostart);
+    // T-FLOW-UNSKIPPABLE FU.2 (D2) — scope-sprawl escalation: ticks a per-session
+    // dwell counter while the FSM is in scoping/researching; the entry-and-handoffs
+    // prompt_submit rule surfaces a "converge the scope" directive at the threshold.
+    r.register(ScopeDwellTick);
+    // T-ASC ASC.5 — chain-state read primitive. Exposes the persisted T-ASC
+    // chain (stage + enrichment fields) to skill YAML `process:` chains so
+    // ASC.5's reframed scope-decomposer handoff rules can shape their
+    // directive next_action.args from the persisted stage. memoizable:false
+    // because the chain transitions mid-session via the ASC.1 writers.
+    // T-loop-engine-reintegration T.3 — FIRST-EVER production wiring of the
+    // RAG primitives. Resolves backend choice (env > ~/.opensquid/rag-config
+    // .json > default), constructs, inits, registers. Tests override via
+    // `opts.backend` to skip the resolver + a real init (which may need a
+    // live engine binary).
+    const backend = opts.backend ?? createBackend(await resolveBackendConfig());
+    await backend.init();
+    registerRagFunctions(r, backend);
+    // G.4 — `recall_pre_inject` shares the same backend handle as `recall`
+    // (no second connection). Registered immediately after RAG so the backend
+    // is guaranteed initialized; the primitive itself ignores non-prompt_submit
+    // events at the per-call boundary as a defensive guard on top of the
+    // dispatcher's skill-trigger filter.
+    registerRecallPreInjectFunction(r, backend);
+    // T-loop-engine-reintegration T.6 — wire the wedge gate lesson surface
+    // (`propose_lesson`, `promote_lesson`, `recall_lesson`). Lessons need a
+    // direct EngineClient handle (the RAG backend handles memory.* calls; the
+    // lesson.* wedge gate still routes through the engine — RES-3 will port it).
+    // Construct + init the wedge lesson store (libSQL + per-file source), then
+    // register the lesson primitives against it. Tests pass `lessonStore: null`
+    // to skip registration; `lessonStore: <stub>` to inject a store.
+    if (opts.lessonStore !== null) {
+        const store = opts.lessonStore ??
+            wedgeLessonStore({ dbUrl: wedgeLessonsDbUrl(), sourceDir: wedgeLessonsDir() });
+        await store.init();
+        registerLessonFunctions(r, store);
+    }
+    return r;
+}
+// ---------------------------------------------------------------------------
+// Active packs — three composing sources (G.1 lands the third one).
+//
+//   1. Test seam: `OPENSQUID_TEST_PACK`     (inline JSON pack object)
+//   2. Test seam: `OPENSQUID_TEST_PACK_DIR` (path to a pack folder)
+//   3. Real loader: user-scope + project-scope `active.json` (G.1)
+//
+// The two test seams keep their fail-OPEN contract verbatim — fixtures are
+// opensquid-authored, so a malformed fixture stays a test bug and shouldn't
+// crash the hook binary mid-tool-call. The real loader path (3) fails LOUD
+// per `project_opensquid_runtime_failure_handling` — user-authored config
+// bugs must surface, not silent-fail to the "allow everything" path.
+//
+// Composition order in `loadActivePacks`:
+//   in-process override (`setActivePacks`) → env seam → disk seam → real on-disk
+//
+// `setActivePacks` is the test override that completely replaces the
+// in-process list; env+disk+real compose by concatenation. The real-loader
+// output is run through `sortPacksByScope` to land 5-tier scope ordering
+// across user-scope + project-scope packs; the test seams are NOT sorted
+// because tests want to assert exact insertion order.
+// ---------------------------------------------------------------------------
+function loadFromEnv() {
+    const raw = process.env.OPENSQUID_TEST_PACK;
+    if (raw === undefined || raw === '')
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        // Trust shape at this seam — the test pack is opensquid-authored, and
+        // mis-shaped input surfaces immediately as the evaluator rejects rules
+        // it can't parse. A full Zod parse here would force a circular import
+        // (types.ts -> bootstrap.ts -> types.ts) for zero benefit.
+        return [parsed];
+    }
+    catch {
+        return [];
+    }
+}
+// Sync constant — the JSON env-var path is read at module load (no I/O).
+const envPacks = loadFromEnv();
+// Async test seam — the on-disk YAML path requires fs reads. Resolved at
+// module load too; `loadActivePacks` awaits the same promise on every call
+// so the load happens exactly once per hook subprocess. Errors are swallowed
+// per the seam contract (see header) — a broken fixture yields the empty
+// "allow everything" path rather than crashing the hook binary mid-tool-call.
+const diskPacksPromise = (async () => {
+    const dir = process.env.OPENSQUID_TEST_PACK_DIR;
+    if (dir === undefined || dir === '')
+        return [];
+    try {
+        return [await loadPack(dir)];
+    }
+    catch {
+        return [];
+    }
+})();
+// G.1 — real on-disk loader. Composes both installation scopes:
+//   - user scope: `~/.opensquid/` (via `resolveUserScopeRoot()`)
+//   - project scope: walked up from `process.cwd()` (via
+//     `resolveProjectScopeRoot(...)`); `null` when no `.opensquid/` exists
+//     in or above cwd, in which case `discoverActivePacks` returns `[]`.
+//
+// Fail-LOUD: any thrown error from `discoverActivePacks` (malformed
+// active.json, missing pack folder, broken manifest.yaml) is rethrown
+// after a stderr blame line so the user can see WHICH file is wrong. This
+// is the diametric opposite of the two test seams above, which fail-OPEN.
+//
+// One-shot resolution at module load: hooks run as short-lived subprocesses,
+// so we pay the disk-read cost once per hook invocation, not once per call.
+const realPacksPromise = (async () => {
+    try {
+        const cwd = process.cwd();
+        // IDF.3 — pre-stage a DetectionContext from cwd so opted-in packs
+        // with `detected_by[]` clauses gate their load on the current
+        // project signals. Opt-in is still required (packs not in
+        // active.json never load); detected_by gates WHEN among opt-in.
+        const ctx = await buildDetectionContext(cwd);
+        // BPDISC — resolve the built-in pack root so discoverActivePacks can
+        // fall back to `<npm-install>/packs/builtin/<name>/` when an active.json
+        // entry isn't installed at user / project scope. Without this fallback,
+        // listing a built-in pack name in active.json (default-discipline,
+        // scope-architect, focused-react-19, ...) ENOENT-crashes the hook.
+        const builtinRoot = resolveBuiltinScopeRoot();
+        const user = await discoverActivePacks(resolveUserScopeRoot(), ctx, builtinRoot);
+        const projectRoot = await resolveProjectScopeRoot(cwd);
+        const project = await discoverActivePacks(projectRoot, ctx, builtinRoot);
+        return sortPacksByScope([...user, ...project]);
+    }
+    catch (e) {
+        // Surface the path-bearing error to stderr so the user can act on it,
+        // then rethrow. The hook binary's top-level `main().catch(...)` is
+        // fail-OPEN (exit 0 with stderr) so this never blocks the parent
+        // agent — but the user sees the message and can fix the config.
+        process.stderr.write(`[opensquid] active pack load failed: ${e.message}\n`);
+        throw e;
+    }
+})();
+/**
+ * IDF.3 — pre-stage a `DetectionContext` from the current cwd. Reads
+ * existence flags for well-known files + parses package.json/tsconfig.json/
+ * Cargo.toml contents so `detected_by` `file_match`/`file_exists` clauses
+ * can evaluate without I/O at the dispatch layer.
+ *
+ * Perf budget (per IDF.3 spec risk callout): the real loader runs ONCE
+ * per hook subprocess (module-load `realPacksPromise`), so this fn pays
+ * its disk cost exactly once. No recursive walk in this version — IDF.3
+ * ships the eager well-known-file path; deeper traversal + memory recall
+ * are deferred follow-ups. memoryBodies + recentPrompts + userPinned
+ * stay empty/false — populated by Phase 2/3 work.
+ */
+async function buildDetectionContext(cwd) {
+    const files = {};
+    const fileContents = {};
+    const wellKnown = [
+        'package.json',
+        'tsconfig.json',
+        'Cargo.toml',
+        'pyproject.toml',
+        'go.mod',
+    ];
+    for (const name of wellKnown) {
+        try {
+            const body = await fsp.readFile(join(cwd, name), 'utf8');
+            fileContents[name] = body;
+            files[name] = true;
+        }
+        catch {
+            // missing file — leave maps absent
+        }
+    }
+    return {
+        cwd,
+        files,
+        dirs: {},
+        fileContents,
+        memoryBodies: '',
+        recentPrompts: '',
+        userPinned: false,
+    };
+}
+let activePacks = envPacks;
+export function setActivePacks(packs) {
+    activePacks = packs;
+}
+/**
+ * Returns the composed active-pack list for this hook subprocess.
+ *
+ * Order: in-process override (`setActivePacks`) wins outright; on top of
+ * that the env-var JSON seam, the disk-YAML seam, and the real on-disk
+ * loader compose by concatenation. Real-loader output is scope-sorted
+ * before concat; test-seam packs preserve insertion order so tests can
+ * assert specific positioning.
+ */
+export async function loadActivePacks(_sessionId) {
+    const [disk, real] = await Promise.all([diskPacksPromise, realPacksPromise]);
+    return [...activePacks, ...disk, ...real];
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/runtime/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAyB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAyB,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAqBpG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA0B,EAAE;IAC9D,MAAM,CAAC,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACjC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC1B,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC1B,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACxB,wBAAwB,CAAC,CAAC,CAAC,CAAC;IAC5B,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACxB,2BAA2B,CAAC,CAAC,CAAC,CAAC;IAC/B,kEAAkE;IAClE,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,uBAAuB;IACvB,gCAAgC,CAAC,CAAC,CAAC,CAAC;IACpC,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,qEAAqE;IACrE,uBAAuB;IACvB,wBAAwB,CAAC,CAAC,CAAC,CAAC;IAC5B,sEAAsE;IACtE,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,qBAAqB;IACrB,mCAAmC,CAAC,CAAC,CAAC,CAAC;IACvC,yEAAyE;IACzE,0EAA0E;IAC1E,8EAA8E;IAC9E,wEAAwE;IACxE,8EAA8E;IAC9E,iEAAiE;IACjE,4EAA4E;IAC5E,sEAAsE;IACtE,mCAAmC,CAAC,CAAC,CAAC,CAAC;IACvC,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC7B,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC/B,qEAAqE;IACrE,iEAAiE;IACjE,2EAA2E;IAC3E,qEAAqE;IACrE,0BAA0B;IAC1B,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvB,wEAAwE;IACxE,gFAAgF;IAChF,yEAAyE;IACzE,sEAAsE;IACtE,mEAAmE;IACnE,mBAAmB;IACnB,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC7B,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,0DAA0D;IAC1D,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC1B,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACnC,0EAA0E;IAC1E,6EAA6E;IAC7E,kEAAkE;IAClE,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC7B,yEAAyE;IACzE,8EAA8E;IAC9E,mCAAmC;IACnC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC9B,+EAA+E;IAC/E,kDAAkD;IAClD,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC1B,uEAAuE;IACvE,iFAAiF;IACjF,8EAA8E;IAC9E,2BAA2B;IAC3B,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC5B,gFAAgF;IAChF,yEAAyE;IACzE,+EAA+E;IAC/E,kEAAkE;IAClE,4BAA4B;IAC5B,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAClC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAChC,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC7B,4EAA4E;IAC5E,6EAA6E;IAC7E,kFAAkF;IAClF,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IACjC,8EAA8E;IAC9E,gFAAgF;IAChF,iFAAiF;IACjF,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC3B,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,mEAAmE;IACnE,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,sEAAsE;IACtE,uBAAuB;IACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACrB,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,qEAAqE;IACrE,qCAAqC;IACrC,+BAA+B,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAE5C,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,KAAK,GACT,IAAI,CAAC,WAAW;YAChB,gBAAgB,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QACjF,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,uBAAuB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,oEAAoE;AACpE,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,mEAAmE;AACnE,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,qEAAqE;AACrE,EAAE;AACF,0CAA0C;AAC1C,iFAAiF;AACjF,EAAE;AACF,qEAAqE;AACrE,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,sDAAsD;AACtD,8EAA8E;AAE9E,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC5C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,2DAA2D;QAC3D,OAAO,CAAC,MAAc,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,QAAQ,GAAW,WAAW,EAAE,CAAC;AAEvC,yEAAyE;AACzE,2EAA2E;AAC3E,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,MAAM,gBAAgB,GAAoB,CAAC,KAAK,IAAI,EAAE;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,gEAAgE;AAChE,iEAAiE;AACjE,yDAAyD;AACzD,2EAA2E;AAC3E,yEAAyE;AACzE,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,0EAA0E;AAC1E,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,gBAAgB,GAAoB,CAAC,KAAK,IAAI,EAAE;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,kEAAkE;QAClE,8DAA8D;QAC9D,0DAA0D;QAC1D,gEAAgE;QAChE,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7C,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,WAAW,GAAG,uBAAuB,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QACjF,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QACzE,OAAO,gBAAgB,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,sEAAsE;QACtE,mEAAmE;QACnE,iEAAiE;QACjE,gEAAgE;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAyC,CAAW,CAAC,OAAO,IAAI,CAAC,CAAC;QACvF,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAW;IAC9C,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,YAAY,GAA2B,EAAE,CAAC;IAEhD,MAAM,SAAS,GAAG;QAChB,cAAc;QACd,eAAe;QACf,YAAY;QACZ,gBAAgB;QAChB,QAAQ;KACA,CAAC;IACX,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACzD,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,KAAK;QACL,IAAI,EAAE,EAAE;QACR,YAAY;QACZ,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,KAAK;KAClB,CAAC;AACJ,CAAC;AAED,IAAI,WAAW,GAAW,QAAQ,CAAC;AAEnC,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkB;IACtD,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/dist/runtime/builtin_denylist.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Sealed built-in denylist for the capability gate (AUTO.3).
+ * Spec: `docs/tasks/automation.md` AUTO.3 risk callouts.
+ *
+ * Value-only constants file. Exports are `Object.freeze`d so a misbehaving
+ * consumer can't monkey-patch at runtime (the audit constraint demands the
+ * built-in denylist be sealed; no `BUILTIN_SHELL_DENY.push(...)` escape).
+ *
+ * Escape hatch: env var `OPENSQUID_TRUST_BUILTIN_DENY=0` disables the
+ * entire built-in denylist at gate construction time. The gate snapshots
+ * the env once in its constructor; it can't be flipped mid-session.
+ *
+ * Channel + binary built-in denies are empty by design — shell + path
+ * cover the high-risk surface; channels/binaries are user-defined.
+ *
+ * Imported by: src/runtime/capability_gate.ts.
+ */
+export declare const BUILTIN_SHELL_DENY: readonly RegExp[];
+export declare const SHELL_METACHARACTERS: readonly string[];
+export declare const BUILTIN_PATH_DENY: readonly string[];
+export declare const BUILTIN_CHANNEL_DENY: readonly string[];
+export declare const BUILTIN_BINARY_DENY: readonly string[];
+export declare const BUILTIN_SUBAGENT_DENY: readonly string[];
+export declare function trustBuiltinDeny(env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=builtin_denylist.d.ts.map

package/dist/runtime/builtin_denylist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin_denylist.d.ts","sourceRoot":"","sources":["../../src/runtime/builtin_denylist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAyBrC,CAAC;AAOZ,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAUvC,CAAC;AAKZ,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAkBpC,CAAC;AAQZ,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAA+B,CAAC;AAClF,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAA+B,CAAC;AACjF,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAA+B,CAAC;AAInF,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE9E"}

package/dist/runtime/builtin_denylist.js

@@ -0,0 +1,98 @@
+/**
+ * Sealed built-in denylist for the capability gate (AUTO.3).
+ * Spec: `docs/tasks/automation.md` AUTO.3 risk callouts.
+ *
+ * Value-only constants file. Exports are `Object.freeze`d so a misbehaving
+ * consumer can't monkey-patch at runtime (the audit constraint demands the
+ * built-in denylist be sealed; no `BUILTIN_SHELL_DENY.push(...)` escape).
+ *
+ * Escape hatch: env var `OPENSQUID_TRUST_BUILTIN_DENY=0` disables the
+ * entire built-in denylist at gate construction time. The gate snapshots
+ * the env once in its constructor; it can't be flipped mid-session.
+ *
+ * Channel + binary built-in denies are empty by design — shell + path
+ * cover the high-risk surface; channels/binaries are user-defined.
+ *
+ * Imported by: src/runtime/capability_gate.ts.
+ */
+// Shell-command denylist — regex matched against the raw command. Patterns
+// are case-sensitive (POSIX commands are lowercase) and use `\s+` so
+// tab/multi-space invocations still trip. No `^`/`$` anchors so substring
+// matches fire (`cd /tmp && rm -rf /` triggers).
+export const BUILTIN_SHELL_DENY = Object.freeze([
+    // rm -rf at root: /, /*, /<anything>
+    /\brm\s+-rf\s+\/(?:\s|$|\*)/,
+    // rm -rf with --no-preserve-root (deliberate root wipe)
+    /\brm\s+-rf\s+--no-preserve-root\b/,
+    // Fork bomb — match the canonical :(){...}; structure
+    /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/,
+    // dd from /dev/{zero,random,urandom} to /dev/sd* (real disk wipe)
+    /\bdd\s+(?:[^|;&]*\s+)?if=\/dev\/(?:zero|random|urandom)\s+(?:[^|;&]*\s+)?of=\/dev\/sd/,
+    // Redirect > /dev/sd*
+    />\s*\/dev\/sd[a-z]/,
+    // World-writable chmod (777) including recursive
+    /\bchmod\s+(?:-R\s+)?(?:[ugoa]*[=+]\s*)?(?:[ugoa]*7+\s|7{3,4}\s|7{3,4}$)/,
+    // chmod 777 form
+    /\bchmod\s+(?:-R\s+)?[0-7]?777\b/,
+    // curl ... | sh|bash|zsh — pipe-to-shell installer pattern
+    /\bcurl\s+[^|;&]+\|\s*(?:sh|bash|zsh)\b/,
+    // wget ... | sh|bash|zsh
+    /\bwget\s+[^|;&]+\|\s*(?:sh|bash|zsh)\b/,
+    // eval $(...) — command substitution into eval
+    /\beval\s+["']?\$\(/,
+    // mkfs on /dev/sd* — filesystem-format-on-disk
+    /\bmkfs(?:\.[a-z0-9]+)?\s+\/dev\/sd/,
+    // shutdown / halt / poweroff / reboot — host-destructive
+    /\b(?:shutdown|halt|poweroff|reboot)\s+(?:-[a-z]+\s+)*(?:now|0|-h\s+now)\b/,
+]);
+// Shell metacharacters the gate rejects unless the exact raw command is in
+// the pack's allowlist (per AUTO.3 spec; SEC.4 ships full shell-quote argv
+// parser). `|` included even though pipes are legitimate — gate can't tell
+// `git log | head` (safe) from `curl | sh` (built-in deny) at this layer.
+export const SHELL_METACHARACTERS = Object.freeze([
+    ';',
+    '&&',
+    '||',
+    '`',
+    '$(',
+    '|',
+    '>',
+    '>>',
+    '<(',
+]);
+// Path denylist — minimatch globs. `~/` is expanded by the gate to
+// `os.homedir()` BEFORE matching, so we can use the literal `~/` here.
+export const BUILTIN_PATH_DENY = Object.freeze([
+    '/etc/**',
+    '/usr/**',
+    '/bin/**',
+    '/sbin/**',
+    '/boot/**',
+    '/System/**', // macOS protected
+    '/Library/**', // macOS protected (user has ~/Library which is fine)
+    '/dev/**',
+    '/proc/**',
+    '/sys/**',
+    '~/.ssh/**',
+    '~/.aws/credentials',
+    '~/.aws/config',
+    '~/.config/op/**', // 1Password CLI state
+    '~/.kube/config',
+    '~/.gnupg/**',
+    '~/.docker/config.json',
+]);
+// NOTE: `/var/**` and `/private/**` are intentionally excluded — macOS
+// tmpdir is `/var/folders/...` and `/private/var/folders/...`, both
+// user-writable scratch space. High-risk subpaths within /var (log,
+// run, spool) are rarely skill-write targets; packs can deny them.
+// Channel + binary + subagent built-in denies stay empty — packs declare via
+// `permissions.<cap>.deny:`. Frozen for sealed-module discipline.
+export const BUILTIN_CHANNEL_DENY = Object.freeze([]);
+export const BUILTIN_BINARY_DENY = Object.freeze([]);
+export const BUILTIN_SUBAGENT_DENY = Object.freeze([]);
+// Env-var snapshot. Gate copies into its constructor so a mid-session env
+// mutation can't flip policy under a running pack.
+export function trustBuiltinDeny(env = process.env) {
+    return env.OPENSQUID_TRUST_BUILTIN_DENY !== '0';
+}
+//# sourceMappingURL=builtin_denylist.js.map

package/dist/runtime/builtin_denylist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin_denylist.js","sourceRoot":"","sources":["../../src/runtime/builtin_denylist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,2EAA2E;AAC3E,qEAAqE;AACrE,0EAA0E;AAC1E,iDAAiD;AAEjD,MAAM,CAAC,MAAM,kBAAkB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACjE,qCAAqC;IACrC,4BAA4B;IAC5B,wDAAwD;IACxD,mCAAmC;IACnC,sDAAsD;IACtD,gDAAgD;IAChD,kEAAkE;IAClE,uFAAuF;IACvF,sBAAsB;IACtB,oBAAoB;IACpB,iDAAiD;IACjD,yEAAyE;IACzE,iBAAiB;IACjB,iCAAiC;IACjC,2DAA2D;IAC3D,wCAAwC;IACxC,yBAAyB;IACzB,wCAAwC;IACxC,+CAA+C;IAC/C,oBAAoB;IACpB,+CAA+C;IAC/C,oCAAoC;IACpC,yDAAyD;IACzD,2EAA2E;CACnE,CAAC,CAAC;AAEZ,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAE1E,MAAM,CAAC,MAAM,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACnE,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,GAAG;IACH,GAAG;IACH,IAAI;IACJ,IAAI;CACI,CAAC,CAAC;AAEZ,mEAAmE;AACnE,uEAAuE;AAEvE,MAAM,CAAC,MAAM,iBAAiB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAChE,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,UAAU;IACV,YAAY,EAAE,kBAAkB;IAChC,aAAa,EAAE,qDAAqD;IACpE,SAAS;IACT,UAAU;IACV,SAAS;IACT,WAAW;IACX,oBAAoB;IACpB,eAAe;IACf,iBAAiB,EAAE,sBAAsB;IACzC,gBAAgB;IAChB,aAAa;IACb,uBAAuB;CACf,CAAC,CAAC;AACZ,uEAAuE;AACvE,oEAAoE;AACpE,oEAAoE;AACpE,mEAAmE;AAEnE,6EAA6E;AAC7E,kEAAkE;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAAC,EAAW,CAAC,CAAC;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,MAAM,CAAC,EAAW,CAAC,CAAC;AACjF,MAAM,CAAC,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC,EAAW,CAAC,CAAC;AAEnF,0EAA0E;AAC1E,mDAAmD;AACnD,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,OAAO,GAAG,CAAC,4BAA4B,KAAK,GAAG,CAAC;AAClD,CAAC"}

package/dist/runtime/capability_gate.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Capability gate (AUTO.3) — POSIX-style declared-capability check.
+ * Spec: `docs/tasks/automation.md` AUTO.3.
+ *
+ * Precedence: builtin-deny → pack-deny → pack-allow → prompt → deny+audit.
+ * Engine-vocabulary: gate speaks in `(pack, capability, target)` only.
+ *
+ * Risk postures (locked at AUTO.3):
+ *   - Shell metacharacters (`; && || $() backticks | > >> <(`) blanket-
+ *     reject unless the exact raw command is in the allowlist; SEC.4 ships
+ *     full `shell-quote` argv parser.
+ *   - HTTP allowlist match is on `new URL(target).hostname` (never glob on
+ *     raw URL — foot-gun: `api.github.com.attacker.com`).
+ *   - Parse failures + prompt-throw + audit-throw all DENY (constraint C10).
+ *
+ * Audit: every verdict flows through `auditLog`. CLI.5 lands the libsql
+ * `audit_log` table; AUTO.3 ships the interface (no-op default).
+ */
+import type { Capability, PermissionsType } from '../packs/schemas/index.js';
+export interface CapabilityRequest {
+    pack: string;
+    capability: Capability;
+    target: string;
+    method?: string;
+    context?: Record<string, unknown>;
+}
+export interface CapabilityVerdict {
+    allowed: boolean;
+    source: 'declared' | 'user_approved' | 'user_override' | 'denied' | 'denylist';
+    message?: string;
+}
+export type PromptCallback = (req: CapabilityRequest) => Promise<boolean>;
+export type AuditLog = (verdict: CapabilityVerdict, req: CapabilityRequest) => void;
+export interface PackPermissions {
+    name: string;
+    permissions?: PermissionsType;
+}
+/**
+ * User-side capability override (CLI.4). Persisted in
+ * `~/.opensquid/permission_overrides.yaml` and merged into the gate by
+ * `applyOverrides()` (see `src/setup/cli/permissions_state.ts`).
+ *
+ * Each override grants `(pack, capability, target-glob)`. The CLI is
+ * forbidden from persisting overrides that match the built-in denylist —
+ * the gate still applies its built-in deny FIRST, so even a malicious
+ * write to the overrides file can never escape the sealed denylist
+ * unless `OPENSQUID_TRUST_BUILTIN_DENY=0` is set.
+ */
+export interface UserOverride {
+    pack: string;
+    capability: Capability;
+    target: string;
+}
+export interface CapabilityGateOpts {
+    packs: Map<string, PackPermissions>;
+    prompt?: PromptCallback;
+    auditLog?: AuditLog;
+    /** Snapshot of env-var trust flag (constant per-instance). */
+    trustBuiltinDeny?: boolean;
+    /** Override `~/...` expansion target (defaults to os.homedir()). */
+    homeDir?: string;
+    /**
+     * User-side overrides (CLI.4). Applied AFTER built-in deny + pack
+     * deny, BEFORE pack allowlist. Override-matched verdicts carry
+     * `source: 'user_override'` for audit-log triage.
+     */
+    overrides?: readonly UserOverride[];
+}
+export declare class CapabilityGate {
+    private readonly packs;
+    private readonly prompt;
+    private readonly auditLogFn;
+    private readonly trustBuiltinDeny;
+    private readonly homeDir;
+    private readonly overrides;
+    constructor(opts: CapabilityGateOpts);
+    check(req: CapabilityRequest): Promise<CapabilityVerdict>;
+    private matchOverride;
+    private matchBuiltinDeny;
+    private matchPackDeny;
+    private matchPathList;
+    private matchAllowlist;
+    private handleUndeclared;
+    private audit;
+}
+//# sourceMappingURL=capability_gate.d.ts.map

package/dist/runtime/capability_gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability_gate.d.ts","sourceRoot":"","sources":["../../src/runtime/capability_gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,KAAK,EACV,UAAU,EAGV,eAAe,EAKhB,MAAM,2BAA2B,CAAC;AAcnC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,UAAU,GAAG,eAAe,GAAG,eAAe,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAC1E,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,KAAK,IAAI,CAAC;AAEpF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CACrC;AAgCD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAW;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;gBAExC,IAAI,EAAE,kBAAkB;IAS9B,KAAK,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAiC/D,OAAO,CAAC,aAAa;IA+CrB,OAAO,CAAC,gBAAgB;IA0BxB,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,aAAa;IAWrB,OAAO,CAAC,cAAc;YAkDR,gBAAgB;IAwB9B,OAAO,CAAC,KAAK;CAQd"}