patchwork-os 0.2.0-beta.9.canary.92 → 1.1.0-beta.1

package/dist/workers/worker.js

@@ -0,0 +1,88 @@
+import { DEFAULT_PRIOR, priorFromCompetence, } from "./trustLevel.js";
+/**
+ * A worker manifest. Deliberately NOT a fork of the recipe schema — the recipe
+ * is the worker's *body* (triggers + steps); this manifest adds identity, the
+ * action-classes it owns, a trust prior, and the policy autonomy ceiling. It
+ * references a recipe by name rather than redefining execution. (worker-ramp-v0)
+ */
+const WORKER_ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+export class WorkerParseError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "WorkerParseError";
+    }
+}
+function reqString(o, key) {
+    const v = o[key];
+    if (typeof v !== "string" || !v)
+        throw new WorkerParseError(`worker.${key} must be a non-empty string`);
+    return v;
+}
+export function parseWorker(raw) {
+    if (typeof raw !== "object" || raw === null)
+        throw new WorkerParseError("worker must be an object");
+    const r = raw;
+    const id = reqString(r, "id");
+    if (!WORKER_ID_RE.test(id))
+        throw new WorkerParseError(`worker.id must be kebab-case (got ${JSON.stringify(id)})`);
+    const name = reqString(r, "name");
+    const owns = Array.isArray(r.owns)
+        ? r.owns.filter((x) => typeof x === "string")
+        : [];
+    const responsibilities = Array.isArray(r.responsibilities)
+        ? r.responsibilities.filter((x) => typeof x === "string")
+        : [];
+    // autonomyCeiling: 0–4, default 4 (uncapped).
+    let autonomyCeiling = 4;
+    if (r.autonomyCeiling !== undefined) {
+        const c = r.autonomyCeiling;
+        if (typeof c !== "number" || !Number.isInteger(c) || c < 0 || c > 4)
+            throw new WorkerParseError("worker.autonomyCeiling must be an integer 0–4");
+        autonomyCeiling = c;
+    }
+    let competence;
+    if (r.competence !== undefined) {
+        const c = r.competence;
+        if (typeof c !== "object" ||
+            c === null ||
+            typeof c.mean !== "number" ||
+            !Number.isFinite(c.mean) ||
+            typeof c.strength !== "number" ||
+            !Number.isFinite(c.strength))
+            throw new WorkerParseError("worker.competence must be { mean: number, strength: number } (finite values)");
+        if (c.mean < 0 || c.mean > 1)
+            throw new WorkerParseError("worker.competence.mean must be in [0,1]");
+        competence = { mean: c.mean, strength: c.strength };
+    }
+    return {
+        id,
+        name,
+        responsibilities,
+        recipe: typeof r.recipe === "string" ? r.recipe : undefined,
+        owns,
+        autonomyCeiling,
+        competence,
+        sector: typeof r.sector === "string" ? r.sector : undefined,
+    };
+}
+/** The per-class trust prior for a worker (its shipped competence, or uniform). */
+export function priorFor(worker) {
+    return worker.competence
+        ? priorFromCompetence(worker.competence.mean, worker.competence.strength)
+        : DEFAULT_PRIOR;
+}
+/** Whether a worker is responsible for a given action-class. A pattern matches
+ * the class domain, an exact key, or a key prefix. Empty `owns` ⇒ owns nothing. */
+export function ownsAction(worker, ac) {
+    return worker.owns.some((p) => p === ac.domain || p === ac.key || ac.key.startsWith(`${p}:`));
+}
+/**
+ * Ownership check against a raw class key (`domain:reversibility:blastTier`),
+ * for callers that have a board row's `classKey` but not a full ActionClass
+ * (e.g. the dial). Mirrors `ownsAction`: the domain is the key's first segment.
+ */
+export function ownsClassKey(worker, classKey) {
+    const domain = classKey.split(":")[0];
+    return worker.owns.some((p) => p === domain || p === classKey || classKey.startsWith(`${p}:`));
+}
+//# sourceMappingURL=worker.js.map

package/dist/workers/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/workers/worker.ts"],"names":[],"mappings":"AACA,OAAO,EACL,aAAa,EAEb,mBAAmB,GAEpB,MAAM,iBAAiB,CAAC;AAEzB;;;;;GAKG;AAEH,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAoCjD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,SAAS,SAAS,CAAC,CAA0B,EAAE,GAAW;IACxD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,gBAAgB,CAAC,UAAU,GAAG,6BAA6B,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QACzC,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CACxB,qCAAqC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAC3D,CAAC;IACJ,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAElC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC1D,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACxD,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACtE,CAAC,CAAC,EAAE,CAAC;IAEP,8CAA8C;IAC9C,IAAI,eAAe,GAAe,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC;QAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YACjE,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,CAChD,CAAC;QACJ,eAAe,GAAG,CAAe,CAAC;IACpC,CAAC;IAED,IAAI,UAAwC,CAAC;IAC7C,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,UAAqC,CAAC;QAClD,IACE,OAAO,CAAC,KAAK,QAAQ;YACrB,CAAC,KAAK,IAAI;YACV,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAC1B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YACxB,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAE5B,MAAM,IAAI,gBAAgB,CACxB,8EAA8E,CAC/E,CAAC;QACJ,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;YAC1B,MAAM,IAAI,gBAAgB,CAAC,yCAAyC,CAAC,CAAC;QACxE,UAAU,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC;IAED,OAAO;QACL,EAAE;QACF,IAAI;QACJ,gBAAgB;QAChB,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC3D,IAAI;QACJ,eAAe;QACf,UAAU;QACV,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KAC5D,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,QAAQ,CAAC,MAAsB;IAC7C,OAAO,MAAM,CAAC,UAAU;QACtB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzE,CAAC,CAAC,aAAa,CAAC;AACpB,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,UAAU,CAAC,MAAsB,EAAE,EAAe;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAsB,EACtB,QAAgB;IAEhB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CACtE,CAAC;AACJ,CAAC"}

package/dist/workers/workerGate.d.ts

@@ -0,0 +1,101 @@
+import { type ActionClass } from "./actionClass.js";
+import { type ContextRisk } from "./contextRisk.js";
+import type { TrustLevel } from "./trustLevel.js";
+import { type WorkerManifest } from "./worker.js";
+import type { WorkerLevelStore } from "./workerLevelStore.js";
+/**
+ * The LIVE worker-autonomy decision (worker-ramp-v0, phase 2). Unlike
+ * `shadowGate.recommend` — which reports queue/bypass purely for the dial — this
+ * is what the approval gate ACTS on when the `worker.autonomy` flag is enabled.
+ *
+ * The rule is reversibility-scoped, deliberately. Pure "gate everything the
+ * worker hasn't earned L4 on" is correct-but-unusable: a brand-new worker would
+ * halt on EVERY action for the weeks it takes to accumulate evidence (the
+ * evidence-latency reality). Reversibility is the ramp's primary axis, so it is
+ * the gate's too:
+ *
+ *   - REVERSIBLE actions flow un-gated regardless of earned level. They are
+ *     undoable (transactions + WriteEffectLedger, git reset/reflog, re-runnable
+ *     CI) so the cost of being wrong is bounded — undo it. Blast tier still
+ *     drives the FAILURE WEIGHT, so a big reversible mistake demotes the worker
+ *     hard; it just isn't pre-gated. This is the routine work (read, local
+ *     commit, ledgered file write) a new worker should simply do.
+ *   - COMPENSABLE / IRREVERSIBLE actions (lossy or no undo — remote push, PR,
+ *     merge, outbound message, http POST, shell, delete) are gated for human
+ *     approval until the worker has EARNED (ceiling-capped) L4 trust on that
+ *     exact action-class. This is the "stop and ask before the dangerous thing"
+ *     behaviour of a trustworthy new employee.
+ *
+ * The decision NEVER widens access on its own: when the flag is off the gate
+ * path this feeds is not engaged at all, and even on, a "gate" result only ever
+ * routes an action to the EXISTING human-approval queue (fail-closed) — it never
+ * auto-approves anything that would otherwise have been queued by tier policy.
+ */
+export type WorkerGateAction = "allow" | "gate";
+export interface WorkerGateDecision {
+    action: WorkerGateAction;
+    classKey: string;
+    domain: string;
+    owned: boolean;
+    blastTier: ActionClass["blastTier"];
+    reversibility: ActionClass["reversibility"];
+    /** Trust actually earned on this class (for logging / the dial). */
+    earnedLevel: TrustLevel;
+    autonomyCeiling: TrustLevel;
+    /** What the gate operates at: min(earned, ceiling, contextCeiling), 0 if not
+     *  owned. */
+    effectiveLevel: TrustLevel;
+    /** The descending ceiling imposed by live context-risk (4 = no de-rate).
+     *  Present only when a contextRisk was supplied. Diagnostic / audit. */
+    contextCeiling?: TrustLevel;
+    reason: string;
+}
+/** Optional, descending-only signals that fold into the autonomy decision
+ *  alongside earned trust (the keystone seam — see
+ *  docs/worker-autonomy-policy-gate.md). All absent ⇒ byte-identical to the
+ *  earned-trust-only gate. New signals may only LOWER autonomy, never raise it. */
+export interface AutonomyDecisionOpts {
+    /** Live situational risk for THIS action (fast, day-1, no cold-start). */
+    contextRisk?: ContextRisk;
+}
+/** The gate-policy version stamped on every persisted decision (the threshold
+ *  constants + composition rule below). A decision can't be replayed/explained
+ *  without knowing which policy produced it — bump when the thresholds or the
+ *  reversibility→level mapping change. */
+export declare const GATE_POLICY_VERSION = "worker-ramp-v0";
+/**
+ * Undoable → flows un-gated even when unearned. Only reversible actions are
+ * exempt from the trust requirement; compensable ones graduate to autonomous
+ * at L2+; irreversible ones wait for earned L4.
+ */
+export declare function flowsUngated(ac: ActionClass): boolean;
+export declare function decideWorkerAction(worker: WorkerManifest, toolName: string, params: Record<string, unknown> | undefined, store: WorkerLevelStore, opts?: AutonomyDecisionOpts): WorkerGateDecision;
+/**
+ * Tools a worker's AGENT step must be barred from calling.
+ *
+ * An `agent` step spawns a Claude subprocess whose INTERNAL tool calls bypass
+ * the per-step worker gate (only recipe *steps* pass through `decideWorkerAction`
+ * — tools the subprocess invokes itself never do). Without this, a worker could
+ * do via its agent exactly the risky action (`gitPush`, `githubMergePR`,
+ * `slackPostMessage`, `runCommand`, …) the gate would otherwise have queued for
+ * approval. We re-apply the gate as a subprocess sandbox: every tool the worker
+ * cannot currently run autonomously (`decideWorkerAction → "gate"`) is added to
+ * the subprocess's `--disallowed-tools`.
+ *
+ * Honours the live trust state AND the autonomy ceiling (both fold into
+ * `decideWorkerAction`'s `effectiveLevel = min(earned, ceiling)`): reversible
+ * tools and risky tools the worker has EARNED stay callable; everything else is
+ * blocked. The universe is the canonical tool registry (TIER_MAP keys); params
+ * are unknown at sandbox-build time, so each tool is classified conservatively
+ * with empty params.
+ */
+export declare function disallowedToolsForAgentStep(worker: WorkerManifest, store: WorkerLevelStore): string[];
+/**
+ * Union a step's own `disallowedTools` with the worker-ceiling-derived block
+ * list. Returns `undefined` when both are empty so callers preserve the "field
+ * absent" shape. When there is NO worker list (the non-worker case), the step's
+ * list is returned VERBATIM — same value, same order, same duplicates — so a
+ * non-worker agent step is byte-identical to pre-flip behaviour. Only an actual
+ * merge dedups + sorts (argv order/dupes are inert for a deny SET).
+ */
+export declare function mergeAgentDisallowedTools(stepList?: string[], workerList?: string[]): string[] | undefined;

package/dist/workers/workerGate.js

@@ -0,0 +1,210 @@
+import { classifyTool, getRiskTierMap } from "../riskTier.js";
+import { classifyActionClass, knownActionTools, } from "./actionClass.js";
+import { contextRiskCeiling } from "./contextRisk.js";
+import { ownsAction } from "./worker.js";
+/**
+ * Compensable actions (git-remote, issue) unlock autonomous execution at L2.
+ * A compensating path exists (close the PR, delete the issue) so the cost of
+ * an error is bounded — a worker at L2 has demonstrated enough reliability
+ * that occasional human cleanup is acceptable. Irreversible actions (shell,
+ * messaging, http) still require L4; they skip L2/L3 in the reachable-levels
+ * set entirely, so this threshold never fires for them.
+ */
+const COMPENSABLE_AUTONOMY_LEVEL = 2;
+/** Irreversible actions (and unowned/unearned anything) require full L4. */
+const AUTONOMOUS_LEVEL = 4;
+/** The gate-policy version stamped on every persisted decision (the threshold
+ *  constants + composition rule below). A decision can't be replayed/explained
+ *  without knowing which policy produced it — bump when the thresholds or the
+ *  reversibility→level mapping change. */
+export const GATE_POLICY_VERSION = "worker-ramp-v0";
+/** How the Claude subprocess sees bridge MCP tools under `--disallowed-tools`:
+ *  `mcp__<server>__<tool>`. The server name is fixed to `patchwork` by the
+ *  subprocess driver's writeMcpConfigFile, so the agent-step sandbox must block
+ *  this form (not just the bare tool name) to actually deny a bridge MCP call. */
+const BRIDGE_MCP_TOOL_PREFIX = "mcp__patchwork__";
+/**
+ * Undoable → flows un-gated even when unearned. Only reversible actions are
+ * exempt from the trust requirement; compensable ones graduate to autonomous
+ * at L2+; irreversible ones wait for earned L4.
+ */
+export function flowsUngated(ac) {
+    return ac.reversibility === "reversible";
+}
+export function decideWorkerAction(worker, toolName, params, store, opts) {
+    const ac = classifyActionClass(toolName, params);
+    const owned = ownsAction(worker, ac);
+    const earnedLevel = (store.getState(worker.id, ac.key)?.level ??
+        0);
+    let effectiveLevel = owned ? earnedLevel : 0;
+    if (effectiveLevel > worker.autonomyCeiling)
+        effectiveLevel = worker.autonomyCeiling;
+    // Descending context-risk clamp (keystone seam). A live, situational de-rater:
+    // it can only LOWER the effective level (never-widen). Absent ⇒ no-op, so the
+    // earned-trust-only path is byte-identical. A worker with a clean situation
+    // keeps its earned autonomy; a dangerous live context (red CI, huge diff,
+    // hotspot file) throttles it toward propose-only regardless of earned level.
+    const contextCeiling = opts?.contextRisk
+        ? contextRiskCeiling(opts.contextRisk.score)
+        : undefined;
+    if (contextCeiling !== undefined && effectiveLevel > contextCeiling)
+        effectiveLevel = contextCeiling;
+    const base = {
+        classKey: ac.key,
+        domain: ac.domain,
+        owned,
+        blastTier: ac.blastTier,
+        reversibility: ac.reversibility,
+        earnedLevel,
+        autonomyCeiling: worker.autonomyCeiling,
+        effectiveLevel,
+        ...(contextCeiling !== undefined && { contextCeiling }),
+    };
+    // Agent (reasoning) steps are not a durable side-effecting action-class: the
+    // claude subprocess produces an output var, and any tool calls it makes are
+    // gated on their OWN class. The step id classifies as `other:irreversible`
+    // (owned by no worker), so without this it would gate forever and stall every
+    // worker on its agent step while the real file.write flowed. Let it through;
+    // the downstream tool steps still gate. The tier gate (composed as a floor by
+    // the caller) still applies its own policy to the agent step.
+    if (toolName === "agent") {
+        return {
+            ...base,
+            action: "allow",
+            reason: "agent reasoning step — not a gated action-class",
+        };
+    }
+    // Reversible: flows freely. The routine work a new worker should just do.
+    if (flowsUngated(ac)) {
+        return {
+            ...base,
+            action: "allow",
+            reason: `reversible (${ac.blastTier} blast) — undoable, flows un-gated`,
+        };
+    }
+    // Compensable: autonomous at L2+. A compensating action exists, so the cost
+    // of being wrong is bounded. Workers earning L2 on vcs-remote or issue can
+    // push and open issues without per-action approval.
+    if (ac.reversibility === "compensable" &&
+        effectiveLevel >= COMPENSABLE_AUTONOMY_LEVEL) {
+        return {
+            ...base,
+            action: "allow",
+            reason: `earned autonomy (L${effectiveLevel}) on compensable class — auto-allowed at L${COMPENSABLE_AUTONOMY_LEVEL}+`,
+        };
+    }
+    // Irreversible (and compensable still below L2): autonomous only at L4.
+    if (effectiveLevel >= AUTONOMOUS_LEVEL) {
+        return {
+            ...base,
+            action: "allow",
+            reason: `earned autonomy (L4) on ${ac.reversibility} class`,
+        };
+    }
+    const threshold = ac.reversibility === "compensable"
+        ? COMPENSABLE_AUTONOMY_LEVEL
+        : AUTONOMOUS_LEVEL;
+    let reason;
+    // Context-risk is the BINDING constraint when it dropped the effective level
+    // below what earned trust + ceiling alone would have allowed. Attribute it so
+    // the audit trail shows the situation throttled the action, not stale trust.
+    const earnedCapped = Math.min(owned ? earnedLevel : 0, worker.autonomyCeiling);
+    if (contextCeiling !== undefined &&
+        contextCeiling < threshold &&
+        contextCeiling < earnedCapped) {
+        const why = opts?.contextRisk?.reasons?.length
+            ? ` (${opts.contextRisk.reasons.join(", ")})`
+            : "";
+        reason = `${ac.reversibility} throttled by live context-risk (ceiling L${contextCeiling} < L${threshold})${why} — gated`;
+    }
+    else if (!owned) {
+        reason = `${ac.reversibility} action outside the worker's owned domain — gated`;
+    }
+    else if (worker.autonomyCeiling < threshold) {
+        reason = `${ac.reversibility} class capped by autonomy ceiling (L${worker.autonomyCeiling} < L${threshold}) — always gated`;
+    }
+    else {
+        reason = `${ac.reversibility} + unearned (effective L${effectiveLevel} < L${threshold}) — gated for approval`;
+    }
+    return { ...base, action: "gate", reason };
+}
+/**
+ * Tools a worker's AGENT step must be barred from calling.
+ *
+ * An `agent` step spawns a Claude subprocess whose INTERNAL tool calls bypass
+ * the per-step worker gate (only recipe *steps* pass through `decideWorkerAction`
+ * — tools the subprocess invokes itself never do). Without this, a worker could
+ * do via its agent exactly the risky action (`gitPush`, `githubMergePR`,
+ * `slackPostMessage`, `runCommand`, …) the gate would otherwise have queued for
+ * approval. We re-apply the gate as a subprocess sandbox: every tool the worker
+ * cannot currently run autonomously (`decideWorkerAction → "gate"`) is added to
+ * the subprocess's `--disallowed-tools`.
+ *
+ * Honours the live trust state AND the autonomy ceiling (both fold into
+ * `decideWorkerAction`'s `effectiveLevel = min(earned, ceiling)`): reversible
+ * tools and risky tools the worker has EARNED stay callable; everything else is
+ * blocked. The universe is the canonical tool registry (TIER_MAP keys); params
+ * are unknown at sandbox-build time, so each tool is classified conservatively
+ * with empty params.
+ */
+export function disallowedToolsForAgentStep(worker, store) {
+    // Universe = the canonical risk-tier map (broad MCP coverage) ∪ the worker
+    // subsystem's own tool→domain map (adds messaging/http TIER_MAP omits).
+    // Neither alone is complete; the union is the best enumerable approximation of
+    // the risky tool surface.
+    const universe = new Set([
+        ...Object.keys(getRiskTierMap()),
+        ...knownActionTools(),
+    ]);
+    const blocked = new Set();
+    for (const toolName of universe) {
+        // The agent step itself is always allowed (reasoning, not a durable side-
+        // effect — decideWorkerAction special-cases it); never self-block.
+        if (toolName === "agent")
+            continue;
+        // Recipe-DSL ids (`github.create_issue`, `file.write`) are internal to the
+        // recipe runner — the Claude subprocess never calls them by that name, so
+        // they would be dead weight in `--disallowed-tools`. The camelCase MCP twin
+        // (githubCreateIssue) is enumerated separately and IS emitted below.
+        if (toolName.includes("."))
+            continue;
+        if (decideWorkerAction(worker, toolName, undefined, store).action !== "gate")
+            continue;
+        // Don't over-block. An UNKNOWN tool (domain "other") defaults to
+        // irreversible in the trust model — conservative for EARNING, but blanket-
+        // denying every unknown here would strip the agent of the harmless reads and
+        // navigation it needs to do its job (getDiagnostics, searchWorkspace,
+        // goToDefinition, getHover, … all classify as other:irreversible:low). Only
+        // block an "other" tool when the registry rates it high-blast (e.g. Bash);
+        // tools with a KNOWN risky domain (shell, messaging, http, vcs-push/merge,
+        // issue) are always blocked. The recipe's explicit tool STEPS still gate on
+        // their own class — this list is defense-in-depth, not the only gate.
+        const ac = classifyActionClass(toolName);
+        if (ac.domain === "other" && classifyTool(toolName) !== "high")
+            continue;
+        // Emit BOTH naming forms the subprocess might use: the bare name (native CC
+        // tools like `Bash`, and any non-namespaced match) AND the bridge MCP form
+        // `mcp__patchwork__<tool>` (how claude -p sees bridge tools under
+        // --disallowed-tools; server name fixed by writeMcpConfigFile). A form that
+        // matches nothing is harmless; missing one would leave the bypass open.
+        blocked.add(toolName);
+        blocked.add(`${BRIDGE_MCP_TOOL_PREFIX}${toolName}`);
+    }
+    return Array.from(blocked).sort();
+}
+/**
+ * Union a step's own `disallowedTools` with the worker-ceiling-derived block
+ * list. Returns `undefined` when both are empty so callers preserve the "field
+ * absent" shape. When there is NO worker list (the non-worker case), the step's
+ * list is returned VERBATIM — same value, same order, same duplicates — so a
+ * non-worker agent step is byte-identical to pre-flip behaviour. Only an actual
+ * merge dedups + sorts (argv order/dupes are inert for a deny SET).
+ */
+export function mergeAgentDisallowedTools(stepList, workerList) {
+    if (!workerList?.length)
+        return stepList?.length ? stepList : undefined;
+    if (!stepList?.length)
+        return Array.from(new Set(workerList)).sort();
+    return Array.from(new Set([...stepList, ...workerList])).sort();
+}
+//# sourceMappingURL=workerGate.js.map

package/dist/workers/workerGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workerGate.js","sourceRoot":"","sources":["../../src/workers/workerGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAEL,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAoB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAExE,OAAO,EAAE,UAAU,EAAuB,MAAM,aAAa,CAAC;AA8D9D;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAG,CAAU,CAAC;AAE9C,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,CAAU,CAAC;AAEpC;;;0CAG0C;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD;;;kFAGkF;AAClF,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,EAAe;IAC1C,OAAO,EAAE,CAAC,aAAa,KAAK,YAAY,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAsB,EACtB,QAAgB,EAChB,MAA2C,EAC3C,KAAuB,EACvB,IAA2B;IAE3B,MAAM,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK;QAC3D,CAAC,CAAe,CAAC;IAEnB,IAAI,cAAc,GAAe,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,cAAc,GAAG,MAAM,CAAC,eAAe;QACzC,cAAc,GAAG,MAAM,CAAC,eAAe,CAAC;IAE1C,+EAA+E;IAC/E,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,cAAc,GAA2B,IAAI,EAAE,WAAW;QAC9D,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAC5C,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,GAAG,cAAc;QACjE,cAAc,GAAG,cAAc,CAAC;IAElC,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,EAAE,CAAC,GAAG;QAChB,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,KAAK;QACL,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,aAAa,EAAE,EAAE,CAAC,aAAa;QAC/B,WAAW;QACX,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,cAAc;QACd,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,CAAC;KAC/C,CAAC;IAEX,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,8DAA8D;IAC9D,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,iDAAiD;SAC1D,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,IAAI,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,eAAe,EAAE,CAAC,SAAS,oCAAoC;SACxE,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,IACE,EAAE,CAAC,aAAa,KAAK,aAAa;QAClC,cAAc,IAAI,0BAA0B,EAC5C,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,qBAAqB,cAAc,6CAA6C,0BAA0B,GAAG;SACtH,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,IAAI,cAAc,IAAI,gBAAgB,EAAE,CAAC;QACvC,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,2BAA2B,EAAE,CAAC,aAAa,QAAQ;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,EAAE,CAAC,aAAa,KAAK,aAAa;QAChC,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,gBAAgB,CAAC;IACvB,IAAI,MAAc,CAAC;IACnB,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAC3B,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EACvB,MAAM,CAAC,eAAe,CACvB,CAAC;IACF,IACE,cAAc,KAAK,SAAS;QAC5B,cAAc,GAAG,SAAS;QAC1B,cAAc,GAAG,YAAY,EAC7B,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM;YAC5C,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7C,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,6CAA6C,cAAc,OAAO,SAAS,IAAI,GAAG,UAAU,CAAC;IAC3H,CAAC;SAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,mDAAmD,CAAC;IAClF,CAAC;SAAM,IAAI,MAAM,CAAC,eAAe,GAAG,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,uCAAuC,MAAM,CAAC,eAAe,OAAO,SAAS,kBAAkB,CAAC;IAC9H,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,2BAA2B,cAAc,OAAO,SAAS,wBAAwB,CAAC;IAChH,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAsB,EACtB,KAAuB;IAEvB,2EAA2E;IAC3E,wEAAwE;IACxE,+EAA+E;IAC/E,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAChC,GAAG,gBAAgB,EAAE;KACtB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,0EAA0E;QAC1E,mEAAmE;QACnE,IAAI,QAAQ,KAAK,OAAO;YAAE,SAAS;QACnC,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,IACE,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,MAAM,KAAK,MAAM;YAExE,SAAS;QACX,iEAAiE;QACjE,2EAA2E;QAC3E,6EAA6E;QAC7E,sEAAsE;QACtE,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,MAAM,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC,MAAM,KAAK,OAAO,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,MAAM;YAAE,SAAS;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,kEAAkE;QAClE,4EAA4E;QAC5E,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,GAAG,sBAAsB,GAAG,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAmB,EACnB,UAAqB;IAErB,IAAI,CAAC,UAAU,EAAE,MAAM;QAAE,OAAO,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClE,CAAC"}

package/dist/workers/workerLevelStore.d.ts

@@ -0,0 +1,33 @@
+import { type ClassTrustState, type GraduationConfig, type GraduationEvent, type Outcome } from "./graduation.js";
+import { type Posterior } from "./trustLevel.js";
+export type AuditEvent = GraduationEvent & {
+    workerId: string;
+};
+export interface AppliedOutcome {
+    classKey: string;
+    state: ClassTrustState;
+    event?: AuditEvent;
+}
+export interface BoardRow {
+    classKey: string;
+    level: number;
+    observations: number;
+    mean: number;
+}
+export declare class WorkerLevelStore {
+    private states;
+    private log;
+    /** Fold one outcome for a worker; derives the action-class from the tool. */
+    apply(workerId: string, outcome: Outcome, opts?: {
+        prior?: Posterior;
+        cfg?: GraduationConfig;
+    }): AppliedOutcome;
+    getState(workerId: string, classKey: string): ClassTrustState | undefined;
+    /** Dial snapshot for one worker: every action-class it has touched, sorted. */
+    board(workerId: string): BoardRow[];
+    /** The audit log (optionally filtered to one worker). */
+    events(workerId?: string): AuditEvent[];
+    /** Serialize states + events to JSONL (one record per line). */
+    toJSONL(): string;
+    static fromJSONL(text: string): WorkerLevelStore;
+}

package/dist/workers/workerLevelStore.js

@@ -0,0 +1,87 @@
+import { classifyActionClass } from "./actionClass.js";
+import { DEFAULT_GRADUATION_CONFIG, graduate, initialState, } from "./graduation.js";
+import { DEFAULT_PRIOR, posteriorMean } from "./trustLevel.js";
+/**
+ * Holds the per-(worker × action-class) trust state and the promotion/demotion
+ * event log. The state map is the dial; the event log is the compliance/audit
+ * artifact ("prove this worker never acted beyond its authority"). In-memory
+ * with a JSONL round-trip; wiring it to a live append-only JSONL file with the
+ * tail-on-read concurrency pattern (ADR-0007, as the existing trace stores do)
+ * is the productionization step — kept out of v0 to stay pure + testable.
+ */
+function compositeKey(workerId, classKey) {
+    return `${workerId}::${classKey}`;
+}
+export class WorkerLevelStore {
+    states = new Map();
+    log = [];
+    /** Fold one outcome for a worker; derives the action-class from the tool. */
+    apply(workerId, outcome, opts = {}) {
+        const ac = classifyActionClass(outcome.toolName, outcome.params);
+        const k = compositeKey(workerId, ac.key);
+        const prior = opts.prior ?? DEFAULT_PRIOR;
+        const current = this.states.get(k) ?? initialState(ac.key, prior, outcome.at);
+        const { state, event } = graduate(current, outcome, opts.cfg ?? DEFAULT_GRADUATION_CONFIG);
+        this.states.set(k, state);
+        const audit = event ? { ...event, workerId } : undefined;
+        if (audit)
+            this.log.push(audit);
+        return { classKey: ac.key, state, event: audit };
+    }
+    getState(workerId, classKey) {
+        return this.states.get(compositeKey(workerId, classKey));
+    }
+    /** Dial snapshot for one worker: every action-class it has touched, sorted. */
+    board(workerId) {
+        const prefix = `${workerId}::`;
+        const rows = [];
+        for (const [k, s] of this.states) {
+            if (!k.startsWith(prefix))
+                continue;
+            rows.push({
+                classKey: s.classKey,
+                level: s.level,
+                observations: s.observations,
+                mean: posteriorMean(s.posterior),
+            });
+        }
+        return rows.sort((a, b) => a.classKey.localeCompare(b.classKey));
+    }
+    /** The audit log (optionally filtered to one worker). */
+    events(workerId) {
+        return workerId
+            ? this.log.filter((e) => e.workerId === workerId)
+            : this.log;
+    }
+    /** Serialize states + events to JSONL (one record per line). */
+    toJSONL() {
+        const lines = [];
+        for (const [k, s] of this.states) {
+            const workerId = k.slice(0, k.indexOf("::"));
+            lines.push(JSON.stringify({ rec: "state", workerId, state: s }));
+        }
+        for (const e of this.log)
+            lines.push(JSON.stringify({ rec: "event", ...e }));
+        return lines.join("\n");
+    }
+    static fromJSONL(text) {
+        const store = new WorkerLevelStore();
+        for (const line of text.split("\n")) {
+            const t = line.trim();
+            if (!t)
+                continue;
+            const obj = JSON.parse(t);
+            if (obj.rec === "state") {
+                const workerId = obj.workerId;
+                const state = obj.state;
+                store.states.set(compositeKey(workerId, state.classKey), state);
+            }
+            else if (obj.rec === "event") {
+                const { rec: _rec, ...event } = obj;
+                store.log.push(event);
+            }
+        }
+        return store;
+    }
+}
+//# sourceMappingURL=workerLevelStore.js.map

package/dist/workers/workerLevelStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workerLevelStore.js","sourceRoot":"","sources":["../../src/workers/workerLevelStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAEL,yBAAyB,EAGzB,QAAQ,EACR,YAAY,GAEb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAkB,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE/E;;;;;;;GAOG;AAEH,SAAS,YAAY,CAAC,QAAgB,EAAE,QAAgB;IACtD,OAAO,GAAG,QAAQ,KAAK,QAAQ,EAAE,CAAC;AACpC,CAAC;AAiBD,MAAM,OAAO,gBAAgB;IACnB,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC5C,GAAG,GAAiB,EAAE,CAAC;IAE/B,6EAA6E;IAC7E,KAAK,CACH,QAAgB,EAChB,OAAgB,EAChB,OAAsD,EAAE;QAExD,MAAM,EAAE,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;QAC1C,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,CAC/B,OAAO,EACP,OAAO,EACP,IAAI,CAAC,GAAG,IAAI,yBAAyB,CACtC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,QAAgB;QACpB,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC;QAC/B,MAAM,IAAI,GAAe,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC,IAAI,CAAC;gBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,yDAAyD;IACzD,MAAM,CAAC,QAAiB;QACtB,OAAO,QAAQ;YACb,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IACf,CAAC;IAED,gEAAgE;IAChE,OAAO;QACL,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG;YACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAA4B,CAAC;YACrD,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAkB,CAAC;gBACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAwB,CAAC;gBAC3C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;gBAC/B,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,GAAG,GAAG,CAAC;gBACpC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAA8B,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/workers/workerLoader.d.ts

@@ -0,0 +1,7 @@
+import { type WorkerManifest } from "./worker.js";
+/**
+ * Load worker manifests from a directory of `*.worker.yaml` files. Fail-soft:
+ * a malformed worker file is skipped (logged by the caller if a logger is
+ * passed), never fatal — one bad manifest must not blind the whole dial.
+ */
+export declare function loadWorkersFromDir(dir: string, log?: (msg: string) => void): WorkerManifest[];

package/dist/workers/workerLoader.js

@@ -0,0 +1,31 @@
+import { readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { parse as parseYaml } from "yaml";
+import { parseWorker } from "./worker.js";
+/**
+ * Load worker manifests from a directory of `*.worker.yaml` files. Fail-soft:
+ * a malformed worker file is skipped (logged by the caller if a logger is
+ * passed), never fatal — one bad manifest must not blind the whole dial.
+ */
+export function loadWorkersFromDir(dir, log) {
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    const workers = [];
+    for (const f of entries) {
+        if (!/\.worker\.ya?ml$/i.test(f))
+            continue;
+        try {
+            workers.push(parseWorker(parseYaml(readFileSync(path.join(dir, f), "utf-8"))));
+        }
+        catch (err) {
+            log?.(`[workers] skipped ${f} — ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return workers.sort((a, b) => a.id.localeCompare(b.id));
+}
+//# sourceMappingURL=workerLoader.js.map

package/dist/workers/workerLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workerLoader.js","sourceRoot":"","sources":["../../src/workers/workerLoader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAuB,MAAM,aAAa,CAAC;AAE/D;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,GAA2B;IAE3B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CACV,WAAW,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CACjE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,EAAE,CACH,qBAAqB,CAAC,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC"}