patchwork-os 1.2.4 → 1.2.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (213) hide show
  1. package/README.md +1 -1
  2. package/dist/activityLog.js +7 -2
  3. package/dist/activityLog.js.map +1 -1
  4. package/dist/butler/factStore.js +6 -0
  5. package/dist/butler/factStore.js.map +1 -1
  6. package/dist/claudeDriver.js +7 -4
  7. package/dist/claudeDriver.js.map +1 -1
  8. package/dist/commands/doctorAcceptance.js +5 -0
  9. package/dist/commands/doctorAcceptance.js.map +1 -1
  10. package/dist/commands/policyExplain.js +7 -2
  11. package/dist/commands/policyExplain.js.map +1 -1
  12. package/dist/commands/recipe.js +86 -35
  13. package/dist/commands/recipe.js.map +1 -1
  14. package/dist/commands/sinceDays.d.ts +14 -0
  15. package/dist/commands/sinceDays.js +19 -0
  16. package/dist/commands/sinceDays.js.map +1 -0
  17. package/dist/commands/tools.js +9 -4
  18. package/dist/commands/tools.js.map +1 -1
  19. package/dist/connectors/airtable.js +16 -8
  20. package/dist/connectors/airtable.js.map +1 -1
  21. package/dist/connectors/asana.js +2 -2
  22. package/dist/connectors/asana.js.map +1 -1
  23. package/dist/connectors/baseConnector.d.ts +8 -0
  24. package/dist/connectors/baseConnector.js +17 -1
  25. package/dist/connectors/baseConnector.js.map +1 -1
  26. package/dist/connectors/caldiy.js +7 -6
  27. package/dist/connectors/caldiy.js.map +1 -1
  28. package/dist/connectors/circleci.js +6 -3
  29. package/dist/connectors/circleci.js.map +1 -1
  30. package/dist/connectors/cloudflare.js +2 -2
  31. package/dist/connectors/cloudflare.js.map +1 -1
  32. package/dist/connectors/confluence.js +1 -1
  33. package/dist/connectors/confluence.js.map +1 -1
  34. package/dist/connectors/connectorFetch.d.ts +15 -0
  35. package/dist/connectors/connectorFetch.js +46 -0
  36. package/dist/connectors/connectorFetch.js.map +1 -0
  37. package/dist/connectors/discord.js +1 -1
  38. package/dist/connectors/discord.js.map +1 -1
  39. package/dist/connectors/gmail.js +4 -30
  40. package/dist/connectors/gmail.js.map +1 -1
  41. package/dist/connectors/googleCalendar.js +4 -30
  42. package/dist/connectors/googleCalendar.js.map +1 -1
  43. package/dist/connectors/googleDocs.js +4 -25
  44. package/dist/connectors/googleDocs.js.map +1 -1
  45. package/dist/connectors/googleDrive.js +4 -25
  46. package/dist/connectors/googleDrive.js.map +1 -1
  47. package/dist/connectors/googleTokenRefresh.d.ts +25 -0
  48. package/dist/connectors/googleTokenRefresh.js +37 -0
  49. package/dist/connectors/googleTokenRefresh.js.map +1 -0
  50. package/dist/connectors/grafana.js +14 -13
  51. package/dist/connectors/grafana.js.map +1 -1
  52. package/dist/connectors/hubspot.js +1 -1
  53. package/dist/connectors/hubspot.js.map +1 -1
  54. package/dist/connectors/intercom.js +2 -2
  55. package/dist/connectors/intercom.js.map +1 -1
  56. package/dist/connectors/jira.js +3 -3
  57. package/dist/connectors/jira.js.map +1 -1
  58. package/dist/connectors/mcpOAuth.js +2 -0
  59. package/dist/connectors/mcpOAuth.js.map +1 -1
  60. package/dist/connectors/monday.js +2 -0
  61. package/dist/connectors/monday.js.map +1 -1
  62. package/dist/connectors/notion.js +5 -3
  63. package/dist/connectors/notion.js.map +1 -1
  64. package/dist/connectors/obsidian.d.ts +8 -1
  65. package/dist/connectors/obsidian.js +37 -14
  66. package/dist/connectors/obsidian.js.map +1 -1
  67. package/dist/connectors/pagerduty.js +2 -2
  68. package/dist/connectors/pagerduty.js.map +1 -1
  69. package/dist/connectors/paystack.js +5 -5
  70. package/dist/connectors/paystack.js.map +1 -1
  71. package/dist/connectors/pipedrive.js +15 -6
  72. package/dist/connectors/pipedrive.js.map +1 -1
  73. package/dist/connectors/posthog.js +15 -14
  74. package/dist/connectors/posthog.js.map +1 -1
  75. package/dist/connectors/resend.js +3 -3
  76. package/dist/connectors/resend.js.map +1 -1
  77. package/dist/connectors/salesforce.js +2 -0
  78. package/dist/connectors/salesforce.js.map +1 -1
  79. package/dist/connectors/sendgrid.js +1 -1
  80. package/dist/connectors/sendgrid.js.map +1 -1
  81. package/dist/connectors/supabase.js +18 -17
  82. package/dist/connectors/supabase.js.map +1 -1
  83. package/dist/connectors/telegram.js +1 -1
  84. package/dist/connectors/telegram.js.map +1 -1
  85. package/dist/connectors/todoist.js +2 -2
  86. package/dist/connectors/todoist.js.map +1 -1
  87. package/dist/connectors/tokenRefreshTimeout.d.ts +15 -0
  88. package/dist/connectors/tokenRefreshTimeout.js +22 -0
  89. package/dist/connectors/tokenRefreshTimeout.js.map +1 -0
  90. package/dist/connectors/tokenStorage.js +29 -15
  91. package/dist/connectors/tokenStorage.js.map +1 -1
  92. package/dist/connectors/twilio.js +1 -1
  93. package/dist/connectors/twilio.js.map +1 -1
  94. package/dist/connectors/vercel.js +1 -1
  95. package/dist/connectors/vercel.js.map +1 -1
  96. package/dist/connectors/woocommerce.js +8 -4
  97. package/dist/connectors/woocommerce.js.map +1 -1
  98. package/dist/connectors/zendesk.js +1 -1
  99. package/dist/connectors/zendesk.js.map +1 -1
  100. package/dist/drivers/claude/api.js +8 -1
  101. package/dist/drivers/claude/api.js.map +1 -1
  102. package/dist/drivers/claude/subprocess.js +7 -3
  103. package/dist/drivers/claude/subprocess.js.map +1 -1
  104. package/dist/drivers/codex/subprocess.js +9 -3
  105. package/dist/drivers/codex/subprocess.js.map +1 -1
  106. package/dist/drivers/exitCode.d.ts +11 -0
  107. package/dist/drivers/exitCode.js +21 -0
  108. package/dist/drivers/exitCode.js.map +1 -0
  109. package/dist/drivers/gemini/index.js +9 -3
  110. package/dist/drivers/gemini/index.js.map +1 -1
  111. package/dist/drivers/openai/index.js +8 -1
  112. package/dist/drivers/openai/index.js.map +1 -1
  113. package/dist/drivers/promptStdin.d.ts +14 -0
  114. package/dist/drivers/promptStdin.js +19 -0
  115. package/dist/drivers/promptStdin.js.map +1 -0
  116. package/dist/drivers/systemPreamble.d.ts +15 -0
  117. package/dist/drivers/systemPreamble.js +20 -0
  118. package/dist/drivers/systemPreamble.js.map +1 -0
  119. package/dist/evidenceRelationships.js +11 -1
  120. package/dist/evidenceRelationships.js.map +1 -1
  121. package/dist/extensionClient.js +21 -7
  122. package/dist/extensionClient.js.map +1 -1
  123. package/dist/fp/interpreterContext.js +22 -56
  124. package/dist/fp/interpreterContext.js.map +1 -1
  125. package/dist/governance/doctorReport.js +17 -1
  126. package/dist/governance/doctorReport.js.map +1 -1
  127. package/dist/governance/effectivePolicy.d.ts +17 -0
  128. package/dist/governance/effectivePolicy.js +18 -0
  129. package/dist/governance/effectivePolicy.js.map +1 -1
  130. package/dist/governance/profile.d.ts +10 -0
  131. package/dist/governance/profile.js +2 -0
  132. package/dist/governance/profile.js.map +1 -1
  133. package/dist/governance/secretPathDenies.d.ts +11 -1
  134. package/dist/governance/secretPathDenies.js +30 -1
  135. package/dist/governance/secretPathDenies.js.map +1 -1
  136. package/dist/index.js +74 -27
  137. package/dist/index.js.map +1 -1
  138. package/dist/maintenance/sweep.d.ts +9 -0
  139. package/dist/maintenance/sweep.js +24 -0
  140. package/dist/maintenance/sweep.js.map +1 -1
  141. package/dist/maintenance/sweepCollect.js +10 -4
  142. package/dist/maintenance/sweepCollect.js.map +1 -1
  143. package/dist/pluginLoader.d.ts +5 -0
  144. package/dist/pluginLoader.js +30 -6
  145. package/dist/pluginLoader.js.map +1 -1
  146. package/dist/pluginWatcher.js +18 -7
  147. package/dist/pluginWatcher.js.map +1 -1
  148. package/dist/privacy/boundaryReceiptLog.d.ts +12 -7
  149. package/dist/privacy/boundaryReceiptLog.js +10 -6
  150. package/dist/privacy/boundaryReceiptLog.js.map +1 -1
  151. package/dist/privacy/dataPolicy.js +15 -5
  152. package/dist/privacy/dataPolicy.js.map +1 -1
  153. package/dist/privacy/describeDestinations.d.ts +28 -0
  154. package/dist/privacy/describeDestinations.js +50 -0
  155. package/dist/privacy/describeDestinations.js.map +1 -1
  156. package/dist/privacy/destinationRegistry.js +13 -2
  157. package/dist/privacy/destinationRegistry.js.map +1 -1
  158. package/dist/privateHost.js +93 -0
  159. package/dist/privateHost.js.map +1 -1
  160. package/dist/recipeOrchestration.d.ts +2 -13
  161. package/dist/recipeOrchestration.js +12 -61
  162. package/dist/recipeOrchestration.js.map +1 -1
  163. package/dist/recipes/agentExecutor.js +1 -1
  164. package/dist/recipes/agentExecutor.js.map +1 -1
  165. package/dist/recipes/compoundSteps.d.ts +0 -1
  166. package/dist/recipes/compoundSteps.js.map +1 -1
  167. package/dist/recipes/dependencyGraph.d.ts +0 -2
  168. package/dist/recipes/dependencyGraph.js +0 -8
  169. package/dist/recipes/dependencyGraph.js.map +1 -1
  170. package/dist/recipes/intervalSchedule.d.ts +17 -0
  171. package/dist/recipes/intervalSchedule.js +24 -0
  172. package/dist/recipes/intervalSchedule.js.map +1 -0
  173. package/dist/recipes/nestedRecipeStep.d.ts +0 -5
  174. package/dist/recipes/nestedRecipeStep.js.map +1 -1
  175. package/dist/recipes/scheduler.js +7 -16
  176. package/dist/recipes/scheduler.js.map +1 -1
  177. package/dist/recipes/simulation/sideEffects.d.ts +0 -2
  178. package/dist/recipes/simulation/sideEffects.js +0 -11
  179. package/dist/recipes/simulation/sideEffects.js.map +1 -1
  180. package/dist/recipes/toolRegistry.d.ts +0 -5
  181. package/dist/recipes/toolRegistry.js +0 -7
  182. package/dist/recipes/toolRegistry.js.map +1 -1
  183. package/dist/recipes/tools/http.js +34 -14
  184. package/dist/recipes/tools/http.js.map +1 -1
  185. package/dist/recipes/triggerVars.d.ts +19 -0
  186. package/dist/recipes/triggerVars.js +70 -0
  187. package/dist/recipes/triggerVars.js.map +1 -1
  188. package/dist/recipes/validation.js +22 -2
  189. package/dist/recipes/validation.js.map +1 -1
  190. package/dist/recipes/withheldOutputs.d.ts +0 -2
  191. package/dist/recipes/withheldOutputs.js +0 -4
  192. package/dist/recipes/withheldOutputs.js.map +1 -1
  193. package/dist/recipes/yamlRunner.d.ts +10 -1
  194. package/dist/recipes/yamlRunner.js +6 -2
  195. package/dist/recipes/yamlRunner.js.map +1 -1
  196. package/dist/runLog.js +25 -10
  197. package/dist/runLog.js.map +1 -1
  198. package/dist/ssrfGuard.d.ts +13 -4
  199. package/dist/ssrfGuard.js +17 -5
  200. package/dist/ssrfGuard.js.map +1 -1
  201. package/dist/tools/httpClient.js +7 -2
  202. package/dist/tools/httpClient.js.map +1 -1
  203. package/dist/tools/terminal.js +17 -0
  204. package/dist/tools/terminal.js.map +1 -1
  205. package/dist/workerGateDecisionLog.d.ts +7 -0
  206. package/dist/workerGateDecisionLog.js +20 -11
  207. package/dist/workerGateDecisionLog.js.map +1 -1
  208. package/dist/workers/outcomeStore.js +4 -3
  209. package/dist/workers/outcomeStore.js.map +1 -1
  210. package/dist/workers/previewActions.js +9 -0
  211. package/dist/workers/previewActions.js.map +1 -1
  212. package/package.json +5 -1
  213. package/templates/recipes/fix-errors-on-save.yaml +5 -2
@@ -1 +1 @@
1
- {"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/governance/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAU,CAAC;AA+E7D;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAAY,UAAkB,EAAE,KAAc;QAC5C,KAAK,CACH,kBAAkB,UAAU,+BAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,wEAAwE;YACtE,mEAAmE;YACnE,iCAAiC,CACpC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,CACL,8BAA8B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wBAAwB;QACzE,wEAAwE;QACxE,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgC,EAAE;IAIlE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnD,IAAI,GAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,CAAC,UAAU,CAAuB,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAmC;IAEnC,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC;IACxD,MAAM,IAAI,GAAgB,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrE,MAAM,cAAc,GAClB,GAAG,EAAE,YAAY,KAAK,MAAM;QAC5B,GAAG,EAAE,YAAY,KAAK,KAAK;QAC3B,GAAG,EAAE,YAAY,KAAK,KAAK;QACzB,CAAC,CAAC,GAAG,CAAC,YAAY;QAClB,CAAC,CAAC,KAAK,CAAC;IACZ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,YAAY,EAAE,cAAc;YAC5B,iBAAiB,EAAE,KAAK;YACxB,eAAe,EAAE,KAAK;YACtB,aAAa,EAAE,KAAK;YACpB,gBAAgB,EAAE,QAAQ;YAC1B,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,KAAK;YAC3B,iBAAiB,EAAE,OAAO;YAC1B,iBAAiB,EAAE,MAAM;YACzB,iBAAiB,EAAE,KAAK;YACxB,oBAAoB,EAAE,IAAI;YAC1B,oBAAoB,EAAE,MAAM;SAC7B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,YAAY,EAAE,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;QACvD,iBAAiB,EAAE,IAAI;QACvB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,UAAU;QAC5B,YAAY,EAAE,WAAW;QACzB,oBAAoB,EAAE,IAAI;QAC1B,iBAAiB,EAAE,MAAM;QACzB,iBAAiB,EAAE,QAAQ;QAC3B,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,KAAK;QAC3B,oBAAoB,EAAE,SAAS;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAsB,MAAM,CAAC,MAAM,CAC5D,cAAc,CAAC,SAAS,CAAC,CAC1B,CAAC;AACF,MAAM,CAAC,MAAM,gBAAgB,GAAsB,MAAM,CAAC,MAAM,CAC9D,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CACxC,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,CAAgC;IACzD,OAAO,CAAC,EAAE,IAAI,KAAK,UAAU,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,EAAE;AACF,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,6BAA6B;AAC7B,8EAA8E;AAE9E,IAAI,MAAM,GAAsB,cAAc,CAAC;AAE/C,MAAM,UAAU,gBAAgB,CAAC,CAAoB;IACnD,MAAM,GAAG,CAAC,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,6BAA6B;IAC3C,MAAM,GAAG,cAAc,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC5E,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;CACL,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM;IACN,OAAO;IACP,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC3E,UAAU;IACV,WAAW;IACX,MAAM;IACN,GAAG,2BAA2B;CAC/B,CAAC,CAAC;AAqCH;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA0B,EAC1B,GAAmC;IAEnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;QACvC,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5D,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;YAC9C,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,GAAG,EAAE,SAAS,KAAK,IAAI;YAClC,SAAS;SACV,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,6BAA6B,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,4BAA4B,CAAC,CAAC;IAC7D,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,6EAA6E;QAC7E,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,eAAe,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3B,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,6EAA6E;IAC7E,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,KAAK,IAAI,CAAC;IAC1C,IAAI,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC;QAC1B,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC;QACxB,YAAY,EAAE,IAAI;QAClB,SAAS;QACT,SAAS;QACT,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/governance/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAU,CAAC;AAyF7D;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAAY,UAAkB,EAAE,KAAc;QAC5C,KAAK,CACH,kBAAkB,UAAU,+BAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,wEAAwE;YACtE,mEAAmE;YACnE,iCAAiC,CACpC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,CACL,8BAA8B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wBAAwB;QACzE,wEAAwE;QACxE,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgC,EAAE;IAIlE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnD,IAAI,GAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,CAAC,UAAU,CAAuB,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAmC;IAEnC,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC;IACxD,MAAM,IAAI,GAAgB,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrE,MAAM,cAAc,GAClB,GAAG,EAAE,YAAY,KAAK,MAAM;QAC5B,GAAG,EAAE,YAAY,KAAK,KAAK;QAC3B,GAAG,EAAE,YAAY,KAAK,KAAK;QACzB,CAAC,CAAC,GAAG,CAAC,YAAY;QAClB,CAAC,CAAC,KAAK,CAAC;IACZ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,YAAY,EAAE,cAAc;YAC5B,iBAAiB,EAAE,KAAK;YACxB,eAAe,EAAE,KAAK;YACtB,aAAa,EAAE,KAAK;YACpB,gBAAgB,EAAE,QAAQ;YAC1B,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,KAAK;YAC3B,iBAAiB,EAAE,OAAO;YAC1B,iBAAiB,EAAE,MAAM;YACzB,iBAAiB,EAAE,KAAK;YACxB,oBAAoB,EAAE,IAAI;YAC1B,oBAAoB,EAAE,MAAM;YAC5B,oBAAoB,EAAE,MAAM;SAC7B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,YAAY,EAAE,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;QACvD,iBAAiB,EAAE,IAAI;QACvB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,UAAU;QAC5B,YAAY,EAAE,WAAW;QACzB,oBAAoB,EAAE,IAAI;QAC1B,iBAAiB,EAAE,MAAM;QACzB,iBAAiB,EAAE,QAAQ;QAC3B,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,KAAK;QAC3B,oBAAoB,EAAE,SAAS;QAC/B,oBAAoB,EAAE,QAAQ;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAsB,MAAM,CAAC,MAAM,CAC5D,cAAc,CAAC,SAAS,CAAC,CAC1B,CAAC;AACF,MAAM,CAAC,MAAM,gBAAgB,GAAsB,MAAM,CAAC,MAAM,CAC9D,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CACxC,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,CAAgC;IACzD,OAAO,CAAC,EAAE,IAAI,KAAK,UAAU,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,EAAE;AACF,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,6BAA6B;AAC7B,8EAA8E;AAE9E,IAAI,MAAM,GAAsB,cAAc,CAAC;AAE/C,MAAM,UAAU,gBAAgB,CAAC,CAAoB;IACnD,MAAM,GAAG,CAAC,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,6BAA6B;IAC3C,MAAM,GAAG,cAAc,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC5E,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;CACL,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM;IACN,OAAO;IACP,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC3E,UAAU;IACV,WAAW;IACX,MAAM;IACN,GAAG,2BAA2B;CAC/B,CAAC,CAAC;AAqCH;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA0B,EAC1B,GAAmC;IAEnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;QACvC,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5D,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;YAC9C,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,GAAG,EAAE,SAAS,KAAK,IAAI;YAClC,SAAS;SACV,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,6BAA6B,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,4BAA4B,CAAC,CAAC;IAC7D,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,6EAA6E;QAC7E,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,eAAe,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3B,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,6EAA6E;IAC7E,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,KAAK,IAAI,CAAC;IAC1C,IAAI,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC;QAC1B,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC;QACxB,YAAY,EAAE,IAAI;QAClB,SAAS;QACT,SAAS;QACT,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC"}
@@ -28,7 +28,17 @@ export declare function toAbsoluteRulePath(p: string): string;
28
28
  /** The secret-bearing paths (files, and directories as `<dir>/**`). */
29
29
  export declare function secretStorePaths(): string[];
30
30
  /**
31
- * `Read(...)` and `Edit(...)` deny rules for every secret store. Read rules
31
+ * Files that DEFINE governance (audit M4). Not secrets — an agent may read
32
+ * them — but an agent step allowed to write files (compat, or a governed
33
+ * write widening) could otherwise switch governance off by editing them:
34
+ * the kill switch (`config/flags.json`), the profile (`config.json`), the
35
+ * roster, worker manifests and trust checkpoints, installed recipes (their
36
+ * own `allowWrites` / `requireApproval`), and the evidence ledgers.
37
+ */
38
+ export declare function governanceStatePaths(): string[];
39
+ /**
40
+ * `Read(...)` and `Edit(...)` deny rules for every secret store, plus
41
+ * `Edit(...)` only for governance state. Read rules
32
42
  * also govern Glob, Grep and LS; Edit rules govern every write built-in.
33
43
  * Read per call, never cached: PATCHWORK_HOME is changed at runtime by the
34
44
  * CLI and by tests.
@@ -83,7 +83,33 @@ export function secretStorePaths() {
83
83
  return [...out];
84
84
  }
85
85
  /**
86
- * `Read(...)` and `Edit(...)` deny rules for every secret store. Read rules
86
+ * Files that DEFINE governance (audit M4). Not secrets — an agent may read
87
+ * them — but an agent step allowed to write files (compat, or a governed
88
+ * write widening) could otherwise switch governance off by editing them:
89
+ * the kill switch (`config/flags.json`), the profile (`config.json`), the
90
+ * roster, worker manifests and trust checkpoints, installed recipes (their
91
+ * own `allowWrites` / `requireApproval`), and the evidence ledgers.
92
+ */
93
+ export function governanceStatePaths() {
94
+ const out = new Set();
95
+ for (const r of [patchworkHome(), legacyPatchworkHome()]) {
96
+ for (const home of new Set([r, realOrSelf(r)])) {
97
+ out.add(join(home, "config.json"));
98
+ out.add(join(home, "config", "**"));
99
+ out.add(join(home, "members.json"));
100
+ out.add(join(home, "workers", "**"));
101
+ out.add(join(home, "worker_trust", "**"));
102
+ out.add(join(home, "recipes", "**"));
103
+ out.add(join(home, "*.jsonl"));
104
+ out.add(join(home, "*.jsonl.*"));
105
+ out.add(join(home, "run-ledgers", "**"));
106
+ }
107
+ }
108
+ return [...out];
109
+ }
110
+ /**
111
+ * `Read(...)` and `Edit(...)` deny rules for every secret store, plus
112
+ * `Edit(...)` only for governance state. Read rules
87
113
  * also govern Glob, Grep and LS; Edit rules govern every write built-in.
88
114
  * Read per call, never cached: PATCHWORK_HOME is changed at runtime by the
89
115
  * CLI and by tests.
@@ -94,6 +120,9 @@ export function secretPathDenyRules() {
94
120
  const rp = toAbsoluteRulePath(p);
95
121
  rules.push(`Read(${rp})`, `Edit(${rp})`);
96
122
  }
123
+ for (const p of governanceStatePaths()) {
124
+ rules.push(`Edit(${toAbsoluteRulePath(p)})`);
125
+ }
97
126
  return rules;
98
127
  }
99
128
  //# sourceMappingURL=secretPathDenies.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"secretPathDenies.js","sourceRoot":"","sources":["../../src/governance/secretPathDenies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1E,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,CAAC,6DAA6D;IACzE,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,oEAAoE;IACpE,mDAAmD;IACnD,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;QACzD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,2BAA2B;QACjE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,mCAAmC;QACxE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,yBAAyB;QAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,2BAA2B;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,YAAY,EAAE,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC;QAC3B,eAAe,EAAE;QACjB,UAAU,CAAC,eAAe,EAAE,CAAC;KAC9B,CAAC,EAAE,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,wBAAwB;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,sCAAsC;IAC5E,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
1
+ {"version":3,"file":"secretPathDenies.js","sourceRoot":"","sources":["../../src/governance/secretPathDenies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1E,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,CAAC,6DAA6D;IACzE,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,oEAAoE;IACpE,mDAAmD;IACnD,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;QACzD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,2BAA2B;QACjE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,mCAAmC;QACxE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,yBAAyB;QAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,2BAA2B;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,YAAY,EAAE,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC;QAC3B,eAAe,EAAE;QACjB,UAAU,CAAC,eAAe,EAAE,CAAC;KAC9B,CAAC,EAAE,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,wBAAwB;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,sCAAsC;IAC5E,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YACpC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;YACpC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YAC/B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,oBAAoB,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,QAAQ,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
package/dist/index.js CHANGED
@@ -294,7 +294,7 @@ if (process.argv[2] === "--help" ||
294
294
  `Recipes\n` +
295
295
  ` recipe new <name> [-i] Scaffold a recipe\n` +
296
296
  ` recipe list List installed recipes\n` +
297
- ` recipe run <name> [--vars k=v] Run a recipe by name\n` +
297
+ ` recipe run <name> [--var k=v]... Run a recipe by name\n` +
298
298
  ` recipe install <source> Install from a path or GitHub source\n` +
299
299
  ` recipe --help Full recipe subcommand index\n\n` +
300
300
  `Connectors\n` +
@@ -339,7 +339,7 @@ if (process.argv[2] === "--help" ||
339
339
  `Daemon (no subcommand)\n` +
340
340
  ` --workspace <dir> Start the bridge in foreground\n` +
341
341
  ` --watch Auto-restart supervisor\n` +
342
- ` --slim 27 IDE-only tools (default: full)\n\n` +
342
+ ` --slim IDE-only tools (default: full)\n\n` +
343
343
  `Other\n` +
344
344
  ` --version, -v Print package version\n` +
345
345
  ` shim stdio↔WebSocket shim (used by MCP clients)\n` +
@@ -405,7 +405,7 @@ Options:
405
405
  --dashboard-port <N> Dashboard port (default: 3200)
406
406
  --notify <topic> Push notifications via ntfy.sh
407
407
  --vps <user@host> SSH reverse tunnel for stable claude.ai URL
408
- --slim Slim mode (27 IDE-exclusive tools only — overrides default)
408
+ --slim Slim mode (IDE-exclusive tools only — overrides default)
409
409
  --help, -h Show this help
410
410
 
411
411
  This is a thin wrapper over \`start-all\`. For advanced flags see:
@@ -841,7 +841,9 @@ if (process.argv[2] === "gen-plugin-stub") {
841
841
  description: "A Claude IDE Bridge plugin",
842
842
  entrypoint: "./index.mjs",
843
843
  toolNamePrefix: toolPrefix,
844
- minBridgeVersion: "2.1.24",
844
+ // The bridge that generated the stub. A hardcoded "2.1.24" from an
845
+ // older version line made every scaffolded plugin warn on load.
846
+ minBridgeVersion: PACKAGE_VERSION.split("-")[0],
845
847
  };
846
848
  writeFileSync(path.join(outDir, "claude-ide-bridge-plugin.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf-8");
847
849
  // ── shared tool body — same logic, different surface syntax ──
@@ -871,11 +873,22 @@ export function register(ctx) {
871
873
  name: { type: "string", description: "Name to greet" },
872
874
  },
873
875
  },
876
+ // Declare the shape you return; the bridge validates
877
+ // structuredContent against it. Built-in tools are required to.
878
+ outputSchema: {
879
+ type: "object",
880
+ properties: { greeting: { type: "string" } },
881
+ required: ["greeting"],
882
+ },
874
883
  annotations: { readOnlyHint: true },
875
884
  },
876
- handler: async (args, _signal) => ({
877
- content: [{ type: "text", text: "Hello from " + ${JSON.stringify(pluginName)} + ", " + args.name + "!" }],
878
- }),
885
+ handler: async (args, _signal) => {
886
+ const greeting = "Hello from " + ${JSON.stringify(pluginName)} + ", " + args.name + "!";
887
+ return {
888
+ content: [{ type: "text", text: greeting }],
889
+ structuredContent: { greeting },
890
+ };
891
+ },
879
892
  },
880
893
  ],
881
894
  };
@@ -911,16 +924,22 @@ export function register(ctx: PluginContext) {
911
924
  name: { type: "string" as const, description: "Name to greet" },
912
925
  },
913
926
  },
927
+ // Declare the shape you return; the bridge validates
928
+ // structuredContent against it. Built-in tools are required to.
929
+ outputSchema: {
930
+ type: "object" as const,
931
+ properties: { greeting: { type: "string" as const } },
932
+ required: ["greeting"],
933
+ },
914
934
  annotations: { readOnlyHint: true },
915
935
  },
916
- handler: async (args: HelloArgs) => ({
917
- content: [
918
- {
919
- type: "text" as const,
920
- text: \`Hello from ${pluginName}, \${args.name}!\`,
921
- },
922
- ],
923
- }),
936
+ handler: async (args: HelloArgs) => {
937
+ const greeting = \`Hello from ${pluginName}, \${args.name}!\`;
938
+ return {
939
+ content: [{ type: "text" as const, text: greeting }],
940
+ structuredContent: { greeting },
941
+ };
942
+ },
924
943
  },
925
944
  ],
926
945
  };
@@ -1517,9 +1536,13 @@ if (process.argv[2] === "suggest") {
1517
1536
  for (let i = 0; i < args.length; i++) {
1518
1537
  const a = args[i];
1519
1538
  if (a === "--since-days") {
1520
- const next = args[i + 1];
1521
- if (next)
1522
- sinceDays = Number.parseInt(next, 10);
1539
+ const { parseSinceDays } = await import("./commands/sinceDays.js");
1540
+ const parsed = parseSinceDays(args.slice(i, i + 2));
1541
+ if (!parsed.ok) {
1542
+ process.stderr.write(`patchwork suggest: ${parsed.error}\n`);
1543
+ process.exit(2);
1544
+ }
1545
+ sinceDays = parsed.days;
1523
1546
  i++;
1524
1547
  }
1525
1548
  else if (a === "--help" || a === "-h") {
@@ -5350,11 +5373,25 @@ if (process.argv[2] === "privacy") {
5350
5373
  destinationFactsByDriver,
5351
5374
  ...(cfg.privacy?.notes && { notes: cfg.privacy.notes }),
5352
5375
  });
5376
+ const { describeOrchestratorPath } = await import("./privacy/describeDestinations.js");
5377
+ const orchestrator = describeOrchestratorPath(cfg.privacy
5378
+ ?.orchestrator?.classification);
5353
5379
  if (args.includes("--json")) {
5380
+ // The array shape is unchanged for existing readers; what it cannot
5381
+ // carry goes to stderr so it is never silent (audit M9).
5354
5382
  process.stdout.write(`${JSON.stringify(described, null, 2)}\n`);
5383
+ for (const i of registry.invalid) {
5384
+ process.stderr.write(`[privacy] destination "${i.id}" could not be parsed and is not used: ${i.reason}\n`);
5385
+ }
5386
+ if (orchestrator.state === "malformed") {
5387
+ process.stderr.write(`[privacy] privacy.orchestrator.classification is ${orchestrator.raw}: not a known classification, so orchestrator tasks are NOT enforced\n`);
5388
+ }
5355
5389
  }
5356
5390
  else {
5357
- process.stdout.write(`${formatDestinationsReport(described)}\n`);
5391
+ process.stdout.write(`${formatDestinationsReport(described, {
5392
+ invalid: registry.invalid,
5393
+ orchestrator,
5394
+ })}\n`);
5358
5395
  }
5359
5396
  // Always 0: an inert boundary and a wide-open one are both legitimate
5360
5397
  // operator states, and exiting non-zero on either would make a correct
@@ -5394,10 +5431,14 @@ if (process.argv[2] === "privacy") {
5394
5431
  // do" — the question the boundary was built to make answerable, and the
5395
5432
  // one nothing in this repo could answer until now (ADR-0019:88-92).
5396
5433
  const { summariseBoundaryReceipts, formatBoundaryReceipts } = await import("./privacy/boundaryReceipts.js");
5397
- const i = args.indexOf("--since-days");
5398
- const n = i !== -1 ? Number(args[i + 1]) : undefined;
5399
- const summary = summariseBoundaryReceipts(n !== undefined && Number.isFinite(n) && n > 0
5400
- ? { since: Date.now() - n * 86_400_000 }
5434
+ const { parseSinceDays } = await import("./commands/sinceDays.js");
5435
+ const since = parseSinceDays(args);
5436
+ if (!since.ok) {
5437
+ process.stderr.write(`patchwork privacy receipts: ${since.error}\n`);
5438
+ process.exit(2);
5439
+ }
5440
+ const summary = summariseBoundaryReceipts(since.days !== undefined
5441
+ ? { since: Date.now() - since.days * 86_400_000 }
5401
5442
  : {});
5402
5443
  if (args.includes("--json")) {
5403
5444
  process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
@@ -5411,6 +5452,8 @@ if (process.argv[2] === "privacy") {
5411
5452
  process.stderr.write("Usage: patchwork privacy receipts [--since-days N] [--json]\n" +
5412
5453
  " patchwork privacy shadow [--since-days N] [--json]\n" +
5413
5454
  " patchwork privacy suggest [--json]\n" +
5455
+ " patchwork privacy destinations [--json]\n" +
5456
+ " patchwork privacy undeclared [--dir <path>] [--json]\n" +
5414
5457
  "\n" +
5415
5458
  " Observes boundary decisions WITHOUT enforcing them. Configure a\n" +
5416
5459
  " candidate policy under `privacy.shadow.destinations` in config.json;\n" +
@@ -5418,10 +5461,14 @@ if (process.argv[2] === "privacy") {
5418
5461
  process.exit(2);
5419
5462
  }
5420
5463
  const { summarisePrivacyShadow, formatPrivacyShadow } = await import("./privacy/shadowLog.js");
5421
- const idx = args.indexOf("--since-days");
5422
- const days = idx !== -1 ? Number(args[idx + 1]) : undefined;
5423
- const summary = summarisePrivacyShadow(days !== undefined && Number.isFinite(days) && days > 0
5424
- ? { since: Date.now() - days * 86_400_000 }
5464
+ const { parseSinceDays } = await import("./commands/sinceDays.js");
5465
+ const since = parseSinceDays(args);
5466
+ if (!since.ok) {
5467
+ process.stderr.write(`patchwork privacy shadow: ${since.error}\n`);
5468
+ process.exit(2);
5469
+ }
5470
+ const summary = summarisePrivacyShadow(since.days !== undefined
5471
+ ? { since: Date.now() - since.days * 86_400_000 }
5425
5472
  : {});
5426
5473
  if (args.includes("--json")) {
5427
5474
  process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);