pi-daddy 0.27.4 → 0.32.0

package/dist/propagation.js

@@ -1,279 +0,0 @@
-/**
- * Race-free grant propagation.
- *
- * The first implementation wrote each child's computed grant into `process.env` inside the `tool_call`
- * handler. The environment is process-global, so two concurrent spawns could read each other's values —
- * a real hole in a security control.
- *
- * The fix removes the need for a per-child channel entirely, rather than trying to build one:
- *
- *   1. Everything pushed to children is a property of the PARENT, not of the individual spawn — the
- *      parent's own grant, the child depth (parent depth + 1), and the configured bounds. Those are
- *      identical for every sibling, so concurrent spawns cannot disagree and there is nothing to race.
- *      `ENV_APPROVED` (approvals a human granted at or above this level) is safe on the same global
- *      channel for the same reason: it is intersected with the parent's own grant before being written,
- *      which is itself a parent-level fact, so it too is identical for every sibling.
- *   2. Each child derives ITS OWN grant on arrival: `inheritedParentGrant ∩ ownObservedTools`, where the
- *      observed set comes from the `tools` array of its first provider request — authoritative, because
- *      it is literally what pi sent the model.
- *
- * The environment is therefore written ONCE per session, before any spawn can occur (the first provider
- * request precedes any tool call), and never mutated per spawn.
- *
- * The invariant still holds transitively: own = observed ∩ inheritedParent ⊆ inheritedParent, so no
- * descendant can exceed the root. It is also defence in depth — even if a spawn slipped past the
- * interceptor and pi handed the child more than the parent held, the intersection clamps it back.
- */
-import { WILDCARD } from "./pi-tools.js";
-import { WORKSPACE_WILDCARD } from "./resolve.js";
-import { inheritApprovals } from "./approval.js";
-import { assertCapabilitiesArePropagatable } from "./capabilities.js";
-export const ENV_GRANT = "PI_GRANTS_GRANT";
-/**
- * Total descendants this session may create in its whole subtree (`src/fanout.ts`).
- *
- * In `GRANT_ENV_KEYS` and therefore stripped from a child's environment and re-supplied only by the spawn
- * plan — like depth, and for the same reason: it is capability state that must ATTENUATE downward, not an
- * operator preference that should inherit. `PI_GRANTS_CHILD_TIMEOUT` is deliberately the other kind.
- */
-export const ENV_FANOUT = "PI_GRANTS_FANOUT";
-/**
- * This session's ledger id, so a child's records name their real parent (review finding F8).
- *
- * Without it every level restarts at `d0` and the ledger cannot be joined into a tree across processes.
- */
-export const ENV_PARENT_ID = "PI_GRANTS_PARENT_ID";
-/** Unique identity of this governed execution occurrence; unlike ENV_PARENT_ID it is never reused. */
-export const ENV_EXECUTION_ID = "PI_GRANTS_EXECUTION_ID";
-export const ENV_DEPTH = "PI_GRANTS_DEPTH";
-export const ENV_MAX_DEPTH = "PI_GRANTS_MAX_DEPTH";
-export const ENV_GATED = "PI_GRANTS_GATED";
-export const ENV_LEDGER = "PI_GRANTS_LEDGER";
-export const ENV_APPROVED = "PI_GRANTS_APPROVED";
-/**
- * Every variable this package uses to push governance state at a child.
- *
- * Named as a set so `mergeChildEnv` can guarantee that none of them survives from the parent's own
- * environment into a child's — a governance variable a child inherits by accident is one nobody decided
- * to give it.
- */
-export const GRANT_ENV_KEYS = [
-    ENV_GRANT,
-    ENV_DEPTH,
-    ENV_MAX_DEPTH,
-    ENV_GATED,
-    ENV_LEDGER,
-    ENV_APPROVED,
-    ENV_FANOUT,
-    ENV_PARENT_ID,
-    ENV_EXECUTION_ID,
-];
-export const parseList = (raw) => (raw ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
-/** Does a bare pi tool name correspond to this capability? `read` matches `tool:read` and `ext:pkg/read`. */
-function matchesToolName(capability, toolName) {
-    if (capability === `tool:${toolName}`)
-        return true;
-    return capability.startsWith("ext:") && capability.slice(capability.lastIndexOf("/") + 1) === toolName;
-}
-/**
- * Is this capability something an observed tool array can speak about at all? (R-36, ADR-0017 step 1.)
- *
- * `tool:` and `ext:` name tools, so a tool array that omits one is evidence the session does not have it.
- * `skill:` and `agent:` name a loadable instruction file and a spawnable definition — neither is ever a
- * tool, so an observation says **nothing** about them and must not be read as evidence of absence.
- */
-const isToolCapability = (capability) => capability.startsWith("tool:") || capability.startsWith("ext:");
-/**
- * Derive this session's own grant from what it inherited and what pi actually gave it.
- *
- * `observedTools` is the bare tool-name list from the session's own provider payload, or null when it
- * has not been observed yet — in which case the inherited grant is used unchanged (it is already an
- * upper bound, so this is safe, just less tight).
- *
- * A wildcard holder stays a wildcard holder: an enumerated observation must not silently downgrade an
- * explicitly unlimited grant, or a root session would lose the authority it was configured with.
- *
- * **R-36 / ADR-0017 step 1: only tool-shaped capabilities are filtered.** The observation is a list of
- * TOOLS, so it is evidence about `tool:` and `ext:` and about nothing else. Until this was fixed, a child
- * inheriting `tool:read, skill:review` held only `tool:read` from its first provider request onward — it
- * still *had* the skill (it arrives as `--skill`), but could not re-grant it and `/grants` stopped listing
- * it. Silently, and in the narrowing direction, which is why it survived: nothing fails when a grant
- * quietly shrinks. It also made ADR-0017's `agent:` prerequisite unsatisfiable below the root.
- */
-export function deriveOwnGrant(inheritedParentGrant, observedTools) {
-    if (observedTools === null)
-        return [...inheritedParentGrant];
-    // Capabilities an observation cannot speak about ride through both branches untouched.
-    const nonTool = inheritedParentGrant.filter((c) => !isToolCapability(c) && c !== WILDCARD);
-    if (inheritedParentGrant.includes(WILDCARD)) {
-        // Keep the wildcard, and additionally enumerate what was observed so descendants can be checked
-        // against concrete names too.
-        const enumerated = observedTools.map((t) => `tool:${t}`);
-        return [...new Set([WILDCARD, ...enumerated, ...nonTool])].sort();
-    }
-    return [
-        ...inheritedParentGrant.filter((c) => isToolCapability(c) && observedTools.some((t) => matchesToolName(c, t))),
-        ...nonTool,
-    ].sort();
-}
-/**
- * Parse a bound from the environment, distinguishing **absent** from **malformed**.
- *
- * G7 / A-S4 + B-I4. `Number.parseInt` is the wrong tool for reading configuration: it accepts a numeric
- * prefix (`parseInt("2abc")` is `2`), returns `NaN` for anything else, and `NaN` silently passes every
- * comparison as false — so a malformed `PI_GRANTS_MAX_DEPTH` did not tighten the limit, it removed it.
- *
- * The three-way return is the point. `undefined` means "not configured, use the documented default";
- * `null` means "configured wrongly", which callers must treat as a failure rather than a default,
- * because a value someone tried to set and mistyped is not the same as one they never set.
- */
-export function parseBound(raw) {
-    if (raw === undefined)
-        return undefined;
-    const trimmed = raw.trim();
-    // Exact non-negative decimal integers only: no signs, no fractions, no 0x, no numeric prefixes.
-    if (!/^\d+$/.test(trimmed))
-        return null;
-    const value = Number(trimmed);
-    return Number.isSafeInteger(value) ? value : null;
-}
-/**
- * Resolve this session's depth bounds, failing closed on anything malformed.
- *
- * **Malformed input disables spawning entirely (`maxDepth: 0`)** rather than falling back to a default,
- * and that applies to a bad `PI_GRANTS_DEPTH` just as much as a bad `PI_GRANTS_MAX_DEPTH`. The old
- * `|| 0` guard on depth failed open in a subtler way than the missing guard on maxDepth: a session that
- * could not read its own depth was treated as a **root**, which is the most permissive answer available
- * and precisely the value an attacker would choose. If we do not know how deep we are, we must not spawn.
- */
-export function depthConfig(depthRaw, maxDepthRaw) {
-    const depth = parseBound(depthRaw);
-    const maxDepth = parseBound(maxDepthRaw);
-    const malformed = [];
-    if (depth === null)
-        malformed.push(ENV_DEPTH);
-    if (maxDepth === null)
-        malformed.push(ENV_MAX_DEPTH);
-    if (malformed.length > 0)
-        return { depth: depth ?? 0, maxDepth: 0, malformed };
-    return { depth: depth ?? 0, maxDepth: maxDepth ?? DEFAULT_MAX_DEPTH, malformed };
-}
-/** The documented default child-depth bound when `PI_GRANTS_MAX_DEPTH` is not set. */
-export const DEFAULT_MAX_DEPTH = 2;
-/**
- * Gated by default in a governed session (ADR-0012).
- *
- * `bash` is not one capability among others; it is an execution primitive. A child holding it can run
- * `env -u PI_GRANTS_GRANT pi …` and obtain a completely **ungoverned** descendant — measured, not
- * theorised (`docs/probes/g5-bash-escape`). Handing that down silently is the thing worth changing.
- *
- * Subsumption-aware gating (also ADR-0012) means this single entry covers `write`, `edit`, `read`,
- * `grep`, `find` and `ls` as well, since `bash` confers all of them.
- */
-export const DEFAULT_GATED = ["tool:bash"];
-/**
- * Read the gate list, distinguishing **absent** from **explicitly empty**.
- *
- * `parseList` alone cannot: it maps both `undefined` and `""` to `[]`. That distinction is the operator's
- * only way to turn the default off — without it, someone who wants no gates would have to stop governing
- * altogether, which is strictly worse than the thing they were trying to avoid.
- */
-export function gatedFromEnv(raw) {
-    if (raw === undefined)
-        return [...DEFAULT_GATED];
-    return parseList(raw);
-}
-/**
- * The environment a child should inherit. Constant across all of this session's children by
- * construction, which is what makes concurrent spawning safe.
- *
- * **The wildcard is never inherited.** A root may HOLD `tool:*` — that is authority to grant anything —
- * but handing it down would let every descendant reacquire the full catalog, which makes attenuation
- * meaningless below the root. Children therefore inherit the ENUMERATED grant only.
- *
- * Consequence, deliberate: a wildcard root that has not yet observed its own tools hands children an
- * empty grant, so they can spawn nothing. That fails closed. It is also unreachable in normal flow,
- * because a session's first provider request always precedes its first tool call.
- */
-/**
- * The part of a grant a child may inherit: everything but the wildcards that are HELD, never handed down.
- *
- * `tool:*` for R-26's reason — a root that handed it down let every descendant reacquire the full catalog.
- * `workspace:*` for the same reason one namespace over (R-131): a descendant holding it could route anywhere
- * the registry lists, which is the attenuation failure ADR-0035 exists to close. `agent:*` is deliberately
- * NOT stripped — ADR-0023 decided that a session authorised for any definition passes that on, because
- * definitions are ceilings rather than roots.
- *
- * **Exported, and there is exactly one spelling of this rule on purpose.** It shipped as a filter inline in
- * `childEnv` and nowhere else, so a grant travelling the OTHER path — `delegate.ts` building a child's
- * `PI_GRANTS_GRANT` from `result.effective` — carried `workspace:*` straight down. The test written beside
- * that fix exercised `childEnv`, which is not the path a delegated child's grant travels, so it could not
- * catch it. R-28's shape: two routes for one rule, with the guard on the quieter one. Both call this now.
- */
-export function inheritableGrant(grant) {
-    return grant.filter((c) => c !== WILDCARD && c !== WORKSPACE_WILDCARD);
-}
-export function childEnv(input) {
-    if (input.governed === false)
-        return {};
-    const inheritable = inheritableGrant(input.ownGrant);
-    const env = {
-        [ENV_GRANT]: (assertCapabilitiesArePropagatable(inheritable), inheritable.join(",")),
-        [ENV_DEPTH]: String(input.depth + 1),
-        [ENV_MAX_DEPTH]: String(input.maxDepth),
-    };
-    if (input.gated.length > 0)
-        env[ENV_GATED] = input.gated.join(",");
-    // ALWAYS written, empty string included. This is the one value that changes during a session (a human
-    // approves something, or the session's own grant narrows on observation), and the interceptor path
-    // publishes it by ASSIGNING into the process-global `process.env`. Omitting it when empty would leave
-    // whatever was there before — the parent's own, unclamped `PI_GRANTS_APPROVED` — visible to every child.
-    // `parseList("")` is `[]`, so an empty value reads back exactly as an absent one.
-    env[ENV_APPROVED] = inheritApprovals(input.approved ?? [], inheritable).join(",");
-    // Empty is an explicit one-run ledger opt-out and must overwrite a prior publication too.
-    if (input.ledgerPath !== undefined)
-        env[ENV_LEDGER] = input.ledgerPath;
-    return env;
-}
-/**
- * The environment for a child this process spawns itself: the parent's environment with every governance
- * variable stripped, then the per-child plan applied.
- *
- * Spreading `{ ...process.env, ...plan.env }` is not enough. `plan.env` omits keys that do not apply to
- * this child (an empty approval set, no gated list), and an omitted key does not overwrite — so the
- * parent's own value survives into the child. Stripping first makes the plan the ONLY source of every
- * governance variable, which is what `delegate.ts`'s "nothing is written to the shared `process.env`"
- * claim actually requires. Consumers re-clamp anyway; this is the defence in depth behind that.
- */
-export function mergeChildEnv(parentEnv, planEnv) {
-    const merged = { ...parentEnv };
-    for (const key of GRANT_ENV_KEYS)
-        delete merged[key];
-    return { ...merged, ...planEnv };
-}
-/** Extract bare tool names from a provider payload's tool array, tolerating provider shape differences. */
-export function observeToolNames(payload) {
-    if (!payload || typeof payload !== "object")
-        return null;
-    const record = payload;
-    for (const key of ["tools", "functions"]) {
-        const candidate = record[key];
-        if (!Array.isArray(candidate))
-            continue;
-        const names = candidate
-            .map((entry) => {
-            if (!entry || typeof entry !== "object")
-                return undefined;
-            const e = entry;
-            // Anthropic/OpenAI tool objects, and OpenAI's nested `function.name` form.
-            const nested = e.function;
-            const name = e.name ?? nested?.name;
-            return typeof name === "string" ? name : undefined;
-        })
-            .filter((n) => Boolean(n));
-        // An empty tools array is a real observation (the session has no tools), not a failure to observe.
-        return names;
-    }
-    return null;
-}
-//# sourceMappingURL=propagation.js.map

package/dist/propagation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"propagation.js","sourceRoot":"","sources":["../src/propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAA4B,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AAEtE,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAC3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAC7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,sGAAsG;AACtG,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAC3C,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,UAAU;IACV,YAAY;IACZ,UAAU;IACV,aAAa;IACb,gBAAgB;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAuB,EAAgB,EAAE,CACjE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAE1E,6GAA6G;AAC7G,SAAS,eAAe,CAAC,UAAsB,EAAE,QAAgB;IAC/D,IAAI,UAAU,KAAK,QAAQ,QAAQ,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC;AACzG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,UAAsB,EAAW,EAAE,CAC3D,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,oBAAkC,EAClC,aAA8B;IAE9B,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,oBAAoB,CAAC,CAAC;IAC7D,uFAAuF;IACvF,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC3F,IAAI,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,gGAAgG;QAChG,8BAA8B;QAC9B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO;QACL,GAAG,oBAAoB,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAC/E;QACD,GAAG,OAAO;KACX,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,GAAuB;IAChD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,gGAAgG;IAChG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,QAA4B,EAAE,WAA+B;IACvF,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,IAAI;QAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAErD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,IAAI,iBAAiB,EAAE,SAAS,EAAE,CAAC;AACnF,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAiB,CAAC,WAAW,CAAC,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAqCD;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAoB;IAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,GAAG,GAA2B;QAClC,CAAC,SAAS,CAAC,EAAE,CAAC,iCAAiC,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpF,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QACpC,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;KACxC,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,sGAAsG;IACtG,mGAAmG;IACnG,sGAAsG;IACtG,yGAAyG;IACzG,kFAAkF;IAClF,GAAG,CAAC,YAAY,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,0FAA0F;IAC1F,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,SAA4B,EAC5B,OAA+B;IAE/B,MAAM,MAAM,GAAsB,EAAE,GAAG,SAAS,EAAE,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,cAAc;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,SAAS;aACpB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;YAC3C,2EAA2E;YAC3E,MAAM,MAAM,GAAG,CAAC,CAAC,QAA+C,CAAC;YACjE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,EAAE,IAAI,CAAC;YACpC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,mGAAmG;QACnG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/refusals.d.ts

@@ -1,16 +0,0 @@
-export declare const REFUSAL_CODES: readonly ["CAPABILITY_ESCALATION", "GRANT_ID_MALFORMED", "DEFINITION_NOT_AUTHORIZED", "UNDECLARED_TOOLS", "UNKNOWN_TOOL", "GATED_UNAPPROVED", "APPROVAL_EXPIRED", "APPROVAL_SCOPE_MISMATCH", "APPROVAL_FLOW_FAILED", "DEPTH_EXCEEDED", "FANOUT_EXCEEDED", "EXECUTOR_UNAVAILABLE", "MODEL_UNRESOLVED", "GRANT_STORE_INVALID", "CHILD_TIMED_OUT", "CHILD_CANCELLED", "CHILD_EXIT_NONZERO", "TASK_MISSING", "UNKNOWN_DEFINITION", "CEILING_PATTERNS_UNRESOLVED", "NARROWING_VIOLATED", "DEFINITION_UNREADABLE", "CORRELATION_TOO_LARGE", "CORRELATION_INVALID", "LEDGER_WRITE_FAILED", "FANOUT_FAILED", "WORKSPACE_NOT_REGISTERED", "WORKSPACE_NOT_AUTHORIZED", "WORKSPACE_WRITE_CONFLICT", "WORKSPACE_LEASE_STALE", "CHECK_NOT_CONFIGURED", "CHECK_CONFIGURATION_INVALID", "CHECK_IDENTITY_UNAVAILABLE", "CHECK_IDENTITY_MISMATCH"];
-export type RefusalCode = (typeof REFUSAL_CODES)[number];
-export interface StructuredRefusal {
-    code: RefusalCode;
-    /** Existing actionable diagnostic. Codes accompany rather than replace it. */
-    message: string;
-    details?: Record<string, string | number | boolean | null>;
-}
-export declare function refusal(code: RefusalCode, message: string, details?: StructuredRefusal["details"]): StructuredRefusal;
-/** Error shape for API callers. pi-facing tools still throw, as pi requires, while retaining a stable code. */
-export declare class GovernanceRefusal extends Error {
-    readonly code: RefusalCode;
-    readonly details?: StructuredRefusal["details"];
-    constructor(value: StructuredRefusal);
-}
-//# sourceMappingURL=refusals.d.ts.map

package/dist/refusals.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"refusals.d.ts","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,myBAuChB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,WAAW,CAAC;IAClB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CAC5D;AAED,wBAAgB,OAAO,CACrB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,GACrC,iBAAiB,CAEnB;AAED,+GAA+G;AAC/G,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAEpC,KAAK,EAAE,iBAAiB;CAMrC"}

package/dist/refusals.js

@@ -1,55 +0,0 @@
-export const REFUSAL_CODES = [
-    "CAPABILITY_ESCALATION",
-    "GRANT_ID_MALFORMED",
-    "DEFINITION_NOT_AUTHORIZED",
-    "UNDECLARED_TOOLS",
-    "UNKNOWN_TOOL",
-    "GATED_UNAPPROVED",
-    "APPROVAL_EXPIRED",
-    "APPROVAL_SCOPE_MISMATCH",
-    "APPROVAL_FLOW_FAILED",
-    "DEPTH_EXCEEDED",
-    "FANOUT_EXCEEDED",
-    "EXECUTOR_UNAVAILABLE",
-    "MODEL_UNRESOLVED",
-    "GRANT_STORE_INVALID",
-    // Execution-phase outcomes. Without these, an external controller could distinguish a policy refusal
-    // from an internal error but not a lost writer lease from a user pressing stop (R-103).
-    "CHILD_TIMED_OUT",
-    "CHILD_CANCELLED",
-    "CHILD_EXIT_NONZERO",
-    // Planner refusals that previously carried a message and no code at all — including the narrowing
-    // violation, which is the hardest rule this package enforces (R-109).
-    "TASK_MISSING",
-    "UNKNOWN_DEFINITION",
-    "CEILING_PATTERNS_UNRESOLVED",
-    "NARROWING_VIOLATED",
-    "DEFINITION_UNREADABLE",
-    "CORRELATION_TOO_LARGE",
-    "CORRELATION_INVALID",
-    "LEDGER_WRITE_FAILED",
-    "FANOUT_FAILED",
-    "WORKSPACE_NOT_REGISTERED",
-    "WORKSPACE_NOT_AUTHORIZED",
-    "WORKSPACE_WRITE_CONFLICT",
-    "WORKSPACE_LEASE_STALE",
-    "CHECK_NOT_CONFIGURED",
-    "CHECK_CONFIGURATION_INVALID",
-    "CHECK_IDENTITY_UNAVAILABLE",
-    "CHECK_IDENTITY_MISMATCH",
-];
-export function refusal(code, message, details) {
-    return { code, message, ...(details && Object.keys(details).length > 0 ? { details: { ...details } } : {}) };
-}
-/** Error shape for API callers. pi-facing tools still throw, as pi requires, while retaining a stable code. */
-export class GovernanceRefusal extends Error {
-    code;
-    details;
-    constructor(value) {
-        super(value.message);
-        this.name = "GovernanceRefusal";
-        this.code = value.code;
-        this.details = value.details;
-    }
-}
-//# sourceMappingURL=refusals.js.map

package/dist/refusals.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"refusals.js","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,uBAAuB;IACvB,oBAAoB;IACpB,2BAA2B;IAC3B,kBAAkB;IAClB,cAAc;IACd,kBAAkB;IAClB,kBAAkB;IAClB,yBAAyB;IACzB,sBAAsB;IACtB,gBAAgB;IAChB,iBAAiB;IACjB,sBAAsB;IACtB,kBAAkB;IAClB,qBAAqB;IACrB,qGAAqG;IACrG,wFAAwF;IACxF,iBAAiB;IACjB,iBAAiB;IACjB,oBAAoB;IACpB,kGAAkG;IAClG,sEAAsE;IACtE,cAAc;IACd,oBAAoB;IACpB,6BAA6B;IAC7B,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,qBAAqB;IACrB,qBAAqB;IACrB,eAAe;IACf,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,uBAAuB;IACvB,sBAAsB;IACtB,6BAA6B;IAC7B,4BAA4B;IAC5B,yBAAyB;CACjB,CAAC;AAWX,MAAM,UAAU,OAAO,CACrB,IAAiB,EACjB,OAAe,EACf,OAAsC;IAEtC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED,+GAA+G;AAC/G,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAc;IAClB,OAAO,CAAgC;IAEhD,YAAY,KAAwB;QAClC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC/B,CAAC;CACF"}

package/dist/resolve.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,yFAAyF;AACzF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,UAAU,EAGvD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAC,CAU3E,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CAMhE;AAKD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,EAAE,UAAsB,CAAC;AACpD;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAAE,UAA0B,CAAC;AAE5D,MAAM,WAAW,YAAY;IAC3B,yDAAyD;IACzD,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,sGAAsG;IACtG,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,6FAA6F;IAC7F,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,6FAA6F;IAC7F,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,2FAA2F;IAC3F,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,wEAAwE;IACxE,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,oDAAoD;IACpD,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,+EAA+E;IAC/E,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB;;;OAGG;IACH,UAAU,EAAE,UAAU,EAAE,CAAC;CAC1B;AAID;;;GAGG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,aAAa,CAkG1D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,UAAQ,GAAG,IAAI,CAQnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAQ3E"}

package/dist/resolve.js

@@ -1,211 +0,0 @@
-/**
- * Grant resolution — the entire security surface of capability governance, as a pure function.
- *
- * The invariant (ADR-0008): a capability set may only ever SHRINK as it passes down a delegation
- * tree. Escalation is impossible by construction rather than by policy, because a parent can never
- * confer what it does not itself hold.
- *
- *   effective = ( requested ∩ parentGrant ∩ ceiling ) \ (gated \ approved)
- *
- * Being pure — no I/O, no model, no network — this is exhaustively testable, which matters because it
- * is the only place an escalation could be introduced.
- */
-/**
- * Capabilities that transitively confer everything else. Granting one is equivalent to granting the
- * whole catalog, so they can never be a *narrowing* grant.
- *
- * `ext:pi-fabric/fabric_exec` is here on measured evidence, not suspicion: a child granted
- * `tools: []` (nothing at all) plus `recursive: true` still reached `pi.write` and `pi.bash` and
- * spawned a grandchild that wrote to disk. See docs/probes/pi-fabric-eval (probes 2, 4, 7, 8).
- */
-export const UNIVERSAL_CAPABILITIES = [
-    "ext:pi-fabric/fabric_exec",
-    "tool:fabric_exec",
-];
-/**
- * Capabilities that functionally contain others.
- *
- * `bash` can run `grep`, `find`, `ls`, `cat`, and `sed` — so a session holding it can already do
- * everything the file and search tools do, whatever the tool list says. Modelling this explicitly serves
- * two purposes:
- *
- *  1. It removes false escalation reports. pi's *default* surface is only `read`, `bash`, `edit`, `write`
- *     (measured, not assumed), so an agent type declaring `tools: read, grep, find, ls` would otherwise
- *     look like an escalation from any normal parent — despite being strictly weaker.
- *  2. It makes the uncomfortable truth visible rather than implied: **a grant containing `bash` is not a
- *     narrow grant.** `subsumedBy` in the result says so, so a reviewer can see what the grant really means.
- */
-export const SUBSUMPTION = {
-    "tool:bash": [
-        "tool:grep",
-        "tool:find",
-        "tool:ls",
-        "tool:read",
-        "tool:write",
-        "tool:edit",
-        "tool:edit-diff",
-    ],
-};
-/** Expand a grant to everything it functionally confers. */
-export function expandSubsumed(grant) {
-    const expanded = new Set(grant);
-    for (const held of grant) {
-        for (const implied of SUBSUMPTION[held] ?? [])
-            expanded.add(implied);
-    }
-    return [...expanded].sort();
-}
-import { WILDCARD } from "./pi-tools.js";
-import { isWellFormedCapability } from "./capabilities.js";
-/**
- * "Any definition" — ADR-0023, and one of two wildcards this module understands.
- *
- * Declared here rather than beside `WILDCARD` because `pi-tools.ts` imports `Capability` from this module.
- * That import is `import type`, so it is erased and the runtime dependency runs one way only — which is
- * what makes importing `WILDCARD` back safe.
- *
- * Deliberately weaker than `tool:*`: it confers **no tool authority**, so `agent:*,tool:read` may spawn
- * every definition on disk and hand each of them nothing but `read`. It exists because the alternative was
- * `tool:*` — authority to grant every tool — which made the safe configuration the laborious one.
- */
-export const AGENT_WILDCARD = "agent:*";
-/**
- * `workspace:*` covers any `workspace:<id>` — ADR-0035, and the second namespace wildcard.
- *
- * Added as a deliberate edit, which is what the comment in `resolve()` below asks for: there is no
- * generalised `<ns>:*` rule, so a namespace does not acquire a wildcard by existing. Unlike `agent:*` this
- * one is **not inheritable** (`childEnv` strips it) — R-26's rule, because a root that handed
- * `workspace:*` down would make routing attenuation meaningless below the root, which is the exact defect
- * R-131 records.
- */
-export const WORKSPACE_WILDCARD = "workspace:*";
-const unique = (xs) => [...new Set(xs)].sort();
-/**
- * Resolve a child's grant. Total and side-effect free; every rejected capability is reported rather
- * than silently dropped, because a grant nobody can audit proves nothing.
- */
-export function resolve(input) {
-    const requested = unique(input.requested);
-    const held = new Set(input.parentGrant);
-    const parent = input.subsumption === false ? held : new Set(expandSubsumed(input.parentGrant));
-    /**
-     * `agent:*` covers any `agent:<name>` — ADR-0023. It was the only wildcard rule in this function when
-     * that was written; ADR-0035 added a third, so `covered()` now has `tool:*`, `agent:*` and `workspace:*`.
-     * There is still no GENERALISED `<ns>:*` rule: each is a deliberate edit, which is the property worth
-     * keeping. Corrected because the sentence sat eighty lines above "all THREE wildcards are excluded".
-     *
-     * `resolve` is otherwise exact-match plus subsumption, deliberately: `tool:*` works not because anything
-     * here understands it, but because `deriveOwnGrant` *enumerates* a session's observed tool names beside
-     * it. Definitions are not tools, so nothing enumerates them — which is why `maySpawnDefinition` had to
-     * special-case the wildcard, and why this needs stating rather than falling out.
-     *
-     * Scoped to one namespace on purpose. There is no generalised `<ns>:*` rule, so a namespace added later
-     * does not silently acquire a wildcard; adding one is a deliberate edit and another decision.
-     */
-    const anyDefinition = held.has(AGENT_WILDCARD);
-    /**
-     * `tool:*` satisfies **any** capability, including `skill:` and `agent:` ids.
-     *
-     * Missing until 0.11.2, and the omission broke the one rule this package must never break by accident:
-     * *governance is opt-in*. An ungoverned session holds `[tool:*, …observed tools]` and nothing else, so
-     * spawning a definition whose `allowed-tools` names `agent:worker` or `skill:review` — the composition
-     * ADR-0017 created and ADR-0023's own example uses — was refused with **"capability escalation
-     * blocked"**, and recorded as an escalation attempt, in a session that had opted out.
-     *
-     * `maySpawnDefinition` had always honoured `tool:*` for definition ids and `docs/SPEC.md` had always
-     * claimed it "satisfies any capability". This function disagreed with both, which is R-28's shape: two
-     * spellings of one rule, and the enforcing one was wrong.
-     */
-    const anyCapability = held.has(WILDCARD);
-    const anyWorkspace = held.has(WORKSPACE_WILDCARD);
-    // A malformed id is never covered — not by an exact hold, and above all not by a wildcard's PREFIX rule,
-    // which is how `agent:x,tool:bash` got admitted and then split into two capabilities in the child.
-    // Landing in `denied` is the right outcome rather than a throw: it fails closed AND records an
-    // escalation attempt, so the ledger shows the attempt instead of a clean line.
-    const covered = (c) => isWellFormedCapability(c)
-        && (parent.has(c) || anyCapability
-            || (anyDefinition && c.startsWith("agent:"))
-            || (anyWorkspace && c.startsWith("workspace:")));
-    const ceiling = input.ceiling === undefined ? null : new Set(input.ceiling);
-    const gated = new Set(input.gated ?? []);
-    const approved = new Set(input.approved ?? []);
-    // Order is irrelevant to the outcome (set intersection is commutative), so each rejection reason is
-    // reported independently rather than being masked by whichever filter happened to run first.
-    const denied = requested.filter((c) => !covered(c));
-    const clipped = requested.filter((c) => covered(c) && ceiling !== null && !ceiling.has(c));
-    /**
-     * Is this capability gated, directly or by subsuming something gated?
-     *
-     * ADR-0012. Exact-name gating was defeatable by handing down a broader capability: the package's own
-     * `SUBSUMPTION` table says `bash` confers `write`, so gating `write` produced **no prompt** when `bash`
-     * was granted instead. The gate read as satisfied because the string never appeared.
-     *
-     * The direction is load-bearing and easy to invert. A capability is gated when it **subsumes**
-     * something gated — never when it **is subsumed by** something gated. Gating `bash` must not quietly
-     * gate a plain `write` grant, which would make gating a broad capability restrict the narrow ones and
-     * invert least privilege.
-     */
-    const isGated = (c) => {
-        if (gated.has(c))
-            return true;
-        if (input.subsumption === false)
-            return false;
-        return (SUBSUMPTION[c] ?? []).some((implied) => gated.has(implied));
-    };
-    const gatedBlocked = requested.filter((c) => covered(c) && (ceiling === null || ceiling.has(c)) && isGated(c) && !approved.has(c));
-    const rejected = new Set([...denied, ...clipped, ...gatedBlocked]);
-    const effective = requested.filter((c) => !rejected.has(c));
-    return {
-        effective,
-        denied,
-        clipped,
-        gatedBlocked,
-        universal: effective.filter((c) => UNIVERSAL_CAPABILITIES.includes(c)),
-        // F9: capabilities covered by a WILDCARD are not "subsumed" — this field means "the grant is broader
-        // than its list suggests", which is the `bash`-covers-`grep` warning. A wildcard holder already knows
-        // its grant is broad; listing every id under it would bury the signal the field exists to carry.
-        //
-        // All THREE wildcards are excluded. `anyWorkspace` was missing, so a caller holding `workspace:*` saw
-        // its own `workspace:prod` reported as subsumed while the `agent:*` holder correctly saw nothing — the
-        // field contradicting its own rule, and a false "broader than it looks" flag in the ledger and in
-        // `/grants`. Every wildcard added to `covered()` above needs a line here; that is now three for three.
-        subsumedBy: effective.filter((c) => !held.has(c)
-            && !anyCapability
-            && !(anyDefinition && c.startsWith("agent:"))
-            && !(anyWorkspace && c.startsWith("workspace:"))),
-    };
-}
-/**
- * Fail closed on a grant that cannot actually narrow anything.
- *
- * A universal capability in an "attenuated" grant is not a narrow grant with one extra item — it is
- * full authority wearing a narrow grant's clothing. Callers must opt in explicitly rather than
- * discover this at runtime.
- */
-export function assertNarrowing(result, allowUniversal = false) {
-    if (!allowUniversal && result.universal.length > 0) {
-        throw new Error(`refusing to issue a grant containing universal capabilities: ${result.universal.join(", ")}. ` +
-            `These transitively confer the whole catalog, so the grant would not narrow anything. ` +
-            `Pass allowUniversal to override deliberately.`);
-    }
-}
-/**
- * Project an effective grant onto pi's `--tools` allowlist.
- *
- * pi core is the enforcement point — verified: `--tools` and `--no-tools` both hard-block extension
- * tools, and an explicitly `-e`-loaded extension cannot re-add its tool past them
- * (docs/probes/pi-fabric-eval probes 9–11). That is why enforcement needs no in-descendant runtime.
- *
- * Returns `null` when the grant contains no callable tools, meaning the caller should pass
- * `--no-tools` rather than an empty `--tools` (an empty list is not a valid allowlist).
- */
-export function toPiToolsAllowlist(effective) {
-    const names = effective
-        .filter((c) => c.startsWith("tool:") || c.startsWith("ext:"))
-        // `tool:read` -> `read`; `ext:pkg/web_search` -> `web_search` (pi matches on bare tool name)
-        .map((c) => (c.startsWith("tool:") ? c.slice(5) : c.slice(c.lastIndexOf("/") + 1)))
-        .filter((n) => n.length > 0);
-    const deduped = [...new Set(names)].sort();
-    return deduped.length > 0 ? deduped : null;
-}
-//# sourceMappingURL=resolve.js.map

package/dist/resolve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA0B;IAC3D,2BAA2B;IAC3B,kBAAkB;CACnB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,WAAW,GAAwD;IAC9E,WAAW,EAAE;QACX,WAAW;QACX,WAAW;QACX,SAAS;QACT,WAAW;QACX,YAAY;QACZ,WAAW;QACX,gBAAgB;KACjB;CACF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAe,SAAS,CAAC;AACpD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAe,aAAa,CAAC;AAsC5D,MAAM,MAAM,GAAG,CAAC,EAAgB,EAAgB,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAE3E;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,KAAmB;IACzC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,MAAM,GACV,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAClF;;;;;;;;;;;;;OAaG;IACH,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/C;;;;;;;;;;;;OAYG;IACH,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAClD,yGAAyG;IACzG,mGAAmG;IACnG,+FAA+F;IAC/F,+EAA+E;IAC/E,MAAM,OAAO,GAAG,CAAC,CAAa,EAAW,EAAE,CACzC,sBAAsB,CAAC,CAAC,CAAC;WACtB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,aAAa;eAC7B,CAAC,aAAa,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;eACzC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAE/C,oGAAoG;IACpG,6FAA6F;IAC7F,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F;;;;;;;;;;;OAWG;IACH,MAAM,OAAO,GAAG,CAAC,CAAa,EAAW,EAAE;QACzC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAC5F,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5D,OAAO;QACL,SAAS;QACT,MAAM;QACN,OAAO;QACP,YAAY;QACZ,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtE,qGAAqG;QACrG,sGAAsG;QACtG,iGAAiG;QACjG,EAAE;QACF,sGAAsG;QACtG,uGAAuG;QACvG,kGAAkG;QAClG,uGAAuG;QACvG,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;eACT,CAAC,aAAa;eACd,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;eAC1C,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqB,EAAE,cAAc,GAAG,KAAK;IAC3E,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,gEAAgE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7F,uFAAuF;YACvF,+CAA+C,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAuB;IACxD,MAAM,KAAK,GAAG,SAAS;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7D,6FAA6F;SAC5F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAClF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC"}