sela-core 0.1.0-alpha.1

package/dist/services/WorkspaceSnapshotService.d.ts

@@ -0,0 +1,71 @@
+export interface FileSnapshot {
+    /** Absolute, normalised path of the tracked file. */
+    absolutePath: string;
+    /** Project-relative path (posix slashes) - for diff headers + PR commits. */
+    relativePath: string;
+    /**
+     * Disk content captured BEFORE Sela's first write to this file.
+     * May contain the developer's uncommitted edits - that's the point.
+     */
+    contentBefore: string;
+    /** Disk content captured AFTER Sela's latest write. `null` until first postWrite(). */
+    contentAfter: string | null;
+    /** Content of the file at `HEAD` (last committed) - `null` when untracked / no git. */
+    headContent: string | null;
+    /** True when `contentBefore !== headContent`, i.e. developer had dirty edits. */
+    hadUncommittedChanges: boolean;
+    /** True when the file did not exist on disk before Sela touched it. */
+    createdBySela: boolean;
+}
+export declare class WorkspaceSnapshotService {
+    private snapshots;
+    private cwd;
+    constructor(cwd?: string);
+    /** Override the cwd used for relative-path + HEAD lookups (tests). */
+    setCwd(cwd: string): void;
+    /**
+     * Record the pre-mutation state of `filePath` if not already tracked.
+     * Idempotent - only the FIRST call per file matters.
+     */
+    preWrite(filePath: string): void;
+    /**
+     * Refresh the post-mutation state. Safe to call multiple times - each
+     * call overwrites `contentAfter` with the latest disk state.
+     */
+    postWrite(filePath: string): void;
+    /** Lookup by absolute or relative path. Returns `null` when untracked. */
+    getSnapshot(filePath: string): FileSnapshot | null;
+    /** Every tracked snapshot. Insertion order. */
+    getAllSnapshots(): FileSnapshot[];
+    /**
+     * Did Sela actually mutate this file? True when contentAfter exists and
+     * differs from contentBefore.
+     */
+    isMutated(filePath: string): boolean;
+    /** All snapshots with a real mutation recorded. */
+    getMutatedSnapshots(): FileSnapshot[];
+    /**
+     * Rewind every tracked file on disk to `contentBefore` - restoring the
+     * developer's pre-Sela workspace state byte-for-byte.
+     */
+    restoreOriginal(): void;
+    /**
+     * Rewind a SINGLE tracked file on disk to `contentBefore`. Used by the
+     * Local DX interactive review flow when the developer rejects a fix.
+     * Returns true when the rewind happened, false when the file is untracked.
+     */
+    restoreOriginalByPath(filePath: string): boolean;
+    private rewindSnapshot;
+    /**
+     * Forward every tracked file on disk to `contentAfter` (no-op for files
+     * that were never written). Used by PRAutomationService to reapply
+     * Sela's mutations after a `git stash pop` round-trip.
+     */
+    restoreMutated(): void;
+    clear(): void;
+    private normalise;
+    private toRelative;
+    private readHeadContent;
+}
+export declare const sharedWorkspaceSnapshot: WorkspaceSnapshotService;
+//# sourceMappingURL=WorkspaceSnapshotService.d.ts.map

package/dist/services/WorkspaceSnapshotService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceSnapshotService.d.ts","sourceRoot":"","sources":["../../src/services/WorkspaceSnapshotService.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uFAAuF;IACvF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iFAAiF;IACjF,qBAAqB,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,wBAAwB;IACnC,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,GAAG,CAAS;gBAER,GAAG,GAAE,MAAsB;IAIvC,sEAAsE;IACtE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIzB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAqBhC;;;OAGG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAOjC,0EAA0E;IAC1E,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAIlD,+CAA+C;IAC/C,eAAe,IAAI,YAAY,EAAE;IAIjC;;;OAGG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMpC,mDAAmD;IACnD,mBAAmB,IAAI,YAAY,EAAE;IAMrC;;;OAGG;IACH,eAAe,IAAI,IAAI;IAMvB;;;;OAIG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAOhD,OAAO,CAAC,cAAc;IAUtB;;;;OAIG;IACH,cAAc,IAAI,IAAI;IAOtB,KAAK,IAAI,IAAI;IAQb,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,eAAe;CAcxB;AAED,eAAO,MAAM,uBAAuB,0BAAiC,CAAC"}

package/dist/services/WorkspaceSnapshotService.js

@@ -0,0 +1,200 @@
+"use strict";
+// src/services/WorkspaceSnapshotService.ts
+//
+// Clean-Room Architecture - file 1 of 2.
+//
+// Tracks the EXACT content of every file Sela mutates during a session, so:
+//   • The HTML report diff can be generated from an isolated in-memory diff
+//     (developer's dirty pre-existing edits NEVER bleed in).
+//   • PRAutomationService can restore the developer's pre-Sela workspace
+//     byte-for-byte after a PR is opened on an isolated branch.
+//
+// Lifecycle:
+//   preWrite(path)   - first call per file records `contentBefore` (disk
+//                      snapshot right before Sela touches it) + HEAD blob.
+//   postWrite(path)  - refreshes `contentAfter` (latest disk state).
+//   restoreOriginal()- writes contentBefore back to every tracked file.
+//   restoreMutated() - writes contentAfter back to every tracked file.
+//   clear()          - empties the ledger.
+//
+// Singleton `sharedWorkspaceSnapshot` is the canonical instance the
+// SourceUpdater / ASTSourceUpdater write hooks talk to.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sharedWorkspaceSnapshot = exports.WorkspaceSnapshotService = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+class WorkspaceSnapshotService {
+    snapshots = new Map();
+    cwd;
+    constructor(cwd = process.cwd()) {
+        this.cwd = cwd;
+    }
+    /** Override the cwd used for relative-path + HEAD lookups (tests). */
+    setCwd(cwd) {
+        this.cwd = cwd;
+    }
+    /**
+     * Record the pre-mutation state of `filePath` if not already tracked.
+     * Idempotent - only the FIRST call per file matters.
+     */
+    preWrite(filePath) {
+        const abs = this.normalise(filePath);
+        if (this.snapshots.has(abs))
+            return;
+        const exists = fs.existsSync(abs);
+        const contentBefore = exists ? fs.readFileSync(abs, "utf8") : "";
+        const headContent = this.readHeadContent(abs);
+        const hadUncommittedChanges = headContent !== null && headContent !== contentBefore;
+        this.snapshots.set(abs, {
+            absolutePath: abs,
+            relativePath: this.toRelative(abs),
+            contentBefore,
+            contentAfter: null,
+            headContent,
+            hadUncommittedChanges,
+            createdBySela: !exists,
+        });
+    }
+    /**
+     * Refresh the post-mutation state. Safe to call multiple times - each
+     * call overwrites `contentAfter` with the latest disk state.
+     */
+    postWrite(filePath) {
+        const abs = this.normalise(filePath);
+        const snap = this.snapshots.get(abs);
+        if (!snap)
+            return;
+        snap.contentAfter = fs.existsSync(abs) ? fs.readFileSync(abs, "utf8") : "";
+    }
+    /** Lookup by absolute or relative path. Returns `null` when untracked. */
+    getSnapshot(filePath) {
+        return this.snapshots.get(this.normalise(filePath)) ?? null;
+    }
+    /** Every tracked snapshot. Insertion order. */
+    getAllSnapshots() {
+        return Array.from(this.snapshots.values());
+    }
+    /**
+     * Did Sela actually mutate this file? True when contentAfter exists and
+     * differs from contentBefore.
+     */
+    isMutated(filePath) {
+        const snap = this.getSnapshot(filePath);
+        if (!snap || snap.contentAfter === null)
+            return false;
+        return snap.contentAfter !== snap.contentBefore;
+    }
+    /** All snapshots with a real mutation recorded. */
+    getMutatedSnapshots() {
+        return this.getAllSnapshots().filter((s) => s.contentAfter !== null && s.contentAfter !== s.contentBefore);
+    }
+    /**
+     * Rewind every tracked file on disk to `contentBefore` - restoring the
+     * developer's pre-Sela workspace state byte-for-byte.
+     */
+    restoreOriginal() {
+        for (const snap of this.snapshots.values()) {
+            this.rewindSnapshot(snap);
+        }
+    }
+    /**
+     * Rewind a SINGLE tracked file on disk to `contentBefore`. Used by the
+     * Local DX interactive review flow when the developer rejects a fix.
+     * Returns true when the rewind happened, false when the file is untracked.
+     */
+    restoreOriginalByPath(filePath) {
+        const snap = this.getSnapshot(filePath);
+        if (!snap)
+            return false;
+        this.rewindSnapshot(snap);
+        return true;
+    }
+    rewindSnapshot(snap) {
+        if (snap.createdBySela) {
+            if (fs.existsSync(snap.absolutePath)) {
+                fs.unlinkSync(snap.absolutePath);
+            }
+            return;
+        }
+        fs.writeFileSync(snap.absolutePath, snap.contentBefore, "utf8");
+    }
+    /**
+     * Forward every tracked file on disk to `contentAfter` (no-op for files
+     * that were never written). Used by PRAutomationService to reapply
+     * Sela's mutations after a `git stash pop` round-trip.
+     */
+    restoreMutated() {
+        for (const snap of this.snapshots.values()) {
+            if (snap.contentAfter === null)
+                continue;
+            fs.writeFileSync(snap.absolutePath, snap.contentAfter, "utf8");
+        }
+    }
+    clear() {
+        this.snapshots.clear();
+    }
+    // ────────────────────────────────────────────────────────────────
+    // INTERNAL
+    // ────────────────────────────────────────────────────────────────
+    normalise(raw) {
+        if (!raw)
+            return raw;
+        const abs = path.isAbsolute(raw) ? raw : path.resolve(this.cwd, raw);
+        return path.normalize(abs);
+    }
+    toRelative(abs) {
+        const rel = path.relative(this.cwd, abs);
+        return rel.split(path.sep).join("/");
+    }
+    readHeadContent(abs) {
+        try {
+            const rel = this.toRelative(abs);
+            const out = (0, child_process_1.execSync)(`git show HEAD:"${rel}"`, {
+                cwd: this.cwd,
+                encoding: "utf8",
+                stdio: ["pipe", "pipe", "pipe"],
+                windowsHide: true,
+            });
+            return out.toString();
+        }
+        catch {
+            return null;
+        }
+    }
+}
+exports.WorkspaceSnapshotService = WorkspaceSnapshotService;
+exports.sharedWorkspaceSnapshot = new WorkspaceSnapshotService();

package/dist/services/safety/PipelineContext.d.ts

@@ -0,0 +1,63 @@
+import type { IntentAuditor } from "../IntentAuditor";
+import type { ResolvedThresholds } from "../../config/SelaConfig";
+import type { AIFixSummary, HealMode, SafetyDecision } from "../SafetyGuard";
+import type { FunctionalRole } from "./roleClassifier";
+/**
+ * Mutable bag of state shared across the rule pipeline for a single
+ * evaluate() call.  Immutable inputs are readonly; fields derived
+ * mid-pipeline by context-mutator rules are writable.
+ */
+export interface PipelineContext {
+    readonly aiFix: AIFixSummary;
+    readonly mode: HealMode;
+    readonly branch?: string;
+    /**
+     * AI confidence coerced to a finite number.  Missing / NaN / Infinity
+     * collapses to 0 so the hard-stop and review-threshold rules still gate
+     * the heal (conservative worst case).
+     */
+    readonly confidence: number;
+    readonly thresholds: ResolvedThresholds;
+    readonly auditor: IntentAuditor;
+    /**
+     * The content change the pipeline actually reasons about: the
+     * AI-reported pair when present, otherwise a zero-trust synthesized
+     * pair from live vs DNA text.  Undefined ⇒ structural-only heal.
+     */
+    effectiveContentChange?: {
+        oldText: string;
+        newText: string;
+    };
+    /** Provenance of effectiveContentChange for logging + auditor gating. */
+    source?: "AI-reported" | "zero-trust";
+    oldText?: string;
+    newText?: string;
+    oldRole?: FunctionalRole;
+    newRole?: FunctionalRole;
+    /**
+     * Set by DangerousSinkRule when the heal transitions INTO a destructive /
+     * auth role.  Forces the Intent Auditor gate to fire regardless of source
+     * or mode (decision #2), closing the UNKNOWN→DELETE blind spot.
+     */
+    forceAudit?: boolean;
+    /** Auditor score breakdown forwarded to the final confidence-tier decision. */
+    localAuditMeta?: SafetyDecision["meta"];
+}
+/** A rule returns a decision to short-circuit, or null to continue. */
+export type SafetyRuleResult = SafetyDecision | null;
+export interface SafetyRule {
+    /** Stable identifier for logging / debugging. */
+    readonly id: string;
+    run(ctx: PipelineContext): SafetyRuleResult | Promise<SafetyRuleResult>;
+}
+/**
+ * Builds the initial pipeline context.  Mirrors the head of the
+ * pre-refactor evaluate() exactly (confidence coercion + input
+ * passthrough).  Derived fields are populated later by the rules.
+ */
+export declare function buildContext(context: {
+    mode: HealMode;
+    action?: string;
+    branch?: string;
+}, aiFix: AIFixSummary, thresholds: ResolvedThresholds, auditor: IntentAuditor): PipelineContext;
+//# sourceMappingURL=PipelineContext.d.ts.map

package/dist/services/safety/PipelineContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PipelineContext.d.ts","sourceRoot":"","sources":["../../../src/services/safety/PipelineContext.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EACV,YAAY,EACZ,QAAQ,EACR,cAAc,EACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAE9B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAGhC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,yEAAyE;IACzE,MAAM,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CACzC;AAED,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,IAAI,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,GAAG,EAAE,eAAe,GAAG,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACzE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7D,KAAK,EAAE,YAAY,EACnB,UAAU,EAAE,kBAAkB,EAC9B,OAAO,EAAE,aAAa,GACrB,eAAe,CAcjB"}

package/dist/services/safety/PipelineContext.js

@@ -0,0 +1,34 @@
+"use strict";
+// src/services/safety/PipelineContext.ts
+//
+// Shared state threaded through the SafetyGuard rule pipeline, plus the
+// SafetyRule contract every rule implements.
+//
+// Phase 1 refactor: the monolithic SafetyGuard.evaluate() became an
+// ordered array of rules (chain-of-responsibility).  A rule returns a
+// SafetyDecision to short-circuit the pipeline, or null to fall through
+// to the next rule.  Some rules are pure deciders; a few are
+// *context-mutators* that derive shared fields (effectiveContentChange,
+// roles) and always return null so later rules can consume them without
+// re-deriving.  This keeps the exact priority order and the exact
+// derived values of the pre-refactor implementation.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildContext = buildContext;
+/**
+ * Builds the initial pipeline context.  Mirrors the head of the
+ * pre-refactor evaluate() exactly (confidence coercion + input
+ * passthrough).  Derived fields are populated later by the rules.
+ */
+function buildContext(context, aiFix, thresholds, auditor) {
+    const confidence = typeof aiFix.confidence === "number" && Number.isFinite(aiFix.confidence)
+        ? aiFix.confidence
+        : 0;
+    return {
+        aiFix,
+        mode: context.mode,
+        branch: context.branch,
+        confidence,
+        thresholds,
+        auditor,
+    };
+}

package/dist/services/safety/roleClassifier.d.ts

@@ -0,0 +1,4 @@
+export type FunctionalRole = "SUBMIT" | "CANCEL" | "DELETE" | "NAVIGATE" | "AUTH" | "STATUS_POSITIVE" | "STATUS_NEGATIVE" | "UNKNOWN";
+export declare function classifyFunctionalRole(text: string): FunctionalRole;
+export declare function isSemanticOpposite(oldText: string, newText: string): boolean;
+//# sourceMappingURL=roleClassifier.d.ts.map

package/dist/services/safety/roleClassifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleClassifier.d.ts","sourceRoot":"","sources":["../../../src/services/safety/roleClassifier.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,MAAM,GACN,iBAAiB,GACjB,iBAAiB,GACjB,SAAS,CAAC;AA4Kd,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CASnE;AAgDD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAG5E"}

package/dist/services/safety/roleClassifier.js

@@ -0,0 +1,233 @@
+"use strict";
+// src/services/safety/roleClassifier.ts
+//
+// Pure functional-role classification + binary semantic-opposite lookup.
+//
+// Extracted verbatim from SafetyGuard.ts during the Phase 1 pipeline
+// refactor.  Behavior is byte-for-byte identical to the pre-refactor
+// implementation - the role taxonomy, keyword sets, word-boundary regex
+// compilation, and the 36-entry opposite-pair set are unchanged.  Keeping
+// this module dependency-free (no SafetyGuard import) avoids a runtime
+// import cycle: SafetyGuard and the rule modules consume it, never the
+// reverse.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyFunctionalRole = classifyFunctionalRole;
+exports.isSemanticOpposite = isSemanticOpposite;
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+const ROLE_KEYWORDS = new Map([
+    [
+        "SUBMIT",
+        new Set([
+            "submit",
+            "send",
+            "confirm",
+            "save",
+            "ok",
+            "done",
+            "apply",
+            "proceed",
+            "continue",
+            "execute",
+            "finish",
+            "complete",
+            "publish",
+            "post",
+        ]),
+    ],
+    [
+        "CANCEL",
+        new Set([
+            "cancel",
+            "abort",
+            "dismiss",
+            "close",
+            "back",
+            "exit",
+            "skip",
+            "no",
+            "discard",
+            "reject",
+            "decline",
+        ]),
+    ],
+    [
+        "DELETE",
+        new Set([
+            "delete",
+            "remove",
+            "clear",
+            "erase",
+            "destroy",
+            "trash",
+            "purge",
+            "drop",
+            "wipe",
+        ]),
+    ],
+    [
+        "NAVIGATE",
+        new Set([
+            "next",
+            "previous",
+            "prev",
+            "forward",
+            "backward",
+            "go",
+            "navigate",
+            "open",
+            "view",
+            "home",
+            "return",
+            "redirect",
+        ]),
+    ],
+    [
+        "AUTH",
+        new Set([
+            "login",
+            "logout",
+            "sign in",
+            "sign out",
+            "register",
+            "sign up",
+            "log in",
+            "log out",
+            "authenticate",
+            "authorize",
+        ]),
+    ],
+    [
+        "STATUS_POSITIVE",
+        new Set([
+            "success",
+            "approved",
+            "active",
+            "enabled",
+            "visible",
+            "on",
+            "open",
+            "allowed",
+            "welcome",
+            "pass",
+            "passed",
+            "valid",
+            "granted",
+            "connected",
+            "running",
+            "unlocked",
+            "online",
+            "available",
+        ]),
+    ],
+    [
+        "STATUS_NEGATIVE",
+        new Set([
+            "error",
+            "failure",
+            "failed",
+            "denied",
+            "inactive",
+            "disabled",
+            "hidden",
+            "off",
+            "closed",
+            "blocked",
+            "rejected",
+            "invalid",
+            "locked",
+            "disconnected",
+            "stopped",
+            "offline",
+            "unavailable",
+            "forbidden",
+            "unauthorized",
+        ]),
+    ],
+]);
+// Pre-compiled word-boundary regexes for the role classifier.  Built
+// once at module load - classifyFunctionalRole() is on the hot heal
+// path, so we don't pay for regex construction per call.
+const ROLE_KEYWORD_REGEXES = Array.from(ROLE_KEYWORDS, ([role, keywords]) => ({
+    role,
+    regexes: Array.from(keywords, (kw) => new RegExp(`\\b${escapeRegExp(kw)}\\b`, "i")),
+}));
+// ─────────────────────────────────────────────────────────────
+// FUNCTIONAL ROLE CLASSIFICATION
+//
+// Returns the first role whose keyword matches the text as a whole
+// word (delimited by \b boundaries).  Returns UNKNOWN when no role
+// matches.
+//
+// Why \b instead of `.includes(kw)`:
+//   - "unauthorized".includes("authorize")  → true   ← bug
+//   - "offline".includes("on")              → true   ← bug
+//   - "disconnected".includes("connected")  → true   ← bug
+//   - "inactive".includes("active")         → true   ← bug
+// The substring approach mis-classified negations into the
+// positive role of their root word, silently bypassing
+// FAIL_HARD_STATUS_INVERSION.  Word-boundary regex eliminates
+// these collisions while keeping multi-word keywords ("sign in")
+// and punctuation-flanked matches ("Submit!") working.
+// ─────────────────────────────────────────────────────────────
+function classifyFunctionalRole(text) {
+    const normalized = text.toLowerCase().trim();
+    if (normalized.length === 0)
+        return "UNKNOWN";
+    for (const { role, regexes } of ROLE_KEYWORD_REGEXES) {
+        for (const re of regexes) {
+            if (re.test(normalized))
+                return role;
+        }
+    }
+    return "UNKNOWN";
+}
+// ═══════════════════════════════════════════════════════════════════
+// BINARY SEMANTIC OPPOSITES
+// ═══════════════════════════════════════════════════════════════════
+// Binary semantic opposites - always trigger FAIL_HARD regardless of mode,
+// because they indicate a state inversion (pass→fail, success→error, etc.)
+// that almost certainly masks a real logical regression.
+const SEMANTIC_OPPOSITE_PAIRS = new Set([
+    "denied|welcome",
+    "welcome|denied",
+    "login|logout",
+    "logout|login",
+    "success|failure",
+    "failure|success",
+    "success|error",
+    "error|success",
+    "pass|fail",
+    "fail|pass",
+    "approved|rejected",
+    "rejected|approved",
+    "active|inactive",
+    "inactive|active",
+    "enabled|disabled",
+    "disabled|enabled",
+    "open|closed",
+    "closed|open",
+    "visible|hidden",
+    "hidden|visible",
+    "on|off",
+    "off|on",
+    "true|false",
+    "false|true",
+    "allowed|denied",
+    "denied|allowed",
+    "granted|denied",
+    "denied|granted",
+    "locked|unlocked",
+    "unlocked|locked",
+    "connected|disconnected",
+    "disconnected|connected",
+    "running|stopped",
+    "stopped|running",
+    "valid|invalid",
+    "invalid|valid",
+]);
+function isSemanticOpposite(oldText, newText) {
+    const key = `${oldText.toLowerCase().trim()}|${newText.toLowerCase().trim()}`;
+    return SEMANTIC_OPPOSITE_PAIRS.has(key);
+}

package/dist/services/safety/rules/ConfidenceTierRule.d.ts

@@ -0,0 +1,3 @@
+import type { SafetyRule } from "../PipelineContext";
+export declare const ConfidenceTierRule: SafetyRule;
+//# sourceMappingURL=ConfidenceTierRule.d.ts.map

package/dist/services/safety/rules/ConfidenceTierRule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfidenceTierRule.d.ts","sourceRoot":"","sources":["../../../../src/services/safety/rules/ConfidenceTierRule.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAqC,MAAM,oBAAoB,CAAC;AAExF,eAAO,MAAM,kBAAkB,EAAE,UAqBhC,CAAC"}

package/dist/services/safety/rules/ConfidenceTierRule.js

@@ -0,0 +1,32 @@
+"use strict";
+// src/services/safety/rules/ConfidenceTierRule.ts
+//
+// Step 8 - Confidence tiers (terminal rule).  All inversion checks have
+// passed; the only remaining question is whether confidence clears the
+// review threshold.  Below it → REQUIRES_REVIEW, at/above → SAFE.  This
+// rule always returns a decision, so the pipeline never falls past it.
+//
+// Extracted verbatim - identical reasons and the auditor score-breakdown
+// meta forwarded from the IntentAuditor gate.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfidenceTierRule = void 0;
+exports.ConfidenceTierRule = {
+    id: "confidence-tiers",
+    run(ctx) {
+        if (ctx.confidence < ctx.thresholds.confidenceReviewThreshold) {
+            return {
+                level: "REQUIRES_REVIEW",
+                reason: `Low-confidence fix (${ctx.confidence}/100) - tagging for manual review`,
+                canProceed: true,
+                meta: ctx.localAuditMeta,
+            };
+        }
+        return {
+            level: "SAFE",
+            reason: `All safety checks passed (confidence=${ctx.confidence}, source=${ctx.source}, ` +
+                `oldRole=${ctx.oldRole}, newRole=${ctx.newRole})`,
+            canProceed: true,
+            meta: ctx.localAuditMeta,
+        };
+    },
+};

package/dist/services/safety/rules/DangerousSinkRule.d.ts

@@ -0,0 +1,10 @@
+import type { FunctionalRole } from "../roleClassifier";
+import type { SafetyRule } from "../PipelineContext";
+/**
+ * Roles whose ARRIVAL is treated as high-risk: a control that did not
+ * obviously mean "delete" or "authenticate" before, but now does.
+ */
+export declare const DANGEROUS_SINK_ROLES: ReadonlySet<FunctionalRole>;
+export declare function isDangerousSinkTransition(oldRole: FunctionalRole, newRole: FunctionalRole): boolean;
+export declare const DangerousSinkRule: SafetyRule;
+//# sourceMappingURL=DangerousSinkRule.d.ts.map

package/dist/services/safety/rules/DangerousSinkRule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DangerousSinkRule.d.ts","sourceRoot":"","sources":["../../../../src/services/safety/rules/DangerousSinkRule.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,KAAK,EAAE,UAAU,EAAqC,MAAM,oBAAoB,CAAC;AAExF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,cAAc,CAG3D,CAAC;AAEH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,cAAc,GACtB,OAAO,CAET;AAED,eAAO,MAAM,iBAAiB,EAAE,UAmB/B,CAAC"}