usesteady 0.1.0-alpha.1

package/dist/src/cursor/glob-matcher.js

@@ -0,0 +1,68 @@
+/**
+ * Minimal glob matcher for OCD policy checks.
+ *
+ * Supports the glob features required for cursor integration:
+ *   double-star - matches any sequence including path separators
+ *   single-star - matches any sequence NOT including path separators
+ *   question    - matches exactly one non-separator character
+ *
+ * Matching rules:
+ *   Paths are normalized to forward slashes before matching.
+ *   Patterns are anchored (full match required, not substring).
+ *   Matching is case-insensitive.
+ *
+ * See: docs/cursor-allowedfiles-policy.md
+ */
+/**
+ * Return true if filePath matches the given glob pattern.
+ *
+ * @param filePath  File path to test. Backslashes are normalized to forward slashes.
+ * @param pattern   Glob pattern. Supports double-star, single-star, and question-mark.
+ */
+export function matchesGlob(filePath, pattern) {
+    const normalizedPath = filePath.replace(/\\/g, "/");
+    const regex = globToRegex(pattern);
+    return regex.test(normalizedPath);
+}
+/**
+ * Convert a glob pattern to an anchored, case-insensitive RegExp.
+ *
+ * Uses a character-by-character scan to avoid string placeholders that
+ * could introduce control characters or confuse source parsers.
+ */
+export function globToRegex(glob) {
+    const normalized = glob.replace(/\\/g, "/");
+    const ESCAPE_RE = /[.+^${}()|[\]\\]/g;
+    let pattern = "";
+    let i = 0;
+    while (i < normalized.length) {
+        const ch = normalized[i];
+        if (ch === "*" && normalized[i + 1] === "*") {
+            // "**" followed by "/" means zero or more directory components (including none).
+            // e.g. "**/.env*" must match root-level ".env.local" and "config/.env.local".
+            if (normalized[i + 2] === "/") {
+                pattern += "(.*/)?";
+                i += 3; // consume **/ together
+            }
+            else {
+                // "**" at end of pattern or not followed by "/" — any chars including separators
+                pattern += ".*";
+                i += 2;
+            }
+        }
+        else if (ch === "*") {
+            pattern += "[^/]*";
+            i += 1;
+        }
+        else if (ch === "?") {
+            pattern += "[^/]";
+            i += 1;
+        }
+        else {
+            pattern += ch.replace(ESCAPE_RE, "\\$&");
+            i += 1;
+        }
+    }
+    return new RegExp(`^${pattern}$`, "i");
+}
+//# sourceMappingURL=glob-matcher.js.map

package/dist/src/cursor/glob-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob-matcher.js","sourceRoot":"","sources":["../../../src/cursor/glob-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,OAAe;IAC3D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,KAAK,GAAY,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAI,mBAAmB,CAAC;IAEvC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC,GAAS,CAAC,CAAC;IAEhB,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAW,CAAC;QAEnC,IAAI,EAAE,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC5C,iFAAiF;YACjF,8EAA8E;YAC9E,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC9B,OAAO,IAAI,QAAQ,CAAC;gBACpB,CAAC,IAAU,CAAC,CAAC,CAAC,uBAAuB;YACvC,CAAC;iBAAM,CAAC;gBACN,iFAAiF;gBACjF,OAAO,IAAI,IAAI,CAAC;gBAChB,CAAC,IAAU,CAAC,CAAC;YACf,CAAC;QACH,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,OAAO,IAAI,OAAO,CAAC;YACnB,CAAC,IAAU,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,OAAO,IAAI,MAAM,CAAC;YAClB,CAAC,IAAU,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC,IAAU,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC"}

package/dist/src/cursor/index.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Cursor integration — public API surface.
+ *
+ * Exports the types, functions, and classes that consumers of this module need.
+ * Internal helpers (normalizePath, buildChangeSpecFrom*, etc.) are not re-exported.
+ *
+ * ── Intended consumers ────────────────────────────────────────────────────────
+ *
+ *   - Workflow coordinator / product session: calls buildCursorHandoffArtifact
+ *     + evaluateOCDForHandoff + CursorDeliveryGate.deliver() in sequence
+ *   - Test suite: imports types and stubs CursorEditorPlugin
+ *   - UCP persistence layer: already imported via src/ucp/envelope.ts
+ *
+ * ── Call sequence ─────────────────────────────────────────────────────────────
+ *
+ *   1. buildCursorHandoffArtifact(intake, intentId, responseId, policy)
+ *        → initial artifact (eligibility: "pending_confirmation")
+ *
+ *   2. evaluateOCDForHandoff(artifact, policy)
+ *        → ocdClearance
+ *      applyOCDClearance(artifact, ocdClearance)
+ *        → artifact with OCD result (may be conflict_detected)
+ *
+ *   3. [OCD conflict? → acceptOCDConflict(artifact) when H accepts]
+ *
+ *   4. [H narrows scope? → narrowArtifactScope(artifact, newAllowedFiles)]
+ *      [H provides path from empty?
+ *        → validateHProvidedPath(path, workspaceRoot) — tier 1
+ *        → if ok: narrowArtifactScope(artifact, [path])
+ *        → re-run evaluateOCDForHandoff for tier 2]
+ *
+ *   5. approveArtifact(artifact, confirmedAt)
+ *        → artifact with eligibility: "approved_for_cursor"
+ *
+ *   6. new CursorDeliveryGate(plugin, storeDir).deliver(artifact)
+ *        → DeliveryGateResult
+ */
+export type { CursorHandoffEligibility, CursorOCDClearanceStatus, CursorOCDClearance, CursorScopeConstraint, CursorChangeSpec, CursorHandoffArtifact, CursorOCDPolicy, CursorDeliveryRequest, CursorAccepted, CursorRefusedDueToScope, CursorRefusedDueToExecutionError, CursorResponse, CursorScopeQuestionKind, CursorScopeQuestion, CursorExecutionErrorCode, WorkspacePathValidationResult, } from "./types.js";
+export { buildCursorHandoffArtifact, narrowArtifactScope, approveArtifact, } from "./artifact-mapper.js";
+export { evaluateOCDForHandoff, validateHProvidedPath, applyOCDClearance, acceptOCDConflict, } from "./ocd-evaluator.js";
+export { CursorDeliveryGate, } from "./delivery-gate.js";
+export type { CursorEditorPlugin, CursorGateDeps, DeliveryGateResult, } from "./delivery-gate.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/cursor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cursor/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,YAAY,EACV,wBAAwB,EACxB,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,uBAAuB,EACvB,gCAAgC,EAChC,cAAc,EACd,uBAAuB,EACvB,mBAAmB,EACnB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,YAAY,CAAC;AAIpB,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,kBAAkB,GACnB,MAAM,oBAAoB,CAAC"}

package/dist/src/cursor/index.js

@@ -0,0 +1,44 @@
+/**
+ * Cursor integration — public API surface.
+ *
+ * Exports the types, functions, and classes that consumers of this module need.
+ * Internal helpers (normalizePath, buildChangeSpecFrom*, etc.) are not re-exported.
+ *
+ * ── Intended consumers ────────────────────────────────────────────────────────
+ *
+ *   - Workflow coordinator / product session: calls buildCursorHandoffArtifact
+ *     + evaluateOCDForHandoff + CursorDeliveryGate.deliver() in sequence
+ *   - Test suite: imports types and stubs CursorEditorPlugin
+ *   - UCP persistence layer: already imported via src/ucp/envelope.ts
+ *
+ * ── Call sequence ─────────────────────────────────────────────────────────────
+ *
+ *   1. buildCursorHandoffArtifact(intake, intentId, responseId, policy)
+ *        → initial artifact (eligibility: "pending_confirmation")
+ *
+ *   2. evaluateOCDForHandoff(artifact, policy)
+ *        → ocdClearance
+ *      applyOCDClearance(artifact, ocdClearance)
+ *        → artifact with OCD result (may be conflict_detected)
+ *
+ *   3. [OCD conflict? → acceptOCDConflict(artifact) when H accepts]
+ *
+ *   4. [H narrows scope? → narrowArtifactScope(artifact, newAllowedFiles)]
+ *      [H provides path from empty?
+ *        → validateHProvidedPath(path, workspaceRoot) — tier 1
+ *        → if ok: narrowArtifactScope(artifact, [path])
+ *        → re-run evaluateOCDForHandoff for tier 2]
+ *
+ *   5. approveArtifact(artifact, confirmedAt)
+ *        → artifact with eligibility: "approved_for_cursor"
+ *
+ *   6. new CursorDeliveryGate(plugin, storeDir).deliver(artifact)
+ *        → DeliveryGateResult
+ */
+// ─── Artifact mapper ──────────────────────────────────────────────────────────
+export { buildCursorHandoffArtifact, narrowArtifactScope, approveArtifact, } from "./artifact-mapper.js";
+// ─── OCD evaluator ────────────────────────────────────────────────────────────
+export { evaluateOCDForHandoff, validateHProvidedPath, applyOCDClearance, acceptOCDConflict, } from "./ocd-evaluator.js";
+// ─── Delivery gate ────────────────────────────────────────────────────────────
+export { CursorDeliveryGate, } from "./delivery-gate.js";
+//# sourceMappingURL=index.js.map

package/dist/src/cursor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cursor/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAuBH,iFAAiF;AAEjF,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,iFAAiF;AAEjF,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,iFAAiF;AAEjF,OAAO,EACL,kBAAkB,GACnB,MAAM,oBAAoB,CAAC"}

package/dist/src/cursor/ocd-evaluator.d.ts

@@ -0,0 +1,89 @@
+/**
+ * OCD Evaluator — evaluates a CursorHandoffArtifact against policy rules.
+ *
+ * ── Role ───────────────────────────────────────────────────────────────────────
+ *
+ *   Takes the initial artifact produced by the artifact mapper and applies
+ *   the three OCD rules that govern Cursor handoffs:
+ *
+ *     RULE_WRITE_OUTSIDE_WORKSPACE  — file outside write_safe_globs
+ *     RULE_WRITE_TOO_MANY_FILES     — allowedFiles count exceeds threshold
+ *     RULE_H_PATH_WORKSPACE_BOUNDARY — H-provided path outside workspace root
+ *                                      (hard block, not a conflict)
+ *
+ *   Returns an updated ocdClearance. The artifact itself is not mutated —
+ *   callers receive a new ocdClearance to apply.
+ *
+ * ── What OCD does ─────────────────────────────────────────────────────────────
+ *
+ *   - Fires conflicts when allowedFiles entries violate write_safe_globs
+ *   - Fires conflicts when allowedFiles.length > maxFilesApprovalThreshold
+ *   - Returns "cleared" when no rules fire
+ *   - Returns "conflict_detected" when one or more rules fire
+ *
+ * ── What OCD does NOT do ──────────────────────────────────────────────────────
+ *
+ *   - Does not add to allowedFiles (NEVER proposes files)
+ *   - Does not remove from allowedFiles (fires conflict; H decides)
+ *   - Does not read the filesystem
+ *   - Does not call the intake pipeline
+ *
+ * ── H-provided path validation ────────────────────────────────────────────────
+ *
+ *   When H sets allowedFiles from empty, the path must pass two tiers:
+ *
+ *     Tier 1 — workspace boundary (hard block):
+ *       validateHProvidedPath() returns { ok: false } → path rejected, not added
+ *
+ *     Tier 2 — write_safe_globs (OCD conflict):
+ *       evaluateOCDForHandoff() returns conflict_detected → H sees conflict surface
+ *
+ *   Tier 1 runs in the delivery gate before OCD is called.
+ *   Tier 2 runs here in the OCD evaluator.
+ *
+ * See: docs/cursor-allowedfiles-policy.md — policy rules section
+ *      docs/cursor-integration-architecture.md — OCD role in authority model
+ */
+import type { CursorHandoffArtifact, CursorOCDClearance, CursorOCDPolicy, WorkspacePathValidationResult } from "./types.js";
+/**
+ * Evaluate a CursorHandoffArtifact against OCD policy rules.
+ *
+ * Returns an updated ocdClearance. The artifact is not mutated.
+ * Callers apply the returned ocdClearance to the artifact before surfacing
+ * it to H.
+ *
+ * Note: if the artifact already has ocdClearance.status === "conflict_accepted",
+ * this function should NOT be called again (H already accepted the conflict).
+ * The existing ocdClearance should be preserved unchanged.
+ */
+export declare function evaluateOCDForHandoff(artifact: CursorHandoffArtifact, policy: CursorOCDPolicy): CursorOCDClearance;
+/**
+ * Validate an H-provided file path against the workspace boundary.
+ *
+ * This is Tier 1 of H-provided path validation (hard block — not a conflict).
+ * Tier 2 (write_safe_globs) is handled by evaluateOCDForHandoff().
+ *
+ * Called by the delivery gate when H sets allowedFiles from empty, before
+ * adding the path to the artifact and before calling the OCD evaluator.
+ *
+ * A path is valid if and only if:
+ *   - It is a non-empty string
+ *   - Its resolved form is within the workspace root
+ */
+export declare function validateHProvidedPath(filePath: string, workspaceRoot: string): WorkspacePathValidationResult;
+/**
+ * Apply a completed ocdClearance to an artifact, returning an updated artifact.
+ *
+ * Does not mutate. Returns a new artifact reference with ocdClearance replaced.
+ * The artifact id is unchanged — ocdClearance is not part of the content-addressed
+ * id input (the id reflects what the edit IS, not its current OCD state).
+ */
+export declare function applyOCDClearance(artifact: CursorHandoffArtifact, ocdClearance: CursorOCDClearance): CursorHandoffArtifact;
+/**
+ * Mark an artifact's OCD conflict as accepted by H.
+ *
+ * Called when H explicitly accepts a detected conflict (conflict_detected → conflict_accepted).
+ * Preserves rulesFired and conflictsDetected for audit — only status changes.
+ */
+export declare function acceptOCDConflict(artifact: CursorHandoffArtifact): CursorHandoffArtifact;
+//# sourceMappingURL=ocd-evaluator.d.ts.map

package/dist/src/cursor/ocd-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ocd-evaluator.d.ts","sourceRoot":"","sources":["../../../src/cursor/ocd-evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAIH,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,6BAA6B,EAC9B,MAAM,YAAY,CAAC;AASpB;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,qBAAqB,EAC/B,MAAM,EAAI,eAAe,GACxB,kBAAkB,CAqCpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAO,MAAM,EACrB,aAAa,EAAE,MAAM,GACpB,6BAA6B,CAc/B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAM,qBAAqB,EACnC,YAAY,EAAE,kBAAkB,GAC/B,qBAAqB,CAEvB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,qBAAqB,GAC9B,qBAAqB,CAQvB"}

package/dist/src/cursor/ocd-evaluator.js

@@ -0,0 +1,142 @@
+/**
+ * OCD Evaluator — evaluates a CursorHandoffArtifact against policy rules.
+ *
+ * ── Role ───────────────────────────────────────────────────────────────────────
+ *
+ *   Takes the initial artifact produced by the artifact mapper and applies
+ *   the three OCD rules that govern Cursor handoffs:
+ *
+ *     RULE_WRITE_OUTSIDE_WORKSPACE  — file outside write_safe_globs
+ *     RULE_WRITE_TOO_MANY_FILES     — allowedFiles count exceeds threshold
+ *     RULE_H_PATH_WORKSPACE_BOUNDARY — H-provided path outside workspace root
+ *                                      (hard block, not a conflict)
+ *
+ *   Returns an updated ocdClearance. The artifact itself is not mutated —
+ *   callers receive a new ocdClearance to apply.
+ *
+ * ── What OCD does ─────────────────────────────────────────────────────────────
+ *
+ *   - Fires conflicts when allowedFiles entries violate write_safe_globs
+ *   - Fires conflicts when allowedFiles.length > maxFilesApprovalThreshold
+ *   - Returns "cleared" when no rules fire
+ *   - Returns "conflict_detected" when one or more rules fire
+ *
+ * ── What OCD does NOT do ──────────────────────────────────────────────────────
+ *
+ *   - Does not add to allowedFiles (NEVER proposes files)
+ *   - Does not remove from allowedFiles (fires conflict; H decides)
+ *   - Does not read the filesystem
+ *   - Does not call the intake pipeline
+ *
+ * ── H-provided path validation ────────────────────────────────────────────────
+ *
+ *   When H sets allowedFiles from empty, the path must pass two tiers:
+ *
+ *     Tier 1 — workspace boundary (hard block):
+ *       validateHProvidedPath() returns { ok: false } → path rejected, not added
+ *
+ *     Tier 2 — write_safe_globs (OCD conflict):
+ *       evaluateOCDForHandoff() returns conflict_detected → H sees conflict surface
+ *
+ *   Tier 1 runs in the delivery gate before OCD is called.
+ *   Tier 2 runs here in the OCD evaluator.
+ *
+ * See: docs/cursor-allowedfiles-policy.md — policy rules section
+ *      docs/cursor-integration-architecture.md — OCD role in authority model
+ */
+import * as path from "node:path";
+import { matchesGlob } from "./glob-matcher.js";
+// ─── Rule IDs ────────────────────────────────────────────────────────────────
+const RULE_WRITE_OUTSIDE_WORKSPACE = "RULE_WRITE_OUTSIDE_WORKSPACE";
+const RULE_WRITE_TOO_MANY_FILES = "RULE_WRITE_TOO_MANY_FILES";
+// ─── Public API ───────────────────────────────────────────────────────────────
+/**
+ * Evaluate a CursorHandoffArtifact against OCD policy rules.
+ *
+ * Returns an updated ocdClearance. The artifact is not mutated.
+ * Callers apply the returned ocdClearance to the artifact before surfacing
+ * it to H.
+ *
+ * Note: if the artifact already has ocdClearance.status === "conflict_accepted",
+ * this function should NOT be called again (H already accepted the conflict).
+ * The existing ocdClearance should be preserved unchanged.
+ */
+export function evaluateOCDForHandoff(artifact, policy) {
+    const rulesFired = [];
+    const conflictsDetected = [];
+    const { allowedFiles } = artifact.scopeConstraint;
+    // RULE_WRITE_OUTSIDE_WORKSPACE — each file must be within write_safe_globs.
+    for (const filePath of allowedFiles) {
+        const normalizedPath = normalizePath(filePath);
+        const isSafe = policy.writeSafeGlobs.some((safeGlob) => matchesGlob(normalizedPath, safeGlob));
+        if (!isSafe) {
+            if (!rulesFired.includes(RULE_WRITE_OUTSIDE_WORKSPACE)) {
+                rulesFired.push(RULE_WRITE_OUTSIDE_WORKSPACE);
+            }
+            conflictsDetected.push(`File '${filePath}' is outside the safe write zone (write_safe_globs).`);
+        }
+    }
+    // RULE_WRITE_TOO_MANY_FILES — allowedFiles count check.
+    if (allowedFiles.length > 0 &&
+        allowedFiles.length > policy.maxFilesApprovalThreshold) {
+        rulesFired.push(RULE_WRITE_TOO_MANY_FILES);
+        conflictsDetected.push(`Too many files in scope: ${allowedFiles.length} (threshold: ${policy.maxFilesApprovalThreshold}).`);
+    }
+    const status = conflictsDetected.length > 0 ? "conflict_detected" : "cleared";
+    return { status, rulesFired, conflictsDetected };
+}
+/**
+ * Validate an H-provided file path against the workspace boundary.
+ *
+ * This is Tier 1 of H-provided path validation (hard block — not a conflict).
+ * Tier 2 (write_safe_globs) is handled by evaluateOCDForHandoff().
+ *
+ * Called by the delivery gate when H sets allowedFiles from empty, before
+ * adding the path to the artifact and before calling the OCD evaluator.
+ *
+ * A path is valid if and only if:
+ *   - It is a non-empty string
+ *   - Its resolved form is within the workspace root
+ */
+export function validateHProvidedPath(filePath, workspaceRoot) {
+    if (!filePath || filePath.trim().length === 0) {
+        return { ok: false, reason: "invalid_path" };
+    }
+    const resolvedWorkspace = path.resolve(workspaceRoot);
+    const resolvedFile = path.resolve(workspaceRoot, filePath);
+    // Path must be at or under workspaceRoot.
+    if (!resolvedFile.startsWith(resolvedWorkspace + path.sep) && resolvedFile !== resolvedWorkspace) {
+        return { ok: false, reason: "outside_workspace_boundary" };
+    }
+    return { ok: true };
+}
+/**
+ * Apply a completed ocdClearance to an artifact, returning an updated artifact.
+ *
+ * Does not mutate. Returns a new artifact reference with ocdClearance replaced.
+ * The artifact id is unchanged — ocdClearance is not part of the content-addressed
+ * id input (the id reflects what the edit IS, not its current OCD state).
+ */
+export function applyOCDClearance(artifact, ocdClearance) {
+    return { ...artifact, ocdClearance };
+}
+/**
+ * Mark an artifact's OCD conflict as accepted by H.
+ *
+ * Called when H explicitly accepts a detected conflict (conflict_detected → conflict_accepted).
+ * Preserves rulesFired and conflictsDetected for audit — only status changes.
+ */
+export function acceptOCDConflict(artifact) {
+    return {
+        ...artifact,
+        ocdClearance: {
+            ...artifact.ocdClearance,
+            status: "conflict_accepted",
+        },
+    };
+}
+// ─── Internal ────────────────────────────────────────────────────────────────
+function normalizePath(filePath) {
+    return filePath.replace(/\\/g, "/");
+}
+//# sourceMappingURL=ocd-evaluator.js.map

package/dist/src/cursor/ocd-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ocd-evaluator.js","sourceRoot":"","sources":["../../../src/cursor/ocd-evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,gFAAgF;AAEhF,MAAM,4BAA4B,GAAI,8BAA8B,CAAC;AACrE,MAAM,yBAAyB,GAAO,2BAA2B,CAAC;AAElE,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAA+B,EAC/B,MAAyB;IAEzB,MAAM,UAAU,GAAoB,EAAE,CAAC;IACvC,MAAM,iBAAiB,GAAa,EAAE,CAAC;IAEvC,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;IAElD,4EAA4E;IAC5E,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QACpC,MAAM,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpD,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;gBACvD,UAAU,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,iBAAiB,CAAC,IAAI,CACpB,SAAS,QAAQ,sDAAsD,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,IACE,YAAY,CAAC,MAAM,GAAG,CAAC;QACvB,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC,yBAAyB,EACtD,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC3C,iBAAiB,CAAC,IAAI,CACpB,4BAA4B,YAAY,CAAC,MAAM,gBAAgB,MAAM,CAAC,yBAAyB,IAAI,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAqB,EACrB,aAAqB;IAErB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,YAAY,GAAQ,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEhE,0CAA0C;IAC1C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,KAAK,iBAAiB,EAAE,CAAC;QACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAmC,EACnC,YAAgC;IAEhC,OAAO,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAA+B;IAE/B,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ,GAAG,QAAQ,CAAC,YAAY;YACxB,MAAM,EAAE,mBAAmB;SAC5B;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC"}