wotann 0.5.0 → 0.5.39

package/dist/cli/orphan-wires/patch-cmd.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `wotann ow patch <verb>` — apply_patch DSL CLI surface.
+ *
+ * Exposes the apply-patch executor pipeline at the command line:
+ *
+ *   wotann ow patch parse <file>
+ *     Parses a patch file and prints the structured ParsedPatch as JSON.
+ *
+ *   wotann ow patch preview <file> [--root <dir>] [--policy <preset>]
+ *     Dry-run the patch against the workspace. Prints what would happen
+ *     per-operation. No writes.
+ *
+ *   wotann ow patch apply <file> [--root <dir>] [--policy <preset>]
+ *     Execute the patch end-to-end. Writes files, appends an audit
+ *     entry per operation to .wotann/patch-audit.jsonl by default.
+ *
+ *   wotann ow patch policies
+ *     Lists the built-in scope-policy presets that --policy accepts.
+ *
+ * Quality bars:
+ *   - QB#3 honest stub: every error path exits with non-zero AND
+ *     surfaces a structured reason
+ *   - QB#11 sibling-site: composes apply-patch-executor.ts +
+ *     file-scope-policy.ts; doesn't re-implement either
+ *   - QB#13 no env reads outside `--root` resolution
+ */
+import type { Command } from "commander";
+export declare function registerPatchWire(parent: Command): void;
+//# sourceMappingURL=patch-cmd.d.ts.map

package/dist/cli/orphan-wires/patch-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch-cmd.d.ts","sourceRoot":"","sources":["../../../src/cli/orphan-wires/patch-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqFzC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAsEvD"}

package/dist/cli/orphan-wires/patch-cmd.js

@@ -0,0 +1,150 @@
+/**
+ * `wotann ow patch <verb>` — apply_patch DSL CLI surface.
+ *
+ * Exposes the apply-patch executor pipeline at the command line:
+ *
+ *   wotann ow patch parse <file>
+ *     Parses a patch file and prints the structured ParsedPatch as JSON.
+ *
+ *   wotann ow patch preview <file> [--root <dir>] [--policy <preset>]
+ *     Dry-run the patch against the workspace. Prints what would happen
+ *     per-operation. No writes.
+ *
+ *   wotann ow patch apply <file> [--root <dir>] [--policy <preset>]
+ *     Execute the patch end-to-end. Writes files, appends an audit
+ *     entry per operation to .wotann/patch-audit.jsonl by default.
+ *
+ *   wotann ow patch policies
+ *     Lists the built-in scope-policy presets that --policy accepts.
+ *
+ * Quality bars:
+ *   - QB#3 honest stub: every error path exits with non-zero AND
+ *     surfaces a structured reason
+ *   - QB#11 sibling-site: composes apply-patch-executor.ts +
+ *     file-scope-policy.ts; doesn't re-implement either
+ *   - QB#13 no env reads outside `--root` resolution
+ */
+import { promises as fs } from "node:fs";
+import { resolve } from "node:path";
+import { executePatch, joinPath, previewPatch, } from "../../intelligence/apply-patch-executor.js";
+import { parsePatch } from "../../intelligence/apply-patch-dsl.js";
+import { DOCS_ONLY_POLICY, I18N_ONLY_POLICY, READ_ONLY_POLICY, TESTS_ONLY_POLICY, } from "../../agents/file-scope-policy.js";
+// ── Policy lookup ────────────────────────────────────────────────────
+const POLICY_PRESETS = {
+    "read-only": READ_ONLY_POLICY,
+    "tests-only": TESTS_ONLY_POLICY,
+    "docs-only": DOCS_ONLY_POLICY,
+    "i18n-only": I18N_ONLY_POLICY,
+};
+function resolvePolicy(name) {
+    if (!name)
+        return undefined;
+    const p = POLICY_PRESETS[name];
+    if (!p) {
+        process.stderr.write(`Unknown policy preset: ${name}. Available: ${Object.keys(POLICY_PRESETS).join(", ")}\n`);
+        process.exit(2);
+    }
+    return p;
+}
+// ── Output formatting ────────────────────────────────────────────────
+function printResultPlain(r) {
+    if (r.status === "rejected") {
+        process.stderr.write(`PATCH REJECTED: ${r.reason}\n`);
+        return;
+    }
+    process.stdout.write(`${r.dryRun ? "DRY-RUN: " : ""}${r.counts.add} adds, ${r.counts.update} updates, ${r.counts.delete} deletes\n`);
+    for (const op of r.operations) {
+        const symbol = op.status === "applied" ? "✓" : op.status === "skipped" ? "·" : "✗";
+        process.stdout.write(`  ${symbol} [${op.kind}] ${op.path} — ${op.reason}\n`);
+    }
+}
+function printResultJson(r) {
+    process.stdout.write(`${JSON.stringify(r, null, 2)}\n`);
+}
+function exitFromResult(r) {
+    if (r.status === "rejected")
+        process.exit(1);
+    const anyFailed = r.operations.some((op) => op.status === "failed");
+    process.exit(anyFailed ? 1 : 0);
+}
+// ── Verb implementations ─────────────────────────────────────────────
+async function readPatchFile(path) {
+    try {
+        return await fs.readFile(path, "utf8");
+    }
+    catch (err) {
+        process.stderr.write(`Cannot read patch file ${path}: ${err instanceof Error ? err.message : err}\n`);
+        process.exit(2);
+    }
+}
+// ── Registration ─────────────────────────────────────────────────────
+export function registerPatchWire(parent) {
+    const cmd = parent
+        .command("patch")
+        .description("Apply Codex apply_patch DSL files (parse / preview / apply / list policies)");
+    cmd
+        .command("parse <file>")
+        .description("Parse a patch file and emit the ParsedPatch as JSON")
+        .action(async (file) => {
+        const source = await readPatchFile(file);
+        const parsed = parsePatch(source);
+        if (!parsed.ok) {
+            process.stderr.write(`PARSE ERROR: ${parsed.error}${parsed.line ? ` (line ${parsed.line})` : ""}\n`);
+            process.exit(1);
+        }
+        process.stdout.write(`${JSON.stringify(parsed.patch, null, 2)}\n`);
+        process.exit(0);
+    });
+    cmd
+        .command("preview <file>")
+        .description("Dry-run a patch against the workspace; no writes")
+        .option("--root <dir>", "Workspace root (default: cwd)")
+        .option("--policy <preset>", "File-scope policy preset to enforce")
+        .option("--json", "Emit ExecuteResult as JSON", false)
+        .action(async (file, opts) => {
+        const source = await readPatchFile(file);
+        const root = resolve(opts.root ?? process.cwd());
+        const policy = resolvePolicy(opts.policy);
+        const r = await previewPatch(source, root, policy);
+        if (opts.json)
+            printResultJson(r);
+        else
+            printResultPlain(r);
+        exitFromResult(r);
+    });
+    cmd
+        .command("apply <file>")
+        .description("Apply a patch end-to-end (writes files + audit log)")
+        .option("--root <dir>", "Workspace root (default: cwd)")
+        .option("--policy <preset>", "File-scope policy preset to enforce")
+        .option("--audit <path>", "JSONL audit log path (default: .wotann/patch-audit.jsonl)")
+        .option("--json", "Emit ExecuteResult as JSON", false)
+        .action(async (file, opts) => {
+        const source = await readPatchFile(file);
+        const root = resolve(opts.root ?? process.cwd());
+        const policy = resolvePolicy(opts.policy);
+        const audit = opts.audit ?? joinPath(root, ".wotann", "patch-audit.jsonl");
+        const r = await executePatch({
+            source,
+            workspaceRoot: root,
+            dryRun: false,
+            ...(policy ? { scopePolicy: policy } : {}),
+            auditLogPath: audit,
+        });
+        if (opts.json)
+            printResultJson(r);
+        else
+            printResultPlain(r);
+        exitFromResult(r);
+    });
+    cmd
+        .command("policies")
+        .description("List built-in file-scope policy presets")
+        .action(() => {
+        for (const name of Object.keys(POLICY_PRESETS)) {
+            process.stdout.write(`  ${name}\n`);
+        }
+        process.exit(0);
+    });
+}
+//# sourceMappingURL=patch-cmd.js.map

package/dist/cli/orphan-wires/patch-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch-cmd.js","sourceRoot":"","sources":["../../../src/cli/orphan-wires/patch-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,YAAY,GAEb,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AACnE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,mCAAmC,CAAC;AAE3C,wEAAwE;AAExE,MAAM,cAAc,GAA+C;IACjE,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,gBAAgB;IAC7B,WAAW,EAAE,gBAAgB;CAC9B,CAAC;AAEF,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,IAAI,gBAAgB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACzF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,wEAAwE;AAExE,SAAS,gBAAgB,CAAC,CAAgB;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,aAAa,CAAC,CAAC,MAAM,CAAC,MAAM,YAAY,CAC/G,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAgB;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,CAAgB;IACtC,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACpE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,wEAAwE;AAExE,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AASD,wEAAwE;AAExE,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,MAAM,GAAG,GAAG,MAAM;SACf,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,6EAA6E,CAAC,CAAC;IAE9F,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gBAAgB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAC/E,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,cAAc,EAAE,+BAA+B,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,qCAAqC,CAAC;SAClE,MAAM,CAAC,QAAQ,EAAE,4BAA4B,EAAE,KAAK,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAgB,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI;YAAE,eAAe,CAAC,CAAC,CAAC,CAAC;;YAC7B,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACzB,cAAc,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,cAAc,EAAE,+BAA+B,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,qCAAqC,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,2DAA2D,CAAC;SACrF,MAAM,CAAC,QAAQ,EAAE,4BAA4B,EAAE,KAAK,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAgB,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC;YAC3B,MAAM;YACN,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,KAAK;YACb,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI;YAAE,eAAe,CAAC,CAAC,CAAC,CAAC;;YAC7B,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACzB,cAAc,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,yCAAyC,CAAC;SACtD,MAAM,CAAC,GAAG,EAAE;QACX,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/orphan-wires/redteam-scan-cmd.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `wotann ow redteam-scan <verb>` — Promptfoo-style 25-plugin attack
+ * catalog scanner.
+ *
+ * Sibling to redteam-cmd.ts (which only LISTS plugins). This command
+ * actually runs the catalog against a model and produces a per-plugin
+ * report.
+ *
+ * Verbs:
+ *   list                  — list all 25 catalog plugins with severity
+ *   list --category C     — filter by category (jailbreak / pii-leak / ...)
+ *   list --severity S     — filter by severity (critical / high / medium / low)
+ *   scan --provider <p>   — run the full catalog against a configured provider
+ *     [--plugins id1,id2] — restrict to a subset of plugin IDs
+ *     [--cases <n>]       — cases per plugin (default 3)
+ *     [--md]              — emit Markdown report (default)
+ *     [--json]            — emit JSON report
+ *     [--out <path>]      — also write report to a file
+ *
+ * The model invocation goes through the runtime's resolveAgentModel()
+ * + provider router so any of WOTANN's 19+7 providers (including
+ * anonymous public-tier) can be the target. NO secrets needed for
+ * Pollinations / LLM7 / OVH / Horde — the catalog scan works on a
+ * fresh install.
+ */
+import type { Command } from "commander";
+export declare function registerRedteamScanWire(parent: Command): void;
+//# sourceMappingURL=redteam-scan-cmd.d.ts.map

package/dist/cli/orphan-wires/redteam-scan-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redteam-scan-cmd.d.ts","sourceRoot":"","sources":["../../../src/cli/orphan-wires/redteam-scan-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqKzC,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAgC7D"}

package/dist/cli/orphan-wires/redteam-scan-cmd.js

@@ -0,0 +1,169 @@
+/**
+ * `wotann ow redteam-scan <verb>` — Promptfoo-style 25-plugin attack
+ * catalog scanner.
+ *
+ * Sibling to redteam-cmd.ts (which only LISTS plugins). This command
+ * actually runs the catalog against a model and produces a per-plugin
+ * report.
+ *
+ * Verbs:
+ *   list                  — list all 25 catalog plugins with severity
+ *   list --category C     — filter by category (jailbreak / pii-leak / ...)
+ *   list --severity S     — filter by severity (critical / high / medium / low)
+ *   scan --provider <p>   — run the full catalog against a configured provider
+ *     [--plugins id1,id2] — restrict to a subset of plugin IDs
+ *     [--cases <n>]       — cases per plugin (default 3)
+ *     [--md]              — emit Markdown report (default)
+ *     [--json]            — emit JSON report
+ *     [--out <path>]      — also write report to a file
+ *
+ * The model invocation goes through the runtime's resolveAgentModel()
+ * + provider router so any of WOTANN's 19+7 providers (including
+ * anonymous public-tier) can be the target. NO secrets needed for
+ * Pollinations / LLM7 / OVH / Horde — the catalog scan works on a
+ * fresh install.
+ */
+import { promises as fs } from "node:fs";
+import { REDTEAM_PLUGIN_CATALOG, pluginsByCategory, pluginsBySeverity, renderMarkdownReport, runCatalogScan, } from "../../intelligence/eval-frameworks/redteam-plugin-catalog.js";
+// ── Helpers ──────────────────────────────────────────────────────────
+function printPluginRow(p) {
+    process.stdout.write(`  ${p.severity.padEnd(8)} ${p.id.padEnd(28)} ${p.description}\n`);
+}
+function isCategory(s) {
+    return (s === "jailbreak" || s === "prompt-injection" || s === "harmful-content" || s === "pii-leak");
+}
+function isSeverity(s) {
+    return s === "critical" || s === "high" || s === "medium" || s === "low";
+}
+// ── Default model function ───────────────────────────────────────────
+/**
+ * Build a modelFn: simple HTTP POST to a provider's /chat/completions
+ * endpoint via the public-tier (anonymous) Pollinations adapter.
+ *
+ * This is a deliberately-simple default so `wotann ow redteam-scan`
+ * works zero-config on a fresh install. Callers wanting their own
+ * paid provider should pass --provider and rely on the registry
+ * resolution path (lib.ts ProviderRegistry).
+ */
+function defaultPollinationsModelFn() {
+    const url = "https://text.pollinations.ai/openai/chat/completions";
+    return async (prompt) => {
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                model: "openai-fast",
+                messages: [{ role: "user", content: prompt }],
+                stream: false,
+            }),
+        });
+        if (!res.ok) {
+            throw new Error(`pollinations HTTP ${res.status}: ${await res.text().catch(() => "")}`);
+        }
+        const data = (await res.json());
+        return data.choices?.[0]?.message?.content ?? "";
+    };
+}
+// ── Verbs ────────────────────────────────────────────────────────────
+function runList(opts) {
+    let plugins = REDTEAM_PLUGIN_CATALOG;
+    if (opts.category) {
+        if (!isCategory(opts.category)) {
+            process.stderr.write(`Unknown category: ${opts.category}\n`);
+            process.exit(2);
+        }
+        plugins = pluginsByCategory(opts.category);
+    }
+    if (opts.severity) {
+        if (!isSeverity(opts.severity)) {
+            process.stderr.write(`Unknown severity: ${opts.severity}\n`);
+            process.exit(2);
+        }
+        const filtered = pluginsBySeverity(opts.severity);
+        plugins = plugins.filter((p) => filtered.includes(p));
+    }
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify(plugins.map((p) => ({
+            id: p.id,
+            category: p.category,
+            severity: p.severity,
+            description: p.description,
+            references: p.references,
+        })), null, 2)}\n`);
+        process.exit(0);
+    }
+    process.stdout.write(`Redteam plugin catalog (${plugins.length} of ${REDTEAM_PLUGIN_CATALOG.length}):\n`);
+    for (const p of plugins)
+        printPluginRow(p);
+    process.exit(0);
+}
+async function runScan(opts) {
+    const target = opts.target ?? "test target application";
+    const casesPerPlugin = opts.cases ? Number.parseInt(opts.cases, 10) : 3;
+    const pluginIds = opts.plugins
+        ? opts.plugins
+            .split(",")
+            .map((s) => s.trim())
+            .filter((s) => s.length > 0)
+        : undefined;
+    if (Number.isNaN(casesPerPlugin) || casesPerPlugin < 1) {
+        process.stderr.write(`--cases must be a positive integer; got ${opts.cases}\n`);
+        process.exit(2);
+    }
+    const modelFn = defaultPollinationsModelFn();
+    const reports = await runCatalogScan({
+        target,
+        modelFn,
+        casesPerPlugin,
+        ...(pluginIds ? { pluginIds } : {}),
+    });
+    await emitReports(reports, opts);
+    const failed = reports.reduce((acc, r) => acc + r.summary.failed, 0);
+    process.exit(failed > 0 ? 1 : 0);
+}
+async function emitReports(reports, opts) {
+    let body;
+    if (opts.json) {
+        body = JSON.stringify(reports, null, 2);
+    }
+    else {
+        body = renderMarkdownReport(reports);
+    }
+    process.stdout.write(`${body}\n`);
+    if (opts.out) {
+        await fs.writeFile(opts.out, body, "utf8");
+        process.stderr.write(`Wrote report to ${opts.out}\n`);
+    }
+}
+// ── Registration ─────────────────────────────────────────────────────
+export function registerRedteamScanWire(parent) {
+    const cmd = parent
+        .command("redteam-scan")
+        .description("Promptfoo-style 25-plugin attack catalog scanner");
+    cmd
+        .command("list")
+        .description("List the catalog plugins (filterable by category/severity)")
+        .option("--category <c>", "Filter by category")
+        .option("--severity <s>", "Filter by severity")
+        .option("--json", "Emit as JSON", false)
+        .action((opts) => runList(opts));
+    cmd
+        .command("scan")
+        .description("Run the catalog against a model and produce a report")
+        .option("--target <t>", "Target description (default: 'test target application')")
+        .option("--plugins <ids>", "Comma-separated list of plugin IDs to run")
+        .option("--cases <n>", "Cases per plugin (default 3)")
+        .option("--md", "Emit Markdown report (default)", true)
+        .option("--json", "Emit JSON report instead of Markdown", false)
+        .option("--out <path>", "Also write the report to a file")
+        .action(async (opts) => {
+        try {
+            await runScan(opts);
+        }
+        catch (err) {
+            process.stderr.write(`redteam-scan failed: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=redteam-scan-cmd.js.map

package/dist/cli/orphan-wires/redteam-scan-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redteam-scan-cmd.js","sourceRoot":"","sources":["../../../src/cli/orphan-wires/redteam-scan-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,GAIf,MAAM,8DAA8D,CAAC;AAGtE,wEAAwE;AAExE,SAAS,cAAc,CAAC,CAAmB;IACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CACL,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,iBAAiB,IAAI,CAAC,KAAK,UAAU,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,KAAK,CAAC;AAC3E,CAAC;AAkBD,wEAAwE;AAExE;;;;;;;;GAQG;AACH,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,sDAAsD,CAAC;IACnE,OAAO,KAAK,EAAE,MAAc,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,aAAa;gBACpB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;gBAC7C,MAAM,EAAE,KAAK;aACd,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;IACnD,CAAC,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,SAAS,OAAO,CAAC,IAAc;IAC7B,IAAI,OAAO,GAAgC,sBAAsB,CAAC;IAClE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC,EACH,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2BAA2B,OAAO,CAAC,MAAM,OAAO,sBAAsB,CAAC,MAAM,MAAM,CACpF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAc;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,yBAAyB,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO;QAC5B,CAAC,CAAC,IAAI,CAAC,OAAO;aACT,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;IAE7C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC;QACnC,MAAM;QACN,OAAO;QACP,cAAc;QACd,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAA8B,EAAE,IAAc;IACvE,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,uBAAuB,CAAC,MAAe;IACrD,MAAM,GAAG,GAAG,MAAM;SACf,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,kDAAkD,CAAC,CAAC;IAEnE,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;SAC9C,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;SAC9C,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC;SACvC,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7C,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,cAAc,EAAE,yDAAyD,CAAC;SACjF,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;SACtE,MAAM,CAAC,aAAa,EAAE,8BAA8B,CAAC;SACrD,MAAM,CAAC,MAAM,EAAE,gCAAgC,EAAE,IAAI,CAAC;SACtD,MAAM,CAAC,QAAQ,EAAE,sCAAsC,EAAE,KAAK,CAAC;SAC/D,MAAM,CAAC,cAAc,EAAE,iCAAiC,CAAC;SACzD,MAAM,CAAC,KAAK,EAAE,IAAc,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC7E,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/orphan-wires/scrape-adapt-cmd.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `wotann ow scrape-adapt <verb>` — adaptive-selectors CLI surface.
+ *
+ * Wires src/browser/adaptive-selectors.ts to a discoverable user
+ * surface. Useful for testing adaptive selectors against captured
+ * DOM snapshots without booting a browser.
+ *
+ * Verbs:
+ *   wotann ow scrape-adapt fingerprint <element.json>
+ *     Reads ElementShape from JSON, prints ElementFingerprint as JSON.
+ *
+ *   wotann ow scrape-adapt match <fingerprint.json> <candidates.json>
+ *     Reads a fingerprint + array of ElementShape candidates, scores
+ *     each, prints findBestMatch result as JSON.
+ *
+ *   wotann ow scrape-adapt score <fingerprint.json> <candidate.json>
+ *     Pure score (one candidate vs fingerprint).
+ */
+import type { Command } from "commander";
+export declare function registerScrapeAdaptWire(parent: Command): void;
+//# sourceMappingURL=scrape-adapt-cmd.d.ts.map

package/dist/cli/orphan-wires/scrape-adapt-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrape-adapt-cmd.d.ts","sourceRoot":"","sources":["../../../src/cli/orphan-wires/scrape-adapt-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+CzC,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAoB7D"}

package/dist/cli/orphan-wires/scrape-adapt-cmd.js

@@ -0,0 +1,70 @@
+/**
+ * `wotann ow scrape-adapt <verb>` — adaptive-selectors CLI surface.
+ *
+ * Wires src/browser/adaptive-selectors.ts to a discoverable user
+ * surface. Useful for testing adaptive selectors against captured
+ * DOM snapshots without booting a browser.
+ *
+ * Verbs:
+ *   wotann ow scrape-adapt fingerprint <element.json>
+ *     Reads ElementShape from JSON, prints ElementFingerprint as JSON.
+ *
+ *   wotann ow scrape-adapt match <fingerprint.json> <candidates.json>
+ *     Reads a fingerprint + array of ElementShape candidates, scores
+ *     each, prints findBestMatch result as JSON.
+ *
+ *   wotann ow scrape-adapt score <fingerprint.json> <candidate.json>
+ *     Pure score (one candidate vs fingerprint).
+ */
+import { promises as fs } from "node:fs";
+import { buildFingerprint, findBestMatch, score as scoreOne, } from "../../browser/adaptive-selectors.js";
+async function readJson(path) {
+    try {
+        const raw = await fs.readFile(path, "utf8");
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        process.stderr.write(`Cannot read ${path}: ${err.message}\n`);
+        process.exit(2);
+    }
+}
+async function runFingerprint(file) {
+    const element = await readJson(file);
+    const fp = buildFingerprint(element);
+    process.stdout.write(`${JSON.stringify(fp, null, 2)}\n`);
+    process.exit(0);
+}
+async function runMatch(fpFile, candFile, opts) {
+    const fp = await readJson(fpFile);
+    const candidates = await readJson(candFile);
+    const threshold = opts.threshold ? Number.parseFloat(opts.threshold) : undefined;
+    const result = findBestMatch(candidates, fp, threshold !== undefined ? { threshold } : undefined);
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    process.exit(result.ok ? 0 : 1);
+}
+async function runScore(fpFile, candFile) {
+    const fp = await readJson(fpFile);
+    const cand = await readJson(candFile);
+    const s = scoreOne(cand, fp);
+    process.stdout.write(`${s.toFixed(4)}\n`);
+    process.exit(0);
+}
+export function registerScrapeAdaptWire(parent) {
+    const cmd = parent
+        .command("scrape-adapt")
+        .description("Adaptive-selector helpers (Scrapling pattern)");
+    cmd
+        .command("fingerprint <file>")
+        .description("Build ElementFingerprint from an ElementShape JSON")
+        .action(async (file) => runFingerprint(file));
+    cmd
+        .command("match <fingerprint> <candidates>")
+        .description("Score candidates against fingerprint; return best match")
+        .option("--threshold <n>", "Minimum score (default 0.6)")
+        .action(async (fp, cand, opts) => runMatch(fp, cand, opts));
+    cmd
+        .command("score <fingerprint> <candidate>")
+        .description("Compute the [0,1] similarity score for one candidate")
+        .action(async (fp, cand) => runScore(fp, cand));
+}
+//# sourceMappingURL=scrape-adapt-cmd.js.map

package/dist/cli/orphan-wires/scrape-adapt-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrape-adapt-cmd.js","sourceRoot":"","sources":["../../../src/cli/orphan-wires/scrape-adapt-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,KAAK,IAAI,QAAQ,GAGlB,MAAM,qCAAqC,CAAC;AAE7C,KAAK,UAAU,QAAQ,CAAI,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,KAAM,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAe,IAAI,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAMD,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,QAAgB,EAAE,IAAe;IACvE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAqB,MAAM,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAA0B,QAAQ,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,QAAgB;IACtD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAqB,MAAM,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAe,QAAQ,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAe;IACrD,MAAM,GAAG,GAAG,MAAM;SACf,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,+CAA+C,CAAC,CAAC;IAEhE,GAAG;SACA,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,oDAAoD,CAAC;SACjE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAExD,GAAG;SACA,OAAO,CAAC,kCAAkC,CAAC;SAC3C,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,iBAAiB,EAAE,6BAA6B,CAAC;SACxD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAY,EAAE,IAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAEzF,GAAG;SACA,OAAO,CAAC,iCAAiC,CAAC;SAC1C,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/cli/orphan-wires/shell-tier-cmd.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `wotann ow shell-tier <verb>` — shell-escalation tier classifier CLI.
+ *
+ * Wires src/security/shell-escalation-tiers.ts to a discoverable user
+ * surface.
+ *
+ * Verbs:
+ *   wotann ow shell-tier classify <command...>
+ *     Prints the tier classification for a command.
+ *
+ *   wotann ow shell-tier check <tier> <command...>
+ *     Allows / requires-escalation given the authorized tier 0-3.
+ *     Exit 0 if allowed, 1 if escalation required.
+ *
+ *   wotann ow shell-tier list
+ *     Lists the 4 tier names.
+ */
+import type { Command } from "commander";
+export declare function registerShellTierWire(parent: Command): void;
+//# sourceMappingURL=shell-tier-cmd.d.ts.map

package/dist/cli/orphan-wires/shell-tier-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-tier-cmd.d.ts","sourceRoot":"","sources":["../../../src/cli/orphan-wires/shell-tier-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqDzC,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAmB3D"}

package/dist/cli/orphan-wires/shell-tier-cmd.js

@@ -0,0 +1,74 @@
+/**
+ * `wotann ow shell-tier <verb>` — shell-escalation tier classifier CLI.
+ *
+ * Wires src/security/shell-escalation-tiers.ts to a discoverable user
+ * surface.
+ *
+ * Verbs:
+ *   wotann ow shell-tier classify <command...>
+ *     Prints the tier classification for a command.
+ *
+ *   wotann ow shell-tier check <tier> <command...>
+ *     Allows / requires-escalation given the authorized tier 0-3.
+ *     Exit 0 if allowed, 1 if escalation required.
+ *
+ *   wotann ow shell-tier list
+ *     Lists the 4 tier names.
+ */
+import { TIER_NAMES, classifyCommandLine, decideEscalation, } from "../../security/shell-escalation-tiers.js";
+function parseTier(s) {
+    const n = Number.parseInt(s, 10);
+    if (n === 0 || n === 1 || n === 2 || n === 3)
+        return n;
+    return null;
+}
+function runClassify(args) {
+    const cmd = args.join(" ");
+    const r = classifyCommandLine(cmd);
+    process.stdout.write(`tier=${r.tier} (${r.tierName}) command=${r.command}\nreason: ${r.reason}\n`);
+    process.exit(0);
+}
+function runCheck(tierStr, args) {
+    const tier = parseTier(tierStr);
+    if (tier === null) {
+        process.stderr.write(`tier must be 0/1/2/3, got: ${tierStr}\n`);
+        process.exit(2);
+    }
+    const cmd = args.join(" ");
+    const classification = classifyCommandLine(cmd);
+    const decision = decideEscalation(classification, tier);
+    if (decision.action === "allow") {
+        process.stdout.write(`ALLOW (tier ${classification.tier} ≤ authorized ${tier})\n`);
+        process.exit(0);
+    }
+    if (decision.action === "escalate-required") {
+        process.stderr.write(`ESCALATE-REQUIRED: ${decision.reason}\n  required: tier ${decision.required} (${TIER_NAMES[decision.required]})\n  missing: ${decision.missing} tier(s)\n`);
+        process.exit(1);
+    }
+    process.stderr.write(`BLOCKED: ${decision.reason}\n`);
+    process.exit(1);
+}
+function runList() {
+    for (const [tier, name] of Object.entries(TIER_NAMES)) {
+        process.stdout.write(`  tier ${tier}: ${name}\n`);
+    }
+    process.exit(0);
+}
+export function registerShellTierWire(parent) {
+    const cmd = parent
+        .command("shell-tier")
+        .description("Codex-style shell-escalation tier classifier (0=read-only ... 3=destructive)");
+    cmd
+        .command("classify <command...>")
+        .description("Classify a shell command into a tier (0-3)")
+        .action((args) => runClassify(args));
+    cmd
+        .command("check <tier> <command...>")
+        .description("Check if a command is allowed at the given authorized tier")
+        .action((tier, args) => runCheck(tier, args));
+    cmd
+        .command("list")
+        .description("List the 4 tier names")
+        .action(() => runList());
+}
+//# sourceMappingURL=shell-tier-cmd.js.map

package/dist/cli/orphan-wires/shell-tier-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-tier-cmd.js","sourceRoot":"","sources":["../../../src/cli/orphan-wires/shell-tier-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,0CAA0C,CAAC;AAElD,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAuB;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,IAAI,CAC7E,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,IAAuB;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,OAAO,IAAI,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,cAAc,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,cAAc,CAAC,IAAI,iBAAiB,IAAI,KAAK,CAAC,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sBAAsB,QAAQ,CAAC,MAAM,sBAAsB,QAAQ,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,QAAQ,CAAC,OAAO,YAAY,CAC5J,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,OAAO;IACd,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,MAAM,GAAG,GAAG,MAAM;SACf,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,8EAA8E,CAAC,CAAC;IAE/F,GAAG;SACA,OAAO,CAAC,uBAAuB,CAAC;SAChC,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjD,GAAG;SACA,OAAO,CAAC,2BAA2B,CAAC;SACpC,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,CAAC,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAElE,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uBAAuB,CAAC;SACpC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;AAC7B,CAAC"}

package/dist/cli/orphan-wires/sub-recipes-cmd.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `wotann ow sub-recipes <verb>` — isolated sub-recipe orchestrator CLI.
+ *
+ * Wires src/recipes/sub-recipe-orchestrator.ts to a discoverable user
+ * surface. Useful for visualizing the dependency DAG of a sub-recipe
+ * plan without actually running the recipes.
+ *
+ * Verbs:
+ *   wotann ow sub-recipes batches <plan.json>
+ *     Reads a JSON file describing { subs: [...], dependencies: [[from,to]] }
+ *     and prints the topological execution batches.
+ *
+ *   wotann ow sub-recipes plan <plan.json> [--json|--md]
+ *     Same as batches, but with structured output suitable for review.
+ */
+import type { Command } from "commander";
+export declare function registerSubRecipesWire(parent: Command): void;
+//# sourceMappingURL=sub-recipes-cmd.d.ts.map

package/dist/cli/orphan-wires/sub-recipes-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sub-recipes-cmd.d.ts","sourceRoot":"","sources":["../../../src/cli/orphan-wires/sub-recipes-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8EzC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAgB5D"}