zelari-code 0.1.0

package/dist/cli/slashCommands.js

@@ -0,0 +1,431 @@
+/**
+ * Parse a user input string starting with '/' into a SlashCommand + args.
+ * Returns { command, args } or null if not a slash command.
+ */
+function parseSlashCommand(text) {
+    const trimmed = text.trim();
+    if (!trimmed.startsWith('/'))
+        return null;
+    const parts = trimmed.slice(1).split(/\s+/);
+    const command = parts[0];
+    const args = parts.slice(1);
+    return { command, args };
+}
+/**
+ * Expand a skill's systemPromptFragment + the user's input into a complete
+ * prompt ready to send to AgentHarness. If the skill is invoked WITHOUT
+ * an input arg (e.g. just `/skill architect-feature`), generate a placeholder
+ * prompt asking the user for the input.
+ */
+export function expandSkillTemplate(skill, options = {}) {
+    const userInput = options.input?.trim() ?? '';
+    const prompt = userInput
+        ? `${skill.systemPromptFragment}\n\n## User input\n${userInput}`
+        : `${skill.systemPromptFragment}\n\n## User input\n(Please provide the task description or input for this skill.)`;
+    return {
+        skillId: skill.id,
+        prompt,
+        requiredRoles: skill.requiredRoles,
+        requiredTools: skill.requiredTools,
+        estimatedCost: skill.estimatedCost,
+    };
+}
+/**
+ * Format the list of available skills for `/skill` autocomplete or `/help`.
+ * Group by category.
+ */
+export function formatSkillList(skills) {
+    if (skills.length === 0)
+        return '(no skills available)';
+    const byCategory = new Map();
+    for (const skill of skills) {
+        const list = byCategory.get(skill.category) ?? [];
+        list.push(skill);
+        byCategory.set(skill.category, list);
+    }
+    const lines = ['Available skills:'];
+    for (const [category, list] of [...byCategory.entries()].sort()) {
+        lines.push(`\n[${category}]`);
+        for (const skill of list) {
+            const costLabel = skill.estimatedCost;
+            lines.push(`  /skill ${skill.id} — ${skill.name} (${costLabel} cost)`);
+        }
+    }
+    return lines.join('\n');
+}
+/**
+ * Handle a slash command from the CLI user. Returns a SlashCommandResult
+ * describing what the caller should do. Pure function — no side effects,
+ * no I/O. The caller (Phase 14's Ink UI) is responsible for actually
+ * performing the action (e.g. sending the expandedSkill.prompt to
+ * AgentHarness, clearing the transcript, etc.).
+ */
+export function handleSlashCommand(text, availableSkills) {
+    const parsed = parseSlashCommand(text);
+    if (!parsed) {
+        return { handled: false, kind: 'unknown' };
+    }
+    const { command, args } = parsed;
+    switch (command) {
+        case 'help':
+            return {
+                handled: true,
+                kind: 'help',
+                message: `Available commands:\n  /login <provider> — authenticate with provider (grok, minimax, glm, custom)\n  /model <name> — switch the active model\n  /model refresh — re-discover models for the active provider (v3-U)\n  /models — list discovered models for the active provider (v3-U)\n  /models refresh — re-discover models for the active provider (v3-U)\n  /provider <name> — switch the active provider\n  /provider custom <baseUrl> — point the active provider at a self-hosted endpoint (Ollama, LM Studio, vLLM, ...)\n  /provider custom clear — clear the custom endpoint override\n  /skill <name> [input] — invoke a skill (autocomplete with /skill <TAB>)\n  /skill-stats [name] — show invocation stats (success rate, avg duration, total tokens)\n  /council <input> — invoke the multi-agent council on input\n  /council-feedback <memberId> <1-5> [note] — rate a council member for future ranking (Task I.2)
+  /promote-member <memberId> — promote a council member to a standalone skill (v3-K)
+  /update [--yes|-y] — check for zelari-coder updates; --yes performs the update (v3-N)\n  /steer <text> — enqueue a follow-up prompt on the active run (Task 18.2)\n  /steer --interrupt <text> — cancel current run + enqueue <text> for next dispatch (Task C.3.2)\n  /compact — compact the session transcript\n  /clear — clear the visible transcript (session is preserved)\n  /sessions — list past sessions\n  /resume <id> — load a past session\n  /branch <name> — snapshot the current session into a new branch\n  /branches — list branches\n  /checkout <name> — switch the active branch\n  /new — start a fresh session\n  /diff [--staged] — show uncommitted changes (or staged with --staged)\n  /undo [--yes] — revert working-tree changes (destructive! requires --yes)\n  /help — show this help\n  /exit — exit the CLI\n\n${formatSkillList(availableSkills)}`,
+            };
+        case 'exit':
+            return { handled: true, kind: 'exit', message: 'Goodbye.' };
+        case 'clear':
+            return { handled: true, kind: 'clear', message: 'Transcript cleared.' };
+        case 'login': {
+            const provider = args[0];
+            if (!provider) {
+                return { handled: true, kind: 'login', message: 'Usage: /login <provider> [key] (or /login <provider> for OAuth if supported)' };
+            }
+            const key = args.slice(1).join(' ').trim();
+            if (!key) {
+                // No key supplied: if provider supports OAuth, signal OAuth flow;
+                // otherwise, show env-var hint as before.
+                if (provider === 'grok') {
+                    return { handled: true, kind: 'login_oauth', provider };
+                }
+                return {
+                    handled: true,
+                    kind: 'login',
+                    provider,
+                    message: `[login] no key supplied — set ${provider.toUpperCase()}_API_KEY env or pass the key: /login ${provider} <key>`,
+                };
+            }
+            return { handled: true, kind: 'login', provider, loginKey: key };
+        }
+        case 'model': {
+            const model = args[0];
+            if (!model) {
+                return {
+                    handled: true,
+                    kind: 'model_show',
+                    message: 'Usage: /model <name> to change, /model to show current',
+                };
+            }
+            if (model === 'refresh') {
+                return { handled: true, kind: 'model_refresh' };
+            }
+            return { handled: true, kind: 'model_set', model };
+        }
+        case 'models': {
+            const sub = args[0];
+            if (sub === 'refresh') {
+                return { handled: true, kind: 'models_refresh' };
+            }
+            return { handled: true, kind: 'models_list' };
+        }
+        case 'provider': {
+            const subcommand = args[0];
+            if (!subcommand) {
+                return {
+                    handled: true,
+                    kind: 'provider_list',
+                    message: 'Usage: /provider <name> — switch active provider\n         /provider custom <baseUrl> — set custom base URL (Ollama, LM Studio, vLLM, ...)\n         /provider custom clear — clear the custom override\n         /provider <name> refresh — force token refresh (v3-F)\n         /provider <name> status — show key source, expiry, refresh impl (v3-F)\nAvailable: openai-compatible, minimax, glm, grok, custom',
+                };
+            }
+            if (subcommand === 'custom') {
+                const target = args[1];
+                if (!target || target === 'show') {
+                    return {
+                        handled: true,
+                        kind: 'provider_custom',
+                        message: 'Usage: /provider custom <baseUrl> — set custom base URL for the active provider\n         /provider custom clear — clear the custom override for the active provider',
+                    };
+                }
+                if (target === 'clear') {
+                    return {
+                        handled: true,
+                        kind: 'provider_custom',
+                        customClear: true,
+                    };
+                }
+                // Treat the rest of the line as the URL (supports paths with spaces
+                // in user-typed input, though unusual).
+                const url = args.slice(1).join(' ').trim();
+                // Identify the provider id from the active provider at handler time.
+                // The caller (app.tsx) resolves this from providerConfig.activeProviderId.
+                return {
+                    handled: true,
+                    kind: 'provider_custom',
+                    customEndpoint: url,
+                };
+            }
+            // v3-F: /provider <id> refresh | status subcommands.
+            // subcommand is the provider id here; args[1] is the sub-subcommand.
+            const providerId = subcommand;
+            const sub = args[1];
+            if (sub === 'refresh') {
+                return { handled: true, kind: 'provider_refresh', provider: providerId };
+            }
+            if (sub === 'status') {
+                return { handled: true, kind: 'provider_status', provider: providerId };
+            }
+            return { handled: true, kind: 'provider_set', provider: subcommand };
+        }
+        case 'branch': {
+            const name = args[0];
+            if (!name) {
+                return {
+                    handled: true,
+                    kind: 'branch_create',
+                    message: 'Usage: /branch <name> — snapshots the current session into a new branch',
+                };
+            }
+            return { handled: true, kind: 'branch_create', branchName: name };
+        }
+        case 'branches':
+            return { handled: true, kind: 'branch_list' };
+        case 'checkout': {
+            const name = args[0];
+            if (!name) {
+                return {
+                    handled: true,
+                    kind: 'branch_checkout',
+                    message: 'Usage: /checkout <name> — switch the active branch',
+                };
+            }
+            return { handled: true, kind: 'branch_checkout', branchName: name };
+        }
+        case 'compact': {
+            // Optional flags: --threshold N, --keep N
+            let compactThreshold;
+            let compactKeepRecent;
+            for (let i = 0; i < args.length; i++) {
+                const a = args[i];
+                if (a === '--threshold' || a === '-t') {
+                    const v = Number.parseInt(args[++i] ?? '', 10);
+                    if (Number.isFinite(v) && v > 0)
+                        compactThreshold = v;
+                }
+                else if (a === '--keep' || a === '-k') {
+                    const v = Number.parseInt(args[++i] ?? '', 10);
+                    if (Number.isFinite(v) && v > 0)
+                        compactKeepRecent = v;
+                }
+            }
+            return {
+                handled: true,
+                kind: 'compact',
+                message: 'Compacting session...',
+                compactThreshold,
+                compactKeepRecent,
+            };
+        }
+        case 'sessions':
+            return { handled: true, kind: 'session' };
+        case 'resume': {
+            const targetId = args[0];
+            if (!targetId) {
+                return { handled: true, kind: 'resume', message: 'Usage: /resume <id>' };
+            }
+            return {
+                handled: true,
+                kind: 'resume',
+                targetSessionId: targetId,
+                message: `[resume] session ${targetId} ready — restart zelari-code to load`,
+            };
+        }
+        case 'new':
+            return {
+                handled: true,
+                kind: 'new',
+                message: '[new] session reset — next prompt starts fresh',
+            };
+        case 'council': {
+            const input = args.join(' ').trim();
+            if (!input) {
+                return {
+                    handled: true,
+                    kind: 'council',
+                    message: 'Usage: /council <input> — invokes the multi-agent council on the input',
+                };
+            }
+            return { handled: true, kind: 'council', councilInput: input };
+        }
+        case 'council-feedback': {
+            // Usage: /council-feedback <memberId> <1-5> [note...]
+            const memberId = args[0];
+            const scoreStr = args[1];
+            if (!memberId || !scoreStr) {
+                return {
+                    handled: true,
+                    kind: 'council_feedback',
+                    message: 'Usage: /council-feedback <memberId> <1-5> [note...] — rate a council member (e.g. /council-feedback sisyphus 4 great framing)',
+                };
+            }
+            const score = Number.parseInt(scoreStr, 10);
+            if (!Number.isInteger(score) || score < 1 || score > 5) {
+                return {
+                    handled: true,
+                    kind: 'council_feedback',
+                    message: `Invalid score "${scoreStr}" — must be an integer in [1, 5].`,
+                };
+            }
+            const note = args.slice(2).join(' ').trim() || undefined;
+            return {
+                handled: true,
+                kind: 'council_feedback',
+                feedbackMemberId: memberId,
+                feedbackScore: score,
+                ...(note ? { feedbackNote: note } : {}),
+            };
+        }
+        case 'skill': {
+            const skillId = args[0];
+            if (!skillId) {
+                return {
+                    handled: true,
+                    kind: 'skill',
+                    skillError: 'Usage: /skill <name> [input]',
+                    message: formatSkillList(availableSkills),
+                };
+            }
+            const skill = availableSkills.find((s) => s.id === skillId);
+            if (!skill) {
+                return {
+                    handled: true,
+                    kind: 'skill',
+                    skillError: `Unknown skill: "${skillId}". Use /skill <TAB> for autocomplete.`,
+                    message: formatSkillList(availableSkills),
+                };
+            }
+            const input = args.slice(1).join(' ');
+            const expandedSkill = expandSkillTemplate(skill, { input });
+            return { handled: true, kind: 'skill', expandedSkill };
+        }
+        case 'skill_stats': {
+            // `/skill-stats [name]` — show aggregated stats from skill-history.jsonl.
+            // name is optional; when omitted, returns stats across all skills.
+            const skillId = args[0];
+            return {
+                handled: true,
+                kind: 'skill_stats',
+                skillStatsSkillId: skillId,
+                message: skillId ? `Computing stats for skill "${skillId}"…` : 'Computing stats for all skills…',
+            };
+        }
+        case 'skill-compare': {
+            // `/skill-compare <id1> <id2>` — side-by-side stats for two skills.
+            // Args: exactly 2 IDs (whitespace-separated).
+            const id1 = args[0];
+            const id2 = args[1];
+            if (!id1 || !id2) {
+                return {
+                    handled: true,
+                    kind: 'skill-compare',
+                    message: '⚠ /skill-compare requires exactly 2 skill IDs (e.g. `/skill-compare debug refactor`).',
+                };
+            }
+            return {
+                handled: true,
+                kind: 'skill-compare',
+                compareIds: [id1, id2],
+                message: `Comparing skills "${id1}" vs "${id2}"…`,
+            };
+        }
+        case 'steer': {
+            // /steer <text>           → enqueue follow-up prompt (queue-only)
+            // /steer --interrupt <text>  → enqueue + cancel current run (Task C.3.2)
+            // /steer -i <text>        → short form of --interrupt
+            let interrupt = false;
+            const filtered = [];
+            for (const a of args) {
+                if (a === '--interrupt' || a === '-i') {
+                    interrupt = true;
+                }
+                else {
+                    filtered.push(a);
+                }
+            }
+            const text = filtered.join(' ').trim();
+            if (!text) {
+                return {
+                    handled: true,
+                    kind: interrupt ? 'steer_interrupt' : 'steer',
+                    message: 'Usage: /steer [--interrupt|-i] <text> — enqueue (and optionally cancel) a follow-up prompt',
+                };
+            }
+            return {
+                handled: true,
+                kind: interrupt ? 'steer_interrupt' : 'steer',
+                steerText: text,
+            };
+        }
+        case 'diff': {
+            const staged = args.includes('--staged') || args.includes('--cached');
+            return { handled: true, kind: 'diff', diffStaged: staged ? true : undefined };
+        }
+        case 'promote-member': {
+            // Usage: /promote-member <memberId>
+            // Validates the id against the AGENT_ROLES registry; if invalid,
+            // surfaces a usage-style error (the parser is pure, so we don't
+            // throw — the dispatcher can render the error message).
+            const memberId = args[0];
+            if (!memberId) {
+                return {
+                    handled: true,
+                    kind: 'promote_member_error',
+                    promoteMemberError: 'Usage: /promote-member <memberId> — e.g. /promote-member hephaestus',
+                };
+            }
+            // Quick sanity check — the dispatcher will do the full UnknownMemberError
+            // handling via promoteMember(). Here we just echo the id.
+            return { handled: true, kind: 'promote_member', promoteMemberId: memberId };
+        }
+        case 'update': {
+            // Usage:
+            //   /update                  → check for updates (silent current vs latest)
+            //   /update --yes | /update -y → perform the update
+            // Any other args → usage hint
+            let force = false;
+            for (const a of args) {
+                if (a === '--yes' || a === '-y') {
+                    force = true;
+                }
+            }
+            if (args.length > 0 && !force) {
+                return {
+                    handled: true,
+                    kind: 'update_usage',
+                    message: 'Usage: /update — check for the latest zelari-coder version\n' +
+                        '       /update --yes (or -y) — install the latest version (will ask you to restart manually)',
+                };
+            }
+            return {
+                handled: true,
+                kind: force ? 'update_perform' : 'update_check',
+                updateForce: force,
+            };
+        }
+        case 'undo': {
+            const confirmed = args.includes('--yes') || args.includes('-y');
+            if (confirmed) {
+                return { handled: true, kind: 'undo_confirm', undoConfirmed: true };
+            }
+            // Without --yes, surface a destructive warning. The caller (app.tsx)
+            // can still emit the actual git operation but should prefix with a
+            // "are you sure?" banner. We keep two distinct kinds so the UI can
+            // ask before acting.
+            return {
+                handled: true,
+                kind: 'undo',
+                message: '⚠ /undo is DESTRUCTIVE — it reverts all unstaged modifications ' +
+                    'and unstages everything.\nUse `/undo --yes` (or `/undo -y`) to confirm.',
+            };
+        }
+        default:
+            return {
+                handled: false,
+                kind: 'unknown',
+                message: `Unknown command: /${command}. Type /help for available commands.`,
+            };
+    }
+}
+//# sourceMappingURL=slashCommands.js.map

package/dist/cli/slashCommands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slashCommands.js","sourceRoot":"","sources":["../../src/cli/slashCommands.ts"],"names":[],"mappings":"AA2EA;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAiB,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA4B,EAC5B,UAA8B,EAAE;IAEhC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,SAAS;QACtB,CAAC,CAAC,GAAG,KAAK,CAAC,oBAAoB,sBAAsB,SAAS,EAAE;QAChE,CAAC,CAAC,GAAG,KAAK,CAAC,oBAAoB,mFAAmF,CAAC;IACrH,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,MAAM;QACN,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAwC;IACtE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,uBAAuB,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,KAAK,GAAa,CAAC,mBAAmB,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,EAAE,MAAM,KAAK,CAAC,IAAI,KAAK,SAAS,QAAQ,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,eAAiD;IAEjD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAEjC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;;uzBAEsyB,eAAe,CAAC,eAAe,CAAC,EAAE;aACl1B,CAAC;QAEJ,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAE9D,KAAK,OAAO;YACV,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;QAE1E,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC;YACnI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,kEAAkE;gBAClE,0CAA0C;gBAC1C,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;oBACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;gBAC1D,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,OAAO;oBACb,QAAQ;oBACR,OAAO,EAAE,iCAAiC,QAAQ,CAAC,WAAW,EAAE,wCAAwC,QAAQ,QAAQ;iBACzH,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,YAAY;oBAClB,OAAO,EAAE,wDAAwD;iBAClE,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YAClD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QACrD,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;YACnD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAChD,CAAC;QAED,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,oZAAoZ;iBAC9Z,CAAC;YACJ,CAAC;YACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACjC,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,iBAAiB;wBACvB,OAAO,EAAE,sKAAsK;qBAChL,CAAC;gBACJ,CAAC;gBACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;oBACvB,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,iBAAiB;wBACvB,WAAW,EAAE,IAAI;qBAClB,CAAC;gBACJ,CAAC;gBACD,oEAAoE;gBACpE,wCAAwC;gBACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3C,qEAAqE;gBACrE,2EAA2E;gBAC3E,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,iBAAiB;oBACvB,cAAc,EAAE,GAAG;iBACpB,CAAC;YACJ,CAAC;YACD,qDAAqD;YACrD,qEAAqE;YACrE,MAAM,UAAU,GAAG,UAAU,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC3E,CAAC;YACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QACvE,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,yEAAyE;iBACnF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACpE,CAAC;QAED,KAAK,UAAU;YACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAEhD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,oDAAoD;iBAC9D,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACtE,CAAC;QAED,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,0CAA0C;YAC1C,IAAI,gBAAoC,CAAC;YACzC,IAAI,iBAAqC,CAAC;YAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACtC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,gBAAgB,GAAG,CAAC,CAAC;gBACxD,CAAC;qBAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,iBAAiB,GAAG,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,uBAAuB;gBAChC,gBAAgB;gBAChB,iBAAiB;aAClB,CAAC;QACJ,CAAC;QAED,KAAK,UAAU;YACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAE5C,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;YAC3E,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,eAAe,EAAE,QAAQ;gBACzB,OAAO,EAAE,oBAAoB,QAAQ,sCAAsC;aAC5E,CAAC;QACJ,CAAC;QAED,KAAK,KAAK;YACR,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,gDAAgD;aAC1D,CAAC;QAEJ,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,wEAAwE;iBAClF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,sDAAsD;YACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC3B,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EACL,+HAA+H;iBAClI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACvD,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,kBAAkB,QAAQ,mCAAmC;iBACvE,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;YACzD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,kBAAkB;gBACxB,gBAAgB,EAAE,QAAQ;gBAC1B,aAAa,EAAE,KAAK;gBACpB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC;QACJ,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,OAAO;oBACb,UAAU,EAAE,8BAA8B;oBAC1C,OAAO,EAAE,eAAe,CAAC,eAAe,CAAC;iBAC1C,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,OAAO;oBACb,UAAU,EAAE,mBAAmB,OAAO,uCAAuC;oBAC7E,OAAO,EAAE,eAAe,CAAC,eAAe,CAAC;iBAC1C,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;QACzD,CAAC;QAED,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,0EAA0E;YAC1E,mEAAmE;YACnE,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,aAAa;gBACnB,iBAAiB,EAAE,OAAO;gBAC1B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,8BAA8B,OAAO,IAAI,CAAC,CAAC,CAAC,iCAAiC;aACjG,CAAC;QACJ,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,oEAAoE;YACpE,8CAA8C;YAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,uFAAuF;iBACjG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,eAAe;gBACrB,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;gBACtB,OAAO,EAAE,qBAAqB,GAAG,SAAS,GAAG,IAAI;aAClD,CAAC;QACJ,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,kEAAkE;YAClE,yEAAyE;YACzE,sDAAsD;YACtD,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACtC,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO;oBAC7C,OAAO,EAAE,4FAA4F;iBACtG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO;gBAC7C,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChF,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,oCAAoC;YACpC,iEAAiE;YACjE,gEAAgE;YAChE,wDAAwD;YACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,sBAAsB;oBAC5B,kBAAkB,EAChB,qEAAqE;iBACxE,CAAC;YACJ,CAAC;YACD,0EAA0E;YAC1E,0DAA0D;YAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;QAC9E,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,SAAS;YACT,4EAA4E;YAC5E,oDAAoD;YACpD,8BAA8B;YAC9B,IAAI,KAAK,GAAG,KAAK,CAAC;YAClB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBAChC,KAAK,GAAG,IAAI,CAAC;gBACf,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,cAAc;oBACpB,OAAO,EACL,8DAA8D;wBAC9D,8FAA8F;iBACjG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc;gBAC/C,WAAW,EAAE,KAAK;aACnB,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAChE,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACtE,CAAC;YACD,qEAAqE;YACrE,mEAAmE;YACnE,mEAAmE;YACnE,qBAAqB;YACrB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,MAAM;gBACZ,OAAO,EACL,iEAAiE;oBACjE,yEAAyE;aAC5E,CAAC;QACJ,CAAC;QAED;YACE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,qBAAqB,OAAO,sCAAsC;aAC5E,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/cli/toolRegistry.js

@@ -0,0 +1,187 @@
+/**
+ * toolRegistry — default ToolRegistry for the zelari-code CLI.
+ *
+ * Wires the 5 built-in tools (filesystem read/write/edit + bash + grep) into a
+ * ToolRegistry instance that the AgentHarness can hand to the provider via
+ * `tools: registry.toOpenAITools()` + `toolRegistry: registry`.
+ *
+ * Task A1 of AnathemaCoder v3-A: enable the existing tool pipeline.
+ * Task A2 of v3-A: wrap each tool with the safety layer (sandbox path,
+ * shell blocklist, audit log).
+ *
+ * @see docs/plans/2026-06-29-anathema-coder-v3.md (Tasks A1 + A2)
+ */
+import { ToolRegistry } from '../main/core/tools/registry.js';
+import { readFileTool, writeFileTool, editFileTool, } from '../main/core/tools/builtin/filesystem.js';
+import { bashTool } from '../main/core/tools/builtin/shell.js';
+import { grepContentTool } from '../main/core/tools/builtin/search.js';
+import { resolveSandboxedPath, SandboxViolationError } from './safety/sandboxPath.js';
+import { assertShellAllowed, ShellBlockedError } from './safety/shellBlocklist.js';
+import { AuditLogger } from './safety/auditLogger.js';
+/**
+ * Create a fresh ToolRegistry pre-populated with the 5 built-in tools,
+ * each wrapped with the safety layer (Task A2).
+ *
+ * Safety policy applied:
+ *  - filesystem tools: resolveSandboxedPath() on every path arg; throws
+ *    SandboxViolationError if the path escapes the root.
+ *  - bash: assertShellAllowed() on the command; throws ShellBlockedError
+ *    on any blocklist match.
+ *  - every tool: AuditLogger.runTool() wraps the call to record ts,
+ *    args (redacted), ok, duration, summary.
+ */
+export function createBuiltinToolRegistry(options = {}) {
+    const root = options.root ?? process.cwd();
+    const audit = options.audit ?? new AuditLogger();
+    const sessionId = options.sessionId ?? 'cli';
+    // Wrap filesystem tools: sandbox the path argument before delegating.
+    const safeReadFile = wrapWithSandbox(readFileTool, ['path'], root, audit, sessionId);
+    const safeWriteFile = wrapWithSandbox(writeFileTool, ['path'], root, audit, sessionId);
+    const safeEditFile = wrapWithSandbox(editFileTool, ['path'], root, audit, sessionId);
+    const safeGrepContent = wrapWithSandbox(grepContentTool, ['path'], root, audit, sessionId);
+    // Wrap bash: shell blocklist + audit.
+    const safeBash = wrapWithShellSafety(bashTool, audit, sessionId);
+    const registry = new ToolRegistry();
+    registry.register(safeReadFile);
+    registry.register(safeWriteFile);
+    registry.register(safeEditFile);
+    registry.register(safeBash);
+    registry.register(safeGrepContent);
+    const tools = [
+        safeReadFile,
+        safeWriteFile,
+        safeEditFile,
+        safeBash,
+        safeGrepContent,
+    ].map((t) => ({
+        name: t.name,
+        description: t.description,
+        permissions: t.permissions ?? [],
+    }));
+    return { registry, tools };
+}
+/**
+ * Wrap a tool so that the named string args are validated through
+ * resolveSandboxedPath() before the original execute() runs. The path
+ * arg is rewritten to its resolved form so the tool sees the absolute
+ * sandboxed path.
+ */
+function wrapWithSandbox(original, pathArgs, root, audit, sessionId) {
+    return {
+        ...original,
+        execute: async (rawArgs, ctx) => {
+            // Pre-flight: sandbox all path args; rewrite them in-place.
+            const args = rawArgs;
+            for (const key of pathArgs) {
+                const v = args[key];
+                if (typeof v === 'string' && v.length > 0) {
+                    try {
+                        args[key] = resolveSandboxedPath(v, { root });
+                    }
+                    catch (err) {
+                        if (err instanceof SandboxViolationError) {
+                            // Audit + return typedErr so the caller gets a friendly error.
+                            await audit.append({
+                                ts: new Date().toISOString(),
+                                sessionId,
+                                tool: original.name,
+                                args: redactForAudit(args),
+                                ok: false,
+                                resultSummary: err.message,
+                                durationMs: 0,
+                                error: 'sandbox_violation',
+                            });
+                            return {
+                                ok: false,
+                                error: `[sandbox] ${err.message}`,
+                            };
+                        }
+                        throw err;
+                    }
+                }
+            }
+            // Audit-wrapped execution.
+            try {
+                return await audit.runTool({
+                    tool: original.name,
+                    args: redactForAudit(args),
+                    sessionId,
+                    fn: () => original.execute(rawArgs, ctx),
+                });
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    error: err instanceof Error ? err.message : String(err),
+                };
+            }
+        },
+    };
+}
+/**
+ * Wrap the bash tool: assertShellAllowed() runs before execute(), and
+ * every invocation is audited.
+ */
+function wrapWithShellSafety(original, audit, sessionId) {
+    return {
+        ...original,
+        execute: async (rawArgs, ctx) => {
+            const args = rawArgs;
+            const cmd = args['command'];
+            if (typeof cmd === 'string') {
+                try {
+                    assertShellAllowed(cmd);
+                }
+                catch (err) {
+                    if (err instanceof ShellBlockedError) {
+                        await audit.append({
+                            ts: new Date().toISOString(),
+                            sessionId,
+                            tool: original.name,
+                            args: redactForAudit(args),
+                            ok: false,
+                            resultSummary: err.message,
+                            durationMs: 0,
+                            error: 'shell_blocked',
+                        });
+                        return {
+                            ok: false,
+                            error: `[shell-blocked] ${err.message}`,
+                        };
+                    }
+                    throw err;
+                }
+            }
+            try {
+                return await audit.runTool({
+                    tool: original.name,
+                    args: redactForAudit(args),
+                    sessionId,
+                    fn: () => original.execute(rawArgs, ctx),
+                });
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    error: err instanceof Error ? err.message : String(err),
+                };
+            }
+        },
+    };
+}
+function redactForAudit(args) {
+    const out = {};
+    for (const [k, v] of Object.entries(args)) {
+        if (/(api[_-]?key|secret|token|password)/i.test(k) && typeof v === 'string') {
+            out[k] = '***';
+        }
+        else if (typeof v === 'string' && v.length > 200) {
+            out[k] = v.slice(0, 200) + '…';
+        }
+        else {
+            out[k] = v;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=toolRegistry.js.map

package/dist/cli/toolRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolRegistry.js","sourceRoot":"","sources":["../../src/cli/toolRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAqBtD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAiC,EAAE;IAEnC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE7C,sEAAsE;IACtE,MAAM,YAAY,GAAG,eAAe,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACvF,MAAM,YAAY,GAAG,eAAe,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,eAAe,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAE3F,sCAAsC;IACtC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAEjE,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAEnC,MAAM,KAAK,GAAyB;QAClC,YAAY;QACZ,aAAa;QACb,YAAY;QACZ,QAAQ;QACR,eAAe;KAChB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;KACjC,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,QAA8B,EAC9B,QAA2B,EAC3B,IAAY,EACZ,KAAkB,EAClB,SAAiB;IAEjB,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,KAAK,EAAE,OAAU,EAAE,GAAgB,EAA2B,EAAE;YACvE,4DAA4D;YAC5D,MAAM,IAAI,GAAG,OAAkC,CAAC;YAChD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;gBACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC;wBACH,IAAI,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;oBAChD,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;4BACzC,+DAA+D;4BAC/D,MAAM,KAAK,CAAC,MAAM,CAAC;gCACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gCAC5B,SAAS;gCACT,IAAI,EAAE,QAAQ,CAAC,IAAI;gCACnB,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;gCAC1B,EAAE,EAAE,KAAK;gCACT,aAAa,EAAE,GAAG,CAAC,OAAO;gCAC1B,UAAU,EAAE,CAAC;gCACb,KAAK,EAAE,mBAAmB;6BAC3B,CAAC,CAAC;4BACH,OAAO;gCACL,EAAE,EAAE,KAAK;gCACT,KAAK,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE;6BAChB,CAAC;wBACtB,CAAC;wBACD,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,2BAA2B;YAC3B,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC;oBACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;oBAC1B,SAAS;oBACT,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;iBACzC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACtC,CAAC;YACtB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,QAA8B,EAC9B,KAAkB,EAClB,SAAiB;IAEjB,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,KAAK,EAAE,OAAU,EAAE,GAAgB,EAA2B,EAAE;YACvE,MAAM,IAAI,GAAG,OAAkC,CAAC;YAChD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBAC1B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;wBACrC,MAAM,KAAK,CAAC,MAAM,CAAC;4BACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BAC5B,SAAS;4BACT,IAAI,EAAE,QAAQ,CAAC,IAAI;4BACnB,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;4BAC1B,EAAE,EAAE,KAAK;4BACT,aAAa,EAAE,GAAG,CAAC,OAAO;4BAC1B,UAAU,EAAE,CAAC;4BACb,KAAK,EAAE,eAAe;yBACvB,CAAC,CAAC;wBACH,OAAO;4BACL,EAAE,EAAE,KAAK;4BACT,KAAK,EAAE,mBAAmB,GAAG,CAAC,OAAO,EAAE;yBACtB,CAAC;oBACtB,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC;oBACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;oBAC1B,SAAS;oBACT,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;iBACzC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACtC,CAAC;YACtB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAA6B;IACnD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC5E,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;QACjB,CAAC;aAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACnD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}