zob-harness 0.2.0 → 0.3.1

package/.pi/capabilities/zob-public-runtime-capabilities.json

@@ -1374,7 +1374,7 @@
       ],
       "docRefs": [
         ".pi/git-policy.json",
-        ".pi/extensions/zob-harness/src/git-ops.ts",
+        ".pi/extensions/zob-harness/src/domains/git/git-ops.ts",
         ".pi/extensions/zob-harness/src/runtime/tools-zcommit.ts"
       ],
       "noShipNotes": "Agent-executable governed zcommit tool for plan|commit|push|commit_and_push. Use when the user explicitly asks the agent to commit/push so the agent does not ask the user to paste /zcommit commands. It reuses the /zcommit engine, supports session_modified/pathspecs/all_safe_dirty scopes, stores body-free ledgers, stages only selected paths via git add --, excludes runtime/secrets/vendor/build paths, and never uses direct git commit/push/tag or git add ./-A/--all."
@@ -1424,7 +1424,7 @@
       "docRefs": [
         "AGENTS.md",
         ".pi/extensions/zob-harness/src/runtime/commands.ts",
-        ".pi/extensions/zob-harness/src/goal-runtime.ts"
+        ".pi/extensions/zob-harness/src/runtime/goal-runtime.ts"
       ],
       "noShipNotes": "Session-local stop command only: aborts foreground work through ctx.abort when busy, aborts active background delegate_task controllers, stops supervised daemon loop, pauses runtime-goal auto-continuation, and appends body-free/hash-only telemetry. It must not shutdown Pi, kill arbitrary processes, or count append-only refs as delivery success."
     },
@@ -1499,7 +1499,7 @@
       ],
       "docRefs": [
         ".pi/git-policy.json",
-        ".pi/extensions/zob-harness/src/git-ops.ts",
+        ".pi/extensions/zob-harness/src/domains/git/git-ops.ts",
         ".pi/extensions/zob-harness/src/runtime/commands.ts"
       ],
       "noShipNotes": "Easy governed explicit-only /zcommit status [paths/globs...]|plan [paths/globs...]|adopt <paths...>|commit [paths/globs...]|push|autocommit on|off|autopush on|off. No aliases. Normal mode selects safe dirty workspace files after forbidden-path filtering, or an explicit safe subset by repo-relative file/directory/glob pathspecs. Adopt remains metadata-only for legacy/strict ownership hints and never stages. Commit uses explicit git add -- selected paths only, never git add . or -A; forbidden staged paths block, forbidden unstaged paths are excluded, advisory validation is recorded in the Conventional Commit body, and push is limited to last /zcommit-created HEAD via allowed remote/branch without force/tags/push-all."
@@ -1711,7 +1711,7 @@
       "docRefs": [
         "AGENTS.md",
         ".pi/autonomy-policy.json",
-        ".pi/extensions/zob-harness/src/daemon-runtime.ts",
+        ".pi/extensions/zob-harness/src/domains/autonomy/daemon-runtime.ts",
         ".pi/extensions/zob-harness/src/runtime/commands.ts"
       ],
       "noShipNotes": "Sets interactive autonomy policy only: open/controlled/adaptive/status/stop plus daemon status|plan-tick|tick|start|stop. Daemon subcommands are scoped to the active goal, session-local, plan-only, bounded when started, no autostart/no cron/no global loop, and no global autonomy or production readiness claim; launch authorization remains in-scope and safety-gated with no secrets, destructive commands, or production apply."

package/.pi/extensions/zob-child-safety/AGENTS.md

@@ -0,0 +1,12 @@
+# zob-child-safety extension guardrails
+
+This folder is safety-critical. Changes here must be split-only unless the owner explicitly approves behavior changes.
+
+- Preserve the Pi entrypoint in `index.ts` and keep the default export stable.
+- Do not change event names, registration order, safety messages, default rules, path policy, env parsing, or sync/async behavior.
+- Preserve public exports from `index.ts`.
+- Use NodeNext relative imports with `.js` suffix.
+- Prefer `import type` for type-only imports.
+- Do not import from `index.ts` inside `src/**`.
+- Do not read or write secrets, generated output, logs, sessions, or temp ledgers.
+- Validate with `npm run check -- --pretty false`, `npm run smoke:path-policy`, and `npm run smoke:harness` after edits.

package/.pi/extensions/zob-child-safety/index.ts

@@ -1,99 +1,11 @@
 import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { join } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { isToolCallEventType } from "@earendil-works/pi-coding-agent";
+import { DEFAULT_RULES, blockedFeedback, parsePathListEnv, pathMatches, validateRuntimeWritePolicy } from "./src/policy.js";
+import type { DamageRules } from "./src/policy.js";
 
-interface DamageRule {
-  pattern: string;
-  reason: string;
-  ask?: boolean;
-}
-
-interface DamageRules {
-  bashToolPatterns: DamageRule[];
-  zeroAccessPaths: string[];
-  readOnlyPaths: string[];
-  noDeletePaths: string[];
-}
-
-const DEFAULT_RULES: DamageRules = {
-  bashToolPatterns: [
-    { pattern: "\\brm\\s+(-rf?|--recursive)", reason: "recursive deletion" },
-    { pattern: "\\bgit\\s+reset\\s+--hard\\b", reason: "destructive git reset" },
-    { pattern: "\\bgit\\s+clean\\s+-", reason: "destructive git clean" },
-    { pattern: "\\bgit\\s+add\\s+(-A|\\.)", reason: "bulk git staging" },
-    { pattern: "\\bsudo\\b", reason: "privileged command" },
-  ],
-  zeroAccessPaths: [".env", ".env.*", "~/.ssh", "~/.aws", "*.pem", "*.key"],
-  readOnlyPaths: [".git/", "node_modules/", "dist/", "build/", "package-lock.json", "pnpm-lock.yaml", "bun.lock"],
-  noDeletePaths: [".git/", "AGENTS.md", "README.md", ".pi/"],
-};
-
-function expandHome(input: string): string {
-  if (input === "~") return homedir();
-  if (input.startsWith("~/")) return join(homedir(), input.slice(2));
-  return input;
-}
-
-function wildcardToRegex(pattern: string): RegExp {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`(^|/)${escaped}($|/)`);
-}
-
-export function pathMatches(targetPath: string, pattern: string, cwd: string, policyRoot = cwd): boolean {
-  const expanded = expandHome(pattern);
-  const root = resolve(policyRoot);
-  const normalizedTarget = resolve(cwd, expandHome(targetPath));
-  const relativeTarget = normalizedTarget.startsWith(root) ? normalizedTarget.slice(root.length + 1) : normalizedTarget;
-  if (expanded.endsWith("/")) {
-    const prefix = resolve(root, expanded.slice(0, -1));
-    return normalizedTarget === prefix || normalizedTarget.startsWith(`${prefix}/`) || relativeTarget.startsWith(expanded);
-  }
-  const regex = wildcardToRegex(expanded);
-  return regex.test(normalizedTarget) || regex.test(relativeTarget) || relativeTarget.includes(expanded);
-}
-
-export function parsePathListEnv(value: string | undefined): string[] {
-  if (!value) return [];
-  return value
-    .split(/[,:\n]/)
-    .map((item) => item.trim())
-    .filter(Boolean);
-}
-
-export function validateRuntimeWritePolicy(input: {
-  targetPath: string;
-  cwd: string;
-  policyRoot?: string;
-  allowedPaths?: string[];
-  forbiddenPaths?: string[];
-  zeroAccessPaths?: string[];
-  readOnlyPaths?: string[];
-  sandboxRoot?: string;
-}): { allowed: boolean; violations: string[] } {
-  const policyRoot = input.policyRoot ?? input.cwd;
-  const violations: string[] = [];
-  for (const protectedPattern of input.zeroAccessPaths ?? []) {
-    if (pathMatches(input.targetPath, protectedPattern, input.cwd, policyRoot)) violations.push(`zero-access path: ${protectedPattern}`);
-  }
-  for (const forbiddenPattern of input.forbiddenPaths ?? []) {
-    if (pathMatches(input.targetPath, forbiddenPattern, input.cwd, policyRoot)) violations.push(`forbidden path: ${forbiddenPattern}`);
-  }
-  for (const readOnlyPattern of input.readOnlyPaths ?? []) {
-    if (pathMatches(input.targetPath, readOnlyPattern, input.cwd, policyRoot)) violations.push(`read-only path: ${readOnlyPattern}`);
-  }
-  const allowedPaths = input.allowedPaths ?? [];
-  if (allowedPaths.length > 0 && !allowedPaths.some((allowedPath) => pathMatches(input.targetPath, allowedPath, input.cwd, policyRoot))) {
-    violations.push(`outside allowed_paths: ${allowedPaths.join(", ")}`);
-  }
-  if (input.sandboxRoot) {
-    const sandboxRoot = resolve(policyRoot, expandHome(input.sandboxRoot));
-    const target = resolve(input.cwd, expandHome(input.targetPath));
-    if (target !== sandboxRoot && !target.startsWith(`${sandboxRoot}/`)) violations.push(`outside sandbox root: ${input.sandboxRoot}`);
-  }
-  return { allowed: violations.length === 0, violations };
-}
+export { pathMatches, parsePathListEnv, validateRuntimeWritePolicy } from "./src/policy.js";
 
 function loadDamageRules(cwd: string): DamageRules {
   const root = process.env.ZOB_HARNESS_ROOT || cwd;
@@ -112,19 +24,6 @@ function loadDamageRules(cwd: string): DamageRules {
   }
 }
 
-function blockedFeedback(toolName: string, reason: string, attempted: string): string {
-  return [
-    `ZOB child safety blocked ${toolName}: ${reason}`,
-    "",
-    `Attempted: ${attempted}`,
-    "",
-    "Continue safely:",
-    "- Do not retry the same blocked call.",
-    "- If a secret or destructive operation is required, stop and ask the parent/user for explicit approval.",
-    "- Produce a safe partial result with evidence and blockers instead.",
-  ].join("\n");
-}
-
 export default function zobChildSafety(pi: ExtensionAPI): void {
   let rules: DamageRules = DEFAULT_RULES;
 

package/.pi/extensions/zob-child-safety/src/AGENTS.md

@@ -0,0 +1,10 @@
+# zob-child-safety src guardrails
+
+Modules in this folder are split-only support modules for the safety-critical child safety extension.
+
+- Move helpers/types/policy/path code only; do not rewrite logic or optimize behavior.
+- Never import from `../index.ts` or `../index.js`.
+- Keep imports NodeNext-compatible with `.js` suffix for relative runtime imports.
+- Prefer `import type` for type-only imports.
+- Do not change blocked messages, default rules, path matching, env parsing, validation ordering, or return shapes.
+- Keep safety helpers deterministic and side-effect-free unless an existing side effect is explicitly being moved unchanged.

package/.pi/extensions/zob-child-safety/src/policy.ts

@@ -0,0 +1,106 @@
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+
+export interface DamageRule {
+  pattern: string;
+  reason: string;
+  ask?: boolean;
+}
+
+export interface DamageRules {
+  bashToolPatterns: DamageRule[];
+  zeroAccessPaths: string[];
+  readOnlyPaths: string[];
+  noDeletePaths: string[];
+}
+
+export const DEFAULT_RULES: DamageRules = {
+  bashToolPatterns: [
+    { pattern: "\\brm\\s+(-rf?|--recursive)", reason: "recursive deletion" },
+    { pattern: "\\bgit\\s+reset\\s+--hard\\b", reason: "destructive git reset" },
+    { pattern: "\\bgit\\s+clean\\s+-", reason: "destructive git clean" },
+    { pattern: "\\bgit\\s+add\\s+(-A|\\.)", reason: "bulk git staging" },
+    { pattern: "\\bsudo\\b", reason: "privileged command" },
+  ],
+  zeroAccessPaths: [".env", ".env.*", "~/.ssh", "~/.aws", "*.pem", "*.key"],
+  readOnlyPaths: [".git/", "node_modules/", "dist/", "build/", "package-lock.json", "pnpm-lock.yaml", "bun.lock"],
+  noDeletePaths: [".git/", "AGENTS.md", "README.md", ".pi/"],
+};
+
+function expandHome(input: string): string {
+  if (input === "~") return homedir();
+  if (input.startsWith("~/")) return join(homedir(), input.slice(2));
+  return input;
+}
+
+function wildcardToRegex(pattern: string): RegExp {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`(^|/)${escaped}($|/)`);
+}
+
+export function pathMatches(targetPath: string, pattern: string, cwd: string, policyRoot = cwd): boolean {
+  const expanded = expandHome(pattern);
+  const root = resolve(policyRoot);
+  const normalizedTarget = resolve(cwd, expandHome(targetPath));
+  const relativeTarget = normalizedTarget.startsWith(root) ? normalizedTarget.slice(root.length + 1) : normalizedTarget;
+  if (expanded.endsWith("/")) {
+    const prefix = resolve(root, expanded.slice(0, -1));
+    return normalizedTarget === prefix || normalizedTarget.startsWith(`${prefix}/`) || relativeTarget.startsWith(expanded);
+  }
+  const regex = wildcardToRegex(expanded);
+  return regex.test(normalizedTarget) || regex.test(relativeTarget) || relativeTarget.includes(expanded);
+}
+
+export function parsePathListEnv(value: string | undefined): string[] {
+  if (!value) return [];
+  return value
+    .split(/[,:\n]/)
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+export function validateRuntimeWritePolicy(input: {
+  targetPath: string;
+  cwd: string;
+  policyRoot?: string;
+  allowedPaths?: string[];
+  forbiddenPaths?: string[];
+  zeroAccessPaths?: string[];
+  readOnlyPaths?: string[];
+  sandboxRoot?: string;
+}): { allowed: boolean; violations: string[] } {
+  const policyRoot = input.policyRoot ?? input.cwd;
+  const violations: string[] = [];
+  for (const protectedPattern of input.zeroAccessPaths ?? []) {
+    if (pathMatches(input.targetPath, protectedPattern, input.cwd, policyRoot)) violations.push(`zero-access path: ${protectedPattern}`);
+  }
+  for (const forbiddenPattern of input.forbiddenPaths ?? []) {
+    if (pathMatches(input.targetPath, forbiddenPattern, input.cwd, policyRoot)) violations.push(`forbidden path: ${forbiddenPattern}`);
+  }
+  for (const readOnlyPattern of input.readOnlyPaths ?? []) {
+    if (pathMatches(input.targetPath, readOnlyPattern, input.cwd, policyRoot)) violations.push(`read-only path: ${readOnlyPattern}`);
+  }
+  const allowedPaths = input.allowedPaths ?? [];
+  if (allowedPaths.length > 0 && !allowedPaths.some((allowedPath) => pathMatches(input.targetPath, allowedPath, input.cwd, policyRoot))) {
+    violations.push(`outside allowed_paths: ${allowedPaths.join(", ")}`);
+  }
+  if (input.sandboxRoot) {
+    const sandboxRoot = resolve(policyRoot, expandHome(input.sandboxRoot));
+    const target = resolve(input.cwd, expandHome(input.targetPath));
+    if (target !== sandboxRoot && !target.startsWith(`${sandboxRoot}/`)) violations.push(`outside sandbox root: ${input.sandboxRoot}`);
+  }
+  return { allowed: violations.length === 0, violations };
+}
+
+export function blockedFeedback(toolName: string, reason: string, attempted: string): string {
+  return [
+    `ZOB child safety blocked ${toolName}: ${reason}`,
+    "",
+    `Attempted: ${attempted}`,
+    "",
+    "Continue safely:",
+    "- Do not retry the same blocked call.",
+    "- If a secret or destructive operation is required, stop and ask the parent/user for explicit approval.",
+    "- Produce a safe partial result with evidence and blockers instead.",
+  ].join("\n");
+}

package/.pi/extensions/zob-harness/AGENTS.md

@@ -3,6 +3,7 @@
 - Ce dossier contient l'extension Pi `zob-harness`, son entrypoint `index.ts` et les modules sidecar du refactor split-only.
 - `index.ts` reste l'entrypoint Pi déclaré dans `package.json` jusqu'à approval explicite d'une bascule finale.
 - Les sous-dossiers `src/**` contiennent uniquement de la logique extraite ou du contexte local; ils ne remplacent pas l'entrypoint sans review.
+- L'architecture cible et les consignes de refactor sont documentées dans `docs/ZOB_HARNESS_ARCHITECTURE.md` et les `AGENTS.md` locaux.
 
 # Invariants
 
@@ -19,6 +20,7 @@
 - `index.ts` peut rester hybride pendant la migration.
 - Aucun fichier `src/**` ne doit importer depuis `index.ts`.
 - Préférer `import type` pour les types.
+- Direction cible des dépendances: `runtime -> domains -> core`; jamais `core -> domains/runtime`.
 
 # Validation locale