kward 0.79.0 → 0.80.0

data/lib/kward/tools/git_commit.rb

@@ -0,0 +1,39 @@
+require_relative "base"
+
+# Namespace for model-callable tool wrappers.
+module Kward
+  module Tools
+    # Tool wrapper for the trusted host-side Git commit operation.
+    class GitCommit < Base
+      def initialize(committer:)
+        @committer = committer
+        super(
+          "git_commit",
+          "Stage and commit changes in the active worktree. Omit paths to include all current changes.",
+          properties: {
+            message: { type: "string", description: "Commit message." },
+            paths: { type: "array", items: { type: "string" }, description: "Optional workspace-relative paths to include." }
+          },
+          required: ["message"]
+        )
+      end
+
+      def call(args, _conversation, cancellation: nil)
+        cancellation&.raise_if_cancelled!
+        message = argument(args, :message, "").to_s
+        paths = argument(args, :paths, nil)
+        return "Error: commit message is required" if message.strip.empty?
+        return "Error: paths must be an array" unless paths.nil? || paths.is_a?(Array)
+        return "Error: paths must contain strings" if paths && paths.any? { |path| !path.is_a?(String) }
+
+        paths = nil if paths&.empty?
+        result = @committer.call(message: message, paths: paths)
+        output = result[:output].to_s.strip
+        return "Git commit succeeded\n#{output}" if result[:success]
+
+        failure = output.empty? ? "Git commit failed." : "Git commit failed.\n#{output}"
+        "Error: #{failure}"
+      end
+    end
+  end
+end

data/lib/kward/tools/registry.rb

@@ -8,6 +8,7 @@ require_relative "context_for_task"
 require_relative "edit_file"
 require_relative "fetch_content"
 require_relative "fetch_raw"
+require_relative "git_commit"
 require_relative "list_directory"
 require_relative "mcp_tool"
 require_relative "read_file"
@@ -78,7 +79,7 @@ module Kward
     # @param web_search_enabled [Boolean, nil] override for web search exposure
     # @param skills [Array<ConfigFiles::Skill>, nil] override discovered skills
     # @param ask_user_question_enabled [Boolean, nil] override question exposure
-    def initialize(workspace: Workspace.new, prompt: nil, web_search: WebSearch.new, web_fetch: WebFetch.new, code_search: CodeSearch.new, web_search_enabled: nil, skills: nil, ask_user_question_enabled: nil, allowed_tool_names: nil, tool_output_compactor: ToolOutputCompactor.new, telemetry_logger: TelemetryLogger.new, context_budget_meter: nil, mcp_clients: nil, tool_approval: nil, approval_for_allowed_tools: false, permission_policy: nil, hook_manager: nil, hook_context: nil)
+    def initialize(workspace: Workspace.new, prompt: nil, web_search: WebSearch.new, web_fetch: WebFetch.new, code_search: CodeSearch.new, web_search_enabled: nil, skills: nil, ask_user_question_enabled: nil, allowed_tool_names: nil, tool_output_compactor: ToolOutputCompactor.new, telemetry_logger: TelemetryLogger.new, context_budget_meter: nil, mcp_clients: nil, tool_approval: nil, approval_for_allowed_tools: false, permission_policy: nil, hook_manager: nil, hook_context: nil, git_committer: nil)
       @workspace = workspace
       @prompt = prompt
       @web_search = web_search
@@ -96,6 +97,7 @@ module Kward
       @permission_policy = permission_policy || Permissions::Policy.from_config(ConfigFiles.read_config)
       @hook_manager = hook_manager
       @hook_context = hook_context
+      @git_committer = git_committer
       @mcp_clients = if mcp_clients
                        mcp_clients
                      elsif @allowed_tool_names
@@ -484,6 +486,7 @@ module Kward
 
     def build_schema_tools
       tools = @tools.values_at(*CORE_TOOL_NAMES)
+      tools << @tools["git_commit"] if @tools["git_commit"]
       tools.concat(@tools.values_at("web_search", "fetch_content", "fetch_raw")) if web_search_available?
       tools.concat(@tools.values.select { |tool| tool.is_a?(Tools::MCPTool) })
       tools << @tools["read_skill"] if skills_available?
@@ -492,7 +495,9 @@ module Kward
     end
 
     def all_tools
-      core_tools + [
+      tools = core_tools
+      tools << Tools::GitCommit.new(committer: @git_committer) if @git_committer
+      tools + [
         Tools::WebSearch.new(web_search: @web_search),
         Tools::FetchContent.new(web_fetch: @web_fetch),
         Tools::FetchRaw.new(web_fetch: @web_fetch),

data/lib/kward/tools/tool_call.rb

@@ -24,6 +24,7 @@ module Kward
       "web_search" => "web_search",
       "fetch_content" => "fetch_content",
       "fetch_raw" => "fetch_raw",
+      "git_commit" => "git_commit",
       "read_skill" => "read_skill",
       "ask_user_question" => "ask_user_question"
     }.freeze

data/lib/kward/transport/gateway.rb

@@ -0,0 +1,253 @@
+require "base64"
+require "digest"
+require "thread"
+require_relative "../deep_copy"
+require_relative "store"
+
+module Kward
+  module Transport
+    # Adapts the existing session manager to the transport host contract.
+    #
+    # The adapter deliberately uses the manager's public session and turn
+    # methods. It can be replaced by a frontend-neutral runtime gateway later
+    # without changing transport plugins.
+    class Gateway
+      POLL_INTERVAL = 0.05
+      TERMINAL_STATUSES = %w[completed canceled failed].freeze
+
+      def initialize(session_manager:, transport_id:, storage: nil, poll_interval: POLL_INTERVAL)
+        @session_manager = session_manager
+        @transport_id = transport_id.to_s
+        @storage = storage || Store.new(@transport_id)
+        @poll_interval = poll_interval
+        @subscriptions = []
+        @interaction_subscribers = []
+        @mutex = Mutex.new
+        @session_manager.subscribe_events { |method, payload| handle_runtime_event(method, payload) } if @session_manager.respond_to?(:subscribe_events)
+      end
+
+      def resolve_transport_session(transport_id:, conversation:, actor:, workspace_root: nil, name: nil, execution_profile: nil)
+        raise ArgumentError, "transport id does not match gateway" unless transport_id.to_s == @transport_id
+        if conversation.respond_to?(:transport_id) && conversation.transport_id.to_s != @transport_id
+          raise ArgumentError, "conversation transport does not match gateway"
+        end
+
+        binding_key = binding_key_for(conversation)
+        binding = @storage.get(binding_key)
+        session = if binding
+                     resume_bound_session(binding, execution_profile: execution_profile)
+                   else
+                     @session_manager.create_session(workspace_root: workspace_root || Dir.pwd, name: name, **execution_profile_arguments(execution_profile))
+                   end
+        persist_binding(binding_key, session)
+        session_handle(session)
+      end
+
+      def start_transport_turn(session_id:, input:, attachments: [], options: {}, streaming_behavior: nil, execution_profile: nil)
+        payload = @session_manager.start_turn(
+          session_id: session_id,
+          input: input,
+          attachments: normalize_attachments(attachments, execution_profile: execution_profile),
+          options: profile_options(options, execution_profile),
+          streaming_behavior: streaming_behavior,
+          execution_profile: execution_profile
+        )
+        { id: payload.fetch(:id), session_id: payload.fetch(:sessionId) }
+      end
+
+      def transport_transcript(session_id:)
+        @session_manager.transcript(session_id: session_id)
+      end
+
+      def transport_turn_events(turn_id:, after: nil)
+        payload = @session_manager.turn_events(turn_id: turn_id, after_sequence: after.to_i)
+        Array(payload[:events]).map { |event| normalize_event(event) }
+      end
+
+      def transport_turn_status(turn_id:)
+        @session_manager.turn_status(turn_id: turn_id)
+      end
+
+      def cancel_transport_turn(turn_id:)
+        @session_manager.cancel_turn(turn_id: turn_id)
+      end
+
+      def answer_transport_interaction(session_id:, request_id:, answer:)
+        if answer == true || answer == false
+          @session_manager.answer_tool_approval(
+            session_id: session_id,
+            approval_request_id: request_id,
+            approved: answer
+          )
+        else
+          answers = answer.is_a?(Array) ? answer : [{ question: request_id, answer: answer.to_s }]
+          @session_manager.answer_question(
+            session_id: session_id,
+            question_request_id: request_id,
+            answers: answers
+          )
+        end
+      end
+
+      def subscribe_transport_interactions(&block)
+        raise ArgumentError, "interaction subscription requires a block" unless block
+
+        @mutex.synchronize { @interaction_subscribers << block }
+        block
+      end
+
+      def subscribe_transport_turn(turn_id:, after: nil)
+        cursor = after.to_i
+        thread = Thread.new do
+          loop do
+            events = transport_turn_events(turn_id: turn_id, after: cursor)
+            events.each do |event|
+              cursor = event.sequence
+              yield event
+            end
+            status = transport_turn_status(turn_id: turn_id)
+            break if TERMINAL_STATUSES.include?(status[:status].to_s)
+
+            sleep @poll_interval
+          end
+        rescue StandardError
+          nil
+        end
+        @mutex.synchronize { @subscriptions << thread }
+        thread
+      end
+
+      def shutdown
+        subscriptions = @mutex.synchronize do
+          current = @subscriptions
+          @subscriptions = []
+          @interaction_subscribers = []
+          current
+        end
+        subscriptions.each(&:kill)
+        subscriptions.each(&:join)
+        nil
+      end
+
+      private
+
+      def resume_bound_session(binding, execution_profile: nil)
+        @session_manager.resume_session(
+          path: binding.fetch("path"),
+          workspace_root: binding.fetch("workspace_root"),
+          include_transcript: false,
+          **execution_profile_arguments(execution_profile)
+        )
+      rescue StandardError
+        @session_manager.create_session(workspace_root: binding.fetch("workspace_root"), **execution_profile_arguments(execution_profile))
+      end
+
+      def execution_profile_arguments(profile)
+        profile ? { execution_profile: profile } : {}
+      end
+
+      def persist_binding(key, session)
+        @storage.put(key, {
+          "path" => session.fetch(:path),
+          "workspace_root" => session.fetch(:workspaceRoot)
+        })
+      end
+
+      def session_handle(session)
+        Host::SessionHandle.new(
+          id: session.fetch(:id),
+          workspace_root: session.fetch(:workspaceRoot),
+          name: session[:name]
+        )
+      end
+
+      def binding_key_for(conversation)
+        external_id = conversation.respond_to?(:external_id) ? conversation.external_id : conversation.to_s
+        digest = Digest::SHA256.hexdigest("#{@transport_id}\0#{external_id}")
+        "binding:#{digest}"
+      end
+
+      def handle_runtime_event(method, payload)
+        request = case method
+                  when "ui/question"
+                    questions = Array(payload[:questions] || payload["questions"])
+                    Transport.interaction_request(
+                      id: payload[:questionRequestId] || payload["questionRequestId"],
+                      session_id: payload[:sessionId] || payload["sessionId"],
+                      turn_id: payload[:turnId] || payload["turnId"] || "unknown",
+                      kind: :question,
+                      prompt: questions.map { |question| question[:question] || question["question"] }.join("\\n"),
+                      choices: questions
+                    )
+                  when "tool/approvalRequested"
+                    Transport.interaction_request(
+                      id: payload[:approvalRequestId] || payload["approvalRequestId"],
+                      session_id: payload[:sessionId] || payload["sessionId"],
+                      turn_id: payload[:turnId] || payload["turnId"] || "unknown",
+                      kind: :tool_approval,
+                      prompt: "Allow #{payload[:toolName] || payload["toolName"]}?",
+                      choices: [{ id: "approve", label: "Approve" }, { id: "deny", label: "Deny" }],
+                      metadata: { tool_call_id: payload[:toolCallId] || payload["toolCallId"], args: payload[:args] || payload["args"] }
+                    )
+                  end
+        return unless request
+
+        subscribers = @mutex.synchronize { @interaction_subscribers.dup }
+        subscribers.each do |subscriber|
+          begin
+            subscriber.call(request)
+          rescue StandardError
+            nil
+          end
+        end
+      end
+
+      def profile_options(options, profile)
+        return options unless profile
+
+        options = options.dup
+        case profile.tool_mode
+        when :none
+          options.delete("disabledTools")
+          options.delete(:disabled_tools)
+          options["allowedTools"] = []
+        when :allowlist
+          options.delete("disabledTools")
+          options.delete(:disabled_tools)
+          options["allowedTools"] = profile.allowed_tools
+        end
+        options["approvalMode"] = "none" if profile.approval_mode == :deny
+        options["approvalMode"] = "ask" if profile.approval_mode == :ask
+        options
+      end
+
+      def normalize_attachments(attachments, execution_profile: nil)
+        if execution_profile && !execution_profile.attachments && !Array(attachments).empty?
+          raise ArgumentError, "transport execution profile does not allow attachments"
+        end
+
+        Array(attachments).map do |attachment|
+          raise ArgumentError, "transport attachment must be a Transport::Attachment" unless attachment.is_a?(Attachment)
+          raise ArgumentError, "transport attachment URLs are not supported by the session gateway" if attachment.url
+
+          {
+            type: "image",
+            data: Base64.strict_encode64(attachment.data),
+            mimeType: attachment.mime_type,
+            name: attachment.name
+          }.compact
+        end
+      end
+
+      def normalize_event(event)
+        Transport.turn_event(
+          type: event.fetch(:type),
+          session_id: event.fetch(:sessionId),
+          turn_id: event.fetch(:turnId),
+          sequence: event.fetch(:sequence),
+          payload: event.fetch(:payload, {})
+        )
+      end
+    end
+  end
+end

data/lib/kward/transport/host.rb

@@ -0,0 +1,343 @@
+require_relative "../deep_copy"
+require_relative "store"
+
+module Kward
+  module Transport
+    # Public dependencies made available to a running transport adapter.
+    class Host
+      class UnavailableGateway < StandardError; end
+      class PolicyDenied < StandardError; end
+
+      SessionHandle = Data.define(:id, :workspace_root, :name)
+      TurnHandle = Data.define(:id, :session_id)
+      PluginChatHandle = Data.define(:id, :type_id, :scope_key, :name)
+      PluginChatTurnHandle = Data.define(:id, :chat_id)
+
+      # Creates a host for one registered transport instance.
+      def initialize(transport_id:, gateway: nil, plugin_chat_gateway: nil, config: {}, storage: nil, policy: nil, logger: nil, execution_profile: nil)
+        unless execution_profile.nil? || execution_profile.is_a?(ExecutionProfile)
+          raise ArgumentError, "execution_profile must be a Transport::ExecutionProfile"
+        end
+
+        @transport_id = transport_id.to_s.freeze
+        @gateway = gateway
+        @plugin_chat_gateway = plugin_chat_gateway
+        @config = freeze_copy(config)
+        @storage = storage || Store.new(@transport_id)
+        @policy = policy || AllowAllPolicy.new
+        @execution_profile = execution_profile
+        @logger = logger || Logger.new($stderr)
+        @sessions = Sessions.new(self)
+        @plugin_chats = PluginChats.new(self)
+        @interactions = Interactions.new(self)
+      end
+
+      attr_reader :transport_id, :config, :storage, :policy, :execution_profile, :logger
+
+      def sessions
+        @sessions
+      end
+
+      def interactions
+        @interactions
+      end
+
+      def plugin_chats
+        @plugin_chats
+      end
+
+      def gateway
+        return @gateway if @gateway
+
+        raise UnavailableGateway, "transport host has no session gateway"
+      end
+
+      def authorize!(action, **attributes)
+        return true if policy.authorize(action: action, transport_id: @transport_id, **attributes) == true
+
+        raise PolicyDenied, "Transport policy denied #{action}"
+      end
+
+      def plugin_chat_gateway
+        return @plugin_chat_gateway if @plugin_chat_gateway
+
+        raise UnavailableGateway, "transport host has no plugin chat gateway"
+      end
+
+      # Reads a transport secret from private config or an explicit environment
+      # variable without exposing it through status or logging helpers.
+      def secret(key, env: nil)
+        key = key.to_s
+        raise ArgumentError, "secret key is required" if key.empty?
+
+        value = config[key]
+        value = ENV.fetch(env.to_s) if value.nil? && env
+        value = ENV[default_secret_env_name(key)] if value.nil?
+        value.to_s unless value.nil?
+      end
+
+      def shutdown
+        @gateway&.shutdown
+        @plugin_chat_gateway&.shutdown
+        nil
+      end
+
+      # Resolves an external conversation to a normal Kward session.
+      class Sessions
+        def initialize(host)
+          @host = host
+        end
+
+        def resolve(conversation:, actor:, workspace_root: nil, name: nil)
+          workspace_root = fixed_workspace_root(workspace_root)
+          @host.authorize!(:resolve_session, conversation: conversation, actor: actor, workspace_root: workspace_root)
+          result = @host.gateway.resolve_transport_session(
+            transport_id: @host.transport_id,
+            conversation: conversation,
+            actor: actor,
+            workspace_root: workspace_root,
+            name: name,
+            execution_profile: @host.execution_profile
+          )
+          Session.new(@host, normalize_handle(result), actor)
+        end
+
+        private
+
+        def fixed_workspace_root(workspace_root)
+          return workspace_root unless @host.execution_profile&.workspace_mode == :fixed
+
+          configured = @host.config["workspace"] || @host.config[:workspace]
+          raise ArgumentError, "fixed execution profile requires a configured workspace" if configured.to_s.empty?
+
+          configured.to_s
+        end
+
+        def normalize_handle(result)
+          return result if result.is_a?(SessionHandle)
+          return SessionHandle.new(**result.transform_keys(&:to_sym)) if result.is_a?(Hash)
+
+          raise TypeError, "session gateway returned an invalid session handle"
+        end
+      end
+
+      # Narrow session operations exposed to a transport.
+      class Session
+        attr_reader :id, :workspace_root, :name
+
+        def initialize(host, handle, actor)
+          @host = host
+          @actor = actor
+          @id = handle.id.to_s.freeze
+          @workspace_root = handle.workspace_root.to_s.freeze
+          @name = handle.name&.to_s&.freeze
+        end
+
+        def start_turn(input, attachments: [], options: {}, streaming_behavior: nil)
+          @host.authorize!(:start_turn, actor: @actor, session_id: @id, input: input.to_s)
+          result = @host.gateway.start_transport_turn(
+            session_id: @id,
+            input: input.to_s,
+            attachments: attachments,
+            options: options,
+            streaming_behavior: streaming_behavior,
+            execution_profile: @host.execution_profile
+          )
+          handle = result.is_a?(TurnHandle) ? result : TurnHandle.new(**result.transform_keys(&:to_sym))
+          Turn.new(@host, handle, @actor)
+        end
+
+        def transcript
+          @host.authorize!(:read_transcript, actor: @actor, session_id: @id)
+          @host.gateway.transport_transcript(session_id: @id)
+        end
+
+        def answer_interaction(request_id:, answer:)
+          if @host.execution_profile&.approval_mode == :deny
+            raise PolicyDenied, "Transport execution profile does not allow interactions"
+          end
+
+          @host.authorize!(:answer_interaction, actor: @actor, session_id: @id, request_id: request_id)
+          @host.gateway.answer_transport_interaction(session_id: @id, request_id: request_id, answer: answer)
+        end
+      end
+
+      # Resolves an external conversation to a plugin-owned chat.
+      class PluginChats
+        def initialize(host)
+          @host = host
+        end
+
+        def resolve(type_id:, conversation:, actor:, scope_key: nil, descriptor: {})
+          scope_key ||= conversation.external_id
+          @host.authorize!(:resolve_plugin_chat, type_id: type_id.to_s, conversation: conversation, actor: actor, scope_key: scope_key)
+          result = @host.plugin_chat_gateway.resolve_transport_chat(
+            transport_id: @host.transport_id,
+            type_id: type_id,
+            conversation: conversation,
+            actor: actor,
+            scope_key: scope_key,
+            descriptor: descriptor,
+            workspace_root: workspace_root
+          )
+          PluginChat.new(@host, normalize_handle(result), actor)
+        end
+
+        private
+
+        def workspace_root
+          if @host.execution_profile&.workspace_mode == :fixed
+            configured = @host.config["workspace"] || @host.config[:workspace]
+            raise ArgumentError, "fixed execution profile requires a configured workspace" if configured.to_s.empty?
+
+            return configured.to_s
+          end
+
+          @host.config["workspace"] || @host.config[:workspace] || Dir.pwd
+        end
+
+        def normalize_handle(result)
+          return result if result.is_a?(PluginChatHandle)
+          return PluginChatHandle.new(**result.transform_keys(&:to_sym)) if result.is_a?(Hash)
+
+          raise TypeError, "plugin chat gateway returned an invalid chat handle"
+        end
+      end
+
+      # Narrow plugin-chat operations exposed to a transport.
+      class PluginChat
+        attr_reader :id, :type_id, :scope_key, :name
+
+        def initialize(host, handle, actor)
+          @host = host
+          @actor = actor
+          @id = handle.id.to_s.freeze
+          @type_id = handle.type_id.to_s.freeze
+          @scope_key = handle.scope_key.to_s.freeze
+          @name = handle.name&.to_s&.freeze
+        end
+
+        def start_turn(input, attachments: [], options: {}, streaming_behavior: nil)
+          @host.authorize!(:start_plugin_chat_turn, actor: @actor, chat_id: @id, type_id: @type_id, input: input.to_s)
+          if @host.execution_profile && !@host.execution_profile.attachments && !Array(attachments).empty?
+            raise PolicyDenied, "Transport execution profile does not allow attachments"
+          end
+          unless options.nil? || options.empty?
+            raise ArgumentError, "plugin chat turns do not support options"
+          end
+          unless streaming_behavior.nil? || %i[aggregate none].include?(streaming_behavior.to_sym)
+            raise ArgumentError, "plugin chat turns do not support #{streaming_behavior} streaming"
+          end
+
+          result = @host.plugin_chat_gateway.start_transport_plugin_chat_turn(
+            chat_id: @id,
+            actor: @actor,
+            input: input,
+            attachments: attachments,
+            streaming_behavior: streaming_behavior,
+            execution_profile: @host.execution_profile
+          )
+          handle = result.is_a?(PluginChatTurnHandle) ? result : PluginChatTurnHandle.new(**result.transform_keys(&:to_sym))
+          PluginChatTurn.new(@host, handle, @actor)
+        end
+
+        def transcript
+          @host.authorize!(:read_plugin_chat_transcript, actor: @actor, chat_id: @id, type_id: @type_id)
+          @host.plugin_chat_gateway.transport_plugin_chat_transcript(chat_id: @id)
+        end
+      end
+
+      # Handle for an asynchronously running plugin-chat turn.
+      class PluginChatTurn
+        attr_reader :id, :chat_id
+
+        def initialize(host, handle, actor)
+          @host = host
+          @actor = actor
+          @id = handle.id.to_s.freeze
+          @chat_id = handle.chat_id.to_s.freeze
+        end
+
+        def subscribe(after: nil, &block)
+          raise ArgumentError, "plugin chat turn subscription requires a block" unless block
+
+          @host.plugin_chat_gateway.subscribe_transport_plugin_chat_turn(turn_id: @id, after: after, &block)
+        end
+
+        def events(after: nil)
+          @host.plugin_chat_gateway.transport_plugin_chat_turn_events(turn_id: @id, after: after)
+        end
+
+        def status
+          @host.plugin_chat_gateway.transport_plugin_chat_turn_status(turn_id: @id)
+        end
+
+        def cancel
+          @host.authorize!(:cancel_plugin_chat_turn, actor: @actor, chat_id: @chat_id, turn_id: @id)
+          @host.plugin_chat_gateway.cancel_transport_plugin_chat_turn(turn_id: @id)
+        end
+      end
+
+      # Subscribes to questions and tool approval requests for this transport.
+      class Interactions
+        def initialize(host)
+          @host = host
+        end
+
+        def subscribe(&block)
+          raise ArgumentError, "interaction subscription requires a block" unless block
+
+          @host.gateway.subscribe_transport_interactions(&block)
+        end
+      end
+
+      # Handle for an asynchronously running Kward turn.
+      class Turn
+        attr_reader :id, :session_id
+
+        def initialize(host, handle, actor)
+          @host = host
+          @actor = actor
+          @id = handle.id.to_s.freeze
+          @session_id = handle.session_id.to_s.freeze
+        end
+
+        def subscribe(after: nil, &block)
+          raise ArgumentError, "turn subscription requires a block" unless block
+
+          @host.gateway.subscribe_transport_turn(turn_id: @id, after: after, &block)
+        end
+
+        def events(after: nil)
+          @host.gateway.transport_turn_events(turn_id: @id, after: after)
+        end
+
+        def status
+          @host.gateway.transport_turn_status(turn_id: @id)
+        end
+
+        def cancel
+          @host.authorize!(:cancel_turn, actor: @actor, session_id: @session_id, turn_id: @id)
+          @host.gateway.cancel_transport_turn(turn_id: @id)
+        end
+      end
+
+      # Default policy used by the host until a configured policy is supplied.
+      class AllowAllPolicy
+        def authorize(**)
+          true
+        end
+      end
+
+      private
+
+      def default_secret_env_name(key)
+        "KWARD_TRANSPORT_#{@transport_id.gsub(/[^A-Za-z0-9]/, "_").upcase}_#{key.gsub(/[^A-Za-z0-9]/, "_").upcase}"
+      end
+
+      def freeze_copy(value)
+        DeepCopy.freeze(DeepCopy.dup(value))
+      end
+    end
+  end
+end