@agenticmail/enterprise 0.3.2 → 0.4.0

package/src/engine/deploy-schema-routes.ts

@@ -0,0 +1,176 @@
+/**
+ * Deploy Credentials + Dynamic Schema Routes
+ * Mounted at / on the engine sub-app (routes define /deploy-credentials/*, /schema/*).
+ */
+
+import { Hono } from 'hono';
+import type { EngineDatabase } from './db-adapter.js';
+import type { SecureVault } from './vault.js';
+
+/** Redact passwords/tokens/keys from credential config for display */
+function redactCredConfig(config: Record<string, any>): Record<string, any> {
+  const redacted = { ...config };
+  const sensitiveKeys = ['password', 'token', 'apiToken', 'apiKey', 'secret', 'privateKey', 'sshKey', 'passphrase'];
+  for (const key of Object.keys(redacted)) {
+    if (sensitiveKeys.some(sk => key.toLowerCase().includes(sk.toLowerCase()))) {
+      if (typeof redacted[key] === 'string' && redacted[key].length > 0) {
+        redacted[key] = redacted[key].substring(0, 4) + '***';
+      }
+    }
+  }
+  return redacted;
+}
+
+/** Decrypt credential config if it was encrypted by the vault */
+function decryptCredConfig(config: Record<string, any>, vault?: SecureVault | null): Record<string, any> {
+  if (config?._encrypted && vault) {
+    try {
+      return JSON.parse(vault.decrypt(config._encrypted));
+    } catch {
+      // Decryption failed — return as-is (may be legacy or corrupt)
+      return config;
+    }
+  }
+  return config;
+}
+
+/** Encrypt credential config using the vault (if available) */
+function encryptCredConfig(config: Record<string, any>, vault?: SecureVault | null): Record<string, any> {
+  if (vault) {
+    try {
+      return { _encrypted: vault.encrypt(JSON.stringify(config)) };
+    } catch {
+      // Fallback to plaintext if encryption fails
+      return config;
+    }
+  }
+  return config;
+}
+
+export function createDeploySchemaRoutes(getEngineDb: () => EngineDatabase | null, getVault?: () => SecureVault | null) {
+  const router = new Hono();
+
+  // ─── Deploy Credentials ────────────────────────────────
+
+  router.get('/deploy-credentials', async (c) => {
+    const _engineDb = getEngineDb();
+    if (!_engineDb) return c.json({ error: 'Engine database not initialized' }, 503);
+    const orgId = c.req.query('orgId') || 'default';
+    const vault = getVault?.() || null;
+    const creds = await _engineDb.getDeployCredentialsByOrg(orgId);
+    // Decrypt (if encrypted), then redact sensitive config values for display
+    const safe = creds.map((cred: any) => ({
+      ...cred,
+      config: redactCredConfig(decryptCredConfig(cred.config, vault)),
+    }));
+    return c.json({ credentials: safe });
+  });
+
+  router.post('/deploy-credentials', async (c) => {
+    const _engineDb = getEngineDb();
+    if (!_engineDb) return c.json({ error: 'Engine database not initialized' }, 503);
+    const { orgId, name, targetType, config, createdBy } = await c.req.json();
+    if (!orgId || !name || !targetType) {
+      return c.json({ error: 'orgId, name, and targetType required' }, 400);
+    }
+
+    const validTypes = ['docker', 'vps', 'fly', 'railway', 'ssh'];
+    if (!validTypes.includes(targetType)) {
+      return c.json({ error: `Invalid targetType. Must be one of: ${validTypes.join(', ')}` }, 400);
+    }
+
+    const vault = getVault?.() || null;
+    const id = crypto.randomUUID();
+    await _engineDb.upsertDeployCredential({
+      id, orgId, name, targetType,
+      config: encryptCredConfig(config || {}, vault),
+      createdBy: c.req.header('X-User-Id') || createdBy || 'system',
+    });
+    return c.json({ id, name, targetType }, 201);
+  });
+
+  router.get('/deploy-credentials/:id', async (c) => {
+    const _engineDb = getEngineDb();
+    if (!_engineDb) return c.json({ error: 'Engine database not initialized' }, 503);
+    const vault = getVault?.() || null;
+    const cred = await _engineDb.getDeployCredential(c.req.param('id'));
+    if (!cred) return c.json({ error: 'Credential not found' }, 404);
+    return c.json({ credential: { ...cred, config: redactCredConfig(decryptCredConfig(cred.config, vault)) } });
+  });
+
+  router.put('/deploy-credentials/:id', async (c) => {
+    const _engineDb = getEngineDb();
+    if (!_engineDb) return c.json({ error: 'Engine database not initialized' }, 503);
+    const existing = await _engineDb.getDeployCredential(c.req.param('id'));
+    if (!existing) return c.json({ error: 'Credential not found' }, 404);
+
+    const vault = getVault?.() || null;
+    const body = await c.req.json();
+    // Decrypt existing config to merge, then re-encrypt
+    const existingConfig = decryptCredConfig(existing.config, vault);
+    const newConfig = body.config ? encryptCredConfig(body.config, vault) : encryptCredConfig(existingConfig, vault);
+    await _engineDb.upsertDeployCredential({
+      ...existing,
+      name: body.name || existing.name,
+      targetType: body.targetType || existing.targetType,
+      config: newConfig,
+    });
+    return c.json({ ok: true });
+  });
+
+  router.delete('/deploy-credentials/:id', async (c) => {
+    const _engineDb = getEngineDb();
+    if (!_engineDb) return c.json({ error: 'Engine database not initialized' }, 503);
+    await _engineDb.deleteDeployCredential(c.req.param('id'));
+    return c.json({ ok: true });
+  });
+
+  // ─── Dynamic Tables ────────────────────────────────────
+
+  router.post('/schema/tables', async (c) => {
+    const _engineDb = getEngineDb();
+    if (!_engineDb) return c.json({ error: 'Engine database not initialized' }, 503);
+    try {
+      const def = await c.req.json();
+      if (!def.name || !def.sql) return c.json({ error: 'name and sql are required' }, 400);
+      await _engineDb.createDynamicTable(def);
+      const prefixed = def.name.startsWith('ext_') ? def.name : `ext_${def.name}`;
+      return c.json({ ok: true, table: prefixed });
+    } catch (e: any) {
+      return c.json({ error: e.message }, 500);
+    }
+  });
+
+  router.get('/schema/tables', async (c) => {
+    const _engineDb = getEngineDb();
+    if (!_engineDb) return c.json({ error: 'Engine database not initialized' }, 503);
+    const tables = await _engineDb.listDynamicTables();
+    return c.json({ tables });
+  });
+
+  router.post('/schema/query', async (c) => {
+    const _engineDb = getEngineDb();
+    if (!_engineDb) return c.json({ error: 'Engine database not initialized' }, 503);
+    try {
+      const { sql, params } = await c.req.json();
+      if (!sql) return c.json({ error: 'sql is required' }, 400);
+      // Only allow SELECT on ext_ tables for safety
+      const trimmed = sql.trim().toUpperCase();
+      if (trimmed.startsWith('SELECT')) {
+        const rows = await _engineDb.query(sql, params);
+        return c.json({ rows });
+      } else {
+        // INSERT/UPDATE/DELETE — verify it targets ext_ tables
+        if (!trimmed.includes('EXT_')) {
+          return c.json({ error: 'Mutations only allowed on ext_* tables' }, 403);
+        }
+        await _engineDb.execute(sql, params);
+        return c.json({ ok: true });
+      }
+    } catch (e: any) {
+      return c.json({ error: e.message }, 500);
+    }
+  });
+
+  return router;
+}

package/src/engine/deployer.ts

@@ -203,7 +203,7 @@ export class DeploymentEngine {
           await this.execCommand(`docker exec agenticmail-${config.name} sh -c 'echo "${Buffer.from(content).toString('base64')}" | base64 -d > /workspace/${file}'`);
         }
         // Restart gateway inside container
-        await this.execCommand(`docker exec agenticmail-${config.name} openclaw gateway restart`);
+        await this.execCommand(`docker exec agenticmail-${config.name} agenticmail-enterprise restart`);
         return { success: true, message: 'Configuration updated and gateway restarted' };
       }
       case 'vps': {
@@ -270,7 +270,7 @@ export class DeploymentEngine {
     let healthy = false;
     for (let i = 0; i < 10; i++) {
       await new Promise(r => setTimeout(r, 3000));
-      const check = await this.execCommand(`docker exec agenticmail-${config.name} openclaw status 2>/dev/null || echo "not ready"`);
+      const check = await this.execCommand(`docker exec agenticmail-${config.name} agenticmail-enterprise status 2>/dev/null || echo "not ready"`);
       if (check.success && !check.message.includes('not ready')) {
         healthy = true;
         break;
@@ -540,17 +540,17 @@ primary_region = "${cloud.region || 'iad'}"
 
 WORKDIR /app
 
-RUN npm install -g openclaw agenticmail @agenticmail/core @agenticmail/openclaw
+RUN npm install -g @agenticmail/enterprise @agenticmail/core agenticmail
 
 COPY workspace/ /workspace/
 
 ENV NODE_ENV=production
-ENV OPENCLAW_MODEL=${config.model.provider}/${config.model.modelId}
-ENV OPENCLAW_THINKING=${config.model.thinkingLevel}
+ENV AGENTICMAIL_MODEL=${config.model.provider}/${config.model.modelId}
+ENV AGENTICMAIL_THINKING=${config.model.thinkingLevel}
 
 EXPOSE 3000
 
-CMD ["openclaw", "gateway", "start"]
+CMD ["agenticmail-enterprise", "start"]
 `;
   }
 

package/src/engine/dlp-routes.ts

@@ -0,0 +1,59 @@
+/**
+ * DLP (Data Loss Prevention) Routes
+ * Mounted at /dlp/* on the engine sub-app.
+ */
+
+import { Hono } from 'hono';
+import type { DLPEngine } from './dlp.js';
+
+export function createDlpRoutes(dlp: DLPEngine) {
+  const router = new Hono();
+
+  router.get('/rules', (c) => {
+    const rules = dlp.getRules(c.req.query('orgId') || undefined);
+    return c.json({ rules, total: rules.length });
+  });
+
+  router.post('/rules', async (c) => {
+    const body = await c.req.json();
+    body.id = body.id || crypto.randomUUID();
+    body.createdAt = body.createdAt || new Date().toISOString();
+    body.updatedAt = new Date().toISOString();
+    await dlp.addRule(body);
+    return c.json({ success: true, rule: body }, 201);
+  });
+
+  router.get('/rules/:id', (c) => {
+    const rule = dlp.getRule(c.req.param('id'));
+    if (!rule) return c.json({ error: 'Rule not found' }, 404);
+    return c.json({ rule });
+  });
+
+  router.delete('/rules/:id', (c) => {
+    dlp.removeRule(c.req.param('id'));
+    return c.json({ success: true });
+  });
+
+  router.post('/scan', async (c) => {
+    const { orgId, content } = await c.req.json();
+    if (!orgId || !content) return c.json({ error: 'orgId and content required' }, 400);
+    return c.json(dlp.testScan(orgId, content));
+  });
+
+  router.post('/scan-parameters', async (c) => {
+    const { orgId, agentId, toolId, parameters } = await c.req.json();
+    if (!orgId || !agentId || !toolId) return c.json({ error: 'orgId, agentId, toolId required' }, 400);
+    return c.json(dlp.scanParameters(orgId, agentId, toolId, parameters || {}));
+  });
+
+  router.get('/violations', (c) => {
+    const violations = dlp.getViolations({
+      orgId: c.req.query('orgId') || undefined,
+      agentId: c.req.query('agentId') || undefined,
+      limit: parseInt(c.req.query('limit') || '100'),
+    });
+    return c.json({ violations, total: violations.length });
+  });
+
+  return router;
+}

package/src/engine/dlp.ts

@@ -0,0 +1,231 @@
+/**
+ * Data Loss Prevention (DLP) Engine
+ *
+ * Scans tool call parameters and results for sensitive data:
+ * PII, secrets, API keys, credentials. Can block, redact, warn, or log.
+ *
+ * Integrates into the runtime hook pipeline:
+ * - beforeToolCall: scan parameters → block/redact before execution
+ * - afterToolCall: scan results → redact before returning to agent
+ */
+
+import type { EngineDatabase } from './db-adapter.js';
+
+// ─── Types ──────────────────────────────────────────────
+
+export interface DLPRule {
+  id: string;
+  orgId: string;
+  name: string;
+  description?: string;
+  patternType: 'regex' | 'keyword' | 'pii_type';
+  pattern: string;
+  action: 'block' | 'redact' | 'warn' | 'log';
+  appliesTo: 'parameters' | 'results' | 'both';
+  severity: 'low' | 'medium' | 'high' | 'critical';
+  enabled: boolean;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface DLPViolation {
+  id: string;
+  orgId: string;
+  agentId: string;
+  ruleId: string;
+  toolId: string;
+  actionTaken: 'blocked' | 'redacted' | 'warned' | 'logged';
+  matchContext?: string;
+  direction: 'outbound' | 'inbound';
+  createdAt: string;
+}
+
+export interface DLPScanResult {
+  allowed: boolean;
+  violations: DLPViolation[];
+  modifiedContent?: Record<string, any>;
+  reason?: string;
+}
+
+// ─── Built-in PII Patterns ─────────────────────────────
+
+const PII_PATTERNS: Record<string, RegExp> = {
+  email: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
+  ssn: /\b\d{3}-?\d{2}-?\d{4}\b/g,
+  credit_card: /\b(?:\d{4}[- ]?){3}\d{4}\b/g,
+  phone: /\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g,
+  api_key: /(?:sk|pk|api|key|token|secret|password)[_-]?[a-zA-Z0-9]{20,}/gi,
+  aws_key: /(?:AKIA|ASIA)[A-Z0-9]{16}/g,
+};
+
+// ─── DLP Engine ────────────────────────────────────────
+
+export class DLPEngine {
+  private rules = new Map<string, DLPRule>();
+  private violations: DLPViolation[] = [];
+  private engineDb?: EngineDatabase;
+
+  async setDb(db: EngineDatabase): Promise<void> {
+    this.engineDb = db;
+    await this.loadFromDb();
+  }
+
+  private async loadFromDb(): Promise<void> {
+    if (!this.engineDb) return;
+    try {
+      const rows = await this.engineDb.query<any>('SELECT * FROM dlp_rules WHERE enabled = 1');
+      for (const r of rows) {
+        this.rules.set(r.id, {
+          id: r.id, orgId: r.org_id, name: r.name, description: r.description,
+          patternType: r.pattern_type, pattern: r.pattern, action: r.action,
+          appliesTo: r.applies_to, severity: r.severity, enabled: !!r.enabled,
+          createdAt: r.created_at, updatedAt: r.updated_at,
+        });
+      }
+    } catch { /* table may not exist yet */ }
+  }
+
+  // ─── Rule CRUD ──────────────────────────────────────
+
+  async addRule(rule: DLPRule): Promise<void> {
+    this.rules.set(rule.id, rule);
+    this.engineDb?.execute(
+      `INSERT INTO dlp_rules (id, org_id, name, description, pattern_type, pattern, action, applies_to, severity, enabled, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(id) DO UPDATE SET name=excluded.name, description=excluded.description, pattern_type=excluded.pattern_type, pattern=excluded.pattern, action=excluded.action, applies_to=excluded.applies_to, severity=excluded.severity, enabled=excluded.enabled, updated_at=excluded.updated_at`,
+      [rule.id, rule.orgId, rule.name, rule.description || null, rule.patternType, rule.pattern, rule.action, rule.appliesTo, rule.severity, rule.enabled ? 1 : 0, rule.createdAt, rule.updatedAt]
+    ).catch((err) => { console.error('[dlp] Failed to persist rule:', err); });
+  }
+
+  removeRule(id: string): void {
+    this.rules.delete(id);
+    this.engineDb?.execute('DELETE FROM dlp_rules WHERE id = ?', [id])
+      .catch((err) => { console.error('[dlp] Failed to delete rule:', err); });
+  }
+
+  getRules(orgId?: string): DLPRule[] {
+    const all = Array.from(this.rules.values());
+    return orgId ? all.filter(r => r.orgId === orgId) : all;
+  }
+
+  getRule(id: string): DLPRule | undefined {
+    return this.rules.get(id);
+  }
+
+  // ─── Scanning ──────────────────────────────────────
+
+  scanParameters(orgId: string, agentId: string, toolId: string, params: Record<string, any>): DLPScanResult {
+    const rules = this.getApplicableRules(orgId, 'parameters');
+    return this.scan(orgId, agentId, toolId, params, rules, 'outbound');
+  }
+
+  scanResults(orgId: string, agentId: string, toolId: string, result: any): DLPScanResult {
+    const rules = this.getApplicableRules(orgId, 'results');
+    return this.scan(orgId, agentId, toolId, typeof result === 'object' ? result : { _value: result }, rules, 'inbound');
+  }
+
+  testScan(orgId: string, content: string): { matches: { ruleName: string; ruleId: string; matchCount: number }[] } {
+    const rules = Array.from(this.rules.values()).filter(r => r.orgId === orgId && r.enabled);
+    const matches: { ruleName: string; ruleId: string; matchCount: number }[] = [];
+    for (const rule of rules) {
+      const pattern = this.compilePattern(rule);
+      if (!pattern) continue;
+      const m = content.match(pattern);
+      if (m && m.length > 0) {
+        matches.push({ ruleName: rule.name, ruleId: rule.id, matchCount: m.length });
+      }
+    }
+    return { matches };
+  }
+
+  getViolations(opts?: { orgId?: string; agentId?: string; limit?: number }): DLPViolation[] {
+    let v = [...this.violations];
+    if (opts?.orgId) v = v.filter(x => x.orgId === opts.orgId);
+    if (opts?.agentId) v = v.filter(x => x.agentId === opts.agentId);
+    return v.slice(0, opts?.limit || 100);
+  }
+
+  // ─── Private ──────────────────────────────────────
+
+  private getApplicableRules(orgId: string, direction: 'parameters' | 'results'): DLPRule[] {
+    return Array.from(this.rules.values()).filter(r =>
+      r.orgId === orgId && r.enabled && (r.appliesTo === 'both' || r.appliesTo === direction)
+    );
+  }
+
+  private scan(orgId: string, agentId: string, toolId: string, data: Record<string, any>, rules: DLPRule[], direction: 'outbound' | 'inbound'): DLPScanResult {
+    const content = JSON.stringify(data);
+    const violations: DLPViolation[] = [];
+    let blocked = false;
+    let modified = false;
+    let modifiedContent: Record<string, any> | undefined;
+
+    for (const rule of rules) {
+      const pattern = this.compilePattern(rule);
+      if (!pattern) continue;
+
+      const matches = content.match(pattern);
+      if (!matches || matches.length === 0) continue;
+
+      const violation: DLPViolation = {
+        id: crypto.randomUUID(),
+        orgId, agentId, ruleId: rule.id, toolId,
+        actionTaken: rule.action as any,
+        matchContext: this.sanitizeMatchContext(matches[0]),
+        direction,
+        createdAt: new Date().toISOString(),
+      };
+      violations.push(violation);
+      this.recordViolation(violation);
+
+      switch (rule.action) {
+        case 'block':
+          blocked = true;
+          break;
+        case 'redact':
+          if (!modifiedContent) modifiedContent = JSON.parse(JSON.stringify(data));
+          modifiedContent = JSON.parse(JSON.stringify(modifiedContent).replace(pattern, '[REDACTED]'));
+          modified = true;
+          break;
+        case 'warn':
+        case 'log':
+          break;
+      }
+    }
+
+    return {
+      allowed: !blocked,
+      violations,
+      modifiedContent: modified ? modifiedContent : undefined,
+      reason: blocked ? `DLP policy violation: ${violations.map(v => v.ruleId).join(', ')}` : undefined,
+    };
+  }
+
+  private compilePattern(rule: DLPRule): RegExp | null {
+    try {
+      if (rule.patternType === 'pii_type') {
+        return PII_PATTERNS[rule.pattern] || null;
+      }
+      if (rule.patternType === 'keyword') {
+        return new RegExp(rule.pattern.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi');
+      }
+      return new RegExp(rule.pattern, 'gi');
+    } catch {
+      return null;
+    }
+  }
+
+  private sanitizeMatchContext(match: string): string {
+    if (match.length <= 4) return '***';
+    return match.substring(0, 2) + '***' + match.substring(match.length - 2);
+  }
+
+  private recordViolation(violation: DLPViolation): void {
+    this.violations.push(violation);
+    if (this.violations.length > 1000) this.violations = this.violations.slice(-1000);
+    this.engineDb?.execute(
+      'INSERT INTO dlp_violations (id, org_id, agent_id, rule_id, tool_id, action_taken, match_context, direction, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)',
+      [violation.id, violation.orgId, violation.agentId, violation.ruleId, violation.toolId, violation.actionTaken, violation.matchContext || null, violation.direction, violation.createdAt]
+    ).catch((err) => { console.error('[dlp] Failed to persist violation:', err); });
+  }
+}

package/src/engine/guardrail-routes.ts

@@ -0,0 +1,125 @@
+/**
+ * Guardrails (Intervention & Anomaly Detection) Routes
+ * Mounted at /guardrails/* and /anomaly-rules/* on the engine sub-app.
+ */
+
+import { Hono } from 'hono';
+import type { GuardrailEngine } from './guardrails.js';
+
+export function createGuardrailRoutes(guardrails: GuardrailEngine, opts?: { getWorkforceOffDuty?: (agentId: string) => boolean }) {
+  const router = new Hono();
+
+  // ─── Interventions ─────────────────────────────────────
+
+  router.post('/pause/:id', async (c) => {
+    const { reason } = await c.req.json().catch(() => ({ reason: 'Manual pause' }));
+    const triggeredBy = c.req.header('X-User-Id') || 'admin';
+    const orgId = c.req.query('orgId') || undefined;
+    const record = await guardrails.pauseAgent(c.req.param('id'), reason, triggeredBy, orgId);
+    return c.json({ success: true, intervention: record });
+  });
+
+  router.post('/resume/:id', async (c) => {
+    const { reason } = await c.req.json().catch(() => ({ reason: 'Manual resume' }));
+    const triggeredBy = c.req.header('X-User-Id') || 'admin';
+    const orgId = c.req.query('orgId') || undefined;
+    const record = await guardrails.resumeAgent(c.req.param('id'), reason, triggeredBy, orgId);
+    return c.json({ success: true, intervention: record });
+  });
+
+  router.post('/kill/:id', async (c) => {
+    const { reason } = await c.req.json().catch(() => ({ reason: 'Emergency kill' }));
+    const triggeredBy = c.req.header('X-User-Id') || 'admin';
+    const orgId = c.req.query('orgId') || undefined;
+    const record = await guardrails.killAgent(c.req.param('id'), reason, triggeredBy, orgId);
+    return c.json({ success: true, intervention: record });
+  });
+
+  router.get('/status/:id', (c) => {
+    const agentId = c.req.param('id');
+    const status = guardrails.getAgentStatus(agentId);
+    const offDuty = opts?.getWorkforceOffDuty?.(agentId) ?? false;
+    return c.json({ ...status, offDuty });
+  });
+
+  router.get('/interventions', (c) => {
+    const records = guardrails.getInterventions({
+      orgId: c.req.query('orgId') || undefined,
+      agentId: c.req.query('agentId') || undefined,
+      limit: parseInt(c.req.query('limit') || '50'),
+    });
+    return c.json({ interventions: records, total: records.length });
+  });
+
+  // ─── Extended Guardrail Rules ──────────────────────────
+
+  router.get('/rules', (c) => {
+    const rules = guardrails.getGuardrailRules(
+      c.req.query('orgId') || undefined,
+      c.req.query('category') || undefined,
+    );
+    return c.json({ rules, total: rules.length });
+  });
+
+  router.post('/rules', async (c) => {
+    const body = await c.req.json();
+    body.id = body.id || crypto.randomUUID();
+    body.createdAt = body.createdAt || new Date().toISOString();
+    body.updatedAt = new Date().toISOString();
+    body.triggerCount = 0;
+    body.createdBy = c.req.header('X-User-Id') || body.createdBy || 'admin';
+    await guardrails.addGuardrailRule(body);
+    return c.json({ success: true, rule: body }, 201);
+  });
+
+  router.put('/rules/:id', async (c) => {
+    const body = await c.req.json();
+    const updated = await guardrails.updateGuardrailRule(c.req.param('id'), body);
+    if (!updated) return c.json({ error: 'Rule not found' }, 404);
+    return c.json({ success: true, rule: updated });
+  });
+
+  router.delete('/rules/:id', (c) => {
+    guardrails.removeGuardrailRule(c.req.param('id'));
+    return c.json({ success: true });
+  });
+
+  router.get('/rules/categories', (c) => {
+    const { GUARDRAIL_RULE_CATEGORIES } = require('./guardrails.js');
+    return c.json({ categories: GUARDRAIL_RULE_CATEGORIES || {} });
+  });
+
+  router.get('/status/:id/full', (c) => {
+    const agentId = c.req.param('id');
+    const fullStatus = guardrails.getAgentFullStatus(agentId);
+    const offDuty = opts?.getWorkforceOffDuty?.(agentId) ?? false;
+    return c.json({ ...fullStatus, offDuty });
+  });
+
+  return router;
+}
+
+export function createAnomalyRoutes(guardrails: GuardrailEngine) {
+  const router = new Hono();
+
+  router.get('/', (c) => {
+    const rules = guardrails.getAnomalyRules(c.req.query('orgId') || undefined);
+    return c.json({ rules, total: rules.length });
+  });
+
+  router.post('/', async (c) => {
+    const body = await c.req.json();
+    body.id = body.id || crypto.randomUUID();
+    body.createdAt = body.createdAt || new Date().toISOString();
+    body.updatedAt = new Date().toISOString();
+    await guardrails.addAnomalyRule(body);
+    return c.json({ success: true, rule: body }, 201);
+  });
+
+  router.delete('/:id', (c) => {
+    guardrails.removeAnomalyRule(c.req.param('id'));
+    return c.json({ success: true });
+  });
+
+  return router;
+}