@astrasyncai/verification-gateway 5.15.0 → 5.16.0

package/dist/bin/astrasync-claude-hook.js

@@ -3752,7 +3752,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.15.0";
+var SDK_VERSION = "5.16.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -3889,6 +3889,8 @@ function getCacheKey(request, counterpartyId) {
     request.durationRequired ?? "",
     request.invocationProtocol || "",
     request.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request.routePolicy ? JSON.stringify(request.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -4061,6 +4063,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;

package/dist/bin/astrasync-codex-hook.js

@@ -3751,7 +3751,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.15.0";
+var SDK_VERSION = "5.16.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -3888,6 +3888,8 @@ function getCacheKey(request, counterpartyId) {
     request.durationRequired ?? "",
     request.invocationProtocol || "",
     request.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request.routePolicy ? JSON.stringify(request.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -4060,6 +4062,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;

package/dist/bin/astrasync-guard.js

@@ -3713,7 +3713,7 @@ Policy saved to ${outputPath}`);
 };
 
 // src/version.ts
-var SDK_VERSION = "5.15.0";
+var SDK_VERSION = "5.16.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -4754,6 +4754,8 @@ function getCacheKey(request2, counterpartyId) {
     request2.durationRequired ?? "",
     request2.invocationProtocol || "",
     request2.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request2.routePolicy ? JSON.stringify(request2.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -4926,6 +4928,7 @@ async function callVerifyAccessAPI(config, request2) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -6981,6 +6984,88 @@ function writeManagedSettings(files, outDir) {
   });
 }
 
+// src/fleet/git-route.ts
+var import_child_process2 = require("child_process");
+var realGit = (args) => (0, import_child_process2.execFileSync)("git", args, { encoding: "utf-8" });
+function gitRouteConfig(opts) {
+  const base2 = opts.checkpoint.replace(/\/+$/, "");
+  if (!/^https:\/\//.test(base2) && !/^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(base2)) {
+    throw new Error("--checkpoint must be an https:// URL");
+  }
+  if (!/^ASTRA-[A-Za-z0-9_-]{8,64}$/.test(opts.agent))
+    throw new Error("--agent must be an ASTRA-id");
+  if (!/^[A-Za-z0-9_-]{4,120}$/.test(opts.slug))
+    throw new Error("--slug must be the connector slug");
+  const upstream = opts.upstream ?? "github";
+  return [
+    [`url.${base2}/a/${opts.slug}/git/${upstream}/.insteadOf`, opts.host ?? "https://github.com/"],
+    [`credential.${base2}.helper`, "!astrasync guard git-credential"],
+    ["astrasync.agent", opts.agent],
+    ["astrasync.checkpoint", base2]
+  ];
+}
+function applyGitRoute(opts, git = realGit) {
+  const entries = gitRouteConfig(opts);
+  for (const [key, value] of entries) git(["config", "--global", key, value]);
+  return entries.map(([k, v]) => `${k} = ${v}`);
+}
+function removeGitRoute(git = realGit) {
+  let base2 = "";
+  try {
+    base2 = git(["config", "--global", "--get", "astrasync.checkpoint"]).trim();
+  } catch {
+    return [];
+  }
+  const removed = [];
+  const unset = (args) => {
+    try {
+      git(["config", "--global", ...args]);
+      removed.push(args[args.length - 1]);
+    } catch {
+    }
+  };
+  let urls = "";
+  try {
+    urls = git(["config", "--global", "--get-regexp", "^url\\..*\\.insteadof$"]);
+  } catch {
+  }
+  for (const line of urls.split("\n")) {
+    const key = line.split(" ")[0];
+    if (key && key.toLowerCase().startsWith(`url.${base2}/`.toLowerCase())) unset(["--unset", key]);
+  }
+  unset(["--unset", `credential.${base2}.helper`]);
+  unset(["--unset", "astrasync.agent"]);
+  unset(["--unset", "astrasync.checkpoint"]);
+  return removed;
+}
+function gitCredentialAnswer(action, input, deps) {
+  if (action !== "get" || !deps.agent || !deps.checkpoint || !deps.deviceCredential) return "";
+  const fields = Object.fromEntries(
+    input.split("\n").map((l) => l.split("=")).filter((p) => p.length >= 2).map(([k, ...v]) => [k, v.join("=")])
+  );
+  const host = new URL(deps.checkpoint).host;
+  if (fields.host && fields.host !== host) return "";
+  return `username=${deps.agent}
+password=${deps.deviceCredential}
+`;
+}
+function runGitCredential(action, input, git = realGit) {
+  const read = (key) => {
+    try {
+      return git(["config", "--global", "--get", key]).trim();
+    } catch {
+      return void 0;
+    }
+  };
+  const loaded = loadEnrolment(fleetPaths());
+  const deviceCredential = loaded && "enrolment" in loaded ? loaded.enrolment.credential : void 0;
+  return gitCredentialAnswer(action, input, {
+    agent: read("astrasync.agent"),
+    checkpoint: read("astrasync.checkpoint"),
+    deviceCredential
+  });
+}
+
 // src/cli/guard.ts
 var DEFAULT_POLICY_PATH = "./local-policy.yaml";
 var DEFAULT_CONFIG_DIR = ".astrasync";
@@ -7516,6 +7601,32 @@ async function cmdFleetStatus() {
   const status = await getFleetStatus(fleetPaths());
   for (const line of formatFleetStatus(status)) console.log(line);
 }
+async function cmdGitRoute() {
+  try {
+    if (process.argv.includes("--undo")) {
+      const removed = removeGitRoute();
+      console.log(removed.length ? `Removed: ${removed.join(", ")}` : "No git route was set.");
+      return;
+    }
+    const lines = applyGitRoute({
+      checkpoint: flagValue("--checkpoint") ?? "",
+      slug: flagValue("--slug") ?? "",
+      agent: flagValue("--agent") ?? "",
+      upstream: flagValue("--upstream")
+    });
+    console.log("git now fetches and pushes github.com through your Workforce Guard checkpoint:");
+    for (const l of lines) console.log(`  ${l}`);
+    console.log("Commits still run your local hooks. Undo with: astrasync guard git-route --undo");
+  } catch (err) {
+    console.error(`git-route failed: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
+}
+async function cmdGitCredential() {
+  const action = process.argv[process.argv.indexOf("git-credential") + 1] ?? "";
+  const input = fs.readFileSync(0, "utf-8");
+  process.stdout.write(runGitCredential(action, input));
+}
 async function cmdManagedSettings() {
   const targets = [];
   if (process.argv.includes("--claude")) targets.push("claude");
@@ -7584,6 +7695,12 @@ async function main() {
     case "managed-settings":
       await cmdManagedSettings();
       break;
+    case "git-route":
+      await cmdGitRoute();
+      break;
+    case "git-credential":
+      await cmdGitCredential();
+      break;
     default:
       console.log("AstraSync Local Guard\n");
       console.log("Usage: astrasync guard <command>\n");
@@ -7608,6 +7725,11 @@ async function main() {
       console.log("                         (--api-base-url <url>, --system for machine scope)");
       console.log("  fleet-status           Show fleet enrolment, signed policy and heartbeat");
       console.log("  managed-settings       Print MDM templates (--claude, --codex, --out <dir>)");
+      console.log("  git-route              Route git through your Workforce Guard checkpoint");
+      console.log(
+        "                         (--checkpoint <url> --slug <connector> --agent <ASTRA-id>;"
+      );
+      console.log("                          --undo to remove)");
       console.log("");
       process.exit(command ? 1 : 0);
   }

package/dist/bin/astrasync.js

@@ -36,7 +36,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    SDK_VERSION = "5.15.0";
+    SDK_VERSION = "5.16.0";
   }
 });
 
@@ -5030,6 +5030,13 @@ var init_local = __esm({
   }
 });
 
+// src/types.ts
+var init_types2 = __esm({
+  "src/types.ts"() {
+    "use strict";
+  }
+});
+
 // src/trust-levels.ts
 function getTrustLevel(score) {
   if (score >= 80) return "PLATINUM";
@@ -5161,6 +5168,8 @@ function getCacheKey(request2, counterpartyId) {
     request2.durationRequired ?? "",
     request2.invocationProtocol || "",
     request2.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request2.routePolicy ? JSON.stringify(request2.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -5331,6 +5340,7 @@ async function callVerifyAccessAPI(config, request2) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -6092,6 +6102,7 @@ var init_express = __esm({
   "src/adapters/express.ts"() {
     "use strict";
     init_commerce_detect();
+    init_types2();
     init_stepup_poll();
     init_verify();
     init_http2();
@@ -6114,6 +6125,7 @@ var init_nextjs = __esm({
   "src/adapters/nextjs.ts"() {
     "use strict";
     init_commerce_detect();
+    init_types2();
     init_stepup_poll();
     init_verify();
     init_http2();
@@ -6362,7 +6374,7 @@ var init_extractor_registry = __esm({
 });
 
 // src/transport/registry/types.ts
-var init_types2 = __esm({
+var init_types3 = __esm({
   "src/transport/registry/types.ts"() {
     "use strict";
   }
@@ -6420,7 +6432,7 @@ var init_transport = __esm({
     init_vi_verify();
     init_commerce_pipeline();
     init_extractor_registry();
-    init_types2();
+    init_types3();
     init_visa();
     init_mastercard();
     init_web_bot_auth();
@@ -6740,6 +6752,7 @@ var init_http_signatures = __esm({
 var init_src = __esm({
   "src/index.ts"() {
     "use strict";
+    init_types2();
     init_trust_levels();
     init_verify();
     init_failure_posture();
@@ -7871,7 +7884,7 @@ var init_enrolment_store = __esm({
 
 // src/fleet/types.ts
 var FLEET_POLICY_TYP, FLEET_POLICY_AUD, FLEET_POLICY_ISS, FLEET_KEYS_TYP, FLEET_KEYS_AUD, DEFAULT_HEARTBEAT_INTERVAL_SEC;
-var init_types3 = __esm({
+var init_types4 = __esm({
   "src/fleet/types.ts"() {
     "use strict";
     FLEET_POLICY_TYP = "fleet-policy+jwt";
@@ -8002,7 +8015,7 @@ var init_policy_verify = __esm({
     import_crypto = require("crypto");
     import_jose5 = require("jose");
     init_pdlss_parser();
-    init_types3();
+    init_types4();
     FleetPolicyError = class extends Error {
       constructor(message) {
         super(message);
@@ -8223,7 +8236,7 @@ var init_cli = __esm({
     init_client2();
     init_enrolment_store();
     init_policy_verify();
-    init_types3();
+    init_types4();
     DEFAULT_FLEET_API_BASE_URL = "https://astrasync.ai/api";
     MANAGED_SETTINGS_LOCATIONS = {
       // code.claude.com/docs/en/managed-settings
@@ -8242,6 +8255,95 @@ var init_cli = __esm({
   }
 });
 
+// src/fleet/git-route.ts
+function gitRouteConfig(opts) {
+  const base2 = opts.checkpoint.replace(/\/+$/, "");
+  if (!/^https:\/\//.test(base2) && !/^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(base2)) {
+    throw new Error("--checkpoint must be an https:// URL");
+  }
+  if (!/^ASTRA-[A-Za-z0-9_-]{8,64}$/.test(opts.agent))
+    throw new Error("--agent must be an ASTRA-id");
+  if (!/^[A-Za-z0-9_-]{4,120}$/.test(opts.slug))
+    throw new Error("--slug must be the connector slug");
+  const upstream = opts.upstream ?? "github";
+  return [
+    [`url.${base2}/a/${opts.slug}/git/${upstream}/.insteadOf`, opts.host ?? "https://github.com/"],
+    [`credential.${base2}.helper`, "!astrasync guard git-credential"],
+    ["astrasync.agent", opts.agent],
+    ["astrasync.checkpoint", base2]
+  ];
+}
+function applyGitRoute(opts, git = realGit) {
+  const entries = gitRouteConfig(opts);
+  for (const [key, value] of entries) git(["config", "--global", key, value]);
+  return entries.map(([k, v]) => `${k} = ${v}`);
+}
+function removeGitRoute(git = realGit) {
+  let base2 = "";
+  try {
+    base2 = git(["config", "--global", "--get", "astrasync.checkpoint"]).trim();
+  } catch {
+    return [];
+  }
+  const removed = [];
+  const unset = (args) => {
+    try {
+      git(["config", "--global", ...args]);
+      removed.push(args[args.length - 1]);
+    } catch {
+    }
+  };
+  let urls = "";
+  try {
+    urls = git(["config", "--global", "--get-regexp", "^url\\..*\\.insteadof$"]);
+  } catch {
+  }
+  for (const line of urls.split("\n")) {
+    const key = line.split(" ")[0];
+    if (key && key.toLowerCase().startsWith(`url.${base2}/`.toLowerCase())) unset(["--unset", key]);
+  }
+  unset(["--unset", `credential.${base2}.helper`]);
+  unset(["--unset", "astrasync.agent"]);
+  unset(["--unset", "astrasync.checkpoint"]);
+  return removed;
+}
+function gitCredentialAnswer(action, input, deps) {
+  if (action !== "get" || !deps.agent || !deps.checkpoint || !deps.deviceCredential) return "";
+  const fields = Object.fromEntries(
+    input.split("\n").map((l) => l.split("=")).filter((p) => p.length >= 2).map(([k, ...v]) => [k, v.join("=")])
+  );
+  const host = new URL(deps.checkpoint).host;
+  if (fields.host && fields.host !== host) return "";
+  return `username=${deps.agent}
+password=${deps.deviceCredential}
+`;
+}
+function runGitCredential(action, input, git = realGit) {
+  const read = (key) => {
+    try {
+      return git(["config", "--global", "--get", key]).trim();
+    } catch {
+      return void 0;
+    }
+  };
+  const loaded = loadEnrolment(fleetPaths());
+  const deviceCredential = loaded && "enrolment" in loaded ? loaded.enrolment.credential : void 0;
+  return gitCredentialAnswer(action, input, {
+    agent: read("astrasync.agent"),
+    checkpoint: read("astrasync.checkpoint"),
+    deviceCredential
+  });
+}
+var import_child_process2, realGit;
+var init_git_route = __esm({
+  "src/fleet/git-route.ts"() {
+    "use strict";
+    import_child_process2 = require("child_process");
+    init_enrolment_store();
+    realGit = (args) => (0, import_child_process2.execFileSync)("git", args, { encoding: "utf-8" });
+  }
+});
+
 // src/cli/guard.ts
 var guard_exports = {};
 function createPrompt() {
@@ -8776,6 +8878,32 @@ async function cmdFleetStatus() {
   const status = await getFleetStatus(fleetPaths());
   for (const line of formatFleetStatus(status)) console.log(line);
 }
+async function cmdGitRoute() {
+  try {
+    if (process.argv.includes("--undo")) {
+      const removed = removeGitRoute();
+      console.log(removed.length ? `Removed: ${removed.join(", ")}` : "No git route was set.");
+      return;
+    }
+    const lines = applyGitRoute({
+      checkpoint: flagValue("--checkpoint") ?? "",
+      slug: flagValue("--slug") ?? "",
+      agent: flagValue("--agent") ?? "",
+      upstream: flagValue("--upstream")
+    });
+    console.log("git now fetches and pushes github.com through your Workforce Guard checkpoint:");
+    for (const l of lines) console.log(`  ${l}`);
+    console.log("Commits still run your local hooks. Undo with: astrasync guard git-route --undo");
+  } catch (err) {
+    console.error(`git-route failed: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
+}
+async function cmdGitCredential() {
+  const action = process.argv[process.argv.indexOf("git-credential") + 1] ?? "";
+  const input = fs.readFileSync(0, "utf-8");
+  process.stdout.write(runGitCredential(action, input));
+}
 async function cmdManagedSettings() {
   const targets = [];
   if (process.argv.includes("--claude")) targets.push("claude");
@@ -8844,6 +8972,12 @@ async function main() {
     case "managed-settings":
       await cmdManagedSettings();
       break;
+    case "git-route":
+      await cmdGitRoute();
+      break;
+    case "git-credential":
+      await cmdGitCredential();
+      break;
     default:
       console.log("AstraSync Local Guard\n");
       console.log("Usage: astrasync guard <command>\n");
@@ -8868,6 +9002,11 @@ async function main() {
       console.log("                         (--api-base-url <url>, --system for machine scope)");
       console.log("  fleet-status           Show fleet enrolment, signed policy and heartbeat");
       console.log("  managed-settings       Print MDM templates (--claude, --codex, --out <dir>)");
+      console.log("  git-route              Route git through your Workforce Guard checkpoint");
+      console.log(
+        "                         (--checkpoint <url> --slug <connector> --agent <ASTRA-id>;"
+      );
+      console.log("                          --undo to remove)");
       console.log("");
       process.exit(command ? 1 : 0);
   }
@@ -8890,6 +9029,7 @@ var init_guard = __esm({
     init_settings_installer2();
     init_cli();
     init_enrolment_store();
+    init_git_route();
     DEFAULT_POLICY_PATH = "./local-policy.yaml";
     DEFAULT_CONFIG_DIR = ".astrasync";
     main().catch((err) => {

package/dist/browser/background.js

@@ -3988,7 +3988,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.15.0";
+var SDK_VERSION = "5.16.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -4125,6 +4125,8 @@ function getCacheKey(request, counterpartyId) {
     request.durationRequired ?? "",
     request.invocationProtocol || "",
     request.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request.routePolicy ? JSON.stringify(request.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -4297,6 +4299,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;