@buoy-gg/agent-core 7.0.40 → 7.0.42

package/lib/module/policy/labels.js

@@ -1,312 +1 @@
-"use strict";
-
-/**
- * Human titles for tool calls.
- *
- * The catalog's `summary` field is written FOR THE MODEL — "Navigate the
- * device to a concrete path (pushes by default; replace:true swaps the
- * current screen)". Shown to a QA person in a 300pt-wide chat row it was
- * truncated to "Navigate the device to a concrete path (pushes by default;
- * replace:tru…", which is the worst of both worlds: too long to fit and too
- * technical to help. The transcript, the changes bar and the approval card
- * all render THIS layer instead: a short present-tense sentence with the one
- * or two parameters a person would recognise ("Open /bag", "Update the cart
- * store"), and the catalog sentence is kept alongside as the expandable
- * "what this does" detail.
- *
- * Phrases are keyed `toolId.action`. `{a|b.c}` interpolates the first defined
- * string/number among those parameter paths; a placeholder that resolves to
- * nothing disappears with its surrounding space. Anything not phrased here
- * falls back to the humanised action name plus the tool title, which is
- * still short and still honest — never the model-facing paragraph.
- */
-import { CATALOG } from "../catalog/catalog.g";
-const PHRASES = {
-  // Routes
-  "route-events.getSnapshot": "Check which screen is open",
-  "route-events.getCurrentRoute": "Check the current screen",
-  "route-events.navigate": "Open {path}",
-  "route-events.stackGoBack": "Go back one screen",
-  "route-events.stackNavigateToIndex": "Jump to screen {index} in the stack",
-  "route-events.stackPopToIndex": "Go back to screen {index}",
-  "route-events.stackPopToTop": "Go back to the first screen",
-  // State stores
-  "zustand.listStores": "List the app's stores",
-  "zustand.getStoreState": "Read the {storeName} store",
-  "zustand.getChangeDetail": "Inspect a store change",
-  "zustand.setState": "Update the {storeName} store",
-  "zustand.rehydrate": "Reload the {storeName} store from disk",
-  "redux.getState": "Read the Redux state",
-  "redux.getActionDetail": "Inspect a Redux action",
-  "redux.dispatch": "Dispatch {action.type}",
-  "jotai.listAtoms": "List the app's atoms",
-  "jotai.getAtomValue": "Read atom {label}",
-  "jotai.getChangeDetail": "Inspect an atom change",
-  "jotai.setAtom": "Set atom {label}",
-  // React Query
-  "query.listQueries": "List cached queries",
-  "query.getQueryData": "Read cached data for {queryHash}",
-  "query.refetch": "Refetch {queryHash}",
-  "query.invalidate": "Refresh {queryHash}",
-  "query.reset": "Reset {queryHash}",
-  "query.remove": "Drop {queryHash} from the cache",
-  "query.setQueryData": "Replace cached data for {queryHash|queryKey}",
-  "query.triggerError": "Force {queryHash} into an error",
-  "query.restoreError": "Clear the forced error on {queryHash}",
-  "query.triggerLoading": "Force {queryHash} to keep loading",
-  "query.restoreLoading": "Clear the forced loading on {queryHash}",
-  "query.clearQueryCache": "Clear the query cache",
-  "query.clearMutationCache": "Clear the mutation cache",
-  // Network
-  "network.getSnapshot": "Read recent network requests",
-  "network.getCaptureStatus": "Check network capture",
-  "network.getEventBody": "Read a request's body",
-  "network.setPinned": "Pin a request",
-  "network.setSaved": "Save a request",
-  "network.removeSavedRecord": "Remove saved request {key}",
-  "network.clearSavedRequests": "Clear saved requests",
-  "network.clearPinnedRequests": "Clear pinned requests",
-  "network.listOverrideRules": "List network overrides",
-  "network.getOverrideRuleBody": "Read a network override",
-  "network.debugOverrides": "Check overrides for {url}",
-  "network.upsertOverrideRule": "Add a network override",
-  "network.deleteOverrideRule": "Delete a network override",
-  "network.clearOverrideRules": "Clear all network overrides",
-  // Storage
-  "storage.async.getAllKeys": "List saved storage keys",
-  "storage.async.multiGet": "Read saved values",
-  "storage.async.getItem": "Read saved value {key}",
-  "storage.async.setItem": "Save {key}",
-  "storage.async.removeItem": "Delete saved value {key}",
-  "storage.async.multiRemove": "Delete saved values",
-  "storage.async.multiSet": "Save several values",
-  // These two MUST read differently. They were both "Clear all saved app data",
-  // and the difference is the whole point: `async.clear` also wipes Buoy's own
-  // devtool settings, `clearAppStorage` preserves them. A user approving the
-  // shared wording had no way to tell which one they were about to get.
-  "storage.async.clear": "Clear ALL saved data — including Buoy's own settings",
-  "storage.clearAppStorage": "Clear the app's saved data (keeps Buoy's settings)",
-  "storage.getEventDetail": "Inspect a storage change",
-  "storage.timeTravel.undo": "Undo a storage change",
-  "storage.timeTravel.jump": "Rewind storage to an earlier point",
-  "storage.mmkv.snapshot": "Read MMKV storage",
-  "storage.mmkv.get": "Read {key} from MMKV",
-  "storage.mmkv.set": "Save {key} to MMKV",
-  "storage.mmkv.remove": "Delete {key} from MMKV",
-  "storage.secure.keys": "List secure storage keys",
-  "storage.secure.snapshot": "Read secure storage",
-  "storage.secure.get": "Read secure value {key}",
-  "storage.secure.set": "Save secure value {key}",
-  "storage.secure.delete": "Delete secure value {key}",
-  // Console / env / events
-  "console.getSnapshot": "Read recent console logs",
-  "console.clearEntries": "Clear the console",
-  "env.getSnapshot": "Read environment variables",
-  "events.exportEvents": "Export recent events",
-  "events.setEnabledSources": "Change which events are recorded",
-  "sentry.getSnapshot": "Read what's been sent to Sentry",
-  "sentry.clearEnvelopes": "Clear captured Sentry traffic",
-  // Ask Buoy's own session
-  "ask-buoy.listChanges": "List Ask Buoy's changes",
-  "ask-buoy.undoAll": "Undo everything Ask Buoy changed",
-  // Screen
-  "highlight-updates.describeScreen": "Look at what's on screen",
-  "highlight-updates.tapElement": "Tap {query|testID|text}",
-  "highlight-updates.waitFor": "Wait for {query|testID}",
-  "highlight-updates.locateComponent": "Find {query} on screen",
-  "highlight-updates.getRenderDetail": "Inspect a component's renders",
-  "highlight-updates.beginMeasurement": "Start counting renders",
-  "highlight-updates.endMeasurement": "Stop counting renders",
-  "highlight-updates.clearRenderCounts": "Clear render counts",
-  "debug-borders.cycleMode": "Cycle debug borders",
-  "debug-borders.setMode": "Set debug borders to {mode}",
-  // Impersonate
-  "impersonate.searchUsers": "Search users for {query}",
-  "impersonate.startImpersonation": "Impersonate {user.name|user.email|user.id}",
-  "impersonate.stopImpersonation": "Stop impersonating",
-  "impersonate.pauseImpersonation": "Pause impersonation",
-  "impersonate.resumeImpersonation": "Resume impersonation",
-  "impersonate.clearHistory": "Clear impersonation history",
-  // App / time machine / scenarios / perf
-  "app.ping": "Check the app is responding",
-  "app.reloadApp": "Reload the app",
-  "time-machine.list": "List saved snapshots",
-  "time-machine.capture": "Save a snapshot {name}",
-  "time-machine.captureBaseline": "Save a baseline snapshot",
-  "time-machine.restore": "Restore snapshot {id}",
-  "time-machine.preview": "Preview snapshot {id}",
-  "time-machine.inspect": "Inspect snapshot {id}",
-  "time-machine.delete": "Delete snapshot {id}",
-  "time-machine.rename": "Rename a snapshot to {name}",
-  "time-machine.duplicate": "Duplicate snapshot {id}",
-  // NOT "delete every snapshot" — that is `time-machine.delete`, and this card
-  // said so for months. `wipeAll` clears EVERY registered state source to
-  // fresh-install and reloads the app (timeMachineStore.ts:639); no snapshot is
-  // involved and there is no undo. The approval card is the last thing standing
-  // between a user and that, so it has to name the real blast radius.
-  "time-machine.wipeAll": "Wipe ALL app state to fresh install and reload",
-  "scenarios.listScenarios": "List scenarios",
-  "scenarios.getScenario": "Read scenario {id}",
-  "scenarios.run": "Run scenario {id}",
-  "scenarios.preview": "Preview scenario {id}",
-  "scenarios.deactivate": "Stop the active scenario",
-  "scenarios.delete": "Delete scenario {id}",
-  "perf-monitor.startRecording": "Start recording performance",
-  "perf-monitor.stopRecording": "Stop recording performance",
-  "perf-monitor.mark": "Mark {label} on the timeline",
-  "perf-monitor.loadReport": "Load a performance report",
-  "perf-monitor.clearAll": "Clear all performance reports",
-  "js-top.sample": "Sample the JS thread",
-  "js-top.getOriginDetail": "Inspect {key} on the JS thread",
-  // Assets / images
-  "assets.list": "List bundled assets",
-  "assets.getDetail": "Inspect an asset",
-  "assets.rescan": "Rescan bundled assets",
-  "assets.measureSizes": "Measure asset sizes",
-  "images.list": "List loaded images",
-  "images.getDetail": "Inspect an image",
-  "images.getCaptureStatus": "Check image capture",
-  "images.retry": "Retry loading an image",
-  "images.flash": "Flash an image on screen",
-  "images.setNetworkMode": "Set image network mode to {mode}",
-  "images.clearExpoCaches": "Clear the image caches",
-  // TV
-  "tv-remote.arm": "Start capturing remote presses",
-  "tv-remote.disarm": "Stop capturing remote presses",
-  "focus-inspector.rescan": "Rescan focusable elements",
-  "focus-inspector.focusElement": "Move focus to an element"
-};
-
-/** Boolean-switch actions read better as two sentences than one template. */
-const SWITCHES = {
-  "query.setOnline": {
-    param: "online",
-    on: "Put the app back online",
-    off: "Take the app offline"
-  },
-  "network.setOverridesEnabled": {
-    param: "enabled",
-    on: "Turn network overrides on",
-    off: "Turn network overrides off"
-  },
-  "network.setOverrideRuleEnabled": {
-    param: "enabled",
-    on: "Enable a network override",
-    off: "Disable a network override"
-  },
-  "highlight-updates.setEnabled": {
-    param: "enabled",
-    on: "Turn render highlighting on",
-    off: "Turn render highlighting off"
-  },
-  "perf-monitor.setEnabled": {
-    param: "enabled",
-    on: "Turn the perf monitor on",
-    off: "Turn the perf monitor off"
-  },
-  "js-top.setEnabled": {
-    param: "enabled",
-    on: "Turn JS Top on",
-    off: "Turn JS Top off"
-  },
-  "images.setBlankImages": {
-    param: "enabled",
-    on: "Blank out every image",
-    off: "Show images again"
-  },
-  "focus-inspector.setTracking": {
-    param: "enabled",
-    on: "Start tracking focus",
-    off: "Stop tracking focus"
-  },
-  "highlight-updates.setSilentTracking": {
-    param: "enabled",
-    on: "Track renders silently",
-    off: "Stop silent render tracking"
-  }
-};
-const TOOL_TITLES = Object.fromEntries(CATALOG.map(t => [t.toolId, cleanTitle(t.title)]));
-
-/** "JS TOP (JS-thread task manager)" → "JS Top"; everything else as-is. */
-function cleanTitle(title) {
-  const base = title.replace(/\s*\(.*\)\s*$/, "").trim();
-  if (base !== base.toUpperCase() || base.length <= 3) return base;
-  return base.split(" ").map(w => w.length <= 2 ? w : w.charAt(0) + w.slice(1).toLowerCase()).join(" ");
-}
-
-/** The display name of a tool: "Routes", "Zustand", "React Query". */
-export function toolTitle(toolId) {
-  return TOOL_TITLES[toolId] ?? humanise(toolId);
-}
-const MAX_VALUE = 48;
-function readPath(params, path) {
-  let cur = params;
-  for (const seg of path.split(".")) {
-    if (!cur || typeof cur !== "object") return undefined;
-    cur = cur[seg];
-  }
-  if (typeof cur === "string" && cur.trim()) return truncate(cur.trim());
-  if (typeof cur === "number") return String(cur);
-  // A query key is an array — `["pokemon","pikachu","fetch"]` — and the ledger
-  // row for the product's headline write read "Replace cached data for" with
-  // nothing after it. Primitive arrays render as a path; anything else stays
-  // out of a label.
-  if (Array.isArray(cur) && cur.length > 0 && cur.every(v => typeof v === "string" || typeof v === "number")) {
-    return truncate(cur.map(String).join(" / "));
-  }
-  return undefined;
-}
-function truncate(value) {
-  return value.length > MAX_VALUE ? `${value.slice(0, MAX_VALUE - 1)}…` : value;
-}
-function fill(template, params) {
-  return template.replace(/\{([^}]+)\}/g, (_, spec) => {
-    for (const path of spec.split("|")) {
-      const v = readPath(params, path.trim());
-      if (v !== undefined) return v;
-    }
-    return "";
-  }).replace(/\s{2,}/g, " ").trim();
-}
-
-/** `getStoreState` → "Get store state"; `async.getItem` → "Get item". */
-export function humanise(action) {
-  const last = action.split(".").pop() ?? action;
-  const words = last.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[-_]+/g, " ").toLowerCase();
-  return words.charAt(0).toUpperCase() + words.slice(1);
-}
-
-/** The one or two parameters a person would recognise in a fallback title. */
-function notableParams(params) {
-  const parts = [];
-  for (const key of ["key", "id", "url", "name", "route", "path", "userId", "storeId", "type"]) {
-    const v = readPath(params, key);
-    if (v !== undefined) parts.push(v);
-    if (parts.length >= 2) break;
-  }
-  return parts.join(", ");
-}
-
-/**
- * A short, present-tense title for a call — the thing a transcript row, a
- * ledger row and an approval card all show first.
- */
-export function titleCall(toolId, action, params) {
-  const key = `${toolId}.${action}`;
-  const sw = SWITCHES[key];
-  if (sw) return params[sw.param] === false ? sw.off : sw.on;
-  const phrase = PHRASES[key];
-  if (phrase) {
-    const out = fill(phrase, params);
-    if (out) return out;
-  }
-
-  // Generic verbs the whole suite shares.
-  const leaf = action.split(".").pop() ?? action;
-  if (leaf === "clearEvents") return `Clear the ${toolTitle(toolId)} timeline`;
-  if (leaf === "getSnapshot") return `Read ${toolTitle(toolId)}`;
-  const detail = notableParams(params);
-  const base = `${humanise(action)} in ${toolTitle(toolId)}`;
-  return detail ? `${base} (${detail})` : base;
-}
-//# sourceMappingURL=labels.js.map
+"use strict";import{CATALOG as g}from"../catalog/catalog.g";const h={"route-events.getSnapshot":"Check which screen is open","route-events.getCurrentRoute":"Check the current screen","route-events.navigate":"Open {path}","route-events.stackGoBack":"Go back one screen","route-events.stackNavigateToIndex":"Jump to screen {index} in the stack","route-events.stackPopToIndex":"Go back to screen {index}","route-events.stackPopToTop":"Go back to the first screen","zustand.listStores":"List the app's stores","zustand.getStoreState":"Read the {storeName} store","zustand.getChangeDetail":"Inspect a store change","zustand.setState":"Update the {storeName} store","zustand.rehydrate":"Reload the {storeName} store from disk","redux.getState":"Read the Redux state","redux.getActionDetail":"Inspect a Redux action","redux.dispatch":"Dispatch {action.type}","jotai.listAtoms":"List the app's atoms","jotai.getAtomValue":"Read atom {label}","jotai.getChangeDetail":"Inspect an atom change","jotai.setAtom":"Set atom {label}","query.listQueries":"List cached queries","query.getQueryData":"Read cached data for {queryHash}","query.refetch":"Refetch {queryHash}","query.invalidate":"Refresh {queryHash}","query.reset":"Reset {queryHash}","query.remove":"Drop {queryHash} from the cache","query.setQueryData":"Replace cached data for {queryHash|queryKey}","query.triggerError":"Force {queryHash} into an error","query.restoreError":"Clear the forced error on {queryHash}","query.triggerLoading":"Force {queryHash} to keep loading","query.restoreLoading":"Clear the forced loading on {queryHash}","query.clearQueryCache":"Clear the query cache","query.clearMutationCache":"Clear the mutation cache","network.getSnapshot":"Read recent network requests","network.getCaptureStatus":"Check network capture","network.getEventBody":"Read a request's body","network.setPinned":"Pin a request","network.setSaved":"Save a request","network.removeSavedRecord":"Remove saved request {key}","network.clearSavedRequests":"Clear saved requests","network.clearPinnedRequests":"Clear pinned requests","network.listOverrideRules":"List network overrides","network.getOverrideRuleBody":"Read a network override","network.debugOverrides":"Check overrides for {url}","network.upsertOverrideRule":"Add a network override","network.deleteOverrideRule":"Delete a network override","network.clearOverrideRules":"Clear all network overrides","storage.async.getAllKeys":"List saved storage keys","storage.async.multiGet":"Read saved values","storage.async.getItem":"Read saved value {key}","storage.async.setItem":"Save {key}","storage.async.removeItem":"Delete saved value {key}","storage.async.multiRemove":"Delete saved values","storage.async.multiSet":"Save several values","storage.async.clear":"Clear ALL saved data \u2014 including Buoy's own settings","storage.clearAppStorage":"Clear the app's saved data (keeps Buoy's settings)","storage.getEventDetail":"Inspect a storage change","storage.timeTravel.undo":"Undo a storage change","storage.timeTravel.jump":"Rewind storage to an earlier point","storage.mmkv.snapshot":"Read MMKV storage","storage.mmkv.get":"Read {key} from MMKV","storage.mmkv.set":"Save {key} to MMKV","storage.mmkv.remove":"Delete {key} from MMKV","storage.secure.keys":"List secure storage keys","storage.secure.snapshot":"Read secure storage","storage.secure.get":"Read secure value {key}","storage.secure.set":"Save secure value {key}","storage.secure.delete":"Delete secure value {key}","console.getSnapshot":"Read recent console logs","console.clearEntries":"Clear the console","env.getSnapshot":"Read environment variables","events.exportEvents":"Export recent events","events.setEnabledSources":"Change which events are recorded","sentry.getSnapshot":"Read what's been sent to Sentry","sentry.clearEnvelopes":"Clear captured Sentry traffic","ask-buoy.listChanges":"List Ask Buoy's changes","ask-buoy.undoAll":"Undo everything Ask Buoy changed","highlight-updates.describeScreen":"Look at what's on screen","highlight-updates.tapElement":"Tap {query|testID|text}","highlight-updates.waitFor":"Wait for {query|testID}","highlight-updates.locateComponent":"Find {query} on screen","highlight-updates.getRenderDetail":"Inspect a component's renders","highlight-updates.beginMeasurement":"Start counting renders","highlight-updates.endMeasurement":"Stop counting renders","highlight-updates.clearRenderCounts":"Clear render counts","debug-borders.cycleMode":"Cycle debug borders","debug-borders.setMode":"Set debug borders to {mode}","impersonate.searchUsers":"Search users for {query}","impersonate.startImpersonation":"Impersonate {user.name|user.email|user.id}","impersonate.stopImpersonation":"Stop impersonating","impersonate.pauseImpersonation":"Pause impersonation","impersonate.resumeImpersonation":"Resume impersonation","impersonate.clearHistory":"Clear impersonation history","app.ping":"Check the app is responding","app.reloadApp":"Reload the app","time-machine.list":"List saved snapshots","time-machine.capture":"Save a snapshot {name}","time-machine.captureBaseline":"Save a baseline snapshot","time-machine.restore":"Restore snapshot {id}","time-machine.preview":"Preview snapshot {id}","time-machine.inspect":"Inspect snapshot {id}","time-machine.delete":"Delete snapshot {id}","time-machine.rename":"Rename a snapshot to {name}","time-machine.duplicate":"Duplicate snapshot {id}","time-machine.wipeAll":"Wipe ALL app state to fresh install and reload","scenarios.listScenarios":"List scenarios","scenarios.getScenario":"Read scenario {id}","scenarios.run":"Run scenario {id}","scenarios.preview":"Preview scenario {id}","scenarios.deactivate":"Stop the active scenario","scenarios.delete":"Delete scenario {id}","perf-monitor.startRecording":"Start recording performance","perf-monitor.stopRecording":"Stop recording performance","perf-monitor.mark":"Mark {label} on the timeline","perf-monitor.loadReport":"Load a performance report","perf-monitor.clearAll":"Clear all performance reports","js-top.sample":"Sample the JS thread","js-top.getOriginDetail":"Inspect {key} on the JS thread","assets.list":"List bundled assets","assets.getDetail":"Inspect an asset","assets.rescan":"Rescan bundled assets","assets.measureSizes":"Measure asset sizes","images.list":"List loaded images","images.getDetail":"Inspect an image","images.getCaptureStatus":"Check image capture","images.retry":"Retry loading an image","images.flash":"Flash an image on screen","images.setNetworkMode":"Set image network mode to {mode}","images.clearExpoCaches":"Clear the image caches","tv-remote.arm":"Start capturing remote presses","tv-remote.disarm":"Stop capturing remote presses","focus-inspector.rescan":"Rescan focusable elements","focus-inspector.focusElement":"Move focus to an element"};const m={"query.setOnline":{param:"online",on:"Put the app back online",off:"Take the app offline"},"network.setOverridesEnabled":{param:"enabled",on:"Turn network overrides on",off:"Turn network overrides off"},"network.setOverrideRuleEnabled":{param:"enabled",on:"Enable a network override",off:"Disable a network override"},"highlight-updates.setEnabled":{param:"enabled",on:"Turn render highlighting on",off:"Turn render highlighting off"},"perf-monitor.setEnabled":{param:"enabled",on:"Turn the perf monitor on",off:"Turn the perf monitor off"},"js-top.setEnabled":{param:"enabled",on:"Turn JS Top on",off:"Turn JS Top off"},"images.setBlankImages":{param:"enabled",on:"Blank out every image",off:"Show images again"},"focus-inspector.setTracking":{param:"enabled",on:"Start tracking focus",off:"Stop tracking focus"},"highlight-updates.setSilentTracking":{param:"enabled",on:"Track renders silently",off:"Stop silent render tracking"}};const f=Object.fromEntries(g.map(t=>[t.toolId,y(t.title)]));function y(t){const r=t.replace(/\s*\(.*\)\s*$/,"").trim();if(r!==r.toUpperCase()||r.length<=3)return r;return r.split(" ").map(e=>e.length<=2?e:e.charAt(0)+e.slice(1).toLowerCase()).join(" ")}export function toolTitle(t){return f[t]??humanise(t)}const l=48;function d(t,r){let e=t;for(const a of r.split(".")){if(!e||typeof e!=="object")return void 0;e=e[a]}if(typeof e==="string"&&e.trim())return p(e.trim());if(typeof e==="number")return String(e);if(Array.isArray(e)&&e.length>0&&e.every(a=>typeof a==="string"||typeof a==="number")){return p(e.map(String).join(" / "))}return void 0}function p(t){return t.length>l?`${t.slice(0,l-1)}\u2026`:t}function v(t,r){return t.replace(/\{([^}]+)\}/g,(e,a)=>{for(const s of a.split("|")){const n=d(r,s.trim());if(n!==void 0)return n}return""}).replace(/\s{2,}/g," ").trim()}export function humanise(t){const r=t.split(".").pop()??t;const e=r.replace(/([a-z0-9])([A-Z])/g,"$1 $2").replace(/[-_]+/g," ").toLowerCase();return e.charAt(0).toUpperCase()+e.slice(1)}function k(t){const r=[];for(const e of["key","id","url","name","route","path","userId","storeId","type"]){const a=d(t,e);if(a!==void 0)r.push(a);if(r.length>=2)break}return r.join(", ")}export function titleCall(t,r,e){const a=`${t}.${r}`;const s=m[a];if(s)return e[s.param]===false?s.off:s.on;const n=h[a];if(n){const u=v(n,e);if(u)return u}const o=r.split(".").pop()??r;if(o==="clearEvents")return`Clear the ${toolTitle(t)} timeline`;if(o==="getSnapshot")return`Read ${toolTitle(t)}`;const i=k(e);const c=`${humanise(r)} in ${toolTitle(t)}`;return i?`${c} (${i})`:c}

package/lib/module/policy/policy.js

@@ -1,142 +1 @@
-"use strict";
-
-/**
- * What the agent is allowed to do, decided before dispatch.
- *
- * The default: reads and writes auto-run — the banner plus the effect ledger
- * keep the user in control — but DESTRUCTIVE actions need a human tap unless
- * the app explicitly passes `requireApproval: []`. Auto-running wipes proved
- * too sharp in live evals (five destructive calls in one confused turn), and
- * the approval gate is also the blast-radius control if injected text in a
- * tool result ever steers the model.
- *
- * The one thing the policy layer will not do is let the agent report success
- * for an action that cannot work in this build. Several Buoy actions return
- * `{ok:true}` and do nothing once `__DEV__` is false — `upsertOverrideRule`
- * persists a rule the engine never consults — and a QA tester who files a bug
- * against data that was never applied is a worse outcome than no agent at all.
- * So `release !== "works"` is refused BEFORE dispatch, with the reason handed
- * back to the model as the tool result, and `unknown` fails closed.
- */
-
-import { titleCall } from "./labels";
-
-/**
- * One allow rule. A call is permitted when it matches ANY rule; every field a
- * rule specifies must match. So a support seat that may impersonate and look
- * at anything, and nothing else, is two rules:
- *
- *   allow: [{ effect: "read" }, { toolId: "impersonate" }]
- */
-
-/** The one place the approval default lives; `decide` and the system prompt both resolve through it. */
-export const DEFAULT_REQUIRE_APPROVAL = ["destructive"];
-export function resolveRequireApproval(policy) {
-  return policy.requireApproval ?? DEFAULT_REQUIRE_APPROVAL;
-}
-/** SecureStore VALUE reads — gated behind `policy.secureReads`. Names stay open. */
-const SECURE_VALUE_READS = new Set(["secure.get", "secure.snapshot"]);
-export function decide({
-  descriptor,
-  toolId,
-  policy,
-  isRelease
-}) {
-  for (const rule of policy.deny ?? []) {
-    if (rule.toolId === toolId && (!rule.action || rule.action === descriptor.action)) {
-      return {
-        verdict: "refuse",
-        reason: "This action is disabled in this app."
-      };
-    }
-  }
-  if (isRelease && descriptor.release !== "works") {
-    return {
-      verdict: "refuse",
-      reason: releaseRefusal(descriptor)
-    };
-  }
-  if (policy.allow) {
-    const permitted = policy.allow.some(rule => (rule.toolId === undefined || rule.toolId === toolId) && (rule.action === undefined || rule.action === descriptor.action) && (rule.effect === undefined || rule.effect === descriptor.effect));
-    if (!permitted) {
-      return {
-        verdict: "refuse",
-        reason: "This action isn't on Ask Buoy's allow list in this app."
-      };
-    }
-  }
-  if (toolId === "storage" && SECURE_VALUE_READS.has(descriptor.action) && policy.secureReads !== true) {
-    return {
-      verdict: "refuse",
-      reason: "Reading SecureStore values is off by default — they are credentials, and they would be sent to the configured model endpoint. Key names are still readable via secure.keys; the app can opt in with policy.secureReads: true."
-    };
-  }
-  if (descriptor.effect !== "read" && policy.readOnly) {
-    return {
-      verdict: "refuse",
-      reason: "Ask Buoy is in read-only mode in this app, so it can look at state but not change it."
-    };
-  }
-  for (const rule of policy.requireApprovalFor ?? []) {
-    if (rule.toolId === toolId && (!rule.action || rule.action === descriptor.action)) {
-      return {
-        verdict: "needs-approval",
-        reason: "This app asks for a tap before this particular action runs."
-      };
-    }
-  }
-  if (descriptor.effect === "read") return {
-    verdict: "allow"
-  };
-  if (resolveRequireApproval(policy).includes(descriptor.effect)) {
-    return {
-      verdict: "needs-approval",
-      reason: descriptor.effect === "destructive"
-      // Not "this will wipe or reset something": most destructive actions
-      // in the catalog are ordinary edits that simply cannot be put back
-      // (a store write, a cache reset), and telling someone their quantity
-      // change is a wipe teaches them to stop reading the card.
-      ? "Buoy can't undo this one — that's why it's asking." : "This will change the app's state."
-    };
-  }
-  return {
-    verdict: "allow"
-  };
-}
-
-/**
- * The message the model gets back instead of a result. Written to be relayed
- * to a non-developer, because it usually will be.
- */
-function releaseRefusal(d) {
-  const base = `\`${d.action}\` does not work in this build (a release build).`;
-  switch (d.release) {
-    case "noop":
-      return `${base} It would report success and change nothing, so Buoy refused to run it rather than let you be told it worked. ${d.releaseNote ?? ""}`.trim();
-    case "empty":
-      return `${base} It relies on React's developer hook, which React Native only installs in development builds, so it can only ever return empty results here. ${d.releaseNote ?? ""}`.trim();
-    case "throws":
-      return `${base} It is explicitly disabled outside development. ${d.releaseNote ?? ""}`.trim();
-    default:
-      return `${base} Buoy could not confirm it behaves correctly outside development, so it refused rather than guess.`;
-  }
-}
-
-/**
- * A short, domain-flavoured title for what a call will do — the first line of
- * a transcript row, a ledger row and an approval card.
- *
- * The raw tool payload is deliberately NOT what gets shown. A QA person cannot
- * evaluate `redux_dispatch({type:'SET_ENTITLEMENTS', payload:{...}})`, and an
- * approval prompt nobody can read is a rubber stamp, which is worse than no
- * prompt because it looks like oversight.
- *
- * Nor is the catalog `summary`: that sentence is written for the model and
- * ran to three lines in a phone-width row before it was cut off. The phrasing
- * lives in ./labels.ts; the catalog sentence travels separately on the event
- * as `description`, for a row the user chooses to expand.
- */
-export function describeCall(toolId, descriptor, params) {
-  return titleCall(toolId, descriptor.action, params);
-}
-//# sourceMappingURL=policy.js.map
+"use strict";import{titleCall as s}from"./labels";export const DEFAULT_REQUIRE_APPROVAL=["destructive"];export function resolveRequireApproval(e){return e.requireApproval??DEFAULT_REQUIRE_APPROVAL}const i=new Set(["secure.get","secure.snapshot"]);export function decide({descriptor:e,toolId:t,policy:n,isRelease:o}){for(const r of n.deny??[]){if(r.toolId===t&&(!r.action||r.action===e.action)){return{verdict:"refuse",reason:"This action is disabled in this app."}}}if(o&&e.release!=="works"){return{verdict:"refuse",reason:u(e)}}if(n.allow){const r=n.allow.some(a=>(a.toolId===void 0||a.toolId===t)&&(a.action===void 0||a.action===e.action)&&(a.effect===void 0||a.effect===e.effect));if(!r){return{verdict:"refuse",reason:"This action isn't on Ask Buoy's allow list in this app."}}}if(t==="storage"&&i.has(e.action)&&n.secureReads!==true){return{verdict:"refuse",reason:"Reading SecureStore values is off by default \u2014 they are credentials, and they would be sent to the configured model endpoint. Key names are still readable via secure.keys; the app can opt in with policy.secureReads: true."}}if(e.effect!=="read"&&n.readOnly){return{verdict:"refuse",reason:"Ask Buoy is in read-only mode in this app, so it can look at state but not change it."}}for(const r of n.requireApprovalFor??[]){if(r.toolId===t&&(!r.action||r.action===e.action)){return{verdict:"needs-approval",reason:"This app asks for a tap before this particular action runs."}}}if(e.effect==="read")return{verdict:"allow"};if(resolveRequireApproval(n).includes(e.effect)){return{verdict:"needs-approval",reason:e.effect==="destructive"?"Buoy can't undo this one \u2014 that's why it's asking.":"This will change the app's state."}}return{verdict:"allow"}}function u(e){const t=`\`${e.action}\` does not work in this build (a release build).`;switch(e.release){case"noop":return`${t} It would report success and change nothing, so Buoy refused to run it rather than let you be told it worked. ${e.releaseNote??""}`.trim();case"empty":return`${t} It relies on React's developer hook, which React Native only installs in development builds, so it can only ever return empty results here. ${e.releaseNote??""}`.trim();case"throws":return`${t} It is explicitly disabled outside development. ${e.releaseNote??""}`.trim();default:return`${t} Buoy could not confirm it behaves correctly outside development, so it refused rather than guess.`}}export function describeCall(e,t,n){return s(e,t.action,n)}

package/lib/module/policy/redact.js

@@ -1,165 +1 @@
-"use strict";
-
-/**
- * Scrub tool results before they leave the device.
- *
- * Two separate reasons, and the second is the one people forget:
- *
- * 1. EGRESS. Tool results go to the customer's own model endpoint. That is
- *    their data boundary, not ours — but a response body carrying an
- *    `Authorization` header or a Buoy `licenseKey` is a credential, and
- *    credentials do not belong in a chat transcript that may be retained for
- *    30 days for abuse monitoring.
- * 2. SELF-INJECTION. Buoy's own network interceptor captures the agent's
- *    requests to the model endpoint. Without exclusion, the model reads back
- *    its own request headers — including whatever the host app's `headers()`
- *    returned — out of `network.getRequests`. That is a credential leak and a
- *    prompt-injection channel in one call.
- */
-
-/**
- * Key names that mean "credential", compared with separators stripped —
- * `X_API_KEY`, `x-api-key` and `xApiKey` are the same word. A list of hyphen
- * spellings let `EXPO_PUBLIC_X_API_KEY=…` through to the model whole on a real
- * app, alongside `EXPO_PUBLIC_BUOY_KEY`, which is the Pro licence that gates
- * this very tool. Both went out in plaintext while `…_PASSWORD` was caught.
- */
-const SECRET_KEYS = ["authorization", "cookie", "setcookie", "apikey", "proxyauthorization", "authtoken", "accesstoken", "refreshtoken", "idtoken", "sessiontoken", "bearertoken", "licensekey", "licencekey", "buoykey", "privatekey", "secret", "password", "passwd", "credential"];
-const REDACTED = "[redacted by Buoy]";
-
-/**
- * Credential SHAPES, for values whose key name gives nothing away — a JWT
- * stored under `session`, a Bearer header quoted inside a response body. The
- * key-name check alone let those through whole. Same shapes the broker wire
- * scrubber uses; duplicated here because agent-core cannot depend on ask-buoy.
- */
-const SECRET_VALUE_PATTERNS = [{
-  re: /\bBearer\s+[A-Za-z0-9._~+/-]{12,}=*/gi,
-  label: "[bearer token removed]"
-}, {
-  re: /\beyJ[A-Za-z0-9._-]{20,}/g,
-  label: "[jwt removed]"
-}, {
-  re: /\bsk-[A-Za-z0-9_-]{16,}/g,
-  label: "[api key removed]"
-}, {
-  re: /\bBUOY-[A-Z0-9-]{8,}/g,
-  label: "[license key removed]"
-},
-// Keygen-issued Buoy Pro keys: five hex sextets and a version suffix.
-{
-  re: /\b[A-F0-9]{6}(?:-[A-F0-9]{6}){4}-V\d\b/g,
-  label: "[license key removed]"
-}, {
-  // Key-name spellings inside free text: `X_API_KEY=…`, `apiKey: "…"`,
-  // `EXPO_PUBLIC_BUOY_KEY=…`. Word-prefixed forms (EXPO_PUBLIC_, REACT_APP_)
-  // are covered because the name only has to END in the credential word.
-  re: /("|')?[A-Za-z0-9_-]*(authorization|api[_-]?key|password|passwd|secret|access[_-]?token|refresh[_-]?token|auth[_-]?token|session[_-]?token|license[_-]?key|licence[_-]?key|buoy[_-]?key|private[_-]?key)\1?\s*[:=]\s*("|')?[^\s"',}]{6,}/gi,
-  label: "[credential removed]"
-}];
-function scrubString(s) {
-  let out = s;
-  for (const {
-    re,
-    label
-  } of SECRET_VALUE_PATTERNS) {
-    out = out.replace(re, label);
-  }
-  return out;
-}
-function isSecretKey(key) {
-  const k = key.toLowerCase().replace(/[-_.\s]/g, "");
-  return SECRET_KEYS.some(s => k.includes(s));
-}
-
-/**
- * Deep-redact by key name AND by value shape. Depth-limited because tool
- * results can be deeply nested state trees and a runaway walk on a megabyte
- * payload is a frame drop on the JS thread the app is also using.
- */
-export function redact(value, depth = 0) {
-  if (typeof value === "string") return scrubString(value);
-  if (depth > 12 || value === null || typeof value !== "object") return value;
-  if (Array.isArray(value)) {
-    return value.map(v => redact(v, depth + 1));
-  }
-  const out = {};
-  for (const [key, v] of Object.entries(value)) {
-    out[key] = isSecretKey(key) ? REDACTED : redact(v, depth + 1);
-  }
-  return out;
-}
-
-/**
- * Hosts that must never appear in a tool result, because they are the agent's
- * own traffic. Registered by the runtime from the configured endpoint.
- */
-const selfHosts = new Set();
-
-/**
- * Where the network tool looks for hosts it must not touch.
- *
- * A GLOBAL, not an import, because the dependency cannot go either way:
- * `agent-core` ships with no dependencies at all, and `@buoy-gg/network` is
- * optional — most apps that install Ask Buoy do not have it, and the ones that
- * do may load it after. A well-known key is the only seam that works in both
- * directions without either package requiring the other.
- *
- * Registering a host here means the interceptor passes its requests straight
- * through: not captured, not overridable, and — the reason this exists — not
- * held open while the interceptor reads the body. See `networkListener.ts`.
- */
-const INTERNAL_HOSTS_KEY = "__BUOY_INTERNAL_HOSTS__";
-export function registerSelfEndpoint(endpoint) {
-  try {
-    // No URL polyfill assumptions — a plain parse is enough for a host match.
-    const match = /^[a-z]+:\/\/([^/?#]+)/i.exec(endpoint);
-    if (!match?.[1]) return;
-    const host = match[1].toLowerCase();
-    selfHosts.add(host);
-    const g = globalThis;
-    const existing = g[INTERNAL_HOSTS_KEY];
-    const hosts = existing instanceof Set ? existing : new Set();
-    hosts.add(host);
-    g[INTERNAL_HOSTS_KEY] = hosts;
-  } catch {
-    /* an unparseable endpoint just means no exclusion */
-  }
-}
-export function isSelfTraffic(url) {
-  if (typeof url !== "string") return false;
-  const lower = url.toLowerCase();
-  for (const host of selfHosts) {
-    if (lower.includes(host)) return true;
-  }
-  return false;
-}
-function hasSelfUrl(item) {
-  if (!item || typeof item !== "object") return false;
-  const rec = item;
-  return isSelfTraffic(rec.url ?? rec.uri ?? rec.href);
-}
-
-/**
- * Drop the agent's own requests out of a network-shaped result before the
- * model sees them.
- *
- * WALKS INTO OBJECTS, not just top-level arrays. A network reader returns
- * `{ totalCaptured, requests: [...] }`, not a bare array, and a version of
- * this that only handled the bare array quietly did nothing — the agent's own
- * POST to the model endpoint, headers and all, came straight back to it out
- * of the network read. Depth-limited for the same reason `redact` is: this
- * runs on the JS thread the app is drawing on.
- */
-export function stripSelfTraffic(value, depth = 0) {
-  if (depth > 6 || value === null || typeof value !== "object") return value;
-  if (Array.isArray(value)) {
-    return value.filter(item => !hasSelfUrl(item)).map(item => stripSelfTraffic(item, depth + 1));
-  }
-  const out = {};
-  for (const [key, v] of Object.entries(value)) {
-    out[key] = stripSelfTraffic(v, depth + 1);
-  }
-  return out;
-}
-//# sourceMappingURL=redact.js.map
+"use strict";const a=["authorization","cookie","setcookie","apikey","proxyauthorization","authtoken","accesstoken","refreshtoken","idtoken","sessiontoken","bearertoken","licensekey","licencekey","buoykey","privatekey","secret","password","passwd","credential"];const f="[redacted by Buoy]";const l=[{re:/\bBearer\s+[A-Za-z0-9._~+/-]{12,}=*/gi,label:"[bearer token removed]"},{re:/\beyJ[A-Za-z0-9._-]{20,}/g,label:"[jwt removed]"},{re:/\bsk-[A-Za-z0-9_-]{16,}/g,label:"[api key removed]"},{re:/\bBUOY-[A-Z0-9-]{8,}/g,label:"[license key removed]"},{re:/\b[A-F0-9]{6}(?:-[A-F0-9]{6}){4}-V\d\b/g,label:"[license key removed]"},{re:/("|')?[A-Za-z0-9_-]*(authorization|api[_-]?key|password|passwd|secret|access[_-]?token|refresh[_-]?token|auth[_-]?token|session[_-]?token|license[_-]?key|licence[_-]?key|buoy[_-]?key|private[_-]?key)\1?\s*[:=]\s*("|')?[^\s"',}]{6,}/gi,label:"[credential removed]"}];function y(e){let t=e;for(const{re:o,label:r}of l){t=t.replace(o,r)}return t}function k(e){const t=e.toLowerCase().replace(/[-_.\s]/g,"");return a.some(o=>t.includes(o))}export function redact(e,t=0){if(typeof e==="string")return y(e);if(t>12||e===null||typeof e!=="object")return e;if(Array.isArray(e)){return e.map(r=>redact(r,t+1))}const o={};for(const[r,n]of Object.entries(e)){o[r]=k(r)?f:redact(n,t+1)}return o}const c=new Set;const i="__BUOY_INTERNAL_HOSTS__";export function registerSelfEndpoint(e){try{const t=/^[a-z]+:\/\/([^/?#]+)/i.exec(e);if(!t?.[1])return;const o=t[1].toLowerCase();c.add(o);const r=globalThis;const n=r[i];const s=n instanceof Set?n:new Set;s.add(o);r[i]=s}catch{}}export function isSelfTraffic(e){if(typeof e!=="string")return false;const t=e.toLowerCase();for(const o of c){if(t.includes(o))return true}return false}function u(e){if(!e||typeof e!=="object")return false;const t=e;return isSelfTraffic(t.url??t.uri??t.href)}export function stripSelfTraffic(e,t=0){if(t>6||e===null||typeof e!=="object")return e;if(Array.isArray(e)){return e.filter(r=>!u(r)).map(r=>stripSelfTraffic(r,t+1))}const o={};for(const[r,n]of Object.entries(e)){o[r]=stripSelfTraffic(n,t+1)}return o}