@caupulican/pi-adaptative 0.81.39 → 0.81.41

package/dist/core/autonomy/contracts.js.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../src/core/autonomy/contracts.ts"],"names":[],"mappings":"","sourcesContent":["export type JsonPrimitive = string | number | boolean | null;\nexport type JsonValue = JsonPrimitive | JsonValue[] | { [key: string]: JsonValue };\nexport interface JsonObject {\n\t[key: string]: JsonValue;\n}\n\nexport type ModelTier = \"cheap\" | \"medium\" | \"expensive\" | \"learning\";\n\nexport type RouteRisk = \"read-only\" | \"scoped-write\" | \"high-impact\" | \"approval-required\";\n\nexport type OperationRisk = \"read-only\" | \"scoped-write\" | \"high-impact\" | \"approval-required\";\n\nexport interface RiskAssessmentInput {\n\toperation: string;\n\ttoolName?: string;\n\tcommand?: string;\n\tpaths?: readonly string[];\n\tcapabilities?: readonly CapabilityName[];\n}\n\nexport interface RiskAssessment {\n\trisk: OperationRisk;\n\treasonCode: string;\n\treasons: readonly string[];\n\trequiresApproval: boolean;\n}\n\nexport type PathScopeDecisionKind = \"inside\" | \"outside\" | \"denied\" | \"missing\";\n\nexport interface PathScope {\n\troot: string;\n\tallowedPaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tfollowSymlinks?: boolean;\n}\n\nexport interface PathScopeDecision {\n\tkind: PathScopeDecisionKind;\n\tpath: string;\n\tresolvedPath?: string;\n\tmatchedRule?: string;\n\treasonCode: string;\n}\n\nexport interface RouteDecision {\n\ttier: ModelTier;\n\tmodel?: string;\n\trisk: RouteRisk;\n\tconfidence: number;\n\treasonCode: string;\n\treasons: readonly string[];\n\tfallbackFrom?: ModelTier;\n\tcreatedAt?: string;\n}\n\nexport type CapabilityName =\n\t| \"read_files\"\n\t| \"write_files\"\n\t| \"run_shell\"\n\t| \"network\"\n\t| \"memory_read\"\n\t| \"memory_write\"\n\t| \"settings_read\"\n\t| \"settings_write\"\n\t| \"skill_read\"\n\t| \"skill_write\"\n\t| \"source_read\"\n\t| \"source_write\"\n\t| \"research\"\n\t| \"delegate\"\n\t| \"publish\"\n\t| \"auth_change\";\n\nexport interface CapabilityEnvelope {\n\tid: string;\n\tprofileId?: string;\n\tcapabilities: readonly CapabilityName[];\n\tallowedTools?: readonly string[];\n\tdeniedTools?: readonly string[];\n\tallowedPaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tmaxEstimatedUsd?: number;\n\tcreatedAt?: string;\n}\n\nexport type GateOutcomeKind = \"allow\" | \"downgrade\" | \"escalate\" | \"ask-user\" | \"block\";\n\nexport interface GateOutcome {\n\toutcome: GateOutcomeKind;\n\tgate: string;\n\treasonCode: string;\n\tmessage?: string;\n\treversible?: boolean;\n\tdetails?: JsonObject;\n}\n\nexport interface ApprovalRequest {\n\tid: string;\n\toperation: string;\n\ttarget: string;\n\treversible: boolean;\n\tcapabilities: readonly CapabilityName[];\n\treasonCode: string;\n\tcreatedAt?: string;\n}\n\nexport type EvidenceSourceKind = \"workspace\" | \"transcript\" | \"automata\" | \"web\" | \"user\" | \"tool\";\n\nexport interface EvidenceRef {\n\tid: string;\n\tkind: EvidenceSourceKind;\n\ttitle?: string;\n\turi?: string;\n\ttrusted: boolean;\n\texcerpt?: string;\n\tmetadata?: JsonObject;\n}\n\nexport interface Finding {\n\tid: string;\n\tsummary: string;\n\tevidenceIds: readonly string[];\n\tconfidence?: number;\n}\n\nexport interface EvidenceBundle {\n\tquery: string;\n\tsources: readonly EvidenceRef[];\n\tfindings: readonly Finding[];\n\tcreatedAt?: string;\n}\n\nexport interface WorkerRequest {\n\tid: string;\n\tinstructions: string;\n\troute: RouteDecision;\n\tenvelope: CapabilityEnvelope;\n\tevidence?: EvidenceBundle;\n\tmaxEstimatedUsd?: number;\n\tcreatedAt?: string;\n}\n\nexport type WorkerResultStatus = \"completed\" | \"blocked\" | \"failed\" | \"cancelled\";\n\nexport type WorkerOutputFormat = \"structured\" | \"plain_text\";\n\nexport interface WorkerResult {\n\trequestId: string;\n\tstatus: WorkerResultStatus;\n\tsummary: string;\n\toutputFormat?: WorkerOutputFormat;\n\tevidence?: EvidenceBundle;\n\tchangedFiles: readonly string[];\n\tblockers?: readonly string[];\n\tusageReportId?: string;\n\tcreatedAt?: string;\n\t/** Stamped at persistence time when validateWorkerResult's gate flagged this result\n\t * \"ask-user\"/\"parent_review_required\" (mutated files or blockers on an otherwise-completed run).\n\t * Undefined when not computable (no WorkerRequest was available to validate against, e.g.\n\t * entries recorded before this field existed) — distinct from `false`, which means the gate explicitly cleared it. */\n\tparentReviewRequired?: boolean;\n\t/** ISO 8601 timestamp set once the parent explicitly acknowledges an unreviewed mutation via\n\t * delegate_status's \"review\" action. Presence means reviewed; absence keeps the notice sticky.\n\t * The ack is durable — re-derived from the latest persisted snapshot, not session-local state. */\n\tparentReviewedAt?: string;\n}\n\nexport type LearningDecisionKind = \"no-op\" | \"proposal\" | \"apply\";\n\nexport interface LearningDecision {\n\tkind: LearningDecisionKind;\n\treasonCode: string;\n\tconfidence: number;\n\tsummary: string;\n\trequiresApproval: boolean;\n\tcreatedAt?: string;\n}\n"]}
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../src/core/autonomy/contracts.ts"],"names":[],"mappings":"","sourcesContent":["import type { HarnessCapability } from \"../capability-contract.ts\";\n\nexport type JsonPrimitive = string | number | boolean | null;\nexport type JsonValue = JsonPrimitive | JsonValue[] | { [key: string]: JsonValue };\nexport interface JsonObject {\n\t[key: string]: JsonValue;\n}\n\nexport type ModelTier = \"cheap\" | \"medium\" | \"expensive\" | \"learning\";\n\nexport type RouteRisk = \"read-only\" | \"scoped-write\" | \"high-impact\" | \"approval-required\";\n\nexport type OperationRisk = \"read-only\" | \"scoped-write\" | \"high-impact\" | \"approval-required\";\n\nexport interface RiskAssessmentInput {\n\toperation: string;\n\ttoolName?: string;\n\tcommand?: string;\n\tpaths?: readonly string[];\n\tcapabilities?: readonly HarnessCapability[];\n}\n\nexport interface RiskAssessment {\n\trisk: OperationRisk;\n\treasonCode: string;\n\treasons: readonly string[];\n\trequiresApproval: boolean;\n}\n\nexport type PathScopeDecisionKind = \"inside\" | \"outside\" | \"denied\" | \"missing\";\n\nexport interface PathScope {\n\troot: string;\n\tallowedPaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tfollowSymlinks?: boolean;\n}\n\nexport interface PathScopeDecision {\n\tkind: PathScopeDecisionKind;\n\tpath: string;\n\tresolvedPath?: string;\n\tmatchedRule?: string;\n\treasonCode: string;\n}\n\nexport interface RouteDecision {\n\ttier: ModelTier;\n\tmodel?: string;\n\trisk: RouteRisk;\n\tconfidence: number;\n\treasonCode: string;\n\treasons: readonly string[];\n\tfallbackFrom?: ModelTier;\n\tcreatedAt?: string;\n}\n\nexport interface CapabilityEnvelope {\n\tid: string;\n\tprofileId?: string;\n\tcapabilities: readonly HarnessCapability[];\n\tallowedTools?: readonly string[];\n\tdeniedTools?: readonly string[];\n\tallowedPaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tmaxEstimatedUsd?: number;\n\tcreatedAt?: string;\n}\n\nexport type GateOutcomeKind = \"allow\" | \"downgrade\" | \"escalate\" | \"ask-user\" | \"block\";\n\nexport interface GateOutcome {\n\toutcome: GateOutcomeKind;\n\tgate: string;\n\treasonCode: string;\n\tmessage?: string;\n\treversible?: boolean;\n\tdetails?: JsonObject;\n}\n\nexport interface ApprovalRequest {\n\tid: string;\n\toperation: string;\n\ttarget: string;\n\treversible: boolean;\n\tcapabilities: readonly HarnessCapability[];\n\treasonCode: string;\n\tcreatedAt?: string;\n}\n\nexport type EvidenceSourceKind = \"workspace\" | \"transcript\" | \"automata\" | \"web\" | \"user\" | \"tool\";\n\nexport interface EvidenceRef {\n\tid: string;\n\tkind: EvidenceSourceKind;\n\ttitle?: string;\n\turi?: string;\n\ttrusted: boolean;\n\texcerpt?: string;\n\tmetadata?: JsonObject;\n}\n\nexport interface Finding {\n\tid: string;\n\tsummary: string;\n\tevidenceIds: readonly string[];\n\tconfidence?: number;\n}\n\nexport interface EvidenceBundle {\n\tquery: string;\n\tsources: readonly EvidenceRef[];\n\tfindings: readonly Finding[];\n\tcreatedAt?: string;\n}\n\nexport interface WorkerRequest {\n\tid: string;\n\tinstructions: string;\n\troute: RouteDecision;\n\tenvelope: CapabilityEnvelope;\n\tevidence?: EvidenceBundle;\n\tmaxEstimatedUsd?: number;\n\tcreatedAt?: string;\n}\n\nexport type WorkerClaimStatus = \"completed\" | \"blocked\" | \"failed\" | \"cancelled\";\n\nexport type WorkerClaimOutputFormat = \"structured\" | \"plain_text\";\n\nexport interface WorkerClaimVerificationDecision {\n\tsubjectTaskId: string;\n\tverdict: \"accepted\" | \"rejected\";\n\treasonCodes: readonly string[];\n}\n\n/** Untrusted worker-authored report. Only host adjudication can turn this into a durable result. */\nexport interface WorkerClaim {\n\trequestId: string;\n\tstatus: WorkerClaimStatus;\n\tsummary: string;\n\toutputFormat?: WorkerClaimOutputFormat;\n\tevidence?: EvidenceBundle;\n\tchangedFiles: readonly string[];\n\tblockers?: readonly string[];\n\tusageReportId?: string;\n\tcreatedAt?: string;\n\t/** Stamped at persistence time when validateWorkerClaim's gate flagged this claim\n\t * \"ask-user\"/\"parent_review_required\" (mutated files or blockers on an otherwise-completed run).\n\t * Undefined when not computable because an externally managed lane had no WorkerRequest —\n\t * distinct from `false`, which means the gate explicitly cleared it. */\n\tparentReviewRequired?: boolean;\n\t/** ISO 8601 timestamp set once the parent explicitly acknowledges an unreviewed mutation via\n\t * delegate_status's \"review\" action. Presence means reviewed; absence keeps the notice sticky.\n\t * The ack is durable — re-derived from the latest persisted snapshot, not session-local state. */\n\tparentReviewedAt?: string;\n\t/** Typed semantic verdict emitted only by a verifier-profile worker. */\n\tverification?: WorkerClaimVerificationDecision;\n}\n\nexport type LearningDecisionKind = \"no-op\" | \"proposal\" | \"apply\";\n\nexport interface LearningDecision {\n\tkind: LearningDecisionKind;\n\treasonCode: string;\n\tconfidence: number;\n\tsummary: string;\n\trequiresApproval: boolean;\n\tcreatedAt?: string;\n}\n"]}

package/dist/core/autonomy/foreground-envelope.d.ts

@@ -1,9 +1,15 @@
 import type { CapabilityEnvelope } from "./contracts.ts";
+/**
+ * Background lanes carry hand-authored {@link CapabilityEnvelope}s; foreground turns have none, so
+ * {@link buildForegroundEnvelope} derives one per turn purely for VISIBILITY (observe-only this
+ * round -- the foreground envelope is NOT enforced). The shared tool capability policy is the
+ * only mapping; unknown tools contribute no capability rather than receiving guessed authority.
+ */
 /**
  * Build the auto-constructed foreground {@link CapabilityEnvelope} for a single prompt turn.
  *
  * Pure and deterministic. `capabilities` are derived from the active tool names via the explicit
- * {@link TOOL_CAPABILITY_MAP} (deduplicated, first-seen order; unknown tools omitted).
+ * shared tool policy (deduplicated, first-seen order; unknown tools omitted).
  * `allowedTools` mirrors the active tool names, `allowedPaths` scopes to the working directory, and
  * `maxEstimatedUsd` is set only when a positive per-turn ceiling is supplied.
  */
@@ -15,7 +21,7 @@ export declare function buildForegroundEnvelope(args: {
 }): CapabilityEnvelope;
 /**
  * One bounded plain-text line describing a foreground envelope, for the /context dashboard.
- * Lists capability names (bounded by the small {@link CapabilityName} union) and the tool COUNT
+ * Lists capability names (bounded by the canonical harness capability union) and the tool COUNT
  * (never the full tool list) so the line stays short regardless of how many tools are active.
  */
 export declare function formatForegroundEnvelopeObservation(envelope: CapabilityEnvelope): string;

package/dist/core/autonomy/foreground-envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"foreground-envelope.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/foreground-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAkB,MAAM,gBAAgB,CAAC;AA4BzE;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,kBAAkB,CAuBrB;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAKxF","sourcesContent":["import type { CapabilityEnvelope, CapabilityName } from \"./contracts.ts\";\n\n/**\n * G7: explicit tool-name -> capability mapping for foreground turns.\n *\n * Background lanes carry hand-authored {@link CapabilityEnvelope}s; foreground turns have none, so\n * {@link buildForegroundEnvelope} derives one per turn purely for VISIBILITY (observe-only this\n * round -- the foreground envelope is NOT enforced). Any tool not in this table contributes NO\n * capability: unknown capabilities are omitted, never guessed. Keys are matched against the\n * lowercased active tool name. Every value below is a real member of the {@link CapabilityName}\n * union in contracts.ts.\n */\nconst TOOL_CAPABILITY_MAP: Readonly<Record<string, CapabilityName>> = {\n\tread: \"read_files\",\n\tgrep: \"read_files\",\n\tfind: \"read_files\",\n\tls: \"read_files\",\n\tedit: \"write_files\",\n\twrite: \"write_files\",\n\tbash: \"run_shell\",\n\tpython: \"run_shell\",\n\tpowershell: \"run_shell\",\n\trun_toolkit_script: \"run_shell\",\n\tdelegate: \"delegate\",\n\tgoal: \"memory_write\",\n\tmemory: \"memory_write\",\n};\n\n/**\n * Build the auto-constructed foreground {@link CapabilityEnvelope} for a single prompt turn.\n *\n * Pure and deterministic. `capabilities` are derived from the active tool names via the explicit\n * {@link TOOL_CAPABILITY_MAP} (deduplicated, first-seen order; unknown tools omitted).\n * `allowedTools` mirrors the active tool names, `allowedPaths` scopes to the working directory, and\n * `maxEstimatedUsd` is set only when a positive per-turn ceiling is supplied.\n */\nexport function buildForegroundEnvelope(args: {\n\tturnIndex: number;\n\tactiveToolNames: readonly string[];\n\tcwd: string;\n\tmaxTurnUsd?: number;\n}): CapabilityEnvelope {\n\tconst { turnIndex, activeToolNames, cwd, maxTurnUsd } = args;\n\n\tconst capabilities: CapabilityName[] = [];\n\tconst seen = new Set<CapabilityName>();\n\tfor (const toolName of activeToolNames) {\n\t\tconst capability = TOOL_CAPABILITY_MAP[toolName.toLowerCase()];\n\t\tif (capability !== undefined && !seen.has(capability)) {\n\t\t\tseen.add(capability);\n\t\t\tcapabilities.push(capability);\n\t\t}\n\t}\n\n\tconst envelope: CapabilityEnvelope = {\n\t\tid: `foreground-turn-${turnIndex}`,\n\t\tcapabilities,\n\t\tallowedTools: [...activeToolNames],\n\t\tallowedPaths: [cwd],\n\t};\n\tif (typeof maxTurnUsd === \"number\" && maxTurnUsd > 0) {\n\t\tenvelope.maxEstimatedUsd = maxTurnUsd;\n\t}\n\treturn envelope;\n}\n\n/**\n * One bounded plain-text line describing a foreground envelope, for the /context dashboard.\n * Lists capability names (bounded by the small {@link CapabilityName} union) and the tool COUNT\n * (never the full tool list) so the line stays short regardless of how many tools are active.\n */\nexport function formatForegroundEnvelopeObservation(envelope: CapabilityEnvelope): string {\n\tconst capabilityNames = envelope.capabilities.length > 0 ? envelope.capabilities.join(\", \") : \"none\";\n\tconst toolCount = envelope.allowedTools?.length ?? 0;\n\tconst pathScope = envelope.allowedPaths?.[0] ?? \"(unscoped)\";\n\treturn `foreground envelope: ${envelope.capabilities.length} capability(ies) [${capabilityNames}], ${toolCount} tool(s), path scope ${pathScope}`;\n}\n"]}
+{"version":3,"file":"foreground-envelope.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/foreground-envelope.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD;;;;;GAKG;AACH;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,kBAAkB,CAuBrB;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAKxF","sourcesContent":["import type { HarnessCapability } from \"../capability-contract.ts\";\nimport { requiredEnvelopeCapabilities } from \"../tool-capability-policy.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\n\n/**\n * Background lanes carry hand-authored {@link CapabilityEnvelope}s; foreground turns have none, so\n * {@link buildForegroundEnvelope} derives one per turn purely for VISIBILITY (observe-only this\n * round -- the foreground envelope is NOT enforced). The shared tool capability policy is the\n * only mapping; unknown tools contribute no capability rather than receiving guessed authority.\n */\n/**\n * Build the auto-constructed foreground {@link CapabilityEnvelope} for a single prompt turn.\n *\n * Pure and deterministic. `capabilities` are derived from the active tool names via the explicit\n * shared tool policy (deduplicated, first-seen order; unknown tools omitted).\n * `allowedTools` mirrors the active tool names, `allowedPaths` scopes to the working directory, and\n * `maxEstimatedUsd` is set only when a positive per-turn ceiling is supplied.\n */\nexport function buildForegroundEnvelope(args: {\n\tturnIndex: number;\n\tactiveToolNames: readonly string[];\n\tcwd: string;\n\tmaxTurnUsd?: number;\n}): CapabilityEnvelope {\n\tconst { turnIndex, activeToolNames, cwd, maxTurnUsd } = args;\n\n\tconst capabilities: HarnessCapability[] = [];\n\tconst seen = new Set<HarnessCapability>();\n\tfor (const toolName of activeToolNames) {\n\t\tfor (const capability of requiredEnvelopeCapabilities(toolName)) {\n\t\t\tif (seen.has(capability)) continue;\n\t\t\tseen.add(capability);\n\t\t\tcapabilities.push(capability);\n\t\t}\n\t}\n\n\tconst envelope: CapabilityEnvelope = {\n\t\tid: `foreground-turn-${turnIndex}`,\n\t\tcapabilities,\n\t\tallowedTools: [...activeToolNames],\n\t\tallowedPaths: [cwd],\n\t};\n\tif (typeof maxTurnUsd === \"number\" && maxTurnUsd > 0) {\n\t\tenvelope.maxEstimatedUsd = maxTurnUsd;\n\t}\n\treturn envelope;\n}\n\n/**\n * One bounded plain-text line describing a foreground envelope, for the /context dashboard.\n * Lists capability names (bounded by the canonical harness capability union) and the tool COUNT\n * (never the full tool list) so the line stays short regardless of how many tools are active.\n */\nexport function formatForegroundEnvelopeObservation(envelope: CapabilityEnvelope): string {\n\tconst capabilityNames = envelope.capabilities.length > 0 ? envelope.capabilities.join(\", \") : \"none\";\n\tconst toolCount = envelope.allowedTools?.length ?? 0;\n\tconst pathScope = envelope.allowedPaths?.[0] ?? \"(unscoped)\";\n\treturn `foreground envelope: ${envelope.capabilities.length} capability(ies) [${capabilityNames}], ${toolCount} tool(s), path scope ${pathScope}`;\n}\n"]}

package/dist/core/autonomy/foreground-envelope.js

@@ -1,33 +1,15 @@
+import { requiredEnvelopeCapabilities } from "../tool-capability-policy.js";
 /**
- * G7: explicit tool-name -> capability mapping for foreground turns.
- *
  * Background lanes carry hand-authored {@link CapabilityEnvelope}s; foreground turns have none, so
  * {@link buildForegroundEnvelope} derives one per turn purely for VISIBILITY (observe-only this
- * round -- the foreground envelope is NOT enforced). Any tool not in this table contributes NO
- * capability: unknown capabilities are omitted, never guessed. Keys are matched against the
- * lowercased active tool name. Every value below is a real member of the {@link CapabilityName}
- * union in contracts.ts.
+ * round -- the foreground envelope is NOT enforced). The shared tool capability policy is the
+ * only mapping; unknown tools contribute no capability rather than receiving guessed authority.
  */
-const TOOL_CAPABILITY_MAP = {
-    read: "read_files",
-    grep: "read_files",
-    find: "read_files",
-    ls: "read_files",
-    edit: "write_files",
-    write: "write_files",
-    bash: "run_shell",
-    python: "run_shell",
-    powershell: "run_shell",
-    run_toolkit_script: "run_shell",
-    delegate: "delegate",
-    goal: "memory_write",
-    memory: "memory_write",
-};
 /**
  * Build the auto-constructed foreground {@link CapabilityEnvelope} for a single prompt turn.
  *
  * Pure and deterministic. `capabilities` are derived from the active tool names via the explicit
- * {@link TOOL_CAPABILITY_MAP} (deduplicated, first-seen order; unknown tools omitted).
+ * shared tool policy (deduplicated, first-seen order; unknown tools omitted).
  * `allowedTools` mirrors the active tool names, `allowedPaths` scopes to the working directory, and
  * `maxEstimatedUsd` is set only when a positive per-turn ceiling is supplied.
  */
@@ -36,8 +18,9 @@ export function buildForegroundEnvelope(args) {
     const capabilities = [];
     const seen = new Set();
     for (const toolName of activeToolNames) {
-        const capability = TOOL_CAPABILITY_MAP[toolName.toLowerCase()];
-        if (capability !== undefined && !seen.has(capability)) {
+        for (const capability of requiredEnvelopeCapabilities(toolName)) {
+            if (seen.has(capability))
+                continue;
             seen.add(capability);
             capabilities.push(capability);
         }
@@ -55,7 +38,7 @@ export function buildForegroundEnvelope(args) {
 }
 /**
  * One bounded plain-text line describing a foreground envelope, for the /context dashboard.
- * Lists capability names (bounded by the small {@link CapabilityName} union) and the tool COUNT
+ * Lists capability names (bounded by the canonical harness capability union) and the tool COUNT
  * (never the full tool list) so the line stays short regardless of how many tools are active.
  */
 export function formatForegroundEnvelopeObservation(envelope) {

package/dist/core/autonomy/foreground-envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"foreground-envelope.js","sourceRoot":"","sources":["../../../src/core/autonomy/foreground-envelope.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAA6C;IACrE,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,aAAa;IACpB,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,WAAW;IACnB,UAAU,EAAE,WAAW;IACvB,kBAAkB,EAAE,WAAW;IAC/B,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,cAAc;CACtB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAKvC,EAAsB;IACtB,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAE7D,MAAM,YAAY,GAAqB,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrB,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,GAAuB;QACpC,EAAE,EAAE,mBAAmB,SAAS,EAAE;QAClC,YAAY;QACZ,YAAY,EAAE,CAAC,GAAG,eAAe,CAAC;QAClC,YAAY,EAAE,CAAC,GAAG,CAAC;KACnB,CAAC;IACF,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACtD,QAAQ,CAAC,eAAe,GAAG,UAAU,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CAAC,QAA4B,EAAU;IACzF,MAAM,eAAe,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrG,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;IAC7D,OAAO,wBAAwB,QAAQ,CAAC,YAAY,CAAC,MAAM,qBAAqB,eAAe,MAAM,SAAS,wBAAwB,SAAS,EAAE,CAAC;AAAA,CAClJ","sourcesContent":["import type { CapabilityEnvelope, CapabilityName } from \"./contracts.ts\";\n\n/**\n * G7: explicit tool-name -> capability mapping for foreground turns.\n *\n * Background lanes carry hand-authored {@link CapabilityEnvelope}s; foreground turns have none, so\n * {@link buildForegroundEnvelope} derives one per turn purely for VISIBILITY (observe-only this\n * round -- the foreground envelope is NOT enforced). Any tool not in this table contributes NO\n * capability: unknown capabilities are omitted, never guessed. Keys are matched against the\n * lowercased active tool name. Every value below is a real member of the {@link CapabilityName}\n * union in contracts.ts.\n */\nconst TOOL_CAPABILITY_MAP: Readonly<Record<string, CapabilityName>> = {\n\tread: \"read_files\",\n\tgrep: \"read_files\",\n\tfind: \"read_files\",\n\tls: \"read_files\",\n\tedit: \"write_files\",\n\twrite: \"write_files\",\n\tbash: \"run_shell\",\n\tpython: \"run_shell\",\n\tpowershell: \"run_shell\",\n\trun_toolkit_script: \"run_shell\",\n\tdelegate: \"delegate\",\n\tgoal: \"memory_write\",\n\tmemory: \"memory_write\",\n};\n\n/**\n * Build the auto-constructed foreground {@link CapabilityEnvelope} for a single prompt turn.\n *\n * Pure and deterministic. `capabilities` are derived from the active tool names via the explicit\n * {@link TOOL_CAPABILITY_MAP} (deduplicated, first-seen order; unknown tools omitted).\n * `allowedTools` mirrors the active tool names, `allowedPaths` scopes to the working directory, and\n * `maxEstimatedUsd` is set only when a positive per-turn ceiling is supplied.\n */\nexport function buildForegroundEnvelope(args: {\n\tturnIndex: number;\n\tactiveToolNames: readonly string[];\n\tcwd: string;\n\tmaxTurnUsd?: number;\n}): CapabilityEnvelope {\n\tconst { turnIndex, activeToolNames, cwd, maxTurnUsd } = args;\n\n\tconst capabilities: CapabilityName[] = [];\n\tconst seen = new Set<CapabilityName>();\n\tfor (const toolName of activeToolNames) {\n\t\tconst capability = TOOL_CAPABILITY_MAP[toolName.toLowerCase()];\n\t\tif (capability !== undefined && !seen.has(capability)) {\n\t\t\tseen.add(capability);\n\t\t\tcapabilities.push(capability);\n\t\t}\n\t}\n\n\tconst envelope: CapabilityEnvelope = {\n\t\tid: `foreground-turn-${turnIndex}`,\n\t\tcapabilities,\n\t\tallowedTools: [...activeToolNames],\n\t\tallowedPaths: [cwd],\n\t};\n\tif (typeof maxTurnUsd === \"number\" && maxTurnUsd > 0) {\n\t\tenvelope.maxEstimatedUsd = maxTurnUsd;\n\t}\n\treturn envelope;\n}\n\n/**\n * One bounded plain-text line describing a foreground envelope, for the /context dashboard.\n * Lists capability names (bounded by the small {@link CapabilityName} union) and the tool COUNT\n * (never the full tool list) so the line stays short regardless of how many tools are active.\n */\nexport function formatForegroundEnvelopeObservation(envelope: CapabilityEnvelope): string {\n\tconst capabilityNames = envelope.capabilities.length > 0 ? envelope.capabilities.join(\", \") : \"none\";\n\tconst toolCount = envelope.allowedTools?.length ?? 0;\n\tconst pathScope = envelope.allowedPaths?.[0] ?? \"(unscoped)\";\n\treturn `foreground envelope: ${envelope.capabilities.length} capability(ies) [${capabilityNames}], ${toolCount} tool(s), path scope ${pathScope}`;\n}\n"]}
+{"version":3,"file":"foreground-envelope.js","sourceRoot":"","sources":["../../../src/core/autonomy/foreground-envelope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAG5E;;;;;GAKG;AACH;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAKvC,EAAsB;IACtB,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAE7D,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACxC,KAAK,MAAM,UAAU,IAAI,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAS;YACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrB,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,GAAuB;QACpC,EAAE,EAAE,mBAAmB,SAAS,EAAE;QAClC,YAAY;QACZ,YAAY,EAAE,CAAC,GAAG,eAAe,CAAC;QAClC,YAAY,EAAE,CAAC,GAAG,CAAC;KACnB,CAAC;IACF,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACtD,QAAQ,CAAC,eAAe,GAAG,UAAU,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CAAC,QAA4B,EAAU;IACzF,MAAM,eAAe,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrG,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;IAC7D,OAAO,wBAAwB,QAAQ,CAAC,YAAY,CAAC,MAAM,qBAAqB,eAAe,MAAM,SAAS,wBAAwB,SAAS,EAAE,CAAC;AAAA,CAClJ","sourcesContent":["import type { HarnessCapability } from \"../capability-contract.ts\";\nimport { requiredEnvelopeCapabilities } from \"../tool-capability-policy.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\n\n/**\n * Background lanes carry hand-authored {@link CapabilityEnvelope}s; foreground turns have none, so\n * {@link buildForegroundEnvelope} derives one per turn purely for VISIBILITY (observe-only this\n * round -- the foreground envelope is NOT enforced). The shared tool capability policy is the\n * only mapping; unknown tools contribute no capability rather than receiving guessed authority.\n */\n/**\n * Build the auto-constructed foreground {@link CapabilityEnvelope} for a single prompt turn.\n *\n * Pure and deterministic. `capabilities` are derived from the active tool names via the explicit\n * shared tool policy (deduplicated, first-seen order; unknown tools omitted).\n * `allowedTools` mirrors the active tool names, `allowedPaths` scopes to the working directory, and\n * `maxEstimatedUsd` is set only when a positive per-turn ceiling is supplied.\n */\nexport function buildForegroundEnvelope(args: {\n\tturnIndex: number;\n\tactiveToolNames: readonly string[];\n\tcwd: string;\n\tmaxTurnUsd?: number;\n}): CapabilityEnvelope {\n\tconst { turnIndex, activeToolNames, cwd, maxTurnUsd } = args;\n\n\tconst capabilities: HarnessCapability[] = [];\n\tconst seen = new Set<HarnessCapability>();\n\tfor (const toolName of activeToolNames) {\n\t\tfor (const capability of requiredEnvelopeCapabilities(toolName)) {\n\t\t\tif (seen.has(capability)) continue;\n\t\t\tseen.add(capability);\n\t\t\tcapabilities.push(capability);\n\t\t}\n\t}\n\n\tconst envelope: CapabilityEnvelope = {\n\t\tid: `foreground-turn-${turnIndex}`,\n\t\tcapabilities,\n\t\tallowedTools: [...activeToolNames],\n\t\tallowedPaths: [cwd],\n\t};\n\tif (typeof maxTurnUsd === \"number\" && maxTurnUsd > 0) {\n\t\tenvelope.maxEstimatedUsd = maxTurnUsd;\n\t}\n\treturn envelope;\n}\n\n/**\n * One bounded plain-text line describing a foreground envelope, for the /context dashboard.\n * Lists capability names (bounded by the canonical harness capability union) and the tool COUNT\n * (never the full tool list) so the line stays short regardless of how many tools are active.\n */\nexport function formatForegroundEnvelopeObservation(envelope: CapabilityEnvelope): string {\n\tconst capabilityNames = envelope.capabilities.length > 0 ? envelope.capabilities.join(\", \") : \"none\";\n\tconst toolCount = envelope.allowedTools?.length ?? 0;\n\tconst pathScope = envelope.allowedPaths?.[0] ?? \"(unscoped)\";\n\treturn `foreground envelope: ${envelope.capabilities.length} capability(ies) [${capabilityNames}], ${toolCount} tool(s), path scope ${pathScope}`;\n}\n"]}

package/dist/core/autonomy/gates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gates.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/gates.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAmB,MAAM,gBAAgB,CAAC;AAmBvF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,GAAG,WAAW,CA+BjF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAWhH;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAmB/E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC9B,GAAG,WAAW,CAuJd","sourcesContent":["import path from \"node:path\";\nimport { hasCapabilityPolicyForTool, requiredCapabilitiesForTool } from \"./approval-gate.ts\";\nimport type { CapabilityEnvelope, GateOutcome, GateOutcomeKind } from \"./contracts.ts\";\nimport { checkPathScope } from \"./path-scope.ts\";\nimport { assessOperationRisk } from \"./risk-assessment.ts\";\n\nfunction isGateOutcomeKind(value: unknown): value is GateOutcomeKind {\n\treturn (\n\t\tvalue === \"allow\" || value === \"downgrade\" || value === \"escalate\" || value === \"ask-user\" || value === \"block\"\n\t);\n}\n\nfunction getPrecedence(kind: unknown): number {\n\tif (kind === \"allow\") return 0;\n\tif (kind === \"downgrade\") return 1;\n\tif (kind === \"escalate\") return 2;\n\tif (kind === \"ask-user\") return 3;\n\tif (kind === \"block\") return 4;\n\treturn 4; // Malformed/unknown outcome kind defaults to most restrictive (block)\n}\n\nexport function combineGateOutcomes(outcomes: readonly GateOutcome[]): GateOutcome {\n\tif (outcomes.length === 0) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"gate-combiner\",\n\t\t\treasonCode: \"no_gate_outcomes\",\n\t\t\tmessage: \"No gate outcomes to combine\",\n\t\t};\n\t}\n\n\tlet winner = outcomes[0];\n\tlet maxPrecedence = getPrecedence(winner.outcome);\n\n\tfor (let i = 1; i < outcomes.length; i++) {\n\t\tconst current = outcomes[i];\n\t\tconst currentPrecedence = getPrecedence(current.outcome);\n\t\tif (currentPrecedence > maxPrecedence) {\n\t\t\twinner = current;\n\t\t\tmaxPrecedence = currentPrecedence;\n\t\t}\n\t}\n\n\tif (!isGateOutcomeKind(winner.outcome)) {\n\t\treturn {\n\t\t\t...winner,\n\t\t\toutcome: \"block\",\n\t\t\tmessage: winner.message || \"Malformed outcome kind coerced to block\",\n\t\t};\n\t}\n\n\treturn winner;\n}\n\nexport function fallbackGateOutcome(args: { gate: string; reversible: boolean; reasonCode: string }): GateOutcome {\n\tconst gate = (args.gate || \"\").trim() || \"unknown_gate\";\n\tconst reasonCode = (args.reasonCode || \"\").trim() || \"unknown_reason\";\n\tconst outcome: GateOutcomeKind = args.reversible ? \"ask-user\" : \"block\";\n\n\treturn {\n\t\toutcome,\n\t\tgate,\n\t\treasonCode,\n\t\tmessage: `Fallback gate outcome: ${outcome} for gate ${gate} (${reasonCode})`,\n\t};\n}\n\nexport function extractCandidatePaths(toolName: string, args: unknown): string[] {\n\tif (!args || typeof args !== \"object\") return [];\n\tconst obj = args as Record<string, unknown>;\n\tconst paths: string[] = [];\n\n\tif (\n\t\ttoolName === \"read\" ||\n\t\ttoolName === \"write\" ||\n\t\ttoolName === \"edit\" ||\n\t\ttoolName === \"ls\" ||\n\t\ttoolName === \"grep\" ||\n\t\ttoolName === \"find\"\n\t) {\n\t\tif (typeof obj.path === \"string\" && obj.path.trim()) {\n\t\t\tpaths.push(obj.path.trim());\n\t\t}\n\t}\n\n\treturn paths;\n}\n\nexport function evaluateToolGate(input: {\n\ttoolName: string;\n\targs?: unknown;\n\tcwd: string;\n\tenvelope?: CapabilityEnvelope;\n}): GateOutcome {\n\tif (!input.envelope) {\n\t\treturn {\n\t\t\toutcome: \"allow\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"no_envelope\",\n\t\t\tmessage: \"No envelope active, preserving existing session behavior.\",\n\t\t};\n\t}\n\n\tconst envelope = input.envelope;\n\n\t// 1. Tool allow/deny list overrides\n\tif (envelope.deniedTools?.includes(input.toolName)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"tool_denied\",\n\t\t\tmessage: `Tool '${input.toolName}' is explicitly denied.`,\n\t\t};\n\t}\n\n\tif (envelope.allowedTools && !envelope.allowedTools.includes(input.toolName)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"tool_not_allowed\",\n\t\t\tmessage: `Tool '${input.toolName}' is not in the allowed tools list.`,\n\t\t};\n\t}\n\n\t// 2. Path scope containment for file tools\n\tconst paths = extractCandidatePaths(input.toolName, input.args);\n\tif (paths.length > 0 && envelope.allowedPaths) {\n\t\t// If envelope has allowedPaths, we must check them\n\t\tfor (const targetPath of paths) {\n\t\t\tconst scopedTargetPath = path.isAbsolute(targetPath) ? targetPath : path.resolve(input.cwd, targetPath);\n\t\t\tlet isInsideAny = false;\n\t\t\tlet isDenied = false;\n\t\t\tlet denyRule = \"\";\n\n\t\t\tfor (const allowedRoot of envelope.allowedPaths) {\n\t\t\t\tconst decision = checkPathScope(\n\t\t\t\t\t{\n\t\t\t\t\t\troot: allowedRoot,\n\t\t\t\t\t\tallowedPaths: envelope.allowedPaths,\n\t\t\t\t\t\tdeniedPaths: envelope.deniedPaths,\n\t\t\t\t\t},\n\t\t\t\t\tscopedTargetPath,\n\t\t\t\t);\n\n\t\t\t\tif (decision.kind === \"denied\") {\n\t\t\t\t\tisDenied = true;\n\t\t\t\t\tdenyRule = decision.matchedRule || \"\";\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tif (decision.kind === \"inside\") {\n\t\t\t\t\tisInsideAny = true;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (isDenied) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"path_scope\",\n\t\t\t\t\treasonCode: \"path_denied\",\n\t\t\t\t\tmessage: `Path '${targetPath}' is explicitly denied by rule '${denyRule}'.`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (!isInsideAny) {\n\t\t\t\t// Block only if the tool is mutating. Wait, read path outside allowed root -> block.\n\t\t\t\t// \"read path inside allowed root -> allow. write/edit path outside allowed root -> block. denied path inside allowed root -> block.\"\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"path_scope\",\n\t\t\t\t\treasonCode: \"path_outside_allowed_roots\",\n\t\t\t\t\tmessage: `Path '${targetPath}' is outside all allowed roots.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\t// 2.5. Capability checks\n\tif (!hasCapabilityPolicyForTool(input.toolName)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"unknown_tool_capability\",\n\t\t\tmessage: `Tool '${input.toolName}' has no capability policy in the active envelope.`,\n\t\t};\n\t}\n\n\tconst requiredCaps = requiredCapabilitiesForTool(input.toolName, input.args);\n\tfor (const reqCap of requiredCaps) {\n\t\tif (!envelope.capabilities.includes(reqCap)) {\n\t\t\treturn {\n\t\t\t\toutcome: \"block\",\n\t\t\t\tgate: \"tool_gate\",\n\t\t\t\treasonCode: \"missing_capability\",\n\t\t\t\tmessage: `Tool '${input.toolName}' requires capability '${reqCap}', which is missing from the active envelope.`,\n\t\t\t};\n\t\t}\n\t}\n\tlet command = \"\";\n\tif (\n\t\tinput.toolName === \"bash\" ||\n\t\tinput.toolName === \"powershell\" ||\n\t\tinput.toolName === \"shell\" ||\n\t\tinput.toolName === \"python\"\n\t) {\n\t\tconst argsObj = input.args as Record<string, unknown>;\n\t\tif (argsObj && typeof argsObj.command === \"string\") command = argsObj.command;\n\t\telse if (input.toolName === \"python\" && argsObj && typeof argsObj.code === \"string\") command = argsObj.code;\n\t\telse if (input.toolName === \"python\" && argsObj && typeof argsObj.scriptPath === \"string\") {\n\t\t\tcommand = `python ${argsObj.scriptPath}`;\n\t\t}\n\t}\n\n\tconst riskResult = assessOperationRisk({\n\t\toperation: `Tool ${input.toolName}`,\n\t\ttoolName: input.toolName,\n\t\tcommand,\n\t\tpaths,\n\t\tcapabilities: envelope.capabilities,\n\t});\n\n\tif (riskResult.requiresApproval) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\", // or block, prompt says: ask-user/block\n\t\t\tgate: \"risk_assessment\",\n\t\t\treasonCode: riskResult.reasonCode,\n\t\t\tmessage: `Operation requires approval: ${riskResult.reasons.join(\", \")}`,\n\t\t};\n\t}\n\n\tif (riskResult.risk === \"high-impact\") {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"risk_assessment\",\n\t\t\treasonCode: riskResult.reasonCode,\n\t\t\tmessage: `High-impact operation requires review: ${riskResult.reasons.join(\", \")}`,\n\t\t};\n\t}\n\n\treturn {\n\t\toutcome: \"allow\",\n\t\tgate: \"tool_gate\",\n\t\treasonCode: \"allowed_by_envelope\",\n\t\tmessage: \"Operation allowed by current capability envelope.\",\n\t};\n}\n"]}
+{"version":3,"file":"gates.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/gates.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAmB,MAAM,gBAAgB,CAAC;AAmBvF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,GAAG,WAAW,CA+BjF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAWhH;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAmB/E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC9B,GAAG,WAAW,CAqJd","sourcesContent":["import path from \"node:path\";\nimport {\n\thasCapabilityPolicyForTool,\n\thasRequiredCapabilityForTool,\n\trequiredCapabilitiesForTool,\n} from \"./approval-gate.ts\";\nimport type { CapabilityEnvelope, GateOutcome, GateOutcomeKind } from \"./contracts.ts\";\nimport { checkPathScope } from \"./path-scope.ts\";\nimport { assessOperationRisk } from \"./risk-assessment.ts\";\n\nfunction isGateOutcomeKind(value: unknown): value is GateOutcomeKind {\n\treturn (\n\t\tvalue === \"allow\" || value === \"downgrade\" || value === \"escalate\" || value === \"ask-user\" || value === \"block\"\n\t);\n}\n\nfunction getPrecedence(kind: unknown): number {\n\tif (kind === \"allow\") return 0;\n\tif (kind === \"downgrade\") return 1;\n\tif (kind === \"escalate\") return 2;\n\tif (kind === \"ask-user\") return 3;\n\tif (kind === \"block\") return 4;\n\treturn 4; // Malformed/unknown outcome kind defaults to most restrictive (block)\n}\n\nexport function combineGateOutcomes(outcomes: readonly GateOutcome[]): GateOutcome {\n\tif (outcomes.length === 0) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"gate-combiner\",\n\t\t\treasonCode: \"no_gate_outcomes\",\n\t\t\tmessage: \"No gate outcomes to combine\",\n\t\t};\n\t}\n\n\tlet winner = outcomes[0];\n\tlet maxPrecedence = getPrecedence(winner.outcome);\n\n\tfor (let i = 1; i < outcomes.length; i++) {\n\t\tconst current = outcomes[i];\n\t\tconst currentPrecedence = getPrecedence(current.outcome);\n\t\tif (currentPrecedence > maxPrecedence) {\n\t\t\twinner = current;\n\t\t\tmaxPrecedence = currentPrecedence;\n\t\t}\n\t}\n\n\tif (!isGateOutcomeKind(winner.outcome)) {\n\t\treturn {\n\t\t\t...winner,\n\t\t\toutcome: \"block\",\n\t\t\tmessage: winner.message || \"Malformed outcome kind coerced to block\",\n\t\t};\n\t}\n\n\treturn winner;\n}\n\nexport function fallbackGateOutcome(args: { gate: string; reversible: boolean; reasonCode: string }): GateOutcome {\n\tconst gate = (args.gate || \"\").trim() || \"unknown_gate\";\n\tconst reasonCode = (args.reasonCode || \"\").trim() || \"unknown_reason\";\n\tconst outcome: GateOutcomeKind = args.reversible ? \"ask-user\" : \"block\";\n\n\treturn {\n\t\toutcome,\n\t\tgate,\n\t\treasonCode,\n\t\tmessage: `Fallback gate outcome: ${outcome} for gate ${gate} (${reasonCode})`,\n\t};\n}\n\nexport function extractCandidatePaths(toolName: string, args: unknown): string[] {\n\tif (!args || typeof args !== \"object\") return [];\n\tconst obj = args as Record<string, unknown>;\n\tconst paths: string[] = [];\n\n\tif (\n\t\ttoolName === \"read\" ||\n\t\ttoolName === \"write\" ||\n\t\ttoolName === \"edit\" ||\n\t\ttoolName === \"ls\" ||\n\t\ttoolName === \"grep\" ||\n\t\ttoolName === \"find\"\n\t) {\n\t\tif (typeof obj.path === \"string\" && obj.path.trim()) {\n\t\t\tpaths.push(obj.path.trim());\n\t\t}\n\t}\n\n\treturn paths;\n}\n\nexport function evaluateToolGate(input: {\n\ttoolName: string;\n\targs?: unknown;\n\tcwd: string;\n\tenvelope?: CapabilityEnvelope;\n}): GateOutcome {\n\tif (!input.envelope) {\n\t\treturn {\n\t\t\toutcome: \"allow\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"no_envelope\",\n\t\t\tmessage: \"No envelope active, preserving existing session behavior.\",\n\t\t};\n\t}\n\n\tconst envelope = input.envelope;\n\n\t// 1. Tool allow/deny list overrides\n\tif (envelope.deniedTools?.includes(input.toolName)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"tool_denied\",\n\t\t\tmessage: `Tool '${input.toolName}' is explicitly denied.`,\n\t\t};\n\t}\n\n\tif (envelope.allowedTools && !envelope.allowedTools.includes(input.toolName)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"tool_not_allowed\",\n\t\t\tmessage: `Tool '${input.toolName}' is not in the allowed tools list.`,\n\t\t};\n\t}\n\n\t// 2. Path scope containment for file tools\n\tconst paths = extractCandidatePaths(input.toolName, input.args);\n\tif (paths.length > 0 && envelope.allowedPaths) {\n\t\t// If envelope has allowedPaths, we must check them\n\t\tfor (const targetPath of paths) {\n\t\t\tconst scopedTargetPath = path.isAbsolute(targetPath) ? targetPath : path.resolve(input.cwd, targetPath);\n\t\t\tlet isInsideAny = false;\n\t\t\tlet isDenied = false;\n\t\t\tlet denyRule = \"\";\n\n\t\t\tfor (const allowedRoot of envelope.allowedPaths) {\n\t\t\t\tconst decision = checkPathScope(\n\t\t\t\t\t{\n\t\t\t\t\t\troot: allowedRoot,\n\t\t\t\t\t\tallowedPaths: envelope.allowedPaths,\n\t\t\t\t\t\tdeniedPaths: envelope.deniedPaths,\n\t\t\t\t\t},\n\t\t\t\t\tscopedTargetPath,\n\t\t\t\t);\n\n\t\t\t\tif (decision.kind === \"denied\") {\n\t\t\t\t\tisDenied = true;\n\t\t\t\t\tdenyRule = decision.matchedRule || \"\";\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tif (decision.kind === \"inside\") {\n\t\t\t\t\tisInsideAny = true;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (isDenied) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"path_scope\",\n\t\t\t\t\treasonCode: \"path_denied\",\n\t\t\t\t\tmessage: `Path '${targetPath}' is explicitly denied by rule '${denyRule}'.`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (!isInsideAny) {\n\t\t\t\t// Block only if the tool is mutating. Wait, read path outside allowed root -> block.\n\t\t\t\t// \"read path inside allowed root -> allow. write/edit path outside allowed root -> block. denied path inside allowed root -> block.\"\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"path_scope\",\n\t\t\t\t\treasonCode: \"path_outside_allowed_roots\",\n\t\t\t\t\tmessage: `Path '${targetPath}' is outside all allowed roots.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\t// 2.5. Capability checks\n\tif (!hasCapabilityPolicyForTool(input.toolName)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"unknown_tool_capability\",\n\t\t\tmessage: `Tool '${input.toolName}' has no capability policy in the active envelope.`,\n\t\t};\n\t}\n\n\tconst requiredCaps = requiredCapabilitiesForTool(input.toolName, input.args);\n\tif (!hasRequiredCapabilityForTool(envelope.capabilities, input.toolName, input.args)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"missing_capability\",\n\t\t\tmessage: `Tool '${input.toolName}' requires capability '${requiredCaps.join(\" or \")}', which is missing from the active envelope.`,\n\t\t};\n\t}\n\tlet command = \"\";\n\tif (\n\t\tinput.toolName === \"bash\" ||\n\t\tinput.toolName === \"powershell\" ||\n\t\tinput.toolName === \"shell\" ||\n\t\tinput.toolName === \"python\"\n\t) {\n\t\tconst argsObj = input.args as Record<string, unknown>;\n\t\tif (argsObj && typeof argsObj.command === \"string\") command = argsObj.command;\n\t\telse if (input.toolName === \"python\" && argsObj && typeof argsObj.code === \"string\") command = argsObj.code;\n\t\telse if (input.toolName === \"python\" && argsObj && typeof argsObj.scriptPath === \"string\") {\n\t\t\tcommand = `python ${argsObj.scriptPath}`;\n\t\t}\n\t}\n\n\tconst riskResult = assessOperationRisk({\n\t\toperation: `Tool ${input.toolName}`,\n\t\ttoolName: input.toolName,\n\t\tcommand,\n\t\tpaths,\n\t\tcapabilities: envelope.capabilities,\n\t});\n\n\tif (riskResult.requiresApproval) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\", // or block, prompt says: ask-user/block\n\t\t\tgate: \"risk_assessment\",\n\t\t\treasonCode: riskResult.reasonCode,\n\t\t\tmessage: `Operation requires approval: ${riskResult.reasons.join(\", \")}`,\n\t\t};\n\t}\n\n\tif (riskResult.risk === \"high-impact\") {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"risk_assessment\",\n\t\t\treasonCode: riskResult.reasonCode,\n\t\t\tmessage: `High-impact operation requires review: ${riskResult.reasons.join(\", \")}`,\n\t\t};\n\t}\n\n\treturn {\n\t\toutcome: \"allow\",\n\t\tgate: \"tool_gate\",\n\t\treasonCode: \"allowed_by_envelope\",\n\t\tmessage: \"Operation allowed by current capability envelope.\",\n\t};\n}\n"]}

package/dist/core/autonomy/gates.js

@@ -1,5 +1,5 @@
 import path from "node:path";
-import { hasCapabilityPolicyForTool, requiredCapabilitiesForTool } from "./approval-gate.js";
+import { hasCapabilityPolicyForTool, hasRequiredCapabilityForTool, requiredCapabilitiesForTool, } from "./approval-gate.js";
 import { checkPathScope } from "./path-scope.js";
 import { assessOperationRisk } from "./risk-assessment.js";
 function isGateOutcomeKind(value) {
@@ -155,15 +155,13 @@ export function evaluateToolGate(input) {
         };
     }
     const requiredCaps = requiredCapabilitiesForTool(input.toolName, input.args);
-    for (const reqCap of requiredCaps) {
-        if (!envelope.capabilities.includes(reqCap)) {
-            return {
-                outcome: "block",
-                gate: "tool_gate",
-                reasonCode: "missing_capability",
-                message: `Tool '${input.toolName}' requires capability '${reqCap}', which is missing from the active envelope.`,
-            };
-        }
+    if (!hasRequiredCapabilityForTool(envelope.capabilities, input.toolName, input.args)) {
+        return {
+            outcome: "block",
+            gate: "tool_gate",
+            reasonCode: "missing_capability",
+            message: `Tool '${input.toolName}' requires capability '${requiredCaps.join(" or ")}', which is missing from the active envelope.`,
+        };
     }
     let command = "";
     if (input.toolName === "bash" ||

package/dist/core/autonomy/gates.js.map

@@ -1 +1 @@
-{"version":3,"file":"gates.js","sourceRoot":"","sources":["../../../src/core/autonomy/gates.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAE7F,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,SAAS,iBAAiB,CAAC,KAAc,EAA4B;IACpE,OAAO,CACN,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,OAAO,CAC/G,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CAAC,IAAa,EAAU;IAC7C,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,CAAC,sEAAsE;AAAvE,CACT;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgC,EAAe;IAClF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACN,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,6BAA6B;SACtC,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,iBAAiB,GAAG,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,OAAO,CAAC;YACjB,aAAa,GAAG,iBAAiB,CAAC;QACnC,CAAC;IACF,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACN,GAAG,MAAM;YACT,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,yCAAyC;SACpE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAAA,CACd;AAED,MAAM,UAAU,mBAAmB,CAAC,IAA+D,EAAe;IACjH,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,cAAc,CAAC;IACxD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC;IACtE,MAAM,OAAO,GAAoB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IAExE,OAAO;QACN,OAAO;QACP,IAAI;QACJ,UAAU;QACV,OAAO,EAAE,0BAA0B,OAAO,aAAa,IAAI,KAAK,UAAU,GAAG;KAC7E,CAAC;AAAA,CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,IAAa,EAAY;IAChF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IACC,QAAQ,KAAK,MAAM;QACnB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,MAAM;QACnB,QAAQ,KAAK,IAAI;QACjB,QAAQ,KAAK,MAAM;QACnB,QAAQ,KAAK,MAAM,EAClB,CAAC;QACF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,UAAU,gBAAgB,CAAC,KAKhC,EAAe;IACf,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,2DAA2D;SACpE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAEhC,oCAAoC;IACpC,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,SAAS,KAAK,CAAC,QAAQ,yBAAyB;SACzD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9E,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,SAAS,KAAK,CAAC,QAAQ,qCAAqC;SACrE,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC/C,mDAAmD;QACnD,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;YAChC,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxG,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,QAAQ,GAAG,EAAE,CAAC;YAElB,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACjD,MAAM,QAAQ,GAAG,cAAc,CAC9B;oBACC,IAAI,EAAE,WAAW;oBACjB,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,WAAW,EAAE,QAAQ,CAAC,WAAW;iBACjC,EACD,gBAAgB,CAChB,CAAC;gBAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAChC,QAAQ,GAAG,IAAI,CAAC;oBAChB,QAAQ,GAAG,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;oBACtC,MAAM;gBACP,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAChC,WAAW,GAAG,IAAI,CAAC;gBACpB,CAAC;YACF,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACN,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,aAAa;oBACzB,OAAO,EAAE,SAAS,UAAU,mCAAmC,QAAQ,IAAI;iBAC3E,CAAC;YACH,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,qFAAqF;gBACrF,qIAAqI;gBACrI,OAAO;oBACN,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,4BAA4B;oBACxC,OAAO,EAAE,SAAS,UAAU,iCAAiC;iBAC7D,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,yBAAyB;YACrC,OAAO,EAAE,SAAS,KAAK,CAAC,QAAQ,oDAAoD;SACpF,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,2BAA2B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7E,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACN,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,SAAS,KAAK,CAAC,QAAQ,0BAA0B,MAAM,+CAA+C;aAC/G,CAAC;QACH,CAAC;IACF,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IACC,KAAK,CAAC,QAAQ,KAAK,MAAM;QACzB,KAAK,CAAC,QAAQ,KAAK,YAAY;QAC/B,KAAK,CAAC,QAAQ,KAAK,OAAO;QAC1B,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAC1B,CAAC;QACF,MAAM,OAAO,GAAG,KAAK,CAAC,IAA+B,CAAC;QACtD,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;aACzE,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;aACvG,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC3F,OAAO,GAAG,UAAU,OAAO,CAAC,UAAU,EAAE,CAAC;QAC1C,CAAC;IACF,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC;QACtC,SAAS,EAAE,QAAQ,KAAK,CAAC,QAAQ,EAAE;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO;QACP,KAAK;QACL,YAAY,EAAE,QAAQ,CAAC,YAAY;KACnC,CAAC,CAAC;IAEH,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO;YACN,OAAO,EAAE,UAAU,EAAE,wCAAwC;YAC7D,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,OAAO,EAAE,gCAAgC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACxE,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACvC,OAAO;YACN,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,OAAO,EAAE,0CAA0C,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAClF,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,qBAAqB;QACjC,OAAO,EAAE,mDAAmD;KAC5D,CAAC;AAAA,CACF","sourcesContent":["import path from \"node:path\";\nimport { hasCapabilityPolicyForTool, requiredCapabilitiesForTool } from \"./approval-gate.ts\";\nimport type { CapabilityEnvelope, GateOutcome, GateOutcomeKind } from \"./contracts.ts\";\nimport { checkPathScope } from \"./path-scope.ts\";\nimport { assessOperationRisk } from \"./risk-assessment.ts\";\n\nfunction isGateOutcomeKind(value: unknown): value is GateOutcomeKind {\n\treturn (\n\t\tvalue === \"allow\" || value === \"downgrade\" || value === \"escalate\" || value === \"ask-user\" || value === \"block\"\n\t);\n}\n\nfunction getPrecedence(kind: unknown): number {\n\tif (kind === \"allow\") return 0;\n\tif (kind === \"downgrade\") return 1;\n\tif (kind === \"escalate\") return 2;\n\tif (kind === \"ask-user\") return 3;\n\tif (kind === \"block\") return 4;\n\treturn 4; // Malformed/unknown outcome kind defaults to most restrictive (block)\n}\n\nexport function combineGateOutcomes(outcomes: readonly GateOutcome[]): GateOutcome {\n\tif (outcomes.length === 0) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"gate-combiner\",\n\t\t\treasonCode: \"no_gate_outcomes\",\n\t\t\tmessage: \"No gate outcomes to combine\",\n\t\t};\n\t}\n\n\tlet winner = outcomes[0];\n\tlet maxPrecedence = getPrecedence(winner.outcome);\n\n\tfor (let i = 1; i < outcomes.length; i++) {\n\t\tconst current = outcomes[i];\n\t\tconst currentPrecedence = getPrecedence(current.outcome);\n\t\tif (currentPrecedence > maxPrecedence) {\n\t\t\twinner = current;\n\t\t\tmaxPrecedence = currentPrecedence;\n\t\t}\n\t}\n\n\tif (!isGateOutcomeKind(winner.outcome)) {\n\t\treturn {\n\t\t\t...winner,\n\t\t\toutcome: \"block\",\n\t\t\tmessage: winner.message || \"Malformed outcome kind coerced to block\",\n\t\t};\n\t}\n\n\treturn winner;\n}\n\nexport function fallbackGateOutcome(args: { gate: string; reversible: boolean; reasonCode: string }): GateOutcome {\n\tconst gate = (args.gate || \"\").trim() || \"unknown_gate\";\n\tconst reasonCode = (args.reasonCode || \"\").trim() || \"unknown_reason\";\n\tconst outcome: GateOutcomeKind = args.reversible ? \"ask-user\" : \"block\";\n\n\treturn {\n\t\toutcome,\n\t\tgate,\n\t\treasonCode,\n\t\tmessage: `Fallback gate outcome: ${outcome} for gate ${gate} (${reasonCode})`,\n\t};\n}\n\nexport function extractCandidatePaths(toolName: string, args: unknown): string[] {\n\tif (!args || typeof args !== \"object\") return [];\n\tconst obj = args as Record<string, unknown>;\n\tconst paths: string[] = [];\n\n\tif (\n\t\ttoolName === \"read\" ||\n\t\ttoolName === \"write\" ||\n\t\ttoolName === \"edit\" ||\n\t\ttoolName === \"ls\" ||\n\t\ttoolName === \"grep\" ||\n\t\ttoolName === \"find\"\n\t) {\n\t\tif (typeof obj.path === \"string\" && obj.path.trim()) {\n\t\t\tpaths.push(obj.path.trim());\n\t\t}\n\t}\n\n\treturn paths;\n}\n\nexport function evaluateToolGate(input: {\n\ttoolName: string;\n\targs?: unknown;\n\tcwd: string;\n\tenvelope?: CapabilityEnvelope;\n}): GateOutcome {\n\tif (!input.envelope) {\n\t\treturn {\n\t\t\toutcome: \"allow\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"no_envelope\",\n\t\t\tmessage: \"No envelope active, preserving existing session behavior.\",\n\t\t};\n\t}\n\n\tconst envelope = input.envelope;\n\n\t// 1. Tool allow/deny list overrides\n\tif (envelope.deniedTools?.includes(input.toolName)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"tool_denied\",\n\t\t\tmessage: `Tool '${input.toolName}' is explicitly denied.`,\n\t\t};\n\t}\n\n\tif (envelope.allowedTools && !envelope.allowedTools.includes(input.toolName)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"tool_not_allowed\",\n\t\t\tmessage: `Tool '${input.toolName}' is not in the allowed tools list.`,\n\t\t};\n\t}\n\n\t// 2. Path scope containment for file tools\n\tconst paths = extractCandidatePaths(input.toolName, input.args);\n\tif (paths.length > 0 && envelope.allowedPaths) {\n\t\t// If envelope has allowedPaths, we must check them\n\t\tfor (const targetPath of paths) {\n\t\t\tconst scopedTargetPath = path.isAbsolute(targetPath) ? targetPath : path.resolve(input.cwd, targetPath);\n\t\t\tlet isInsideAny = false;\n\t\t\tlet isDenied = false;\n\t\t\tlet denyRule = \"\";\n\n\t\t\tfor (const allowedRoot of envelope.allowedPaths) {\n\t\t\t\tconst decision = checkPathScope(\n\t\t\t\t\t{\n\t\t\t\t\t\troot: allowedRoot,\n\t\t\t\t\t\tallowedPaths: envelope.allowedPaths,\n\t\t\t\t\t\tdeniedPaths: envelope.deniedPaths,\n\t\t\t\t\t},\n\t\t\t\t\tscopedTargetPath,\n\t\t\t\t);\n\n\t\t\t\tif (decision.kind === \"denied\") {\n\t\t\t\t\tisDenied = true;\n\t\t\t\t\tdenyRule = decision.matchedRule || \"\";\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tif (decision.kind === \"inside\") {\n\t\t\t\t\tisInsideAny = true;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (isDenied) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"path_scope\",\n\t\t\t\t\treasonCode: \"path_denied\",\n\t\t\t\t\tmessage: `Path '${targetPath}' is explicitly denied by rule '${denyRule}'.`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (!isInsideAny) {\n\t\t\t\t// Block only if the tool is mutating. Wait, read path outside allowed root -> block.\n\t\t\t\t// \"read path inside allowed root -> allow. write/edit path outside allowed root -> block. denied path inside allowed root -> block.\"\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"path_scope\",\n\t\t\t\t\treasonCode: \"path_outside_allowed_roots\",\n\t\t\t\t\tmessage: `Path '${targetPath}' is outside all allowed roots.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\t// 2.5. Capability checks\n\tif (!hasCapabilityPolicyForTool(input.toolName)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"unknown_tool_capability\",\n\t\t\tmessage: `Tool '${input.toolName}' has no capability policy in the active envelope.`,\n\t\t};\n\t}\n\n\tconst requiredCaps = requiredCapabilitiesForTool(input.toolName, input.args);\n\tfor (const reqCap of requiredCaps) {\n\t\tif (!envelope.capabilities.includes(reqCap)) {\n\t\t\treturn {\n\t\t\t\toutcome: \"block\",\n\t\t\t\tgate: \"tool_gate\",\n\t\t\t\treasonCode: \"missing_capability\",\n\t\t\t\tmessage: `Tool '${input.toolName}' requires capability '${reqCap}', which is missing from the active envelope.`,\n\t\t\t};\n\t\t}\n\t}\n\tlet command = \"\";\n\tif (\n\t\tinput.toolName === \"bash\" ||\n\t\tinput.toolName === \"powershell\" ||\n\t\tinput.toolName === \"shell\" ||\n\t\tinput.toolName === \"python\"\n\t) {\n\t\tconst argsObj = input.args as Record<string, unknown>;\n\t\tif (argsObj && typeof argsObj.command === \"string\") command = argsObj.command;\n\t\telse if (input.toolName === \"python\" && argsObj && typeof argsObj.code === \"string\") command = argsObj.code;\n\t\telse if (input.toolName === \"python\" && argsObj && typeof argsObj.scriptPath === \"string\") {\n\t\t\tcommand = `python ${argsObj.scriptPath}`;\n\t\t}\n\t}\n\n\tconst riskResult = assessOperationRisk({\n\t\toperation: `Tool ${input.toolName}`,\n\t\ttoolName: input.toolName,\n\t\tcommand,\n\t\tpaths,\n\t\tcapabilities: envelope.capabilities,\n\t});\n\n\tif (riskResult.requiresApproval) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\", // or block, prompt says: ask-user/block\n\t\t\tgate: \"risk_assessment\",\n\t\t\treasonCode: riskResult.reasonCode,\n\t\t\tmessage: `Operation requires approval: ${riskResult.reasons.join(\", \")}`,\n\t\t};\n\t}\n\n\tif (riskResult.risk === \"high-impact\") {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"risk_assessment\",\n\t\t\treasonCode: riskResult.reasonCode,\n\t\t\tmessage: `High-impact operation requires review: ${riskResult.reasons.join(\", \")}`,\n\t\t};\n\t}\n\n\treturn {\n\t\toutcome: \"allow\",\n\t\tgate: \"tool_gate\",\n\t\treasonCode: \"allowed_by_envelope\",\n\t\tmessage: \"Operation allowed by current capability envelope.\",\n\t};\n}\n"]}
+{"version":3,"file":"gates.js","sourceRoot":"","sources":["../../../src/core/autonomy/gates.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACN,0BAA0B,EAC1B,4BAA4B,EAC5B,2BAA2B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,SAAS,iBAAiB,CAAC,KAAc,EAA4B;IACpE,OAAO,CACN,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,OAAO,CAC/G,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CAAC,IAAa,EAAU;IAC7C,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,CAAC,sEAAsE;AAAvE,CACT;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgC,EAAe;IAClF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACN,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,6BAA6B;SACtC,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,iBAAiB,GAAG,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,OAAO,CAAC;YACjB,aAAa,GAAG,iBAAiB,CAAC;QACnC,CAAC;IACF,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACN,GAAG,MAAM;YACT,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,yCAAyC;SACpE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAAA,CACd;AAED,MAAM,UAAU,mBAAmB,CAAC,IAA+D,EAAe;IACjH,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,cAAc,CAAC;IACxD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC;IACtE,MAAM,OAAO,GAAoB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IAExE,OAAO;QACN,OAAO;QACP,IAAI;QACJ,UAAU;QACV,OAAO,EAAE,0BAA0B,OAAO,aAAa,IAAI,KAAK,UAAU,GAAG;KAC7E,CAAC;AAAA,CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,IAAa,EAAY;IAChF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IACC,QAAQ,KAAK,MAAM;QACnB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,MAAM;QACnB,QAAQ,KAAK,IAAI;QACjB,QAAQ,KAAK,MAAM;QACnB,QAAQ,KAAK,MAAM,EAClB,CAAC;QACF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,UAAU,gBAAgB,CAAC,KAKhC,EAAe;IACf,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,2DAA2D;SACpE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAEhC,oCAAoC;IACpC,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,SAAS,KAAK,CAAC,QAAQ,yBAAyB;SACzD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9E,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,SAAS,KAAK,CAAC,QAAQ,qCAAqC;SACrE,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC/C,mDAAmD;QACnD,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;YAChC,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxG,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,QAAQ,GAAG,EAAE,CAAC;YAElB,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACjD,MAAM,QAAQ,GAAG,cAAc,CAC9B;oBACC,IAAI,EAAE,WAAW;oBACjB,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,WAAW,EAAE,QAAQ,CAAC,WAAW;iBACjC,EACD,gBAAgB,CAChB,CAAC;gBAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAChC,QAAQ,GAAG,IAAI,CAAC;oBAChB,QAAQ,GAAG,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;oBACtC,MAAM;gBACP,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAChC,WAAW,GAAG,IAAI,CAAC;gBACpB,CAAC;YACF,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACN,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,aAAa;oBACzB,OAAO,EAAE,SAAS,UAAU,mCAAmC,QAAQ,IAAI;iBAC3E,CAAC;YACH,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,qFAAqF;gBACrF,qIAAqI;gBACrI,OAAO;oBACN,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,4BAA4B;oBACxC,OAAO,EAAE,SAAS,UAAU,iCAAiC;iBAC7D,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,yBAAyB;YACrC,OAAO,EAAE,SAAS,KAAK,CAAC,QAAQ,oDAAoD;SACpF,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,2BAA2B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtF,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,SAAS,KAAK,CAAC,QAAQ,0BAA0B,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,+CAA+C;SAClI,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IACC,KAAK,CAAC,QAAQ,KAAK,MAAM;QACzB,KAAK,CAAC,QAAQ,KAAK,YAAY;QAC/B,KAAK,CAAC,QAAQ,KAAK,OAAO;QAC1B,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAC1B,CAAC;QACF,MAAM,OAAO,GAAG,KAAK,CAAC,IAA+B,CAAC;QACtD,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;aACzE,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;aACvG,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC3F,OAAO,GAAG,UAAU,OAAO,CAAC,UAAU,EAAE,CAAC;QAC1C,CAAC;IACF,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC;QACtC,SAAS,EAAE,QAAQ,KAAK,CAAC,QAAQ,EAAE;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO;QACP,KAAK;QACL,YAAY,EAAE,QAAQ,CAAC,YAAY;KACnC,CAAC,CAAC;IAEH,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO;YACN,OAAO,EAAE,UAAU,EAAE,wCAAwC;YAC7D,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,OAAO,EAAE,gCAAgC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACxE,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACvC,OAAO;YACN,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,OAAO,EAAE,0CAA0C,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAClF,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,qBAAqB;QACjC,OAAO,EAAE,mDAAmD;KAC5D,CAAC;AAAA,CACF","sourcesContent":["import path from \"node:path\";\nimport {\n\thasCapabilityPolicyForTool,\n\thasRequiredCapabilityForTool,\n\trequiredCapabilitiesForTool,\n} from \"./approval-gate.ts\";\nimport type { CapabilityEnvelope, GateOutcome, GateOutcomeKind } from \"./contracts.ts\";\nimport { checkPathScope } from \"./path-scope.ts\";\nimport { assessOperationRisk } from \"./risk-assessment.ts\";\n\nfunction isGateOutcomeKind(value: unknown): value is GateOutcomeKind {\n\treturn (\n\t\tvalue === \"allow\" || value === \"downgrade\" || value === \"escalate\" || value === \"ask-user\" || value === \"block\"\n\t);\n}\n\nfunction getPrecedence(kind: unknown): number {\n\tif (kind === \"allow\") return 0;\n\tif (kind === \"downgrade\") return 1;\n\tif (kind === \"escalate\") return 2;\n\tif (kind === \"ask-user\") return 3;\n\tif (kind === \"block\") return 4;\n\treturn 4; // Malformed/unknown outcome kind defaults to most restrictive (block)\n}\n\nexport function combineGateOutcomes(outcomes: readonly GateOutcome[]): GateOutcome {\n\tif (outcomes.length === 0) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"gate-combiner\",\n\t\t\treasonCode: \"no_gate_outcomes\",\n\t\t\tmessage: \"No gate outcomes to combine\",\n\t\t};\n\t}\n\n\tlet winner = outcomes[0];\n\tlet maxPrecedence = getPrecedence(winner.outcome);\n\n\tfor (let i = 1; i < outcomes.length; i++) {\n\t\tconst current = outcomes[i];\n\t\tconst currentPrecedence = getPrecedence(current.outcome);\n\t\tif (currentPrecedence > maxPrecedence) {\n\t\t\twinner = current;\n\t\t\tmaxPrecedence = currentPrecedence;\n\t\t}\n\t}\n\n\tif (!isGateOutcomeKind(winner.outcome)) {\n\t\treturn {\n\t\t\t...winner,\n\t\t\toutcome: \"block\",\n\t\t\tmessage: winner.message || \"Malformed outcome kind coerced to block\",\n\t\t};\n\t}\n\n\treturn winner;\n}\n\nexport function fallbackGateOutcome(args: { gate: string; reversible: boolean; reasonCode: string }): GateOutcome {\n\tconst gate = (args.gate || \"\").trim() || \"unknown_gate\";\n\tconst reasonCode = (args.reasonCode || \"\").trim() || \"unknown_reason\";\n\tconst outcome: GateOutcomeKind = args.reversible ? \"ask-user\" : \"block\";\n\n\treturn {\n\t\toutcome,\n\t\tgate,\n\t\treasonCode,\n\t\tmessage: `Fallback gate outcome: ${outcome} for gate ${gate} (${reasonCode})`,\n\t};\n}\n\nexport function extractCandidatePaths(toolName: string, args: unknown): string[] {\n\tif (!args || typeof args !== \"object\") return [];\n\tconst obj = args as Record<string, unknown>;\n\tconst paths: string[] = [];\n\n\tif (\n\t\ttoolName === \"read\" ||\n\t\ttoolName === \"write\" ||\n\t\ttoolName === \"edit\" ||\n\t\ttoolName === \"ls\" ||\n\t\ttoolName === \"grep\" ||\n\t\ttoolName === \"find\"\n\t) {\n\t\tif (typeof obj.path === \"string\" && obj.path.trim()) {\n\t\t\tpaths.push(obj.path.trim());\n\t\t}\n\t}\n\n\treturn paths;\n}\n\nexport function evaluateToolGate(input: {\n\ttoolName: string;\n\targs?: unknown;\n\tcwd: string;\n\tenvelope?: CapabilityEnvelope;\n}): GateOutcome {\n\tif (!input.envelope) {\n\t\treturn {\n\t\t\toutcome: \"allow\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"no_envelope\",\n\t\t\tmessage: \"No envelope active, preserving existing session behavior.\",\n\t\t};\n\t}\n\n\tconst envelope = input.envelope;\n\n\t// 1. Tool allow/deny list overrides\n\tif (envelope.deniedTools?.includes(input.toolName)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"tool_denied\",\n\t\t\tmessage: `Tool '${input.toolName}' is explicitly denied.`,\n\t\t};\n\t}\n\n\tif (envelope.allowedTools && !envelope.allowedTools.includes(input.toolName)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"tool_not_allowed\",\n\t\t\tmessage: `Tool '${input.toolName}' is not in the allowed tools list.`,\n\t\t};\n\t}\n\n\t// 2. Path scope containment for file tools\n\tconst paths = extractCandidatePaths(input.toolName, input.args);\n\tif (paths.length > 0 && envelope.allowedPaths) {\n\t\t// If envelope has allowedPaths, we must check them\n\t\tfor (const targetPath of paths) {\n\t\t\tconst scopedTargetPath = path.isAbsolute(targetPath) ? targetPath : path.resolve(input.cwd, targetPath);\n\t\t\tlet isInsideAny = false;\n\t\t\tlet isDenied = false;\n\t\t\tlet denyRule = \"\";\n\n\t\t\tfor (const allowedRoot of envelope.allowedPaths) {\n\t\t\t\tconst decision = checkPathScope(\n\t\t\t\t\t{\n\t\t\t\t\t\troot: allowedRoot,\n\t\t\t\t\t\tallowedPaths: envelope.allowedPaths,\n\t\t\t\t\t\tdeniedPaths: envelope.deniedPaths,\n\t\t\t\t\t},\n\t\t\t\t\tscopedTargetPath,\n\t\t\t\t);\n\n\t\t\t\tif (decision.kind === \"denied\") {\n\t\t\t\t\tisDenied = true;\n\t\t\t\t\tdenyRule = decision.matchedRule || \"\";\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tif (decision.kind === \"inside\") {\n\t\t\t\t\tisInsideAny = true;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (isDenied) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"path_scope\",\n\t\t\t\t\treasonCode: \"path_denied\",\n\t\t\t\t\tmessage: `Path '${targetPath}' is explicitly denied by rule '${denyRule}'.`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (!isInsideAny) {\n\t\t\t\t// Block only if the tool is mutating. Wait, read path outside allowed root -> block.\n\t\t\t\t// \"read path inside allowed root -> allow. write/edit path outside allowed root -> block. denied path inside allowed root -> block.\"\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"path_scope\",\n\t\t\t\t\treasonCode: \"path_outside_allowed_roots\",\n\t\t\t\t\tmessage: `Path '${targetPath}' is outside all allowed roots.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\t// 2.5. Capability checks\n\tif (!hasCapabilityPolicyForTool(input.toolName)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"unknown_tool_capability\",\n\t\t\tmessage: `Tool '${input.toolName}' has no capability policy in the active envelope.`,\n\t\t};\n\t}\n\n\tconst requiredCaps = requiredCapabilitiesForTool(input.toolName, input.args);\n\tif (!hasRequiredCapabilityForTool(envelope.capabilities, input.toolName, input.args)) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"tool_gate\",\n\t\t\treasonCode: \"missing_capability\",\n\t\t\tmessage: `Tool '${input.toolName}' requires capability '${requiredCaps.join(\" or \")}', which is missing from the active envelope.`,\n\t\t};\n\t}\n\tlet command = \"\";\n\tif (\n\t\tinput.toolName === \"bash\" ||\n\t\tinput.toolName === \"powershell\" ||\n\t\tinput.toolName === \"shell\" ||\n\t\tinput.toolName === \"python\"\n\t) {\n\t\tconst argsObj = input.args as Record<string, unknown>;\n\t\tif (argsObj && typeof argsObj.command === \"string\") command = argsObj.command;\n\t\telse if (input.toolName === \"python\" && argsObj && typeof argsObj.code === \"string\") command = argsObj.code;\n\t\telse if (input.toolName === \"python\" && argsObj && typeof argsObj.scriptPath === \"string\") {\n\t\t\tcommand = `python ${argsObj.scriptPath}`;\n\t\t}\n\t}\n\n\tconst riskResult = assessOperationRisk({\n\t\toperation: `Tool ${input.toolName}`,\n\t\ttoolName: input.toolName,\n\t\tcommand,\n\t\tpaths,\n\t\tcapabilities: envelope.capabilities,\n\t});\n\n\tif (riskResult.requiresApproval) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\", // or block, prompt says: ask-user/block\n\t\t\tgate: \"risk_assessment\",\n\t\t\treasonCode: riskResult.reasonCode,\n\t\t\tmessage: `Operation requires approval: ${riskResult.reasons.join(\", \")}`,\n\t\t};\n\t}\n\n\tif (riskResult.risk === \"high-impact\") {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"risk_assessment\",\n\t\t\treasonCode: riskResult.reasonCode,\n\t\t\tmessage: `High-impact operation requires review: ${riskResult.reasons.join(\", \")}`,\n\t\t};\n\t}\n\n\treturn {\n\t\toutcome: \"allow\",\n\t\tgate: \"tool_gate\",\n\t\treasonCode: \"allowed_by_envelope\",\n\t\tmessage: \"Operation allowed by current capability envelope.\",\n\t};\n}\n"]}

package/dist/core/autonomy/lane-private-paths.d.ts

@@ -0,0 +1,2 @@
+export declare function getPrivateLaneDeniedPaths(cwd: string, agentDir: string): string[];
+//# sourceMappingURL=lane-private-paths.d.ts.map

package/dist/core/autonomy/lane-private-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lane-private-paths.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/lane-private-paths.ts"],"names":[],"mappings":"AAGA,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAYjF","sourcesContent":["import path from \"node:path\";\nimport { configFile, getWorkRoot, sessionsDir, stateDir } from \"../agent-paths.ts\";\n\nexport function getPrivateLaneDeniedPaths(cwd: string, agentDir: string): string[] {\n\treturn [\n\t\tconfigFile(agentDir, \"auth.json\"),\n\t\tconfigFile(agentDir, \"MEMORY.md\"),\n\t\tconfigFile(agentDir, \"USER.md\"),\n\t\tconfigFile(agentDir, \"settings.json\"),\n\t\tconfigFile(agentDir, \"models.json\"),\n\t\tsessionsDir(agentDir),\n\t\tstateDir(agentDir),\n\t\tgetWorkRoot(agentDir),\n\t\tpath.join(cwd, \".pi\", \"settings.json\"),\n\t];\n}\n"]}

package/dist/core/autonomy/lane-private-paths.js

@@ -0,0 +1,16 @@
+import path from "node:path";
+import { configFile, getWorkRoot, sessionsDir, stateDir } from "../agent-paths.js";
+export function getPrivateLaneDeniedPaths(cwd, agentDir) {
+    return [
+        configFile(agentDir, "auth.json"),
+        configFile(agentDir, "MEMORY.md"),
+        configFile(agentDir, "USER.md"),
+        configFile(agentDir, "settings.json"),
+        configFile(agentDir, "models.json"),
+        sessionsDir(agentDir),
+        stateDir(agentDir),
+        getWorkRoot(agentDir),
+        path.join(cwd, ".pi", "settings.json"),
+    ];
+}
+//# sourceMappingURL=lane-private-paths.js.map

package/dist/core/autonomy/lane-private-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lane-private-paths.js","sourceRoot":"","sources":["../../../src/core/autonomy/lane-private-paths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEnF,MAAM,UAAU,yBAAyB,CAAC,GAAW,EAAE,QAAgB,EAAY;IAClF,OAAO;QACN,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;QACjC,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;QACjC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC/B,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;QACrC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC;QACnC,WAAW,CAAC,QAAQ,CAAC;QACrB,QAAQ,CAAC,QAAQ,CAAC;QAClB,WAAW,CAAC,QAAQ,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC;KACtC,CAAC;AAAA,CACF","sourcesContent":["import path from \"node:path\";\nimport { configFile, getWorkRoot, sessionsDir, stateDir } from \"../agent-paths.ts\";\n\nexport function getPrivateLaneDeniedPaths(cwd: string, agentDir: string): string[] {\n\treturn [\n\t\tconfigFile(agentDir, \"auth.json\"),\n\t\tconfigFile(agentDir, \"MEMORY.md\"),\n\t\tconfigFile(agentDir, \"USER.md\"),\n\t\tconfigFile(agentDir, \"settings.json\"),\n\t\tconfigFile(agentDir, \"models.json\"),\n\t\tsessionsDir(agentDir),\n\t\tstateDir(agentDir),\n\t\tgetWorkRoot(agentDir),\n\t\tpath.join(cwd, \".pi\", \"settings.json\"),\n\t];\n}\n"]}

package/dist/core/autonomy/lane-tool-surface.d.ts

@@ -1,4 +1,6 @@
 import type { AgentLoopConfig, AgentTool } from "@caupulican/pi-agent-core";
+import { CapabilityGateway } from "../orchestration/capability-gateway.ts";
+import type { ExecutionGrant, OrchestrationExecutionPolicy, ToolCapabilityManifest } from "../orchestration/contracts.ts";
 import type { NormalizedProfile } from "../profile-registry.ts";
 export interface LaneToolSurface {
     /** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. */
@@ -11,6 +13,8 @@ export interface LaneToolSurface {
     unboundAllowPatterns: string[];
     /** Per-call path and capability gate for the isolated child loop. */
     beforeToolCall: NonNullable<AgentLoopConfig["beforeToolCall"]>;
+    /** Canonical cumulative authority/budget meter for a compiled worker grant. */
+    gateway?: CapabilityGateway;
 }
 export interface LaneToolSurfaceOptions {
     cwd: string;
@@ -22,6 +26,12 @@ export interface LaneToolSurfaceOptions {
     /** Research never sets this. Workers require both this flag and at least one write path. */
     writeEnabled?: boolean;
     writePaths?: readonly string[];
+    /** Present only for process-capable owner profiles; absent means no process tool is materialized. */
+    executionPolicy?: OrchestrationExecutionPolicy;
+    processMaxWallClockMs?: number;
+    /** Compiled policy path. When present, it is the only authorization source for this surface. */
+    grant?: ExecutionGrant;
+    toolManifests?: readonly ToolCapabilityManifest[];
 }
 /**
  * Materialize a fresh, fail-closed tool surface for one isolated lane.

package/dist/core/autonomy/lane-tool-surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lane-tool-surface.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE5E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAoBhE,MAAM,WAAW,eAAe;IAC/B,oGAAoG;IACpG,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,8FAA8F;IAC9F,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yEAAyE;IACzE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qEAAqE;IACrE,cAAc,EAAE,WAAW,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,yEAAyE;IACzE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,wGAAwG;IACxG,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,4FAA4F;IAC5F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAsDD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CA0DtF","sourcesContent":["import path from \"node:path\";\nimport type { AgentLoopConfig, AgentTool } from \"@caupulican/pi-agent-core\";\nimport { type Static, Type } from \"typebox\";\nimport type { NormalizedProfile } from \"../profile-registry.ts\";\nimport { matchesResourceProfilePattern } from \"../settings-manager.ts\";\nimport { createEditTool } from \"../tools/edit.ts\";\nimport { createFindTool } from \"../tools/find.ts\";\nimport { createGrepTool } from \"../tools/grep.ts\";\nimport { createLsTool } from \"../tools/ls.ts\";\nimport { createReadTool } from \"../tools/read.ts\";\nimport { createWriteTool } from \"../tools/write.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { evaluateToolGate } from \"./gates.ts\";\n\nconst READ_ONLY_LANE_TOOL_NAMES = [\"read\", \"grep\", \"find\", \"ls\"] as const;\nconst MEMORY_LANE_TOOL_NAME = \"memory\" as const;\nconst WRITE_LANE_TOOL_NAMES = [\"write\", \"edit\"] as const;\nconst laneMemorySchema = Type.Object({\n\tquery: Type.String({ description: \"What relevant standing memory or prior evidence to retrieve\" }),\n});\ntype LaneMemoryParams = Static<typeof laneMemorySchema>;\nconst WRITE_LANE_TOOL_NAME_SET = new Set<string>(WRITE_LANE_TOOL_NAMES);\n\nexport interface LaneToolSurface {\n\t/** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. */\n\ttools: AgentTool[];\n\t/** Exact names after profile globs are expanded. Safe to persist in a capability envelope. */\n\tallowedTools: string[];\n\t/** Exact safe-candidate names denied by the profile's block patterns. */\n\tdeniedTools: string[];\n\t/** Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). */\n\tunboundAllowPatterns: string[];\n\t/** Per-call path and capability gate for the isolated child loop. */\n\tbeforeToolCall: NonNullable<AgentLoopConfig[\"beforeToolCall\"]>;\n}\n\nexport interface LaneToolSurfaceOptions {\n\tcwd: string;\n\tprofile?: NormalizedProfile;\n\t/** Private harness state that generic file tools must never traverse. */\n\tdeniedPaths?: readonly string[];\n\t/** Orchestrator-requested, policy-filtered read-only memory retrieval. Omitted means no memory tool. */\n\treadMemory?: (query: string) => Promise<string>;\n\t/** Research never sets this. Workers require both this flag and at least one write path. */\n\twriteEnabled?: boolean;\n\twritePaths?: readonly string[];\n}\n\nfunction strictLaneProfilePatterns(profile: NormalizedProfile | undefined): {\n\tallow: string[];\n\tblock: string[];\n} {\n\tif (!profile) return { allow: [], block: [] };\n\tconst filter = profile.resources.tools;\n\tconst allow = [...(filter?.allow ?? [])];\n\tconst block = [...(filter?.block ?? [])];\n\t// Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.\n\tif (allow.length === 0 && block.length === 0) return { allow: [], block: [\"*\"] };\n\treturn { allow, block };\n}\n\nfunction resolveWriteRoots(cwd: string, writePaths: readonly string[]): string[] {\n\treturn writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));\n}\n\nfunction createLaneTools(\n\tcwd: string,\n\tnames: readonly string[],\n\treadMemory?: (query: string) => Promise<string>,\n): AgentTool[] {\n\tconst factories = new Map<string, () => AgentTool>([\n\t\t[\"read\", () => createReadTool(cwd)],\n\t\t[\"grep\", () => createGrepTool(cwd)],\n\t\t[\"find\", () => createFindTool(cwd)],\n\t\t[\"ls\", () => createLsTool(cwd)],\n\t\t[\"write\", () => createWriteTool(cwd)],\n\t\t[\"edit\", () => createEditTool(cwd)],\n\t]);\n\tif (readMemory) {\n\t\tfactories.set(MEMORY_LANE_TOOL_NAME, () => ({\n\t\t\tname: MEMORY_LANE_TOOL_NAME,\n\t\t\tlabel: \"Read Memory\",\n\t\t\tdescription:\n\t\t\t\t\"Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.\",\n\t\t\tparameters: laneMemorySchema,\n\t\t\texecute: async (_toolCallId, params) => {\n\t\t\t\tconst { query } = params as LaneMemoryParams;\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\" as const, text: await readMemory(query) }],\n\t\t\t\t\tdetails: { readOnly: true },\n\t\t\t\t};\n\t\t\t},\n\t\t}));\n\t}\n\treturn names.flatMap((name) => {\n\t\tconst factory = factories.get(name);\n\t\treturn factory ? [factory()] : [];\n\t});\n}\n\n/**\n * Materialize a fresh, fail-closed tool surface for one isolated lane.\n *\n * Profiles select only from classified built-ins. Opaque extension tools, shell, memory, goals,\n * and `delegate` are never candidates, so a wildcard cannot manufacture unknown authority or\n * recursively spawn more workers. Write/edit additionally require the explicit worker write switch\n * and a non-empty path scope; research therefore stays read-only regardless of profile contents.\n */\nexport function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface {\n\tconst writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;\n\tconst candidateNames = [\n\t\t...READ_ONLY_LANE_TOOL_NAMES,\n\t\t...(options.readMemory ? [MEMORY_LANE_TOOL_NAME] : []),\n\t\t...(writeCapable ? WRITE_LANE_TOOL_NAMES : []),\n\t];\n\tconst patterns = strictLaneProfilePatterns(options.profile);\n\tconst deniedTools = candidateNames.filter((name) => matchesResourceProfilePattern(name, patterns.block));\n\tconst unboundAllowPatterns = patterns.allow.filter(\n\t\t(pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])),\n\t);\n\tconst allowedTools = candidateNames.filter(\n\t\t(name) =>\n\t\t\t(patterns.allow.length === 0 || matchesResourceProfilePattern(name, patterns.allow)) &&\n\t\t\t!matchesResourceProfilePattern(name, patterns.block),\n\t);\n\tconst allowedToolSet = new Set<string>(allowedTools);\n\tconst deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));\n\tconst readEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-read-tools\",\n\t\tcapabilities: [\"read_files\", ...(allowedToolSet.has(MEMORY_LANE_TOOL_NAME) ? ([\"memory_read\"] as const) : [])],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: [path.resolve(options.cwd)],\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\tconst writeEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-write-tools\",\n\t\tcapabilities: [\"write_files\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\n\treturn {\n\t\ttools: createLaneTools(options.cwd, allowedTools, options.readMemory),\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tunboundAllowPatterns,\n\t\tbeforeToolCall: async ({ toolCall, args }) => {\n\t\t\tif (!allowedToolSet.has(toolCall.name)) {\n\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };\n\t\t\t}\n\t\t\tconst outcome = evaluateToolGate({\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\targs,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tenvelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,\n\t\t\t});\n\t\t\tif (outcome.outcome === \"allow\") return undefined;\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? \"capability gate denied it\"}`,\n\t\t\t};\n\t\t},\n\t};\n}\n"]}
+{"version":3,"file":"lane-tool-surface.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE5E,OAAO,EAAE,iBAAiB,EAAgC,MAAM,wCAAwC,CAAC;AACzG,OAAO,KAAK,EACX,cAAc,EACd,4BAA4B,EAC5B,sBAAsB,EACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAuBhE,MAAM,WAAW,eAAe;IAC/B,oGAAoG;IACpG,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,8FAA8F;IAC9F,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yEAAyE;IACzE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qEAAqE;IACrE,cAAc,EAAE,WAAW,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,+EAA+E;IAC/E,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,yEAAyE;IACzE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,wGAAwG;IACxG,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,4FAA4F;IAC5F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,qGAAqG;IACrG,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gGAAgG;IAChG,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAClD;AA6DD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAiGtF","sourcesContent":["import path from \"node:path\";\nimport type { AgentLoopConfig, AgentTool } from \"@caupulican/pi-agent-core\";\nimport { type Static, Type } from \"typebox\";\nimport { CapabilityGateway, CapabilityGatewayDeniedError } from \"../orchestration/capability-gateway.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationExecutionPolicy,\n\tToolCapabilityManifest,\n} from \"../orchestration/contracts.ts\";\nimport type { NormalizedProfile } from \"../profile-registry.ts\";\nimport { wrapToolWithCredentialExposureGuard } from \"../secrets/credential-exposure-guard.ts\";\nimport { matchesResourceProfilePattern } from \"../settings-manager.ts\";\nimport { createEditTool } from \"../tools/edit.ts\";\nimport { createFindTool } from \"../tools/find.ts\";\nimport { createGrepTool } from \"../tools/grep.ts\";\nimport { createLsTool } from \"../tools/ls.ts\";\nimport { createReadTool } from \"../tools/read.ts\";\nimport { createRunProcessTool } from \"../tools/run-process.ts\";\nimport { createWriteTool } from \"../tools/write.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { evaluateToolGate } from \"./gates.ts\";\n\nconst READ_ONLY_LANE_TOOL_NAMES = [\"read\", \"grep\", \"find\", \"ls\"] as const;\nconst MEMORY_LANE_TOOL_NAME = \"memory\" as const;\nconst WRITE_LANE_TOOL_NAMES = [\"write\", \"edit\"] as const;\nconst PROCESS_LANE_TOOL_NAME = \"run_process\" as const;\nconst laneMemorySchema = Type.Object({\n\tquery: Type.String({ description: \"What relevant standing memory or prior evidence to retrieve\" }),\n});\ntype LaneMemoryParams = Static<typeof laneMemorySchema>;\nconst WRITE_LANE_TOOL_NAME_SET = new Set<string>(WRITE_LANE_TOOL_NAMES);\n\nexport interface LaneToolSurface {\n\t/** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. */\n\ttools: AgentTool[];\n\t/** Exact names after profile globs are expanded. Safe to persist in a capability envelope. */\n\tallowedTools: string[];\n\t/** Exact safe-candidate names denied by the profile's block patterns. */\n\tdeniedTools: string[];\n\t/** Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). */\n\tunboundAllowPatterns: string[];\n\t/** Per-call path and capability gate for the isolated child loop. */\n\tbeforeToolCall: NonNullable<AgentLoopConfig[\"beforeToolCall\"]>;\n\t/** Canonical cumulative authority/budget meter for a compiled worker grant. */\n\tgateway?: CapabilityGateway;\n}\n\nexport interface LaneToolSurfaceOptions {\n\tcwd: string;\n\tprofile?: NormalizedProfile;\n\t/** Private harness state that generic file tools must never traverse. */\n\tdeniedPaths?: readonly string[];\n\t/** Orchestrator-requested, policy-filtered read-only memory retrieval. Omitted means no memory tool. */\n\treadMemory?: (query: string) => Promise<string>;\n\t/** Research never sets this. Workers require both this flag and at least one write path. */\n\twriteEnabled?: boolean;\n\twritePaths?: readonly string[];\n\t/** Present only for process-capable owner profiles; absent means no process tool is materialized. */\n\texecutionPolicy?: OrchestrationExecutionPolicy;\n\tprocessMaxWallClockMs?: number;\n\t/** Compiled policy path. When present, it is the only authorization source for this surface. */\n\tgrant?: ExecutionGrant;\n\ttoolManifests?: readonly ToolCapabilityManifest[];\n}\n\nfunction strictLaneProfilePatterns(profile: NormalizedProfile | undefined): {\n\tallow: string[];\n\tblock: string[];\n} {\n\tif (!profile) return { allow: [], block: [] };\n\tconst filter = profile.resources.tools;\n\tconst allow = [...(filter?.allow ?? [])];\n\tconst block = [...(filter?.block ?? [])];\n\t// Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.\n\tif (allow.length === 0 && block.length === 0) return { allow: [], block: [\"*\"] };\n\treturn { allow, block };\n}\n\nfunction resolveWriteRoots(cwd: string, writePaths: readonly string[]): string[] {\n\treturn writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));\n}\n\nfunction createLaneTools(\n\tcwd: string,\n\tnames: readonly string[],\n\treadMemory?: (query: string) => Promise<string>,\n\texecutionPolicy?: OrchestrationExecutionPolicy,\n\tprocessMaxWallClockMs = 0,\n): AgentTool[] {\n\tconst factories = new Map<string, () => AgentTool>([\n\t\t[\"read\", () => createReadTool(cwd)],\n\t\t[\"grep\", () => createGrepTool(cwd)],\n\t\t[\"find\", () => createFindTool(cwd)],\n\t\t[\"ls\", () => createLsTool(cwd)],\n\t\t[\"write\", () => createWriteTool(cwd)],\n\t\t[\"edit\", () => createEditTool(cwd)],\n\t]);\n\tif (executionPolicy) {\n\t\tfactories.set(PROCESS_LANE_TOOL_NAME, () =>\n\t\t\tcreateRunProcessTool(cwd, { policy: executionPolicy, maxWallClockMs: processMaxWallClockMs }),\n\t\t);\n\t}\n\tif (readMemory) {\n\t\tfactories.set(MEMORY_LANE_TOOL_NAME, () => ({\n\t\t\tname: MEMORY_LANE_TOOL_NAME,\n\t\t\tlabel: \"Read Memory\",\n\t\t\tdescription:\n\t\t\t\t\"Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.\",\n\t\t\tparameters: laneMemorySchema,\n\t\t\texecute: async (_toolCallId, params) => {\n\t\t\t\tconst { query } = params as LaneMemoryParams;\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\" as const, text: await readMemory(query) }],\n\t\t\t\t\tdetails: { readOnly: true },\n\t\t\t\t};\n\t\t\t},\n\t\t}));\n\t}\n\treturn names.flatMap((name) => {\n\t\tconst factory = factories.get(name);\n\t\treturn factory ? [wrapToolWithCredentialExposureGuard(factory(), cwd)] : [];\n\t});\n}\n\n/**\n * Materialize a fresh, fail-closed tool surface for one isolated lane.\n *\n * Profiles select only from classified built-ins. Opaque extension tools, shell, memory, goals,\n * and `delegate` are never candidates, so a wildcard cannot manufacture unknown authority or\n * recursively spawn more workers. Write/edit additionally require the explicit worker write switch\n * and a non-empty path scope; research therefore stays read-only regardless of profile contents.\n */\nexport function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface {\n\tconst writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;\n\tconst candidateNames = [\n\t\t...READ_ONLY_LANE_TOOL_NAMES,\n\t\t...(options.readMemory ? [MEMORY_LANE_TOOL_NAME] : []),\n\t\t...(writeCapable ? WRITE_LANE_TOOL_NAMES : []),\n\t\t...(options.executionPolicy ? [PROCESS_LANE_TOOL_NAME] : []),\n\t];\n\tconst patterns = strictLaneProfilePatterns(options.profile);\n\tconst compiledToolNames = new Set(options.grant?.allowedTools ?? []);\n\tconst deniedTools = candidateNames.filter((name) =>\n\t\toptions.grant ? !compiledToolNames.has(name) : matchesResourceProfilePattern(name, patterns.block),\n\t);\n\tconst unboundAllowPatterns = options.grant\n\t\t? []\n\t\t: patterns.allow.filter(\n\t\t\t\t(pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])),\n\t\t\t);\n\tconst allowedTools = options.grant\n\t\t? candidateNames.filter((name) => compiledToolNames.has(name))\n\t\t: candidateNames.filter(\n\t\t\t\t(name) =>\n\t\t\t\t\t(patterns.allow.length === 0 || matchesResourceProfilePattern(name, patterns.allow)) &&\n\t\t\t\t\t!matchesResourceProfilePattern(name, patterns.block),\n\t\t\t);\n\tconst allowedToolSet = new Set<string>(allowedTools);\n\tconst manifestsByName = new Map(options.toolManifests?.map((manifest) => [manifest.toolName, manifest]) ?? []);\n\tif (options.grant?.allowedTools.some((name) => !manifestsByName.has(name))) {\n\t\tthrow new Error(\"Compiled lane grant references a tool without a capability manifest.\");\n\t}\n\tconst gateway = options.grant ? new CapabilityGateway({ grant: options.grant, cwd: options.cwd }) : undefined;\n\tconst deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));\n\tconst readEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-read-tools\",\n\t\tcapabilities: [\n\t\t\t\"filesystem.read\",\n\t\t\t...(allowedToolSet.has(MEMORY_LANE_TOOL_NAME) ? ([\"memory.query\"] as const) : []),\n\t\t\t...(allowedToolSet.has(PROCESS_LANE_TOOL_NAME) ? ([\"process.exec\"] as const) : []),\n\t\t],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: [path.resolve(options.cwd)],\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\tconst writeEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-write-tools\",\n\t\tcapabilities: [\"filesystem.write\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\n\treturn {\n\t\ttools: createLaneTools(\n\t\t\toptions.cwd,\n\t\t\tallowedTools,\n\t\t\toptions.readMemory,\n\t\t\toptions.executionPolicy,\n\t\t\toptions.processMaxWallClockMs,\n\t\t),\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tunboundAllowPatterns,\n\t\tbeforeToolCall: async ({ toolCall, args }) => {\n\t\t\tif (!allowedToolSet.has(toolCall.name)) {\n\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };\n\t\t\t}\n\t\t\tif (gateway) {\n\t\t\t\tconst manifest = manifestsByName.get(toolCall.name);\n\t\t\t\tif (!manifest) {\n\t\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' has no compiled capability manifest.` };\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\tgateway.authorizeToolCall(manifest, toolCall.name, args);\n\t\t\t\t\treturn undefined;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof CapabilityGatewayDeniedError) {\n\t\t\t\t\t\treturn { block: true, reason: `Lane tool blocked (${error.reasonCode}): ${error.message}` };\n\t\t\t\t\t}\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst outcome = evaluateToolGate({\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\targs,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tenvelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,\n\t\t\t});\n\t\t\tif (outcome.outcome === \"allow\") return undefined;\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? \"capability gate denied it\"}`,\n\t\t\t};\n\t\t},\n\t\t...(gateway ? { gateway } : {}),\n\t};\n}\n"]}

package/dist/core/autonomy/lane-tool-surface.js

@@ -1,16 +1,20 @@
 import path from "node:path";
 import { Type } from "typebox";
+import { CapabilityGateway, CapabilityGatewayDeniedError } from "../orchestration/capability-gateway.js";
+import { wrapToolWithCredentialExposureGuard } from "../secrets/credential-exposure-guard.js";
 import { matchesResourceProfilePattern } from "../settings-manager.js";
 import { createEditTool } from "../tools/edit.js";
 import { createFindTool } from "../tools/find.js";
 import { createGrepTool } from "../tools/grep.js";
 import { createLsTool } from "../tools/ls.js";
 import { createReadTool } from "../tools/read.js";
+import { createRunProcessTool } from "../tools/run-process.js";
 import { createWriteTool } from "../tools/write.js";
 import { evaluateToolGate } from "./gates.js";
 const READ_ONLY_LANE_TOOL_NAMES = ["read", "grep", "find", "ls"];
 const MEMORY_LANE_TOOL_NAME = "memory";
 const WRITE_LANE_TOOL_NAMES = ["write", "edit"];
+const PROCESS_LANE_TOOL_NAME = "run_process";
 const laneMemorySchema = Type.Object({
     query: Type.String({ description: "What relevant standing memory or prior evidence to retrieve" }),
 });
@@ -29,7 +33,7 @@ function strictLaneProfilePatterns(profile) {
 function resolveWriteRoots(cwd, writePaths) {
     return writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));
 }
-function createLaneTools(cwd, names, readMemory) {
+function createLaneTools(cwd, names, readMemory, executionPolicy, processMaxWallClockMs = 0) {
     const factories = new Map([
         ["read", () => createReadTool(cwd)],
         ["grep", () => createGrepTool(cwd)],
@@ -38,6 +42,9 @@ function createLaneTools(cwd, names, readMemory) {
         ["write", () => createWriteTool(cwd)],
         ["edit", () => createEditTool(cwd)],
     ]);
+    if (executionPolicy) {
+        factories.set(PROCESS_LANE_TOOL_NAME, () => createRunProcessTool(cwd, { policy: executionPolicy, maxWallClockMs: processMaxWallClockMs }));
+    }
     if (readMemory) {
         factories.set(MEMORY_LANE_TOOL_NAME, () => ({
             name: MEMORY_LANE_TOOL_NAME,
@@ -55,7 +62,7 @@ function createLaneTools(cwd, names, readMemory) {
     }
     return names.flatMap((name) => {
         const factory = factories.get(name);
-        return factory ? [factory()] : [];
+        return factory ? [wrapToolWithCredentialExposureGuard(factory(), cwd)] : [];
     });
 }
 /**
@@ -72,17 +79,32 @@ export function createLaneToolSurface(options) {
         ...READ_ONLY_LANE_TOOL_NAMES,
         ...(options.readMemory ? [MEMORY_LANE_TOOL_NAME] : []),
         ...(writeCapable ? WRITE_LANE_TOOL_NAMES : []),
+        ...(options.executionPolicy ? [PROCESS_LANE_TOOL_NAME] : []),
     ];
     const patterns = strictLaneProfilePatterns(options.profile);
-    const deniedTools = candidateNames.filter((name) => matchesResourceProfilePattern(name, patterns.block));
-    const unboundAllowPatterns = patterns.allow.filter((pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])));
-    const allowedTools = candidateNames.filter((name) => (patterns.allow.length === 0 || matchesResourceProfilePattern(name, patterns.allow)) &&
-        !matchesResourceProfilePattern(name, patterns.block));
+    const compiledToolNames = new Set(options.grant?.allowedTools ?? []);
+    const deniedTools = candidateNames.filter((name) => options.grant ? !compiledToolNames.has(name) : matchesResourceProfilePattern(name, patterns.block));
+    const unboundAllowPatterns = options.grant
+        ? []
+        : patterns.allow.filter((pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])));
+    const allowedTools = options.grant
+        ? candidateNames.filter((name) => compiledToolNames.has(name))
+        : candidateNames.filter((name) => (patterns.allow.length === 0 || matchesResourceProfilePattern(name, patterns.allow)) &&
+            !matchesResourceProfilePattern(name, patterns.block));
     const allowedToolSet = new Set(allowedTools);
+    const manifestsByName = new Map(options.toolManifests?.map((manifest) => [manifest.toolName, manifest]) ?? []);
+    if (options.grant?.allowedTools.some((name) => !manifestsByName.has(name))) {
+        throw new Error("Compiled lane grant references a tool without a capability manifest.");
+    }
+    const gateway = options.grant ? new CapabilityGateway({ grant: options.grant, cwd: options.cwd }) : undefined;
     const deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));
     const readEnvelope = {
         id: "isolated-lane-read-tools",
-        capabilities: ["read_files", ...(allowedToolSet.has(MEMORY_LANE_TOOL_NAME) ? ["memory_read"] : [])],
+        capabilities: [
+            "filesystem.read",
+            ...(allowedToolSet.has(MEMORY_LANE_TOOL_NAME) ? ["memory.query"] : []),
+            ...(allowedToolSet.has(PROCESS_LANE_TOOL_NAME) ? ["process.exec"] : []),
+        ],
         allowedTools,
         deniedTools,
         allowedPaths: [path.resolve(options.cwd)],
@@ -90,14 +112,14 @@ export function createLaneToolSurface(options) {
     };
     const writeEnvelope = {
         id: "isolated-lane-write-tools",
-        capabilities: ["write_files"],
+        capabilities: ["filesystem.write"],
         allowedTools,
         deniedTools,
         allowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),
         ...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),
     };
     return {
-        tools: createLaneTools(options.cwd, allowedTools, options.readMemory),
+        tools: createLaneTools(options.cwd, allowedTools, options.readMemory, options.executionPolicy, options.processMaxWallClockMs),
         allowedTools,
         deniedTools,
         unboundAllowPatterns,
@@ -105,6 +127,22 @@ export function createLaneToolSurface(options) {
             if (!allowedToolSet.has(toolCall.name)) {
                 return { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };
             }
+            if (gateway) {
+                const manifest = manifestsByName.get(toolCall.name);
+                if (!manifest) {
+                    return { block: true, reason: `Lane tool '${toolCall.name}' has no compiled capability manifest.` };
+                }
+                try {
+                    gateway.authorizeToolCall(manifest, toolCall.name, args);
+                    return undefined;
+                }
+                catch (error) {
+                    if (error instanceof CapabilityGatewayDeniedError) {
+                        return { block: true, reason: `Lane tool blocked (${error.reasonCode}): ${error.message}` };
+                    }
+                    throw error;
+                }
+            }
             const outcome = evaluateToolGate({
                 toolName: toolCall.name,
                 args,
@@ -118,6 +156,7 @@ export function createLaneToolSurface(options) {
                 reason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? "capability gate denied it"}`,
             };
         },
+        ...(gateway ? { gateway } : {}),
     };
 }
 //# sourceMappingURL=lane-tool-surface.js.map