@cirvix_ai/agent-control 0.1.3 → 0.2.0

package/src/core/pipeline.mjs

@@ -61,6 +61,11 @@ import { approvalFingerprint } from "./approvals.mjs";
 import { applyDelegation } from "./delegation.mjs";
 import { redact as redactSecrets, scan as scanSecrets } from "./secret-detect.mjs";
 import { stripInjection } from "./sanitize.mjs";
+import { SessionTaint, assessTrifecta, applyTrifecta } from "./trifecta.mjs";
+import { evaluateIntent } from "./intent.mjs";
+import { SessionTracker } from "./session.mjs";
+import { BehavioralBaseline } from "./baseline.mjs";
+import { globalKillSwitch } from "./kill-switch.mjs";
 
 /** Wall-clock for one stage, in fractional milliseconds. */
 function timer() {
@@ -105,6 +110,10 @@ export class Pipeline {
     agents = null,
     riskFloor = "high",
     runId = null,
+    killSwitch = null,
+    sessionTracker = null,
+    baseline = null,
+    intent = null,
     onEvent = () => {},
     log = () => {},
   } = {}) {
@@ -123,11 +132,21 @@ export class Pipeline {
     this.agents = agents;
     this.riskFloor = riskFloor;
     this.runId = runId;
+    this.killSwitch = killSwitch;
+    this.sessionTracker = sessionTracker;
+    this.baseline = baseline;
+    this.intent = intent;
     this.onEvent = onEvent;
     this.log = log;
 
-    /** Set once this session reads secret-shaped material. */
-    this.touchedSecret = false;
+    /**
+     * Sequence state for this session.
+     *
+     * Was a bare `touchedSecret` boolean. It is now the full three-leg record
+     * the Lethal Trifecta needs, with `touchedSecret` kept as an accessor so
+     * the gateway and every existing caller are unaffected.
+     */
+    this.taint = new SessionTaint();
 
     this.stats = {
       calls: 0,
@@ -143,6 +162,19 @@ export class Pipeline {
     };
   }
 
+  /**
+   * Kept so the gateway, the guard and any embedder that set or read this
+   * boolean keep working unchanged. Leg A of the trifecta and the old
+   * "this session touched a secret" flag are the same fact.
+   */
+  get touchedSecret() {
+    return this.taint.touchedSecret;
+  }
+
+  set touchedSecret(value) {
+    this.taint.touchedSecret = value;
+  }
+
   /**
    * Runs one call through every stage.
    *
@@ -225,6 +257,18 @@ export class Pipeline {
       if (context) call.delegation = context;
     }
 
+    /*
+     * Sequence-aware enforcement, after policy and after mode.
+     *
+     * It runs last among the tightening steps so that a call policy already
+     * refused keeps policy's reason — the first refusal is the actionable one.
+     * `applyTrifecta` is a no-op unless all three legs are satisfied, so the
+     * common path costs one object comparison.
+     */
+    const trifecta = assessTrifecta(call, this.taint, { response: this.trifectaResponse });
+    decision = applyTrifecta(decision, trifecta);
+    call.trifecta = { complete: trifecta.complete, satisfied: trifecta.satisfied, imminent: trifecta.imminent };
+
     decision = applyMode(decision, this.mode);
     decision.decision_id = `dec_${id.slice(4)}`;
 
@@ -243,6 +287,86 @@ export class Pipeline {
       agent: call.agent,
     });
 
+    /* ------------------------------------------- kill switch evaluation ---- */
+    const ksEngine = this.killSwitch ?? globalKillSwitch;
+    const killCheck = ksEngine.evaluate({
+      agentId: call.agent,
+      tool: call.tool,
+      resource: call.resource,
+      session: this.runId,
+      environment: this.environment,
+    });
+    if (killCheck.killed) {
+      decision = {
+        decision: killCheck.decision ?? DECISION.QUARANTINE,
+        verdict: killCheck.decision ?? DECISION.QUARANTINE,
+        rule: "emergency-kill-switch",
+        reason: killCheck.reason,
+        risk: "critical",
+      };
+      call.killSwitchTriggered = true;
+    }
+
+    /* -------------------------------------------------- intent firewall ---- */
+    const declaredIntent = ctx.intent ?? call.intent ?? this.intent;
+    if (declaredIntent && decision.decision === DECISION.ALLOW) {
+      const intentEval = evaluateIntent({
+        intent: declaredIntent,
+        action: call.action,
+        resource: call.resource,
+        tool: call.tool,
+        context: ctx,
+      });
+      call.intentEvaluation = intentEval;
+      if (!intentEval.aligned) {
+        decision = {
+          decision: DECISION.DENY,
+          verdict: "deny",
+          rule: "intent-firewall-boundary",
+          reason: intentEval.reason,
+          risk: "high",
+        };
+      }
+    }
+
+    /* ------------------------------------- stateful session security ---- */
+    if (this.sessionTracker) {
+      const chainCheck = this.sessionTracker.recordStep({
+        action: call.action,
+        resource: call.resource,
+        tool: call.tool,
+        decision: decision.decision,
+        risk: call.risk,
+      });
+      call.sessionRisk = chainCheck.risk;
+      if (chainCheck.suspicious && decision.decision === DECISION.ALLOW) {
+        decision = {
+          decision: DECISION.DENY,
+          verdict: "deny",
+          rule: "stateful-exfiltration-chain",
+          reason: chainCheck.reason,
+          risk: "critical",
+        };
+      }
+    }
+
+    /* --------------------------------------- behavioral baseline check ---- */
+    if (this.baseline) {
+      const deviation = this.baseline.scoreDeviation({
+        tool: call.tool,
+        action: call.action,
+        resource: call.resource,
+      });
+      call.anomalyScore = deviation.anomalyScore;
+      if (deviation.isDeviation && decision.decision === DECISION.ALLOW) {
+        decision = escalateForRisk(
+          decision,
+          { level: "HIGH", signals: ["behavioral_anomaly"], reason: deviation.reasons[0] },
+          { floor: this.riskFloor }
+        );
+      }
+    }
+
     stages.policy = t();
 
     /* ---------------------------------------------------------- 6. approval */
@@ -487,15 +611,29 @@ export class Pipeline {
     stages.audit = t();
     event.stages.audit = Number(stages.audit.toFixed(3));
 
+    /* Attach only when there is something to record. A key present with an
+       undefined value and an absent key are identical to JSON.stringify but
+       not to the canonicaliser the audit chain hashes with, and setting one
+       unconditionally broke chain verification for every call. */
+    if (trifecta.complete) {
+      event.trifecta = { complete: true, legs: trifecta.legs, response: trifecta.decision };
+    } else if (trifecta.satisfied.length) {
+      event.trifecta = { complete: false, satisfied: trifecta.satisfied, imminent: trifecta.imminent };
+    }
+
     this.#count(decision, latency);
     this.onEvent({ kind: "decision", ...event });
 
     // Any permitted read of secret-shaped material taints the session. A
     // brokered substitution deliberately does not: the agent never held the
     // material, which is the entire point of a handle.
-    if (isForwarded(decision.decision) && /secret|credential|token|password|\.env/i.test(call.resource)) {
-      this.touchedSecret = true;
-    }
+    this.taint.observeCall(call, isForwarded(decision.decision));
+
+    /* The result comes back through scrubResult(), which the transport calls
+       with only the decision — it has no call in hand. Holding the last call
+       here is what lets leg B attribute an ingested page to the fetch that
+       asked for it, instead of recording an anonymous taint. */
+    this.lastCall = call;
 
     return { event, call, decision, arguments: outgoing };
   }
@@ -513,7 +651,7 @@ export class Pipeline {
    *      default would corrupt legitimate content that merely discusses
    *      prompts.
    */
-  scrubResult(payload, decision = {}) {
+  scrubResult(payload, decision = {}, call = null) {
     let out = payload;
     const findings = [];
 
@@ -542,6 +680,10 @@ export class Pipeline {
       for (const f of stripped.findings) findings.push({ ...f, kind: "injection" });
     }
 
+    /* Leg B. The injection findings were already computed here and then
+       discarded; remembering them is what makes the trifecta detectable. */
+    this.taint.observeResult(call ?? decision.call ?? this.lastCall ?? {}, findings);
+
     if (findings.length) {
       this.stats.leaks += findings.filter((f) => f.kind === "credential").length;
       this.onEvent({

package/src/core/prompts.mjs

@@ -110,6 +110,57 @@ export function ephemeralSecret(licence = {}, handle = "sec_handle_…") {
 
 /** The fraction of the allowance that triggers the one soft nudge. */
 export const NUDGE_AT = 0.7;
+/**
+ * The egress-class DENY rules that carry a third-party destination.
+ *
+ * A denial in this class is the moment someone learns what Cirvix is for:
+ * an agent they run tried to send something somewhere, and the engine said
+ * no. That is also the story worth telling other people — which is why the
+ * prompt that fires on it offers to share it, and why the share offer lives
+ * here rather than in a place it would fire on every mundane refusal.
+ */
+export const EGRESS_DENY_RULES = new Set([
+  "deny-external-egress-after-secret",
+  "deny-unlisted-egress",
+  "deny-credential-files",
+  "deny-dotenv-production",
+]);
+
+export const SHARE_URL = "https://www.cirvix.com/share.html";
+
+/**
+ * The domain-signal prompt, or null.
+ *
+ * FIRES ON THE EGRESS-CLASS DENIALS ONLY, AND AT MOST ONCE PER PROCESS. A
+ * blocked credential file or a blocked exfiltration-shaped egress is the
+ * strongest evidence that the person behind the terminal is running agents
+ * against real infrastructure — exactly who Team exists for. The prompt
+ * states what was seen (a rule name and a destination, never a secret value),
+ * names the tier's own limits as proof it read them, and offers one next
+ * step. It does not fire on every refusal: a denial of a workspace write is
+ * housekeeping, not a signal.
+ *
+ * Like everything else in this file it decides nothing: the caller owns when,
+ * `notices.mjs` owns once-per-process, and this only shapes the sentence.
+ */
+export function domainSignal(licence = {}, { rule = "", destination = "" } = {}) {
+  const tier = tierFor(licence.tier);
+  if (!EGRESS_DENY_RULES.has(rule)) return null;
+
+  const seen = [rule, destination ? `→ ${destination}` : ""].filter(Boolean).join(" ");
+
+  return [
+    `[cirvix] Blocked an outbound action on ${tier.name} (${seen}).`,
+    tier.agents !== null
+      ? `${tier.name} watches 1 agent; Team (${n(TIERS.team.seatsIncluded)}+ seats) shares one policy across all of them.`
+      : "",
+    "Seen something worth showing? Share the blocked action — no secrets, your call:",
+    `→ ${SHARE_URL}`,
+  ]
+    .filter(Boolean)
+    .join("\n");
+}
+
 
 /**
  * The single mid-day nudge, or null.