@coderifts/agent-guard 8.4.0 → 8.5.0

package/README.md

@@ -161,6 +161,8 @@ Honesty (verbatim, and also on the machine proof as
 `limits.commit_observation_is_observed_at_t3_not_atomic: true`):
 `commit_observation is observed at T3, not atomic: another writer may act between write and observation; token-only adapters compare version token not content; host attestation is a host claim layered on the measurement`.
 
+When `withCodeRifts({ executorAttestation: { registry } })` is set and a CAS outcome carries a verified `cr.exec.attest.v1` token, the T3 section upgrades to `committed — executor-attested (ATTEST_VALID, kid …)`. Invalid attestation stays host-claimed with `attest_status` visible. Observation-side only.
+
 > **Supply `artifacts[]` with content.** If the guard detects a contract change (e.g. from
 > `filesTouched`/`diff`) but you did **not** supply `artifacts[]` with `before`/`after`, it fails
 > closed **locally** with `outcome.verdict.cause === 'MISSING_ARTIFACT_CONTENT'` — the tool does not

package/dist/cjs/auto-derive.d.ts

@@ -0,0 +1,74 @@
+/**
+ * S1 auto-derive — wrap-layer before/after pair from the tool call + current-state readers.
+ *
+ * Default OFF. Frozen guardToolCall is unchanged. Host args.artifacts always win.
+ * BEFORE comes from a reader of the SAME target (fs path / api / db / registry).
+ * AFTER is the call's intended write content. Missing target → before:null
+ * (derivation_note before_unavailable); empty file → before:"".
+ *
+ * Reader throw/timeout → today's fragment path (binder lift); never block on derivation.
+ * Observation-only: derivation is not a fingerprint preimage field.
+ */
+import type { ArtifactType, ResolveConfig } from './artifact-resolver.js';
+import type { GuardConfig, ToolCallDescriptor } from './types.js';
+export declare const AUTO_DERIVE_SOURCE: "guard_auto_derived";
+export declare const AUTO_DERIVE_READ_TIMEOUT_MS = 2000;
+export type AutoDeriveMode = 'host_supplied' | 'auto_derived' | 'fragment_only';
+export type AutoDeriveTargetKind = 'fs' | 'api' | 'db' | 'registry';
+export type AutoDeriveTarget = {
+    kind: AutoDeriveTargetKind;
+    key: string;
+};
+export type AutoDeriveNote = {
+    target: string;
+    note: 'before_unavailable' | 'reader_threw' | 'reader_timeout' | 'not_contract_path';
+};
+export type AutoDeriveObservation = {
+    derivation?: {
+        mode: AutoDeriveMode;
+        targets: ReadonlyArray<AutoDeriveTarget>;
+        notes?: ReadonlyArray<AutoDeriveNote>;
+    };
+};
+export type AutoDeriveReader = (key: string) => string | null | Promise<string | null>;
+/** Current-state readers. Return null = absent (not empty). Throw/timeout → fragment fallback. */
+export type AutoDeriveReaders = {
+    fs?: AutoDeriveReader;
+    api?: AutoDeriveReader;
+    db?: AutoDeriveReader;
+    registry?: AutoDeriveReader;
+};
+export type AutoDeriveConfig = {
+    readers?: AutoDeriveReaders;
+    /** CAP-202 resolve() config (pathTypeHints, ssotPrefer). Optional; not required for fs reads. */
+    resolveConfig?: ResolveConfig;
+};
+export type DerivedArtifact = {
+    id: string;
+    type: ArtifactType;
+    before: string | null;
+    after: string;
+    source: typeof AUTO_DERIVE_SOURCE;
+};
+/** Default fs reader: utf8 contents, ENOENT → null (absent ≠ empty). Other errors throw. */
+export declare function defaultFsReader(filePath: string): Promise<string | null>;
+export declare function normalizeAutoDerive(raw: unknown): AutoDeriveConfig | null;
+export type AutoDeriveResult = {
+    call: ToolCallDescriptor;
+    derivation: NonNullable<AutoDeriveObservation['derivation']>;
+    failed?: {
+        cause: string;
+    };
+};
+/**
+ * Derive a before/after pair onto the call descriptor when the host did not supply artifacts.
+ * Never throws out — reader failures return the bound call with fragment_only + failed.cause.
+ */
+export declare function runAutoDerive(args: {
+    bound: ToolCallDescriptor;
+    rawArgs: unknown;
+    cfg: AutoDeriveConfig;
+    config: GuardConfig;
+}): Promise<AutoDeriveResult>;
+export declare function attachDerivation<T>(outcome: T, derivation: NonNullable<AutoDeriveObservation['derivation']> | null | undefined): T;
+//# sourceMappingURL=auto-derive.d.ts.map

package/dist/cjs/auto-derive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-derive.d.ts","sourceRoot":"","sources":["../../src/auto-derive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAc,kBAAkB,EAAY,MAAM,YAAY,CAAC;AAExF,eAAO,MAAM,kBAAkB,EAAG,oBAA6B,CAAC;AAChE,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,cAAc,GAAG,eAAe,CAAC;AAEhF,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,UAAU,CAAC;AAEpE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,oBAAoB,GAAG,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;CACtF,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,cAAc,CAAC;QACrB,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACzC,KAAK,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;KACvC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,CAC7B,GAAG,EAAE,MAAM,KACR,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE5C,kGAAkG;AAClG,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,CAAC,EAAE,gBAAgB,CAAC;IACtB,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,EAAE,CAAC,EAAE,gBAAgB,CAAC;IACtB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,iGAAiG;IACjG,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,kBAAkB,CAAC;CACnC,CAAC;AAYF,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAU9E;AAkBD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAgBzE;AA0FD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,EAAE,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B,CAAC;AAEF;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,gBAAgB,CAAC;IACtB,MAAM,EAAE,WAAW,CAAC;CACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmG5B;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAChC,OAAO,EAAE,CAAC,EACV,UAAU,EAAE,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,GAC9E,CAAC,CAGH"}

package/dist/cjs/auto-derive.js

@@ -0,0 +1,272 @@
+"use strict";
+/**
+ * S1 auto-derive — wrap-layer before/after pair from the tool call + current-state readers.
+ *
+ * Default OFF. Frozen guardToolCall is unchanged. Host args.artifacts always win.
+ * BEFORE comes from a reader of the SAME target (fs path / api / db / registry).
+ * AFTER is the call's intended write content. Missing target → before:null
+ * (derivation_note before_unavailable); empty file → before:"".
+ *
+ * Reader throw/timeout → today's fragment path (binder lift); never block on derivation.
+ * Observation-only: derivation is not a fingerprint preimage field.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTO_DERIVE_READ_TIMEOUT_MS = exports.AUTO_DERIVE_SOURCE = void 0;
+exports.defaultFsReader = defaultFsReader;
+exports.normalizeAutoDerive = normalizeAutoDerive;
+exports.runAutoDerive = runAutoDerive;
+exports.attachDerivation = attachDerivation;
+const node_fs_1 = require("node:fs");
+const artifact_resolver_js_1 = require("./artifact-resolver.js");
+exports.AUTO_DERIVE_SOURCE = 'guard_auto_derived';
+exports.AUTO_DERIVE_READ_TIMEOUT_MS = 2000;
+function iso() {
+    return new Date().toISOString();
+}
+function emit(config, e) {
+    if (config.onEvent) {
+        try {
+            config.onEvent(e);
+        }
+        catch { /* onEvent never throws out */ }
+    }
+}
+/** Default fs reader: utf8 contents, ENOENT → null (absent ≠ empty). Other errors throw. */
+async function defaultFsReader(filePath) {
+    try {
+        return await node_fs_1.promises.readFile(filePath, 'utf8');
+    }
+    catch (err) {
+        const code = err && typeof err === 'object' && 'code' in err
+            ? String(err.code)
+            : '';
+        if (code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+function looksLikeResolveConfig(o) {
+    return 'ssotPrefer' in o
+        || 'generatedGlobs' in o
+        || 'pathTypeHints' in o
+        || 'openApiAssembly' in o
+        || 'maxRefDepth' in o;
+}
+function looksLikeReaders(o) {
+    const r = o;
+    return typeof r.fs === 'function'
+        || typeof r.api === 'function'
+        || typeof r.db === 'function'
+        || typeof r.registry === 'function';
+}
+function normalizeAutoDerive(raw) {
+    if (raw === true)
+        return { readers: { fs: defaultFsReader } };
+    if (!raw || raw === false || typeof raw !== 'object')
+        return null;
+    const o = raw;
+    const cfg = {};
+    if (o.resolveConfig && typeof o.resolveConfig === 'object')
+        cfg.resolveConfig = o.resolveConfig;
+    if (o.readers && typeof o.readers === 'object') {
+        if (looksLikeReaders(o.readers)) {
+            cfg.readers = { ...o.readers };
+        }
+        else if (looksLikeResolveConfig(o.readers)) {
+            cfg.resolveConfig = o.readers;
+        }
+    }
+    if (!cfg.readers)
+        cfg.readers = {};
+    if (typeof cfg.readers.fs !== 'function')
+        cfg.readers.fs = defaultFsReader;
+    return cfg;
+}
+function rawRecord(args) {
+    if (!args || typeof args !== 'object' || Array.isArray(args))
+        return null;
+    return args;
+}
+function hostSuppliedArtifacts(args) {
+    const a = rawRecord(args);
+    return !!(a && Array.isArray(a.artifacts));
+}
+function targetFromArgs(a) {
+    if (typeof a.path === 'string' && a.path.length > 0)
+        return { kind: 'fs', key: a.path };
+    if (typeof a.url === 'string' && a.url.length > 0)
+        return { kind: 'api', key: a.url };
+    if (typeof a.endpoint === 'string' && a.endpoint.length > 0)
+        return { kind: 'api', key: a.endpoint };
+    if (typeof a.table === 'string' && a.table.length > 0) {
+        const id = a.id != null ? String(a.id) : '';
+        return { kind: 'db', key: id ? `${a.table}/${id}` : a.table };
+    }
+    if (typeof a.key === 'string' && a.key.length > 0)
+        return { kind: 'registry', key: a.key };
+    return null;
+}
+function intendedAfter(a, before) {
+    for (const k of ['contents', 'content', 'new_content', 'new_contents']) {
+        if (typeof a[k] === 'string')
+            return a[k];
+    }
+    const oldS = typeof a.old_string === 'string' ? a.old_string : null;
+    const newS = typeof a.new_string === 'string' ? a.new_string : null;
+    if (newS == null)
+        return null;
+    if (typeof before === 'string' && oldS && oldS.length > 0 && before.includes(oldS)) {
+        return before.replace(oldS, newS);
+    }
+    if (newS.length > 0)
+        return newS;
+    return null;
+}
+function typeForTarget(target, a, resolveConfig) {
+    if (typeof a.type === 'string' && a.type) {
+        const t = a.type;
+        if (t === 'openapi' || t === 'graphql' || t === 'grpc' || t === 'asyncapi' || t === 'mcp_manifest') {
+            return t;
+        }
+    }
+    if (target.kind === 'fs') {
+        const hinted = resolveConfig && resolveConfig.pathTypeHints
+            ? resolveConfig.pathTypeHints[target.key]
+            : undefined;
+        if (hinted)
+            return hinted;
+        return (0, artifact_resolver_js_1.classifyByName)(target.key);
+    }
+    return null;
+}
+async function withTimeout(p, ms) {
+    let timer;
+    try {
+        return await Promise.race([
+            p,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => {
+                    const e = new Error(`autoDerive reader timed out after ${ms}ms`);
+                    e.name = 'TimeoutError';
+                    reject(e);
+                }, Math.max(1, ms));
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+async function readCurrent(readers, target) {
+    const fn = readers[target.kind];
+    if (typeof fn !== 'function') {
+        const err = new Error(`autoDerive: no ${target.kind} reader`);
+        err.code = 'NO_READER';
+        throw err;
+    }
+    return withTimeout(Promise.resolve(fn(target.key)), exports.AUTO_DERIVE_READ_TIMEOUT_MS);
+}
+/**
+ * Derive a before/after pair onto the call descriptor when the host did not supply artifacts.
+ * Never throws out — reader failures return the bound call with fragment_only + failed.cause.
+ */
+async function runAutoDerive(args) {
+    const bound = args.bound;
+    if (hostSuppliedArtifacts(args.rawArgs)) {
+        return {
+            call: bound,
+            derivation: { mode: 'host_supplied', targets: [] },
+        };
+    }
+    const a = rawRecord(args.rawArgs) || rawRecord(bound.arguments);
+    if (!a) {
+        return { call: bound, derivation: { mode: 'fragment_only', targets: [] } };
+    }
+    const target = targetFromArgs(a);
+    if (!target) {
+        return { call: bound, derivation: { mode: 'fragment_only', targets: [] } };
+    }
+    const type = typeForTarget(target, a, args.cfg.resolveConfig);
+    if (!type) {
+        return {
+            call: bound,
+            derivation: {
+                mode: 'fragment_only',
+                targets: [target],
+                notes: [{ target: target.key, note: 'not_contract_path' }],
+            },
+        };
+    }
+    const readers = args.cfg.readers || { fs: defaultFsReader };
+    let before;
+    try {
+        before = await readCurrent(readers, target);
+    }
+    catch (err) {
+        const name = err && typeof err === 'object' && 'name' in err
+            ? String(err.name)
+            : '';
+        const cause = name === 'TimeoutError' ? 'reader_timeout' : 'reader_threw';
+        emit(args.config, { type: 'derive_failed', at: iso(), cause });
+        return {
+            call: bound,
+            derivation: {
+                mode: 'fragment_only',
+                targets: [target],
+                notes: [{
+                        target: target.key,
+                        note: cause === 'reader_timeout' ? 'reader_timeout' : 'reader_threw',
+                    }],
+            },
+            failed: { cause },
+        };
+    }
+    const after = intendedAfter(a, before);
+    if (after == null) {
+        return {
+            call: bound,
+            derivation: { mode: 'fragment_only', targets: [target] },
+        };
+    }
+    const notes = [];
+    if (before === null) {
+        notes.push({ target: target.key, note: 'before_unavailable' });
+        // Absence must not erase a binder-lifted fragment pair (old_string/new_string).
+        if (Array.isArray(bound.artifacts) && bound.artifacts.length > 0) {
+            return {
+                call: bound,
+                derivation: {
+                    mode: 'fragment_only',
+                    targets: [target],
+                    notes,
+                },
+            };
+        }
+    }
+    const derived = {
+        id: `${type}:${target.key}`,
+        type,
+        before,
+        after,
+        source: exports.AUTO_DERIVE_SOURCE,
+    };
+    const call = {
+        ...bound,
+        artifacts: [derived],
+    };
+    return {
+        call,
+        derivation: {
+            mode: 'auto_derived',
+            targets: [target],
+            ...(notes.length ? { notes } : {}),
+        },
+    };
+}
+function attachDerivation(outcome, derivation) {
+    if (!derivation)
+        return outcome;
+    return { ...outcome, derivation };
+}
+//# sourceMappingURL=auto-derive.js.map

package/dist/cjs/auto-derive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-derive.js","sourceRoot":"","sources":["../../src/auto-derive.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAqEH,0CAUC;AAkBD,kDAgBC;AAoGD,sCAwGC;AAED,4CAMC;AAnUD,qCAA0C;AAC1C,iEAAwD;AAI3C,QAAA,kBAAkB,GAAG,oBAA6B,CAAC;AACnD,QAAA,2BAA2B,GAAG,IAAI,CAAC;AAkDhD,SAAS,GAAG;IACV,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,IAAI,CAAC,MAAmB,EAAE,CAAa;IAC9C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,4FAA4F;AACrF,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAS;IACvC,OAAO,YAAY,IAAI,CAAC;WACnB,gBAAgB,IAAI,CAAC;WACrB,eAAe,IAAI,CAAC;WACpB,iBAAiB,IAAI,CAAC;WACtB,aAAa,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,MAAM,CAAC,GAAG,CAAsB,CAAC;IACjC,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,UAAU;WAC5B,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU;WAC3B,OAAO,CAAC,CAAC,EAAE,KAAK,UAAU;WAC1B,OAAO,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;AACxC,CAAC;AAED,SAAgB,mBAAmB,CAAC,GAAY;IAC9C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,CAAC;IAC9D,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,KAAK,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,CAAC,GAAG,GAA+C,CAAC;IAC1D,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,IAAI,CAAC,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QAAE,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC;IAChG,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC/C,IAAI,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QACjC,CAAC;aAAM,IAAI,sBAAsB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,OAAwB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC;IACnC,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,UAAU;QAAE,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,eAAe,CAAC;IAC3E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAa;IAC1C,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,CAA0B;IAChD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxF,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtF,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrG,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,CAA0B,EAAE,MAAqB;IACtE,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,CAAU,EAAE,CAAC;QAChF,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,CAAC,CAAW,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CACpB,MAAwB,EACxB,CAA0B,EAC1B,aAA6B;IAE7B,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAoB,CAAC;QACjC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;YACnG,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,aAAa,IAAI,aAAa,CAAC,aAAa;YACzD,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;YACzC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,OAAO,IAAA,qCAAc,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAI,CAAa,EAAE,EAAU;IACrD,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC3B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,qCAAqC,EAAE,IAAI,CAAC,CAAC;oBAChE,CAAsB,CAAC,IAAI,GAAG,cAAc,CAAC;oBAC9C,MAAM,CAAC,CAAC,CAAC,CAAC;gBACZ,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACtB,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAA0B,EAC1B,MAAwB;IAExB,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC;QAC7D,GAAyB,CAAC,IAAI,GAAG,WAAW,CAAC;QAC9C,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,mCAA2B,CAAC,CAAC;AACnF,CAAC;AAQD;;;GAGG;AACI,KAAK,UAAU,aAAa,CAAC,IAKnC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE;SACnD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,IAAI,EAAE,KAAK;YACX,UAAU,EAAE;gBACV,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,CAAC,MAAM,CAAC;gBACjB,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;aAC3D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC;IAC5D,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,KAAK,GAAG,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO;YACL,IAAI,EAAE,KAAK;YACX,UAAU,EAAE;gBACV,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,CAAC,MAAM,CAAC;gBACjB,KAAK,EAAE,CAAC;wBACN,MAAM,EAAE,MAAM,CAAC,GAAG;wBAClB,IAAI,EAAE,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc;qBACrE,CAAC;aACH;YACD,MAAM,EAAE,EAAE,KAAK,EAAE;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;SACzD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC/D,gFAAgF;QAChF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE;oBACV,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,CAAC,MAAM,CAAC;oBACjB,KAAK;iBACN;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,EAAE,EAAE,GAAG,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE;QAC3B,IAAI;QACJ,MAAM;QACN,KAAK;QACL,MAAM,EAAE,0BAAkB;KAC3B,CAAC;IAEF,MAAM,IAAI,GAAuB;QAC/B,GAAG,KAAK;QACR,SAAS,EAAE,CAAC,OAA8B,CAAC;KAC5C,CAAC;IACF,OAAO;QACL,IAAI;QACJ,UAAU,EAAE;YACV,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,CAAC,MAAM,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAC9B,OAAU,EACV,UAA+E;IAE/E,IAAI,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC;IAChC,OAAO,EAAE,GAAI,OAAkB,EAAE,UAAU,EAAO,CAAC;AACrD,CAAC"}

package/dist/cjs/auto-recheck.d.ts

@@ -0,0 +1,76 @@
+/**
+ * S6 auto-recheck loop — host-side orchestration AFTER a BLOCK with a remediation_transaction.
+ *
+ * Default OFF. The frozen guardToolCall is unchanged; this wraps it. The guard never writes
+ * artifacts: the host's applyFix applies the fix (honesty line). After applyFix true, artifacts
+ * are re-resolved FRESH (resolve() from artifact-resolver when resolveInput is supplied, else
+ * the host-updated call / rebind).
+ *
+ * recheck_scope is an OUTPUT on the BLOCK envelope (app remediation-transaction.js). The
+ * preflight request does not accept a scope hint (measured SDK / authorizeChangeSet) — so
+ * each attempt is a FULL re-preflight. Noted, not faked.
+ *
+ * Nothing here enters a fingerprint preimage (host orchestration only).
+ */
+import type { GuardConfig, GuardOutcome, ToolCallDescriptor, ExecuteFactory, GuardToolCallContext } from './types.js';
+import type { RemediationTransactionView } from './remediation-loop-attestation.js';
+import type { ResolveInput, ResolveConfig } from './artifact-resolver.js';
+/** Hard cap on RE-preflights per original call. */
+export declare const AUTO_RECHECK_MAX_CAP = 3;
+export type RecheckTrailEntry = {
+    attempt: number;
+    decision_id: string | null;
+    fingerprint: string | null;
+    execution_action: string | null;
+};
+export type RecheckStopReason = 'no_progress' | 'apply_fix_declined' | 'apply_fix_threw' | 'exhausted';
+export type RecheckObservation = {
+    recheck_trail?: ReadonlyArray<RecheckTrailEntry>;
+    /** 849 metric feed. Present only when the loop ran. value true iff a recheck landed allow-class. */
+    fixed_after_block?: {
+        value: true | null;
+        attempt_count: number | null;
+    };
+    recheck_stop_reason?: RecheckStopReason;
+};
+export type AutoRecheckApplyFixContext = {
+    call: ToolCallDescriptor;
+    attempt: number;
+    outcome: GuardOutcome<unknown>;
+};
+export type AutoRecheckConfig = {
+    /**
+     * Bound on RE-preflights per original call. Allowed 1–3; values above 3 clamp to 3.
+     * Values below 1 disable the loop.
+     */
+    maxAttempts: number;
+    /**
+     * HOST applies the fix. The guard never writes artifacts.
+     * false / throw → loop ends, original BLOCK stands.
+     */
+    applyFix: (remediation: RemediationTransactionView, context: AutoRecheckApplyFixContext) => boolean | Promise<boolean>;
+    /**
+     * Optional. After applyFix true, produce a fresh git snapshot for resolve() (CAP-202).
+     * When absent, the loop re-runs `rebind` / uses artifacts the host attached on context.call.
+     */
+    resolveInput?: () => ResolveInput | Promise<ResolveInput>;
+    resolveConfig?: ResolveConfig;
+};
+export declare function clampMaxAttempts(n: unknown): number;
+export declare function normalizeAutoRecheck(raw: unknown): AutoRecheckConfig | null;
+export type AutoRecheckLoopArgs<T> = {
+    call: ToolCallDescriptor;
+    factory: ExecuteFactory<T>;
+    config: GuardConfig;
+    callContext?: GuardToolCallContext;
+    rebind: () => ToolCallDescriptor | Promise<ToolCallDescriptor>;
+    /** Re-collect freshness VALUES from the FRESH call (full re-preflight). */
+    refreshContext?: (call: ToolCallDescriptor) => Promise<GuardToolCallContext | undefined>;
+};
+/**
+ * First call is always a normal guardToolCall. The loop runs only when autoRecheck is
+ * normalized (applyFix present, maxAttempts in 1–3) AND the outcome is BLOCK with a
+ * remediation_transaction.
+ */
+export declare function runAutoRecheckLoop<T>(args: AutoRecheckLoopArgs<T>): Promise<GuardOutcome<T>>;
+//# sourceMappingURL=auto-recheck.d.ts.map

package/dist/cjs/auto-recheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-recheck.d.ts","sourceRoot":"","sources":["../../src/auto-recheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EAEZ,kBAAkB,EAClB,cAAc,EAEd,oBAAoB,EAGrB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE1E,mDAAmD;AACnD,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,oBAAoB,GACpB,iBAAiB,GACjB,WAAW,CAAC;AAEhB,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACjD,oGAAoG;IACpG,iBAAiB,CAAC,EAAE;QAAE,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACzE,mBAAmB,CAAC,EAAE,iBAAiB,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,EAAE,CACR,WAAW,EAAE,0BAA0B,EACvC,OAAO,EAAE,0BAA0B,KAChC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,CAAC;AAYF,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAMnD;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,iBAAiB,GAAG,IAAI,CAU3E;AAuHD,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAAI;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,MAAM,EAAE,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/D,2EAA2E;IAC3E,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;CAC1F,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CA4ElG"}