@connexum/ai-governance 1.0.0-beta.11

package/dist/governance/action-isolation.js

@@ -0,0 +1,623 @@
+"use strict";
+/**
+ * AutonomousActionIsolator -- Cycle-composition gate for autonomous agents.
+ *
+ * Enforces the structural rule that an agent which READS the world in a cycle
+ * cannot also CHANGE the world in that same cycle. This stops the prompt-injection
+ * cascade: a hostile document retrieved in cycle N cannot trigger a consequential
+ * action until cycle N+1, at which point the operator has visibility into what
+ * cycle N retrieved before authorising cycle N+1's writes.
+ *
+ * BUILD_PLAN_V3_FULL_LIFECYCLE.md line 278:
+ *   "Autonomous action isolation: no consequential action in same cycle as
+ *    information gathering"
+ *
+ * OWASP A05 -- Security Misconfiguration (cascading hallucination + prompt injection):
+ *   Without isolation, an agent that retrieves a hostile document ("delete all files")
+ *   can obey in the same execution cycle. With isolation, the consequential action is
+ *   deferred to a fresh cycle; the operator can review the cycle N retrieval before
+ *   cycle N+1 is allowed to mutate state.
+ *
+ * Action taxonomy (orthogonal to PR #24 autonomy spectrum):
+ *   - info-gathering  read, retrieve, query, search, fetch, list (non-mutating)
+ *   - reasoning       self-check, regenerate, output (per PR #17 taxonomy)
+ *   - consequential   write, send, deploy, transact, create, update, delete (mutates:true)
+ *
+ * Relation to PR #24 (autonomy spectrum):
+ *   Both gates compose in the PreToolUse chain. Autonomy spectrum runs first and
+ *   decides action class + autonomy level (WHAT kind of action, at WHAT level).
+ *   Action isolation runs second and decides cycle composition (WHEN relative to
+ *   info-gathering in the same cycle). Both must pass before tool dispatch.
+ *
+ * Three operating modes (operator-configured per agent):
+ *   'none'          No enforcement. Agent can mix freely. Default for non-strict packs.
+ *   'strict'        Any info-gathering in this cycle blocks ALL consequential actions.
+ *                   Consequential actions throw ActionIsolationViolationError.
+ *   'sourced-only'  Only blocks consequential actions that reference data sourced in the
+ *                   same cycle (targetIds overlap with prior sourceIds). Allows same-cycle
+ *                   consequential actions on pre-existing data. Used by strict packs
+ *                   (HIPAA, GDPR, PCI DSS, HMDA, DORA) as a pragmatic default that
+ *                   blocks the prompt-injection cascade without breaking legitimate
+ *                   same-cycle workflows on pre-existing data.
+ *
+ * Pack-binding is mandatory on every operation (per feedback_pack_binding_primacy.md).
+ *
+ * Pen-test gates:
+ *   PT-ACTION-ISO-1: source-spoofing -- agent declares info-gathering with empty
+ *     sourceIds to evade sourced-only mode. Compensating control: INFO_GATHERING_NO_SOURCES_DECLARED
+ *     warning event so auditors can detect the pattern.
+ *   PT-ACTION-ISO-2: cycle-id reuse -- agent reuses a cleared cycleId hoping to carry
+ *     over the cleared log. clearCycle() deletes the log; new cycleId starts empty.
+ *   PT-ACTION-ISO-3: parallel-action timing -- agent fires info-gathering and consequential
+ *     simultaneously hoping the guard sees an empty log. Per-cycle Mutex serialises calls.
+ *
+ * Compliance bindings:
+ *   HIPAA 164.308(a)(5) -- Security awareness; anomaly detection
+ *   GDPR Art. 25 -- Data protection by design; access minimisation
+ *   PCI DSS Req 6.4 -- Protect public-facing web applications
+ *   DORA Art. 9 -- ICT risk management; untrusted data handling
+ *   SOC 2 CC7.2 -- System monitoring; anomaly response
+ *   NIST 800-53 SI-10 -- Information input validation
+ *
+ * @connexum/ai-governance P3-T2
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AutonomousActionIsolator = exports.UnauthorizedIsolationConfigError = exports.EmptyPackBindingError = exports.ActionIsolationViolationError = void 0;
+exports.defaultIsolationModeForPacks = defaultIsolationModeForPacks;
+const crypto = __importStar(require("node:crypto"));
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/**
+ * Pack IDs whose default isolation mode is 'sourced-only'.
+ * These are strict regulated packs where prompt-injection via retrieved content
+ * poses a specific compliance risk (PHI exfiltration, financial fraud, etc.).
+ * 'sourced-only' is chosen over 'strict' because it blocks the cascade without
+ * halting legitimate same-cycle writes on pre-existing (non-retrieved) data.
+ */
+const STRICT_PACK_IDS = new Set([
+    'hipaa',
+    'hipaa-security',
+    'hipaa-privacy',
+    'gdpr',
+    'gdpr-eu',
+    'eu-gdpr',
+    'uk-gdpr',
+    'pcidss',
+    'pci-dss',
+    'hmda',
+    'dora',
+    'dora-eu',
+]);
+// ---------------------------------------------------------------------------
+// Errors
+// ---------------------------------------------------------------------------
+class ActionIsolationViolationError extends Error {
+    orgId;
+    agentId;
+    cycleId;
+    mode;
+    remediation;
+    constructor(opts) {
+        super(`ActionIsolationViolationError: Consequential action blocked for agent ` +
+            `'${opts.agentId}' (org '${opts.orgId}') in cycle '${opts.cycleId}'. ` +
+            `Mode: ${opts.mode}. Remediation: ${opts.remediation}. Detail: ${opts.detail}`);
+        this.name = 'ActionIsolationViolationError';
+        this.orgId = opts.orgId;
+        this.agentId = opts.agentId;
+        this.cycleId = opts.cycleId;
+        this.mode = opts.mode;
+        this.remediation = opts.remediation;
+    }
+}
+exports.ActionIsolationViolationError = ActionIsolationViolationError;
+class EmptyPackBindingError extends Error {
+    constructor(operation) {
+        super(`EmptyPackBindingError: packBinding must be a non-empty array for '${operation}'. ` +
+            'Every action isolation operation must declare which compliance packs govern it.');
+        this.name = 'EmptyPackBindingError';
+    }
+}
+exports.EmptyPackBindingError = EmptyPackBindingError;
+class UnauthorizedIsolationConfigError extends Error {
+    approverIdentity;
+    constructor(approverIdentity, detail) {
+        super(`UnauthorizedIsolationConfigError: '${approverIdentity}' is not authorized to ` +
+            `configure action isolation. Requires ADMIN role. Detail: ${detail}`);
+        this.name = 'UnauthorizedIsolationConfigError';
+        this.approverIdentity = approverIdentity;
+    }
+}
+exports.UnauthorizedIsolationConfigError = UnauthorizedIsolationConfigError;
+/**
+ * Simple async mutex for per-cycle serialisation.
+ * PT-ACTION-ISO-3: ensures recordAction and guardConsequentialAction
+ * cannot race even if called near-simultaneously.
+ */
+class CycleMutex {
+    queue = [];
+    locked = false;
+    async acquire() {
+        if (!this.locked) {
+            this.locked = true;
+            return;
+        }
+        return new Promise((resolve) => {
+            this.queue.push(resolve);
+        });
+    }
+    release() {
+        if (this.queue.length > 0) {
+            const next = this.queue.shift();
+            next();
+        }
+        else {
+            this.locked = false;
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// AutonomousActionIsolator
+// ---------------------------------------------------------------------------
+/**
+ * AutonomousActionIsolator
+ *
+ * Operator-configured gate that enforces cycle-composition isolation between
+ * information-gathering and consequential actions.
+ *
+ * Usage:
+ *   const isolator = new AutonomousActionIsolator(auditSink, operatorRoles);
+ *
+ *   // Operator configures mode (requires ADMIN role):
+ *   isolator.configure('org-1', 'agent-1', 'strict', ['hipaa'], 'admin-alice');
+ *
+ *   // PreToolUse chain -- info-gathering tool:
+ *   await isolator.recordAction('org-1', 'agent-1', 'cycle-abc', {
+ *     kind: 'info-gathering',
+ *     sourceIds: ['vs_pubmed_2026'],
+ *   }, ['hipaa']);
+ *
+ *   // PreToolUse chain -- before mutating tool (after autonomy-spectrum check):
+ *   const result = await isolator.guardConsequentialAction(
+ *     'org-1', 'agent-1', 'cycle-abc',
+ *     { class: 'production-write', mutates: true, targetIds: ['doc-123'] },
+ *     ['hipaa'],
+ *   );
+ *   // mode:'strict' + info-gathering present -> throws ActionIsolationViolationError
+ *
+ *   // Cycle teardown:
+ *   isolator.clearCycle('cycle-abc');
+ */
+class AutonomousActionIsolator {
+    auditSink;
+    operatorRoles;
+    /**
+     * Test-only operator map. When provided, OperatorRoles RBAC is bypassed
+     * in favour of this simple identity->role map.
+     */
+    testOperatorMap;
+    /** Per-agent isolation config. Key: orgId::agentId */
+    configs = new Map();
+    /**
+     * Per-agent-cycle action log. Key: orgId::agentId::cycleId
+     * Keyed by agent+cycle so that two different agents' cycle logs
+     * are fully independent even if they share the same cycleId string.
+     */
+    cycleLogs = new Map();
+    /**
+     * Per-agent-cycle mutex. Key: orgId::agentId::cycleId
+     * PT-ACTION-ISO-3: ensures recordAction and guardConsequentialAction
+     * are serialised per agent+cycle pair, not globally.
+     */
+    cycleMutexes = new Map();
+    /** Per-agent SHA chain head. Key: orgId::agentId */
+    chainHead = new Map();
+    constructor(auditSink, operatorRoles, options) {
+        this.auditSink = auditSink ?? (() => undefined);
+        this.operatorRoles = operatorRoles ?? null;
+        this.testOperatorMap = options?.testOperatorMap;
+    }
+    // -------------------------------------------------------------------------
+    // Public API
+    // -------------------------------------------------------------------------
+    /**
+     * Configure isolation mode for an agent. Operator-only (ADMIN role required).
+     *
+     * @param orgId          Organisation identifier.
+     * @param agentId        Agent identifier.
+     * @param mode           Isolation mode: 'none' | 'strict' | 'sourced-only'.
+     * @param packBinding    Non-empty array of compliance pack IDs.
+     * @param approverIdentity Operator identity (must have ADMIN role).
+     */
+    configure(orgId, agentId, mode, packBinding, approverIdentity) {
+        this.validatePackBinding(packBinding, 'configure');
+        this.verifyOperatorIdentity(approverIdentity, orgId, agentId);
+        const key = this.agentKey(orgId, agentId);
+        const config = {
+            mode,
+            packBinding: [...packBinding],
+            approverIdentity,
+            configuredAt: new Date().toISOString(),
+        };
+        this.configs.set(key, config);
+        this.emitEvent({
+            type: 'ACTION_ISOLATION_CONFIGURED',
+            severity: 'INFO',
+            orgId,
+            agentId,
+            cycleId: 'n/a',
+            data: { mode, packBinding, approverIdentity },
+        }, key);
+    }
+    /**
+     * Record an action in a cycle's log.
+     *
+     * This is called from existing audit chain emit points:
+     *   - PR #18 (rag-source-allowlist) allowed retrievals -> kind: 'info-gathering'
+     *   - PR #17 (anomaly-self-reflection) actions -> kind: 'reasoning'
+     *   - PR #24 (autonomy-spectrum) mutating tool calls -> kind: 'consequential'
+     *   - PR #24 non-mutating tool calls -> kind: 'info-gathering' or 'reasoning'
+     *
+     * PT-ACTION-ISO-1 compensating control: if kind is 'info-gathering' and
+     * sourceIds is empty, emits INFO_GATHERING_NO_SOURCES_DECLARED warning.
+     *
+     * @param orgId       Organisation identifier.
+     * @param agentId     Agent identifier.
+     * @param cycleId     Cycle identifier (server-generated, one-shot per PR #15).
+     * @param action      Action descriptor.
+     * @param packBinding Non-empty array of compliance pack IDs.
+     */
+    async recordAction(orgId, agentId, cycleId, action, packBinding) {
+        this.validatePackBinding(packBinding, 'recordAction');
+        const mutex = this.getCycleMutex(orgId, agentId, cycleId);
+        await mutex.acquire();
+        try {
+            const log = this.getCycleLog(orgId, agentId, cycleId);
+            const recordedAt = action.timestamp ?? new Date().toISOString();
+            log.actions.push({ ...action, recordedAt });
+            if (action.kind === 'info-gathering') {
+                log.hasInfoGathering = true;
+                for (const srcId of action.sourceIds ?? []) {
+                    log.infoGatheringSourceIds.add(srcId);
+                }
+                // PT-ACTION-ISO-1: compensating control for source-spoofing.
+                if (!action.sourceIds || action.sourceIds.length === 0) {
+                    const agentKey = this.agentKey(orgId, agentId);
+                    this.emitEvent({
+                        type: 'INFO_GATHERING_NO_SOURCES_DECLARED',
+                        severity: 'WARN',
+                        orgId,
+                        agentId,
+                        cycleId,
+                        data: {
+                            detail: 'info-gathering action recorded with empty sourceIds. ' +
+                                'This pattern may indicate source-spoofing to evade sourced-only isolation mode. ' +
+                                'Review cycle actions for compliance (PT-ACTION-ISO-1).',
+                            packBinding,
+                        },
+                    }, agentKey);
+                }
+            }
+        }
+        finally {
+            mutex.release();
+        }
+    }
+    /**
+     * Pre-execution gate for consequential actions.
+     *
+     * Must run AFTER PR #24 autonomy-spectrum gate and BEFORE tool dispatch.
+     * Order: autonomy-spectrum (class+level check) -> action-isolation (cycle-composition) -> dispatch.
+     *
+     * Returns { decision: 'execute', reason } when allowed.
+     * Throws ActionIsolationViolationError when blocked.
+     * Emits ACTION_ISOLATION_PASSED (NOTICE) when mode is non-'none' and allowed.
+     * Emits ACTION_ISOLATION_VIOLATION (ERROR) when blocked.
+     *
+     * @param orgId       Organisation identifier.
+     * @param agentId     Agent identifier.
+     * @param cycleId     Cycle identifier.
+     * @param action      Consequential action descriptor.
+     * @param packBinding Non-empty array of compliance pack IDs.
+     */
+    async guardConsequentialAction(orgId, agentId, cycleId, action, packBinding) {
+        this.validatePackBinding(packBinding, 'guardConsequentialAction');
+        const mutex = this.getCycleMutex(orgId, agentId, cycleId);
+        await mutex.acquire();
+        try {
+            const mode = this.resolveMode(orgId, agentId, packBinding);
+            const agentKey = this.agentKey(orgId, agentId);
+            if (mode === 'none') {
+                return { decision: 'execute', reason: 'mode:none -- no cycle-composition enforcement' };
+            }
+            const agentCycleKey = this.agentCycleKey(orgId, agentId, cycleId);
+            const cycleLog = this.cycleLogs.get(agentCycleKey);
+            if (mode === 'strict') {
+                const hasInfoGathering = cycleLog?.hasInfoGathering ?? false;
+                if (hasInfoGathering) {
+                    this.emitEvent({
+                        type: 'ACTION_ISOLATION_VIOLATION',
+                        severity: 'ERROR',
+                        orgId,
+                        agentId,
+                        cycleId,
+                        data: {
+                            mode,
+                            remediation: 'deferred-to-next-cycle',
+                            actionClass: action.class,
+                            detail: 'Consequential action blocked: info-gathering actions exist in this cycle. ' +
+                                'Defer the consequential action to a new cycle so the operator can review ' +
+                                'retrieved content before mutation proceeds.',
+                            packBinding,
+                        },
+                    }, agentKey);
+                    throw new ActionIsolationViolationError({
+                        orgId,
+                        agentId,
+                        cycleId,
+                        mode,
+                        remediation: 'deferred-to-next-cycle',
+                        detail: 'Info-gathering detected in this cycle. Consequential action must be deferred to next cycle.',
+                    });
+                }
+                // Allowed in strict mode (no info-gathering in this cycle).
+                this.emitEvent({
+                    type: 'ACTION_ISOLATION_PASSED',
+                    severity: 'NOTICE',
+                    orgId,
+                    agentId,
+                    cycleId,
+                    data: { mode, actionClass: action.class, packBinding },
+                }, agentKey);
+                return {
+                    decision: 'execute',
+                    reason: 'mode:strict -- no info-gathering in this cycle',
+                };
+            }
+            // mode === 'sourced-only'
+            const targetIds = action.targetIds ?? [];
+            const infoGatheringSourceIds = cycleLog?.infoGatheringSourceIds ?? new Set();
+            const overlappingIds = targetIds.filter((id) => infoGatheringSourceIds.has(id));
+            if (overlappingIds.length > 0) {
+                this.emitEvent({
+                    type: 'ACTION_ISOLATION_VIOLATION',
+                    severity: 'ERROR',
+                    orgId,
+                    agentId,
+                    cycleId,
+                    data: {
+                        mode,
+                        remediation: 'sourced-this-cycle',
+                        actionClass: action.class,
+                        overlappingIds,
+                        detail: `Consequential action blocked: targetIds [${overlappingIds.join(', ')}] overlap ` +
+                            `with sourceIds from info-gathering actions in this cycle. ` +
+                            `The agent may be acting on freshly-retrieved (potentially hostile) content. ` +
+                            `Defer to next cycle or use pre-existing data not sourced in this cycle.`,
+                        packBinding,
+                    },
+                }, agentKey);
+                throw new ActionIsolationViolationError({
+                    orgId,
+                    agentId,
+                    cycleId,
+                    mode,
+                    remediation: 'sourced-this-cycle',
+                    detail: `targetIds ${JSON.stringify(overlappingIds)} were sourced in this cycle.`,
+                });
+            }
+            // Allowed: no overlap.
+            this.emitEvent({
+                type: 'ACTION_ISOLATION_PASSED',
+                severity: 'NOTICE',
+                orgId,
+                agentId,
+                cycleId,
+                data: {
+                    mode,
+                    actionClass: action.class,
+                    targetIds,
+                    infoGatheringSourceCount: infoGatheringSourceIds.size,
+                    packBinding,
+                },
+            }, agentKey);
+            return {
+                decision: 'execute',
+                reason: 'mode:sourced-only -- no targetId overlap with cycle info-gathering sources',
+            };
+        }
+        finally {
+            mutex.release();
+        }
+    }
+    /**
+     * Release the per-cycle action log when a cycle completes.
+     * PT-ACTION-ISO-2: A new cycleId starts with an empty log; cleared state
+     * is not carried over even if the cycleId string is reused by a caller.
+     *
+     * The key is agent-scoped (orgId::agentId::cycleId), so clearing agent A's
+     * cycle does not affect agent B's cycle with the same cycleId string.
+     *
+     * @param orgId   Organisation identifier.
+     * @param agentId Agent identifier.
+     * @param cycleId Cycle identifier to clear.
+     */
+    clearCycle(orgId, agentId, cycleId) {
+        const key = this.agentCycleKey(orgId, agentId, cycleId);
+        this.cycleLogs.delete(key);
+        this.cycleMutexes.delete(key);
+    }
+    // -------------------------------------------------------------------------
+    // Private helpers
+    // -------------------------------------------------------------------------
+    agentKey(orgId, agentId) {
+        return `${orgId}::${agentId}`;
+    }
+    /**
+     * Per-agent-cycle compound key. Ensures that two agents running the same
+     * cycleId string have fully independent action logs (multi-agent isolation).
+     */
+    agentCycleKey(orgId, agentId, cycleId) {
+        return `${orgId}::${agentId}::${cycleId}`;
+    }
+    getCycleLog(orgId, agentId, cycleId) {
+        const key = this.agentCycleKey(orgId, agentId, cycleId);
+        if (!this.cycleLogs.has(key)) {
+            this.cycleLogs.set(key, {
+                actions: [],
+                infoGatheringSourceIds: new Set(),
+                hasInfoGathering: false,
+            });
+        }
+        return this.cycleLogs.get(key);
+    }
+    getCycleMutex(orgId, agentId, cycleId) {
+        const key = this.agentCycleKey(orgId, agentId, cycleId);
+        if (!this.cycleMutexes.has(key)) {
+            this.cycleMutexes.set(key, new CycleMutex());
+        }
+        return this.cycleMutexes.get(key);
+    }
+    /**
+     * Resolve the effective isolation mode for an agent.
+     *
+     * Priority order:
+     * 1. Explicitly configured mode (via configure()).
+     * 2. Pack-derived default: if any pack in packBinding is a strict pack,
+     *    default to 'sourced-only'.
+     * 3. Fallback: 'none'.
+     */
+    resolveMode(orgId, agentId, packBinding) {
+        const key = this.agentKey(orgId, agentId);
+        const config = this.configs.get(key);
+        if (config) {
+            return config.mode;
+        }
+        // Pack-derived default.
+        for (const packId of packBinding) {
+            if (STRICT_PACK_IDS.has(packId.toLowerCase())) {
+                return 'sourced-only';
+            }
+        }
+        return 'none';
+    }
+    validatePackBinding(packBinding, operation) {
+        if (!Array.isArray(packBinding) || packBinding.length === 0) {
+            throw new EmptyPackBindingError(operation);
+        }
+    }
+    verifyOperatorIdentity(approverIdentity, orgId, agentId) {
+        if (!approverIdentity || typeof approverIdentity !== 'string' || approverIdentity.trim() === '') {
+            throw new UnauthorizedIsolationConfigError(approverIdentity ?? '', 'approverIdentity must be a non-empty string.');
+        }
+        // Test mode: use injected operator map.
+        if (this.testOperatorMap) {
+            const role = this.testOperatorMap.get(approverIdentity);
+            if (role !== 'ADMIN') {
+                throw new UnauthorizedIsolationConfigError(approverIdentity, `Test operator map: identity '${approverIdentity}' has role '${role ?? 'unknown'}', requires ADMIN.`);
+            }
+            return;
+        }
+        // Production: check via OperatorRoles.
+        if (!this.operatorRoles) {
+            throw new UnauthorizedIsolationConfigError(approverIdentity, 'No OperatorRoles instance provided and no testOperatorMap set.');
+        }
+        const operators = this.operatorRoles.listOperators();
+        const match = operators.find((op) => op.name === approverIdentity || op.id === approverIdentity);
+        if (!match) {
+            throw new UnauthorizedIsolationConfigError(approverIdentity, `Operator '${approverIdentity}' not found in operator registry. ` +
+                'Register via OperatorRoles.createOperator() first.');
+        }
+        if (!match.active) {
+            throw new UnauthorizedIsolationConfigError(approverIdentity, `Operator '${approverIdentity}' (id: ${match.id}) is deactivated.`);
+        }
+        const check = this.operatorRoles.checkPermission(match.id, 'governance.configure');
+        if (!check.allowed) {
+            throw new UnauthorizedIsolationConfigError(approverIdentity, `Operator role '${match.role}' lacks 'governance.configure' permission. ${check.reason}`);
+        }
+    }
+    emitEvent(event, agentKey) {
+        const prevSha = this.chainHead.get(agentKey) ?? this.genesisHash(agentKey);
+        const full = {
+            ...event,
+            timestamp: event.timestamp ?? new Date().toISOString(),
+            prevSha,
+        };
+        // Advance chain head.
+        const newHead = crypto
+            .createHash('sha256')
+            .update(`${prevSha}:${event.type}:${event.cycleId}:${event.timestamp}`)
+            .digest('hex');
+        this.chainHead.set(agentKey, newHead);
+        try {
+            this.auditSink(full);
+        }
+        catch {
+            process.stderr.write(`[ACTION ISOLATION] Audit sink threw for event type: ${event.type}\n`);
+        }
+    }
+    genesisHash(agentKey) {
+        return crypto
+            .createHash('sha256')
+            .update(`action-isolation-genesis-${agentKey}`)
+            .digest('hex');
+    }
+}
+exports.AutonomousActionIsolator = AutonomousActionIsolator;
+// ---------------------------------------------------------------------------
+// Pack default mode helper (exported for pack contributions)
+// ---------------------------------------------------------------------------
+/**
+ * Returns the default isolation mode for a set of pack IDs.
+ * Used by packs that set requiresActionIsolation to communicate their
+ * preferred default to the runtime.
+ *
+ * Strict regulated packs default to 'sourced-only' (not 'strict') because:
+ *   - 'strict' would block all same-cycle mutating actions whenever ANY
+ *     retrieval happened, which is too broad for most regulated workflows.
+ *   - 'sourced-only' specifically blocks consequential actions on freshly-retrieved
+ *     content, which is the precise attack vector (prompt-injection cascade).
+ *   - Operators who need full 'strict' isolation can configure it explicitly.
+ */
+function defaultIsolationModeForPacks(packIds) {
+    for (const id of packIds) {
+        if (STRICT_PACK_IDS.has(id.toLowerCase())) {
+            return 'sourced-only';
+        }
+    }
+    return 'none';
+}
+//# sourceMappingURL=action-isolation.js.map

package/dist/governance/action-isolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-isolation.js","sourceRoot":"","sources":["../../src/governance/action-isolation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuvBH,oEAOC;AA5vBD,oDAAsC;AAGtC,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,OAAO;IACP,gBAAgB;IAChB,eAAe;IACf,MAAM;IACN,SAAS;IACT,SAAS;IACT,SAAS;IACT,QAAQ;IACR,SAAS;IACT,MAAM;IACN,MAAM;IACN,SAAS;CACV,CAAC,CAAC;AAEH,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAa,6BAA8B,SAAQ,KAAK;IAC7C,KAAK,CAAS;IACd,OAAO,CAAS;IAChB,OAAO,CAAS;IAChB,IAAI,CAAgB;IACpB,WAAW,CAAkD;IAEtE,YAAY,IAOX;QACC,KAAK,CACH,wEAAwE;YACtE,IAAI,IAAI,CAAC,OAAO,WAAW,IAAI,CAAC,KAAK,gBAAgB,IAAI,CAAC,OAAO,KAAK;YACtE,SAAS,IAAI,CAAC,IAAI,kBAAkB,IAAI,CAAC,WAAW,aAAa,IAAI,CAAC,MAAM,EAAE,CACjF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,CAAC;CACF;AA3BD,sEA2BC;AAED,MAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,SAAiB;QAC3B,KAAK,CACH,qEAAqE,SAAS,KAAK;YACjF,iFAAiF,CACpF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AARD,sDAQC;AAED,MAAa,gCAAiC,SAAQ,KAAK;IAChD,gBAAgB,CAAS;IAElC,YAAY,gBAAwB,EAAE,MAAc;QAClD,KAAK,CACH,sCAAsC,gBAAgB,yBAAyB;YAC7E,4DAA4D,MAAM,EAAE,CACvE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;CACF;AAXD,4EAWC;AA4HD;;;;GAIG;AACH,MAAM,UAAU;IACN,KAAK,GAAsB,EAAE,CAAC;IAC9B,MAAM,GAAG,KAAK,CAAC;IAEvB,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,OAAO;QACT,CAAC;QACD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAG,CAAC;YACjC,IAAI,EAAE,CAAC;QACT,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAa,wBAAwB;IAClB,SAAS,CAAqB;IAC9B,aAAa,CAAuB;IACrD;;;OAGG;IACc,eAAe,CAAkC;IAElE,sDAAsD;IACrC,OAAO,GAAsC,IAAI,GAAG,EAAE,CAAC;IAExE;;;;OAIG;IACc,SAAS,GAAgC,IAAI,GAAG,EAAE,CAAC;IAEpE;;;;OAIG;IACc,YAAY,GAA4B,IAAI,GAAG,EAAE,CAAC;IAEnE,oDAAoD;IACnC,SAAS,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE5D,YACE,SAA8B,EAC9B,aAA6B,EAC7B,OAAmD;QAEnD,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;IAClD,CAAC;IAED,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAE5E;;;;;;;;OAQG;IACH,SAAS,CACP,KAAa,EACb,OAAe,EACf,IAAmB,EACnB,WAAqB,EACrB,gBAAwB;QAExB,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAyB;YACnC,IAAI;YACJ,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;YAC7B,gBAAgB;YAChB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE9B,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,MAAM;YAChB,KAAK;YACL,OAAO;YACP,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE;SAC9C,EAAE,GAAG,CAAC,CAAC;IACV,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,OAAe,EACf,OAAe,EACf,MAAsB,EACtB,WAAqB;QAErB,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAEtD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAEhE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAE5C,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACrC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;oBAC3C,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACxC,CAAC;gBAED,6DAA6D;gBAC7D,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;oBAC/C,IAAI,CAAC,SAAS,CAAC;wBACb,IAAI,EAAE,oCAAoC;wBAC1C,QAAQ,EAAE,MAAM;wBAChB,KAAK;wBACL,OAAO;wBACP,OAAO;wBACP,IAAI,EAAE;4BACJ,MAAM,EACJ,uDAAuD;gCACvD,kFAAkF;gCAClF,wDAAwD;4BAC1D,WAAW;yBACZ;qBACF,EAAE,QAAQ,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,wBAAwB,CAC5B,KAAa,EACb,OAAe,EACf,OAAe,EACf,MAAgC,EAChC,WAAqB;QAErB,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;QAElE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAE/C,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;YAC1F,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAEnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,gBAAgB,GAAG,QAAQ,EAAE,gBAAgB,IAAI,KAAK,CAAC;gBAC7D,IAAI,gBAAgB,EAAE,CAAC;oBACrB,IAAI,CAAC,SAAS,CAAC;wBACb,IAAI,EAAE,4BAA4B;wBAClC,QAAQ,EAAE,OAAO;wBACjB,KAAK;wBACL,OAAO;wBACP,OAAO;wBACP,IAAI,EAAE;4BACJ,IAAI;4BACJ,WAAW,EAAE,wBAAwB;4BACrC,WAAW,EAAE,MAAM,CAAC,KAAK;4BACzB,MAAM,EACJ,4EAA4E;gCAC5E,2EAA2E;gCAC3E,6CAA6C;4BAC/C,WAAW;yBACZ;qBACF,EAAE,QAAQ,CAAC,CAAC;oBACb,MAAM,IAAI,6BAA6B,CAAC;wBACtC,KAAK;wBACL,OAAO;wBACP,OAAO;wBACP,IAAI;wBACJ,WAAW,EAAE,wBAAwB;wBACrC,MAAM,EACJ,6FAA6F;qBAChG,CAAC,CAAC;gBACL,CAAC;gBAED,4DAA4D;gBAC5D,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,yBAAyB;oBAC/B,QAAQ,EAAE,QAAQ;oBAClB,KAAK;oBACL,OAAO;oBACP,OAAO;oBACP,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE;iBACvD,EAAE,QAAQ,CAAC,CAAC;gBACb,OAAO;oBACL,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,gDAAgD;iBACzD,CAAC;YACJ,CAAC;YAED,0BAA0B;YAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;YACzC,MAAM,sBAAsB,GAAG,QAAQ,EAAE,sBAAsB,IAAI,IAAI,GAAG,EAAU,CAAC;YAErF,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAChF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,4BAA4B;oBAClC,QAAQ,EAAE,OAAO;oBACjB,KAAK;oBACL,OAAO;oBACP,OAAO;oBACP,IAAI,EAAE;wBACJ,IAAI;wBACJ,WAAW,EAAE,oBAAoB;wBACjC,WAAW,EAAE,MAAM,CAAC,KAAK;wBACzB,cAAc;wBACd,MAAM,EACJ,4CAA4C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY;4BACjF,4DAA4D;4BAC5D,8EAA8E;4BAC9E,yEAAyE;wBAC3E,WAAW;qBACZ;iBACF,EAAE,QAAQ,CAAC,CAAC;gBACb,MAAM,IAAI,6BAA6B,CAAC;oBACtC,KAAK;oBACL,OAAO;oBACP,OAAO;oBACP,IAAI;oBACJ,WAAW,EAAE,oBAAoB;oBACjC,MAAM,EAAE,aAAa,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,8BAA8B;iBAClF,CAAC,CAAC;YACL,CAAC;YAED,uBAAuB;YACvB,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,yBAAyB;gBAC/B,QAAQ,EAAE,QAAQ;gBAClB,KAAK;gBACL,OAAO;gBACP,OAAO;gBACP,IAAI,EAAE;oBACJ,IAAI;oBACJ,WAAW,EAAE,MAAM,CAAC,KAAK;oBACzB,SAAS;oBACT,wBAAwB,EAAE,sBAAsB,CAAC,IAAI;oBACrD,WAAW;iBACZ;aACF,EAAE,QAAQ,CAAC,CAAC;YACb,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,4EAA4E;aACrF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,KAAa,EAAE,OAAe,EAAE,OAAe;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAEpE,QAAQ,CAAC,KAAa,EAAE,OAAe;QAC7C,OAAO,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC;IAChC,CAAC;IAED;;;OAGG;IACK,aAAa,CAAC,KAAa,EAAE,OAAe,EAAE,OAAe;QACnE,OAAO,GAAG,KAAK,KAAK,OAAO,KAAK,OAAO,EAAE,CAAC;IAC5C,CAAC;IAEO,WAAW,CAAC,KAAa,EAAE,OAAe,EAAE,OAAe;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE;gBACtB,OAAO,EAAE,EAAE;gBACX,sBAAsB,EAAE,IAAI,GAAG,EAAE;gBACjC,gBAAgB,EAAE,KAAK;aACxB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IAClC,CAAC;IAEO,aAAa,CAAC,KAAa,EAAE,OAAe,EAAE,OAAe;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,UAAU,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;OAQG;IACK,WAAW,CAAC,KAAa,EAAE,OAAe,EAAE,WAAqB;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QAED,wBAAwB;QACxB,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC9C,OAAO,cAAc,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,mBAAmB,CAAC,WAAqB,EAAE,SAAiB;QAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAEO,sBAAsB,CAC5B,gBAAwB,EACxB,KAAa,EACb,OAAe;QAEf,IAAI,CAAC,gBAAgB,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAChG,MAAM,IAAI,gCAAgC,CACxC,gBAAgB,IAAI,EAAE,EACtB,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACxD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,MAAM,IAAI,gCAAgC,CACxC,gBAAgB,EAChB,gCAAgC,gBAAgB,eAAe,IAAI,IAAI,SAAS,oBAAoB,CACrG,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,gCAAgC,CACxC,gBAAgB,EAChB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAC1B,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,gBAAgB,IAAI,EAAE,CAAC,EAAE,KAAK,gBAAgB,CACnE,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,gCAAgC,CACxC,gBAAgB,EAChB,aAAa,gBAAgB,oCAAoC;gBAC/D,oDAAoD,CACvD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,gCAAgC,CACxC,gBAAgB,EAChB,aAAa,gBAAgB,UAAU,KAAK,CAAC,EAAE,mBAAmB,CACnE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACnF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,gCAAgC,CACxC,gBAAgB,EAChB,kBAAkB,KAAK,CAAC,IAAI,8CAA8C,KAAK,CAAC,MAAM,EAAE,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,SAAS,CACf,KAAkF,EAClF,QAAgB;QAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAwB;YAChC,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtD,OAAO;SACR,CAAC;QAEF,sBAAsB;QACtB,MAAM,OAAO,GAAG,MAAM;aACnB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,GAAG,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;aACtE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uDAAuD,KAAK,CAAC,IAAI,IAAI,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,QAAgB;QAClC,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,4BAA4B,QAAQ,EAAE,CAAC;aAC9C,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;CACF;AAtdD,4DAsdC;AAED,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,SAAgB,4BAA4B,CAAC,OAAiB;IAC5D,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC1C,OAAO,cAAc,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/governance/agent-discovery.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Agent Discovery (W2.1 of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Customer-side scan that walks a project directory and produces an
+ * AgentManifest[] for downstream auto-pack-generation (W2.3).
+ *
+ * Runs entirely on the customer's machine (Invariant 10 — push-only;
+ * we never reach into customer infrastructure). The discovery produces a
+ * signed manifest that the customer pushes to us; we never read their
+ * filesystem.
+ *
+ * Detects:
+ *   - Claude Code `agent.md` agent definitions
+ *   - OpenAI Agents SDK `new Agent({...})` instantiations (JS/TS)
+ *   - LangChain `Tool` / `DynamicTool` registrations
+ *   - MCP server entries from `mcp.json` / `.mcp/config.json`
+ *
+ * Each detection produces an AgentManifest the OWASP scanner + auto-pack
+ * generator can consume directly.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-AGENT-DISCOVERY-CLI
+ */
+import type { AgentManifest } from './owasp-agentic-scanner.js';
+export interface DiscoveryOptions {
+    /** Maximum directory depth to walk. Default: 8. */
+    maxDepth?: number;
+    /** Directory names to skip. Default: node_modules, .git, dist, build, .next, .venv. */
+    skipDirs?: string[];
+    /** File extensions to inspect. Default: ts/tsx/js/jsx/mjs/cjs/py/md/json. */
+    fileExtensions?: string[];
+}
+export declare function discoverAgents(rootDir: string, options?: DiscoveryOptions): AgentManifest[];
+//# sourceMappingURL=agent-discovery.d.ts.map