@connexum/ai-governance 1.0.0-beta.11

package/dist/governance/sandbox-replay.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-replay.test.d.ts","sourceRoot":"","sources":["../../src/governance/sandbox-replay.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/governance/sandbox-replay.test.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * RED-GREEN tests for F-NEW-PRODUCT-SANDBOX-REPLAY (W4.2).
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-SANDBOX-REPLAY
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const assert = __importStar(require("node:assert/strict"));
+const sandbox_replay_1 = require("./sandbox-replay");
+(0, node_test_1.describe)('F-NEW-PRODUCT-SANDBOX-REPLAY (W4.2)', () => {
+    (0, node_test_1.it)('ships at least 8 replay sequences', () => {
+        assert.ok(sandbox_replay_1.REPLAY_SEQUENCES.length >= 8);
+    });
+    (0, node_test_1.it)('every sequence has a unique id', () => {
+        const ids = new Set(sandbox_replay_1.REPLAY_SEQUENCES.map((s) => s.id));
+        assert.equal(ids.size, sandbox_replay_1.REPLAY_SEQUENCES.length);
+    });
+    (0, node_test_1.it)('every sequence has at least 3 events', () => {
+        for (const seq of sandbox_replay_1.REPLAY_SEQUENCES) {
+            assert.ok(seq.events.length >= 3, `${seq.id} has < 3 events`);
+        }
+    });
+    (0, node_test_1.it)('events are time-ordered (non-decreasing tMs)', () => {
+        for (const seq of sandbox_replay_1.REPLAY_SEQUENCES) {
+            for (let i = 1; i < seq.events.length; i++) {
+                assert.ok(seq.events[i].tMs >= seq.events[i - 1].tMs, `${seq.id} event ${i} tMs=${seq.events[i].tMs} < prev ${seq.events[i - 1].tMs}`);
+            }
+        }
+    });
+    (0, node_test_1.it)('last event tMs <= sequence durationMs', () => {
+        for (const seq of sandbox_replay_1.REPLAY_SEQUENCES) {
+            const lastT = seq.events[seq.events.length - 1].tMs;
+            assert.ok(lastT <= seq.durationMs, `${seq.id} last event ${lastT} > duration ${seq.durationMs}`);
+        }
+    });
+    (0, node_test_1.it)('every sequence starts with TOOL_CALL_REQUESTED', () => {
+        for (const seq of sandbox_replay_1.REPLAY_SEQUENCES) {
+            assert.equal(seq.events[0].kind, 'TOOL_CALL_REQUESTED', `${seq.id} should start with TOOL_CALL_REQUESTED`);
+        }
+    });
+    (0, node_test_1.it)('outcome ACTION_BLOCKED sequences carry a VERDICT_DENY event', () => {
+        for (const seq of sandbox_replay_1.REPLAY_SEQUENCES) {
+            if (seq.outcome !== 'ACTION_BLOCKED')
+                continue;
+            const deny = seq.events.find((e) => e.kind === 'VERDICT_DENY');
+            assert.ok(deny, `${seq.id} (ACTION_BLOCKED) is missing VERDICT_DENY`);
+        }
+    });
+    (0, node_test_1.it)('outcome APPROVAL_REQUIRED sequences carry a VERDICT_PENDING_APPROVAL event', () => {
+        for (const seq of sandbox_replay_1.REPLAY_SEQUENCES) {
+            if (seq.outcome !== 'APPROVAL_REQUIRED')
+                continue;
+            const pending = seq.events.find((e) => e.kind === 'VERDICT_PENDING_APPROVAL');
+            assert.ok(pending, `${seq.id} (APPROVAL_REQUIRED) is missing VERDICT_PENDING_APPROVAL`);
+        }
+    });
+    (0, node_test_1.it)('outcome INCIDENT_FILED sequences carry a CRITICAL AUDIT_RECORDED', () => {
+        for (const seq of sandbox_replay_1.REPLAY_SEQUENCES) {
+            if (seq.outcome !== 'INCIDENT_FILED')
+                continue;
+            const incident = seq.events.find((e) => e.kind === 'AUDIT_RECORDED' && e.severity === 'CRITICAL');
+            assert.ok(incident, `${seq.id} (INCIDENT_FILED) is missing a CRITICAL AUDIT_RECORDED`);
+        }
+    });
+    (0, node_test_1.it)('listReplaySequences filters by vertical', () => {
+        const hc = (0, sandbox_replay_1.listReplaySequences)({ vertical: 'healthcare' });
+        assert.ok(hc.length >= 1);
+        assert.ok(hc.every((s) => s.vertical === 'healthcare'));
+    });
+    (0, node_test_1.it)('getReplaySequence finds by id', () => {
+        const first = sandbox_replay_1.REPLAY_SEQUENCES[0];
+        const found = (0, sandbox_replay_1.getReplaySequence)(first.id);
+        assert.equal(found?.id, first.id);
+        assert.equal((0, sandbox_replay_1.getReplaySequence)('does-not-exist'), undefined);
+    });
+    (0, node_test_1.it)('covers at least 5 distinct outcomes / verticals between them', () => {
+        const verticals = new Set(sandbox_replay_1.REPLAY_SEQUENCES.map((s) => s.vertical));
+        const outcomes = new Set(sandbox_replay_1.REPLAY_SEQUENCES.map((s) => s.outcome));
+        assert.ok(verticals.size >= 5);
+        assert.ok(outcomes.size >= 3);
+    });
+});
+//# sourceMappingURL=sandbox-replay.test.js.map

package/dist/governance/sandbox-replay.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-replay.test.js","sourceRoot":"","sources":["../../src/governance/sandbox-replay.test.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yCAAyC;AACzC,2DAA6C;AAE7C,qDAI0B;AAE1B,IAAA,oBAAQ,EAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,IAAA,cAAE,EAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,EAAE,CAAC,iCAAgB,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,iCAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,iCAAgB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,KAAK,MAAM,GAAG,IAAI,iCAAgB,EAAE,CAAC;YACnC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,KAAK,MAAM,GAAG,IAAI,iCAAgB,EAAE,CAAC;YACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,MAAM,CAAC,EAAE,CACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAC1C,GAAG,GAAG,CAAC,EAAE,UAAU,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAChF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,KAAK,MAAM,GAAG,IAAI,iCAAgB,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACpD,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,GAAG,GAAG,CAAC,EAAE,eAAe,KAAK,eAAe,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,KAAK,MAAM,GAAG,IAAI,iCAAgB,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,qBAAqB,EAAE,GAAG,GAAG,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,KAAK,MAAM,GAAG,IAAI,iCAAgB,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,OAAO,KAAK,gBAAgB;gBAAE,SAAS;YAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;YAC/D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,EAAE,2CAA2C,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,KAAK,MAAM,GAAG,IAAI,iCAAgB,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,OAAO,KAAK,mBAAmB;gBAAE,SAAS;YAClD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,0BAA0B,CAAC,CAAC;YAC9E,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,EAAE,0DAA0D,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,KAAK,MAAM,GAAG,IAAI,iCAAgB,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,OAAO,KAAK,gBAAgB;gBAAE,SAAS;YAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;YAClG,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,EAAE,wDAAwD,CAAC,CAAC;QACzF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,EAAE,GAAG,IAAA,oCAAmB,EAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,KAAK,GAAG,iCAAgB,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,IAAA,kCAAiB,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,IAAA,kCAAiB,EAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,iCAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,iCAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/governance/self-registration-hook.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Self-Registration Hook (W2.2 of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Runtime-observed agent discovery: the first time an agent fires a tool
+ * call, the hook records its identity and incrementally builds an
+ * AgentManifest from observed activity. Complements W2.1 (static project
+ * scan) — captures agents that don't show up in a code scan (dynamically
+ * instantiated agents, framework-internal agents, agents authored as
+ * notebook cells, etc.).
+ *
+ * Honors Invariant 10 (push-only): hook runs in the customer's process
+ * and emits manifest events through an injected sink. We do not poll the
+ * customer; the customer pushes events to us via the sink they configure.
+ *
+ * Idempotent: subsequent calls for an already-registered agent update the
+ * observed-tools set but do not re-emit the REGISTERED event.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-AGENT-SELF-REGISTRATION
+ */
+import type { ActionContext } from '../adapters/index.js';
+import type { AgentManifest } from './owasp-agentic-scanner.js';
+export type SelfRegistrationEventKind = 'AGENT_REGISTERED' | 'AGENT_TOOL_OBSERVED';
+export interface SelfRegistrationEvent {
+    kind: SelfRegistrationEventKind;
+    agentId: string;
+    orgId: string;
+    tool: string;
+    timestamp: string;
+    /** Full manifest snapshot at the time of this event. */
+    manifest: AgentManifest;
+}
+export type SelfRegistrationSink = (event: SelfRegistrationEvent) => void;
+export interface SelfRegistrationOptions {
+    /** Where to emit registration + tool-observation events. Default: NOOP. */
+    sink?: SelfRegistrationSink;
+    /** LLM provider hint to bake into manifests for agents we observe. */
+    defaultLlmProvider?: string;
+}
+/**
+ * Per-process registry that observes ActionContext events from PreToolUse
+ * hooks and produces / updates AgentManifests.
+ */
+export declare class SelfRegistrationHook {
+    private readonly records;
+    private readonly sink;
+    private readonly defaultLlmProvider?;
+    constructor(options?: SelfRegistrationOptions);
+    /**
+     * Record a single observed tool call. If the agent is unknown, emit
+     * AGENT_REGISTERED. If the tool is new for a known agent, emit
+     * AGENT_TOOL_OBSERVED. Otherwise no event is emitted.
+     *
+     * Always idempotent — safe to call from every PreToolUse fire.
+     */
+    observe(action: ActionContext): void;
+    /** Mark a hook stage as wired on an agent (PreToolUse/PostToolUse/PostResponse). */
+    markHookWired(orgId: string, agentId: string, hook: 'preToolUse' | 'postToolUse' | 'postResponse'): void;
+    /** Read a manifest by orgId + agentId. */
+    getManifest(orgId: string, agentId: string): AgentManifest | undefined;
+    /** List all registered manifests. */
+    listManifests(): AgentManifest[];
+    /** Clear state (typically for tests or per-test isolation). */
+    clear(): void;
+}
+//# sourceMappingURL=self-registration-hook.d.ts.map

package/dist/governance/self-registration-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-registration-hook.d.ts","sourceRoot":"","sources":["../../src/governance/self-registration-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,MAAM,yBAAyB,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;AAEnF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAO1E,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,IAAI,CAAC,EAAE,oBAAoB,CAAC;IAC5B,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAS;gBAEjC,OAAO,GAAE,uBAA4B;IAKjD;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IA+CpC,oFAAoF;IACpF,aAAa,CACX,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,GAAG,aAAa,GAAG,cAAc,GAClD,IAAI;IAeP,0CAA0C;IAC1C,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAItE,qCAAqC;IACrC,aAAa,IAAI,aAAa,EAAE;IAIhC,+DAA+D;IAC/D,KAAK,IAAI,IAAI;CAGd"}

package/dist/governance/self-registration-hook.js

@@ -0,0 +1,116 @@
+"use strict";
+/**
+ * Self-Registration Hook (W2.2 of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Runtime-observed agent discovery: the first time an agent fires a tool
+ * call, the hook records its identity and incrementally builds an
+ * AgentManifest from observed activity. Complements W2.1 (static project
+ * scan) — captures agents that don't show up in a code scan (dynamically
+ * instantiated agents, framework-internal agents, agents authored as
+ * notebook cells, etc.).
+ *
+ * Honors Invariant 10 (push-only): hook runs in the customer's process
+ * and emits manifest events through an injected sink. We do not poll the
+ * customer; the customer pushes events to us via the sink they configure.
+ *
+ * Idempotent: subsequent calls for an already-registered agent update the
+ * observed-tools set but do not re-emit the REGISTERED event.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-AGENT-SELF-REGISTRATION
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SelfRegistrationHook = void 0;
+/**
+ * Per-process registry that observes ActionContext events from PreToolUse
+ * hooks and produces / updates AgentManifests.
+ */
+class SelfRegistrationHook {
+    records = new Map();
+    sink;
+    defaultLlmProvider;
+    constructor(options = {}) {
+        this.sink = options.sink ?? (() => undefined);
+        this.defaultLlmProvider = options.defaultLlmProvider;
+    }
+    /**
+     * Record a single observed tool call. If the agent is unknown, emit
+     * AGENT_REGISTERED. If the tool is new for a known agent, emit
+     * AGENT_TOOL_OBSERVED. Otherwise no event is emitted.
+     *
+     * Always idempotent — safe to call from every PreToolUse fire.
+     */
+    observe(action) {
+        const orgId = action.orgId ?? action.agent?.orgId ?? 'org-unknown';
+        const agentName = action.agent?.name ?? 'agent-unknown';
+        const key = `${orgId}::${agentName}`;
+        const existing = this.records.get(key);
+        const ts = action.timestamp ?? new Date().toISOString();
+        if (!existing) {
+            const tools = new Set([action.toolName]);
+            const manifest = {
+                agentId: agentName,
+                name: agentName,
+                tools: Array.from(tools),
+                llmProvider: this.defaultLlmProvider,
+                hooks: { preToolUse: true, postToolUse: false, postResponse: false },
+            };
+            this.records.set(key, { manifest, tools });
+            this.sink({
+                kind: 'AGENT_REGISTERED',
+                agentId: agentName,
+                orgId,
+                tool: action.toolName,
+                timestamp: ts,
+                manifest,
+            });
+            return;
+        }
+        if (existing.tools.has(action.toolName)) {
+            // No change — idempotent.
+            return;
+        }
+        existing.tools.add(action.toolName);
+        existing.manifest = {
+            ...existing.manifest,
+            tools: Array.from(existing.tools).sort(),
+        };
+        this.sink({
+            kind: 'AGENT_TOOL_OBSERVED',
+            agentId: agentName,
+            orgId,
+            tool: action.toolName,
+            timestamp: ts,
+            manifest: existing.manifest,
+        });
+    }
+    /** Mark a hook stage as wired on an agent (PreToolUse/PostToolUse/PostResponse). */
+    markHookWired(orgId, agentId, hook) {
+        const key = `${orgId}::${agentId}`;
+        const record = this.records.get(key);
+        if (!record)
+            return;
+        record.manifest = {
+            ...record.manifest,
+            hooks: {
+                preToolUse: record.manifest.hooks?.preToolUse ?? false,
+                postToolUse: record.manifest.hooks?.postToolUse ?? false,
+                postResponse: record.manifest.hooks?.postResponse ?? false,
+                [hook]: true,
+            },
+        };
+    }
+    /** Read a manifest by orgId + agentId. */
+    getManifest(orgId, agentId) {
+        return this.records.get(`${orgId}::${agentId}`)?.manifest;
+    }
+    /** List all registered manifests. */
+    listManifests() {
+        return Array.from(this.records.values()).map((r) => r.manifest);
+    }
+    /** Clear state (typically for tests or per-test isolation). */
+    clear() {
+        this.records.clear();
+    }
+}
+exports.SelfRegistrationHook = SelfRegistrationHook;
+//# sourceMappingURL=self-registration-hook.js.map

package/dist/governance/self-registration-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-registration-hook.js","sourceRoot":"","sources":["../../src/governance/self-registration-hook.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AA+BH;;;GAGG;AACH,MAAa,oBAAoB;IACd,OAAO,GAA6B,IAAI,GAAG,EAAE,CAAC;IAC9C,IAAI,CAAuB;IAC3B,kBAAkB,CAAU;IAE7C,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAqB;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,aAAa,CAAC;QACnE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,eAAe,CAAC;QACxD,MAAM,GAAG,GAAG,GAAG,KAAK,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAExD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAkB;gBAC9B,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;gBACxB,WAAW,EAAE,IAAI,CAAC,kBAAkB;gBACpC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE;aACrE,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,SAAS;gBAClB,KAAK;gBACL,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,SAAS,EAAE,EAAE;gBACb,QAAQ;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,0BAA0B;YAC1B,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,QAAQ,CAAC,QAAQ,GAAG;YAClB,GAAG,QAAQ,CAAC,QAAQ;YACpB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;SACzC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,SAAS;YAClB,KAAK;YACL,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,oFAAoF;IACpF,aAAa,CACX,KAAa,EACb,OAAe,EACf,IAAmD;QAEnD,MAAM,GAAG,GAAG,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,CAAC,QAAQ,GAAG;YAChB,GAAG,MAAM,CAAC,QAAQ;YAClB,KAAK,EAAE;gBACL,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,IAAI,KAAK;gBACtD,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,IAAI,KAAK;gBACxD,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,IAAI,KAAK;gBAC1D,CAAC,IAAI,CAAC,EAAE,IAAI;aACb;SACF,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,WAAW,CAAC,KAAa,EAAE,OAAe;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC;IAC5D,CAAC;IAED,qCAAqC;IACrC,aAAa;QACX,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;IAED,+DAA+D;IAC/D,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAlGD,oDAkGC"}

package/dist/governance/self-registration-hook.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * RED-GREEN tests for F-NEW-PRODUCT-AGENT-SELF-REGISTRATION (W2.2).
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-AGENT-SELF-REGISTRATION
+ */
+export {};
+//# sourceMappingURL=self-registration-hook.test.d.ts.map

package/dist/governance/self-registration-hook.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-registration-hook.test.d.ts","sourceRoot":"","sources":["../../src/governance/self-registration-hook.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/governance/self-registration-hook.test.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * RED-GREEN tests for F-NEW-PRODUCT-AGENT-SELF-REGISTRATION (W2.2).
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-AGENT-SELF-REGISTRATION
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const assert = __importStar(require("node:assert/strict"));
+const self_registration_hook_1 = require("./self-registration-hook");
+const index_1 = require("../adapters/index");
+function action(toolName, agentName = 'agent-a', orgId = 'org-x') {
+    return (0, index_1.createActionContext)(toolName, {}, { name: agentName, orgId });
+}
+(0, node_test_1.describe)('F-NEW-PRODUCT-AGENT-SELF-REGISTRATION (W2.2)', () => {
+    (0, node_test_1.it)('first observe emits AGENT_REGISTERED with the initial tool', () => {
+        const events = [];
+        const hook = new self_registration_hook_1.SelfRegistrationHook({ sink: (e) => events.push(e) });
+        hook.observe(action('Bash'));
+        assert.equal(events.length, 1);
+        assert.equal(events[0].kind, 'AGENT_REGISTERED');
+        assert.equal(events[0].agentId, 'agent-a');
+        assert.equal(events[0].orgId, 'org-x');
+        assert.equal(events[0].tool, 'Bash');
+        assert.deepEqual(events[0].manifest.tools, ['Bash']);
+    });
+    (0, node_test_1.it)('observing the same tool twice is idempotent (no second event)', () => {
+        const events = [];
+        const hook = new self_registration_hook_1.SelfRegistrationHook({ sink: (e) => events.push(e) });
+        hook.observe(action('Bash'));
+        hook.observe(action('Bash'));
+        assert.equal(events.length, 1);
+    });
+    (0, node_test_1.it)('observing a NEW tool on a known agent emits AGENT_TOOL_OBSERVED', () => {
+        const events = [];
+        const hook = new self_registration_hook_1.SelfRegistrationHook({ sink: (e) => events.push(e) });
+        hook.observe(action('Bash'));
+        hook.observe(action('WebFetch'));
+        assert.equal(events.length, 2);
+        assert.equal(events[1].kind, 'AGENT_TOOL_OBSERVED');
+        assert.equal(events[1].tool, 'WebFetch');
+        assert.deepEqual(events[1].manifest.tools.sort(), ['Bash', 'WebFetch']);
+    });
+    (0, node_test_1.it)('per-org isolation: two orgs with same agentName are separate registrations', () => {
+        const events = [];
+        const hook = new self_registration_hook_1.SelfRegistrationHook({ sink: (e) => events.push(e) });
+        hook.observe(action('Bash', 'agent-a', 'org-1'));
+        hook.observe(action('Bash', 'agent-a', 'org-2'));
+        assert.equal(events.length, 2);
+        assert.equal(events[0].orgId, 'org-1');
+        assert.equal(events[1].orgId, 'org-2');
+        assert.equal(events[0].kind, 'AGENT_REGISTERED');
+        assert.equal(events[1].kind, 'AGENT_REGISTERED');
+    });
+    (0, node_test_1.it)('listManifests returns all registered agents', () => {
+        const hook = new self_registration_hook_1.SelfRegistrationHook();
+        hook.observe(action('Bash', 'a'));
+        hook.observe(action('WebFetch', 'a'));
+        hook.observe(action('Read', 'b'));
+        const manifests = hook.listManifests();
+        assert.equal(manifests.length, 2);
+        const names = manifests.map((m) => m.agentId).sort();
+        assert.deepEqual(names, ['a', 'b']);
+    });
+    (0, node_test_1.it)('getManifest returns the latest snapshot for a known agent', () => {
+        const hook = new self_registration_hook_1.SelfRegistrationHook();
+        hook.observe(action('Bash'));
+        hook.observe(action('WebFetch'));
+        const m = hook.getManifest('org-x', 'agent-a');
+        assert.ok(m);
+        assert.deepEqual(m?.tools.sort(), ['Bash', 'WebFetch']);
+    });
+    (0, node_test_1.it)('markHookWired flips the right hook flag', () => {
+        const hook = new self_registration_hook_1.SelfRegistrationHook();
+        hook.observe(action('Bash'));
+        hook.markHookWired('org-x', 'agent-a', 'postToolUse');
+        const m = hook.getManifest('org-x', 'agent-a');
+        assert.equal(m?.hooks?.preToolUse, true, 'preToolUse stays true (observe came in via the hook)');
+        assert.equal(m?.hooks?.postToolUse, true);
+        assert.equal(m?.hooks?.postResponse, false);
+    });
+    (0, node_test_1.it)('defaultLlmProvider is baked into observed manifests', () => {
+        const hook = new self_registration_hook_1.SelfRegistrationHook({ defaultLlmProvider: 'connexum-proxy/anthropic' });
+        hook.observe(action('Bash'));
+        const m = hook.getManifest('org-x', 'agent-a');
+        assert.equal(m?.llmProvider, 'connexum-proxy/anthropic');
+    });
+    (0, node_test_1.it)('downstream: observed manifest feeds autoGenerateCompanyPack', async () => {
+        const hook = new self_registration_hook_1.SelfRegistrationHook();
+        hook.observe(action('Bash'));
+        hook.observe(action('WebFetch'));
+        const manifest = hook.getManifest('org-x', 'agent-a');
+        const { autoGenerateCompanyPack } = await Promise.resolve().then(() => __importStar(require('./auto-pack-generator.js')));
+        const result = autoGenerateCompanyPack(manifest, { acceptAllSuggestedRules: true });
+        // Lethal trifecta -- A01 CRIT finding expected
+        assert.ok(result.scanReport.findings.some((f) => f.risk.startsWith('A01')), 'A01 prompt injection detected on Bash+WebFetch agent');
+    });
+    (0, node_test_1.it)('clear() resets state', () => {
+        const hook = new self_registration_hook_1.SelfRegistrationHook();
+        hook.observe(action('Bash'));
+        hook.clear();
+        assert.equal(hook.listManifests().length, 0);
+        assert.equal(hook.getManifest('org-x', 'agent-a'), undefined);
+    });
+    (0, node_test_1.it)('unknown orgId / agentName falls back gracefully', () => {
+        const hook = new self_registration_hook_1.SelfRegistrationHook();
+        // ActionContext with no agent / orgId set
+        const ac = (0, index_1.createActionContext)('Bash', {}, { name: 'fallback-test', orgId: undefined });
+        delete ac.orgId;
+        delete ac.agent.orgId;
+        hook.observe(ac);
+        const all = hook.listManifests();
+        assert.equal(all.length, 1);
+    });
+});
+//# sourceMappingURL=self-registration-hook.test.js.map

package/dist/governance/self-registration-hook.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-registration-hook.test.js","sourceRoot":"","sources":["../../src/governance/self-registration-hook.test.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yCAAyC;AACzC,2DAA6C;AAE7C,qEAA4F;AAC5F,6CAAwD;AAExD,SAAS,MAAM,CAAC,QAAgB,EAAE,SAAS,GAAG,SAAS,EAAE,KAAK,GAAG,OAAO;IACtE,OAAO,IAAA,2BAAmB,EAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,IAAA,oBAAQ,EAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,IAAA,cAAE,EAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,6CAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAEvE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAE7B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,6CAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAEvE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAE7B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,6CAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAEvE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAEjC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,6CAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAEvE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAEjD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,IAAI,GAAG,IAAI,6CAAoB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QAElC,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,IAAI,GAAG,IAAI,6CAAoB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAEjC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,IAAI,GAAG,IAAI,6CAAoB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAE7B,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,sDAAsD,CAAC,CAAC;QACjG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GAAG,IAAI,6CAAoB,CAAC,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAE7B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,EAAE,0BAA0B,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,IAAI,GAAG,IAAI,6CAAoB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAE,CAAC;QACvD,MAAM,EAAE,uBAAuB,EAAE,GAAG,wDAAa,0BAA0B,GAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpF,+CAA+C;QAC/C,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAChE,sDAAsD,CACvD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,IAAI,GAAG,IAAI,6CAAoB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,IAAI,GAAG,IAAI,6CAAoB,EAAE,CAAC;QACxC,0CAA0C;QAC1C,MAAM,EAAE,GAAG,IAAA,2BAAmB,EAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,OAAQ,EAAU,CAAC,KAAK,CAAC;QACzB,OAAQ,EAAE,CAAC,KAAa,CAAC,KAAK,CAAC;QAE/B,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/governance/session-persistence.d.ts

@@ -0,0 +1,153 @@
+/**
+ * SessionPersistence -- Save/restore agent state across sessions.
+ *
+ * Handles session start recovery, pre-compact state dumps,
+ * and session end summaries. Ensures zero context loss during
+ * compaction or session boundaries.
+ *
+ * @connexum/ai-governance
+ */
+export interface SessionState {
+    sessionId: string;
+    agentName: string;
+    startedAt: string;
+    lastSavedAt: string;
+    /** Active tasks at time of save */
+    activeTasks: TaskSnapshot[];
+    /** Files modified in this session */
+    modifiedFiles: string[];
+    /** Pending decisions awaiting human input */
+    pendingDecisions: PendingDecision[];
+    /** Token usage so far */
+    tokenUsage: {
+        input: number;
+        output: number;
+        cost: number;
+    };
+    /** Custom state the agent wants to persist */
+    customState: Record<string, unknown>;
+    /** SHA-256 of the serialized state (excluding this field) */
+    integrity: string;
+}
+export interface TaskSnapshot {
+    id: string;
+    description: string;
+    status: 'in_progress' | 'blocked' | 'waiting';
+    startedAt: string;
+    context?: string;
+}
+export interface PendingDecision {
+    id: string;
+    description: string;
+    options: string[];
+    requestedAt: string;
+    requiredApprover?: string;
+}
+export interface SessionSummary {
+    sessionId: string;
+    agentName: string;
+    duration: string;
+    tasksCompleted: number;
+    tasksRemaining: number;
+    filesModified: string[];
+    tokenUsage: {
+        input: number;
+        output: number;
+        cost: number;
+    };
+    decisionsResolved: number;
+    decisionsPending: number;
+    summary: string;
+}
+/** Minimal encryption interface for loose coupling with EncryptedStorage (T-033) */
+export interface SessionEncryption {
+    writeEncrypted(filePath: string, data: string): void;
+    readEncrypted(filePath: string): string;
+}
+export interface SessionPersistenceConfig {
+    /** Base directory for session data */
+    stateDir: string;
+    /** Agent name */
+    agentName: string;
+    /** Daily logs directory */
+    dailyLogDir?: string;
+    /** Maximum session states to keep (default: 10) */
+    maxStates?: number;
+    /** T-033: Encryption for session state at rest */
+    encryption?: SessionEncryption;
+}
+export declare class SessionPersistence {
+    private config;
+    private currentState;
+    private encryption?;
+    constructor(config: SessionPersistenceConfig);
+    private ensureDirectories;
+    /**
+     * Start a new session. Checks for interrupted work from previous session.
+     * Returns the previous state if one exists (for recovery).
+     */
+    startSession(): {
+        sessionId: string;
+        previousState: SessionState | null;
+        interrupted: boolean;
+    };
+    /**
+     * Save current session state to disk. Call before compaction or periodically.
+     */
+    saveState(updates?: Partial<Pick<SessionState, 'activeTasks' | 'modifiedFiles' | 'pendingDecisions' | 'tokenUsage' | 'customState'>>): void;
+    /**
+     * Record a file modification in the current session.
+     */
+    recordFileModification(filePath: string): void;
+    /**
+     * Record token usage.
+     */
+    recordTokenUsage(input: number, output: number, cost: number): void;
+    /**
+     * Add or update a task in the current session.
+     */
+    updateTask(task: TaskSnapshot): void;
+    /**
+     * Remove a completed task.
+     */
+    completeTask(taskId: string): TaskSnapshot | undefined;
+    /**
+     * Pre-compact dump: saves full state + writes daily log entry.
+     * Called by pre-compact hook before context compaction.
+     */
+    preCompactDump(): string;
+    /**
+     * End session: generate summary, write final state + daily log.
+     */
+    endSession(summary: string): SessionSummary;
+    /**
+     * Load the most recent session state from disk.
+     */
+    loadLatestState(): SessionState | null;
+    /**
+     * Search past session logs by keyword.
+     */
+    searchSessionLogs(query: string, maxResults?: number): Array<{
+        date: string;
+        entry: Record<string, unknown>;
+    }>;
+    /**
+     * Get session metrics for the current session.
+     */
+    getMetrics(): {
+        tokenUsage: SessionState['tokenUsage'];
+        filesModified: number;
+        activeTasks: number;
+        elapsed: string;
+    } | null;
+    /**
+     * Get the current state (read-only snapshot).
+     */
+    getCurrentState(): Readonly<SessionState> | null;
+    private stateFilePath;
+    private listStateFiles;
+    private loadAndVerifyState;
+    private computeIntegrity;
+    private pruneOldStates;
+}
+//# sourceMappingURL=session-persistence.d.ts.map

package/dist/governance/session-persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-persistence.d.ts","sourceRoot":"","sources":["../../src/governance/session-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,qCAAqC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,6CAA6C;IAC7C,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,yBAAyB;IACzB,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACrD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,wBAAwB;IACvC,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAA8F;IAC5G,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,UAAU,CAAC,CAAoB;gBAE3B,MAAM,EAAE,wBAAwB;IAW5C,OAAO,CAAC,iBAAiB;IAQzB;;;OAGG;IACH,YAAY,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE;IAsC/F;;OAEG;IACH,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,eAAe,GAAG,kBAAkB,GAAG,YAAY,GAAG,aAAa,CAAC,CAAC,GAAG,IAAI;IAkC3I;;OAEG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAO9C;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAOnE;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAUpC;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAUtD;;;OAGG;IACH,cAAc,IAAI,MAAM;IA0BxB;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc;IA0C3C;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IActC;;OAEG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,GAAE,MAAW,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAmClH;;OAEG;IACH,UAAU,IAAI;QAAE,UAAU,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAY5H;;OAEG;IACH,eAAe,IAAI,QAAQ,CAAC,YAAY,CAAC,GAAG,IAAI;IAMhD,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,kBAAkB;IAsB1B,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,cAAc;CAavB"}