@corenel/harness 0.1.0

package/dist/guardrail/builtins.js

@@ -0,0 +1,61 @@
+/** Default: read freely, ask before any side effect (file/memory writes). */
+export const STANDARD_POLICY = {
+    version: 1,
+    name: 'standard',
+    description: 'Read-only tools run automatically; writes ask for approval.',
+    onViolation: 'stop',
+    maxTurns: 8,
+    permissions: {
+        'prompd:propose_edit': 'allow', // proposals are reviewed in the diff UI, not applied directly
+        'system:*': 'deny', // harness self-configuration is never automatic
+    },
+    // defaultPermission omitted -> the mutates heuristic (reads allow, writes ask)
+};
+/** Strict: no side effects at all. Mutating tools are denied outright. */
+export const READ_ONLY_POLICY = {
+    version: 1,
+    name: 'read-only',
+    description: 'Inspection only — all writes and side effects are refused.',
+    onViolation: 'stop',
+    maxTurns: 8,
+    tools: {
+        deny: [
+            'fs:write_file', 'fs:create_file', 'fs:delete_file', 'fs:rename_file',
+            // Sidecar fs write tools address as fs:fs_write_file etc.; cover them and any
+            // future fs mutator with the namespace glob (reads address fs:read_file, but
+            // mutating fs tools are caught here AND by mutatingDefault below).
+            'fs:fs_write_file',
+            // Shell execution (sidecar shell_exec, address shell:shell_exec) is a side
+            // effect — denied outright under read-only, regardless of its own permission.
+            'shell:*',
+            'memory:save_memory', 'memory:kv_set',
+            'system:*',
+        ],
+    },
+    permissions: {
+        'fs:write_file': 'deny', 'fs:create_file': 'deny', 'fs:delete_file': 'deny', 'fs:rename_file': 'deny',
+        'memory:save_memory': 'deny', 'memory:kv_set': 'deny',
+        'system:*': 'deny',
+    },
+    // Backstop: any other mutating tool (a dynamic MCP/skill write the deny list
+    // can't name) is refused too, while unknown read-only tools still run.
+    mutatingDefault: 'deny',
+};
+/** Unattended: everything runs without prompting, except harness self-config. */
+export const AUTONOMOUS_POLICY = {
+    version: 1,
+    name: 'autonomous',
+    description: 'Everything runs automatically — no approval prompts (system config still asks).',
+    onViolation: 'warn',
+    maxTurns: 16,
+    permissions: {
+        'system:*': 'ask', // even unattended, never silently reconfigure the harness
+    },
+    defaultPermission: 'allow',
+};
+export const BUILTIN_POLICIES = {
+    standard: STANDARD_POLICY,
+    'read-only': READ_ONLY_POLICY,
+    autonomous: AUTONOMOUS_POLICY,
+};
+//# sourceMappingURL=builtins.js.map

package/dist/guardrail/builtins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtins.js","sourceRoot":"","sources":["../../guardrail/builtins.ts"],"names":[],"mappings":"AAQA,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAW;IACrC,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,6DAA6D;IAC1E,WAAW,EAAE,MAAM;IACnB,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE;QACX,qBAAqB,EAAE,OAAO,EAAE,8DAA8D;QAC9F,UAAU,EAAE,MAAM,EAAE,gDAAgD;KACrE;IACD,+EAA+E;CAChF,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAW;IACtC,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,4DAA4D;IACzE,WAAW,EAAE,MAAM;IACnB,QAAQ,EAAE,CAAC;IACX,KAAK,EAAE;QACL,IAAI,EAAE;YACJ,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB;YACrE,8EAA8E;YAC9E,6EAA6E;YAC7E,mEAAmE;YACnE,kBAAkB;YAClB,2EAA2E;YAC3E,8EAA8E;YAC9E,SAAS;YACT,oBAAoB,EAAE,eAAe;YACrC,UAAU;SACX;KACF;IACD,WAAW,EAAE;QACX,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM;QACrG,oBAAoB,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM;QACrD,UAAU,EAAE,MAAM;KACnB;IACD,6EAA6E;IAC7E,uEAAuE;IACvE,eAAe,EAAE,MAAM;CACxB,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAW;IACvC,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,iFAAiF;IAC9F,WAAW,EAAE,MAAM;IACnB,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE;QACX,UAAU,EAAE,KAAK,EAAE,0DAA0D;KAC9E;IACD,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,QAAQ,EAAE,eAAe;IACzB,WAAW,EAAE,gBAAgB;IAC7B,UAAU,EAAE,iBAAiB;CAC9B,CAAC"}

package/dist/guardrail/glob.d.ts

@@ -0,0 +1,3 @@
+export declare function globToRegex(glob: string): RegExp;
+export declare function matchesAnyGlob(name: string, globs: readonly string[]): boolean;
+//# sourceMappingURL=glob.d.ts.map

package/dist/guardrail/glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../../guardrail/glob.ts"],"names":[],"mappings":"AAKA,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBhD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE9E"}

package/dist/guardrail/glob.js

@@ -0,0 +1,33 @@
+/* Tool-name glob matching — browser-safe port of the Marshal harness matcher.
+ * `*` matches within a dot-segment, `**` matches across dots. Our tool names have
+ * no dots (compile_prompd, kv_set), so `*` matches a whole name and `kv_*` etc.
+ * work as expected. */
+export function globToRegex(glob) {
+    let src = '';
+    for (let i = 0; i < glob.length; i++) {
+        const c = glob[i];
+        if (c === '*') {
+            if (glob[i + 1] === '*') {
+                src += '.*';
+                i++;
+            }
+            else {
+                src += '[^.]*';
+            }
+        }
+        else if (c === '?') {
+            src += '[^.]';
+        }
+        else if ('.+^$()[]{}|\\'.includes(c)) {
+            src += '\\' + c;
+        }
+        else {
+            src += c;
+        }
+    }
+    return new RegExp(`^${src}$`);
+}
+export function matchesAnyGlob(name, globs) {
+    return globs.some((g) => globToRegex(g).test(name));
+}
+//# sourceMappingURL=glob.js.map

package/dist/guardrail/glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../../guardrail/glob.ts"],"names":[],"mappings":"AAAA;;;uBAGuB;AAEvB,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,GAAG,IAAI,MAAM,CAAC;QAChB,CAAC;aAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAwB;IACnE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/guardrail/guardrail.d.ts

@@ -0,0 +1,25 @@
+import type { Policy, Violation, GuardrailDecision } from '@corenel/protocol';
+export interface GuardrailState {
+    turn: number;
+    toolCalls: number;
+    calledTools: Set<string>;
+}
+export interface ToolCallSubject {
+    name: string;
+    exists: boolean;
+    /** Policy address (`namespace:name`) so allow/deny globs may target a whole
+     * namespace (`fs:*`). Falls back to bare-name matching when absent. */
+    address?: string;
+}
+export declare function initialState(): GuardrailState;
+/** Turn-budget check, evaluated at the start of each turn. */
+export declare function evaluateTurnStart(policy: Policy, state: GuardrailState): GuardrailDecision;
+/**
+ * Tool-call gate. Order: exists -> deny -> allow-list -> tool-call budget.
+ * `deny` always blocks and beats `allow`. With an `allow` list present, any tool
+ * not matching it is blocked.
+ */
+export declare function evaluateToolCall(policy: Policy, state: GuardrailState, call: ToolCallSubject): GuardrailDecision;
+/** Completion check: every `mustCall` tool must have been invoked. Always stop. */
+export declare function evaluateCompletion(policy: Policy, state: GuardrailState): Violation[];
+//# sourceMappingURL=guardrail.d.ts.map

package/dist/guardrail/guardrail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrail.d.ts","sourceRoot":"","sources":["../../guardrail/guardrail.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAkC,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE9G,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB;2EACuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AASD,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAgBD,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,iBAAiB,CAK1F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,eAAe,GACpB,iBAAiB,CAkBnB;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,SAAS,EAAE,CAKrF"}

package/dist/guardrail/guardrail.js

@@ -0,0 +1,67 @@
+/* Guardrail evaluator — the hard gates. Pure functions over a small mutable
+ * state object the loop threads through a run. Adapted from the Marshal harness
+ * (filesystem/cwd/phase rules dropped; this harness has no disk or shell). */
+import { matchesAnyGlob } from './glob';
+/** Match a glob list against a tool's address (if any) and its bare name. */
+function callMatches(call, globs) {
+    if (!globs.length)
+        return false;
+    if (call.address && matchesAnyGlob(call.address, globs))
+        return true;
+    return matchesAnyGlob(call.name, globs);
+}
+export function initialState() {
+    return { turn: 0, toolCalls: 0, calledTools: new Set() };
+}
+function onViolation(policy) {
+    return policy.onViolation ?? 'stop';
+}
+function violate(kind, message, action, tool) {
+    const violation = tool ? { kind, message, tool } : { kind, message };
+    return { ok: false, violation, action };
+}
+/** Turn-budget check, evaluated at the start of each turn. */
+export function evaluateTurnStart(policy, state) {
+    if (policy.maxTurns !== undefined && state.turn >= policy.maxTurns) {
+        return violate('MAX_TURNS', `Exceeded maxTurns=${policy.maxTurns}`, onViolation(policy));
+    }
+    return { ok: true };
+}
+/**
+ * Tool-call gate. Order: exists -> deny -> allow-list -> tool-call budget.
+ * `deny` always blocks and beats `allow`. With an `allow` list present, any tool
+ * not matching it is blocked.
+ */
+export function evaluateToolCall(policy, state, call) {
+    if (!call.exists) {
+        return violate('UNKNOWN_TOOL', `Model invoked unknown tool: ${call.name}`, 'stop', call.name);
+    }
+    const allow = policy.tools?.allow ?? [];
+    const deny = policy.tools?.deny ?? [];
+    if (deny.length && callMatches(call, deny)) {
+        return violate('TOOL_DENIED', `Tool denied by policy: ${call.name}`, onViolation(policy), call.name);
+    }
+    if (allow.length && !callMatches(call, allow)) {
+        return violate('TOOL_NOT_ALLOWED', `Tool not in allow list: ${call.name}`, onViolation(policy), call.name);
+    }
+    if (policy.maxToolCalls !== undefined && state.toolCalls + 1 > policy.maxToolCalls) {
+        return violate('MAX_TOOL_CALLS', `Exceeded maxToolCalls=${policy.maxToolCalls}`, onViolation(policy), call.name);
+    }
+    return { ok: true };
+}
+/** Completion check: every `mustCall` tool must have been invoked. Always stop. */
+export function evaluateCompletion(policy, state) {
+    const mustCall = policy.mustCall ?? [];
+    const missing = mustCall.filter((name) => !matchesAnyGlob2(name, state.calledTools));
+    if (!missing.length)
+        return [];
+    return [{ kind: 'MUST_CALL_MISSING', message: `Required tools were not invoked: ${missing.join(', ')}` }];
+}
+/** mustCall entries may be globs; a called tool satisfies it if it matches. */
+function matchesAnyGlob2(globOrName, called) {
+    for (const name of called)
+        if (matchesAnyGlob(name, [globOrName]))
+            return true;
+    return false;
+}
+//# sourceMappingURL=guardrail.js.map

package/dist/guardrail/guardrail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrail.js","sourceRoot":"","sources":["../../guardrail/guardrail.ts"],"names":[],"mappings":"AAAA;;8EAE8E;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAiBxC,6EAA6E;AAC7E,SAAS,WAAW,CAAC,IAAqB,EAAE,KAAwB;IAClE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;AACtC,CAAC;AAED,SAAS,OAAO,CACd,IAAmB,EACnB,OAAe,EACf,MAAuB,EACvB,IAAa;IAEb,MAAM,SAAS,GAAc,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,KAAqB;IACrE,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC,WAAW,EAAE,qBAAqB,MAAM,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,KAAqB,EACrB,IAAqB;IAErB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,cAAc,EAAE,+BAA+B,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAEtC,IAAI,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,aAAa,EAAE,0BAA0B,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,kBAAkB,EAAE,2BAA2B,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QACnF,OAAO,OAAO,CAAC,gBAAgB,EAAE,yBAAyB,MAAM,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,KAAqB;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC/B,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5G,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,UAAkB,EAAE,MAAmB;IAC9D,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/guardrail/index.d.ts

@@ -0,0 +1,9 @@
+export * from '@corenel/protocol';
+export { matchesAnyGlob, globToRegex } from './glob';
+export { initialState, evaluateTurnStart, evaluateToolCall, evaluateCompletion, type GuardrailState, type ToolCallSubject, } from './guardrail';
+export { PermissionService, mostRestrictive, type PermissionSubject, type PermissionPrompt, type PermissionServiceOptions, } from './permission-service';
+export { STANDARD_POLICY, READ_ONLY_POLICY, AUTONOMOUS_POLICY, BUILTIN_POLICIES } from './builtins';
+export { validatePolicy, type PolicyValidationResult } from './validate';
+export { policyToYaml, policyFromYaml } from './serialize';
+export { listPolicies, getPolicy, isBuiltinPolicy, saveCustomPolicy, deleteCustomPolicy, getSelectedPolicyName, setSelectedPolicyName, resolveSelectedPolicy, type PolicyEntry, type PolicySaveResult, } from './store';
+//# sourceMappingURL=index.d.ts.map

package/dist/guardrail/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../guardrail/index.ts"],"names":[],"mappings":"AAEA,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EACL,YAAY,EACZ,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,SAAS,CAAC"}

package/dist/guardrail/index.js

@@ -0,0 +1,11 @@
+/* Policy module barrel. The harness's baked-in governance layer:
+ * guardrail (hard gates) + permission service (per-tool oversight) + built-ins. */
+export * from '@corenel/protocol';
+export { matchesAnyGlob, globToRegex } from './glob';
+export { initialState, evaluateTurnStart, evaluateToolCall, evaluateCompletion, } from './guardrail';
+export { PermissionService, mostRestrictive, } from './permission-service';
+export { STANDARD_POLICY, READ_ONLY_POLICY, AUTONOMOUS_POLICY, BUILTIN_POLICIES } from './builtins';
+export { validatePolicy } from './validate';
+export { policyToYaml, policyFromYaml } from './serialize';
+export { listPolicies, getPolicy, isBuiltinPolicy, saveCustomPolicy, deleteCustomPolicy, getSelectedPolicyName, setSelectedPolicyName, resolveSelectedPolicy, } from './store';
+//# sourceMappingURL=index.js.map

package/dist/guardrail/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../guardrail/index.ts"],"names":[],"mappings":"AAAA;mFACmF;AACnF,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,eAAe,GAIhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpG,OAAO,EAAE,cAAc,EAA+B,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EACL,YAAY,EACZ,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,GAGtB,MAAM,SAAS,CAAC"}

package/dist/guardrail/permission-service.d.ts

@@ -0,0 +1,53 @@
+import type { Policy, PermissionLevel, PermissionCeiling, PermissionDecision } from '@corenel/protocol';
+/** Minimal tool shape the resolver needs (a subset of AgentTool). */
+export interface PermissionSubject {
+    name: string;
+    /** Policy address (`namespace:name`), so `permissions` globs may target a whole
+     * namespace (`fs:*`) or one tool. Falls back to bare-name matching when absent. */
+    address?: string;
+    /** Tool can have side effects (writes/network). Drives the default heuristic. */
+    mutates?: boolean;
+    /** Tool-declared default level (beats the heuristic, loses to policy). */
+    permission?: PermissionLevel;
+}
+export interface PermissionPrompt {
+    ask(req: {
+        tool: string;
+        input: unknown;
+    }): Promise<PermissionDecision>;
+}
+export interface PermissionServiceOptions {
+    policy: Policy;
+    prompt?: PermissionPrompt;
+    /** Level for read-only (non-mutating) tools with no explicit rule. Default "auto". */
+    defaultForReadOnly?: PermissionLevel;
+    /** Level for mutating tools with no explicit rule. Default "ask". */
+    defaultForMutating?: PermissionLevel;
+    /** Hard upper bound clamped onto every resolution. */
+    ceiling?: PermissionCeiling;
+}
+/** The more restrictive of two levels (the ceiling clamp). */
+export declare function mostRestrictive(a: PermissionLevel, b: PermissionLevel): PermissionLevel;
+export declare class PermissionService {
+    private readonly policy;
+    private readonly prompt?;
+    private readonly defaultForReadOnly;
+    private readonly defaultForMutating;
+    private readonly ceiling?;
+    private readonly sessionAllow;
+    constructor(opts: PermissionServiceOptions);
+    /** Pre-approve a tool-name glob for the rest of the session (an "ask" becomes "allow"). */
+    preApprove(toolGlob: string): void;
+    reset(): void;
+    check(tool: PermissionSubject, input: unknown): Promise<PermissionDecision>;
+    /**
+     * Resolve the effective level. Base precedence (highest first):
+     *   policy.permissions glob > tool.permission > mutates heuristic > policy.defaultPermission.
+     * Then the ceiling clamps to the more restrictive of base and ceiling.
+     */
+    resolveLevel(tool: PermissionSubject): PermissionLevel;
+    private resolveBaseLevel;
+    private resolveCeilingLevel;
+    private decide;
+}
+//# sourceMappingURL=permission-service.d.ts.map

package/dist/guardrail/permission-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-service.d.ts","sourceRoot":"","sources":["../../guardrail/permission-service.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAExG,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb;uFACmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,eAAe,CAAC;IACrC,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,eAAe,CAAC;IACrC,sDAAsD;IACtD,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAgCD,8DAA8D;AAC9D,wBAAgB,eAAe,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,eAAe,CAEvF;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAkB;IACrD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAkB;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAoB;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;gBAEtC,IAAI,EAAE,wBAAwB;IAQ1C,2FAA2F;IAC3F,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAIlC,KAAK,IAAI,IAAI;IAIP,KAAK,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAKjF;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,iBAAiB,GAAG,eAAe;IAItD,OAAO,CAAC,gBAAgB;IAaxB,OAAO,CAAC,mBAAmB;YAQb,MAAM;CAQrB"}

package/dist/guardrail/permission-service.js

@@ -0,0 +1,147 @@
+/* Permission resolution — the per-tool oversight layer.
+ *
+ * Resolves an effective PermissionLevel for a tool call, then turns it into an
+ * allow/deny decision (asking the user when the level is "ask"). Adapted from the
+ * Marshal harness; the tool descriptor here is the browser harness's AgentTool
+ * shape ({ name, mutates?, permission? }) rather than the Node Tool. */
+import { matchesAnyGlob } from './glob';
+const LEVEL_RANK = { allow: 0, ask: 1, deny: 2 };
+/** Match a glob against a tool's address (if any) and its bare name. */
+function subjectMatches(tool, glob) {
+    if (tool.address && matchesAnyGlob(tool.address, [glob]))
+        return true;
+    return matchesAnyGlob(tool.name, [glob]);
+}
+/** How specific a glob is, for "most specific wins" resolution. An exact target
+ * (no `*`) always beats any wildcard; among wildcards, more literal characters
+ * wins (`fs:delete_file` > `fs:*` > `*`). */
+function specificity(glob) {
+    const literal = glob.replace(/\*/g, '').length;
+    return (glob.includes('*') ? 0 : 10000) + literal;
+}
+/** The level of the MOST SPECIFIC glob in `rules` that matches `tool`, or
+ * undefined if none match. Order-independent, so a broad wildcard written above
+ * a narrow rule can't shadow it. */
+function matchLevel(tool, rules) {
+    let best;
+    let bestScore = -1;
+    for (const [glob, level] of Object.entries(rules)) {
+        if (!subjectMatches(tool, glob))
+            continue;
+        const score = specificity(glob);
+        if (score > bestScore) {
+            bestScore = score;
+            best = level;
+        }
+    }
+    return best;
+}
+/** The more restrictive of two levels (the ceiling clamp). */
+export function mostRestrictive(a, b) {
+    return LEVEL_RANK[a] >= LEVEL_RANK[b] ? a : b;
+}
+export class PermissionService {
+    constructor(opts) {
+        Object.defineProperty(this, "policy", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "prompt", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "defaultForReadOnly", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "defaultForMutating", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "ceiling", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "sessionAllow", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Set()
+        });
+        this.policy = opts.policy;
+        if (opts.prompt)
+            this.prompt = opts.prompt;
+        this.defaultForReadOnly = opts.defaultForReadOnly ?? 'allow';
+        this.defaultForMutating = opts.defaultForMutating ?? 'ask';
+        if (opts.ceiling)
+            this.ceiling = opts.ceiling;
+    }
+    /** Pre-approve a tool-name glob for the rest of the session (an "ask" becomes "allow"). */
+    preApprove(toolGlob) {
+        this.sessionAllow.add(toolGlob);
+    }
+    reset() {
+        this.sessionAllow.clear();
+    }
+    async check(tool, input) {
+        const level = this.resolveLevel(tool);
+        return this.decide(level, tool.name, input);
+    }
+    /**
+     * Resolve the effective level. Base precedence (highest first):
+     *   policy.permissions glob > tool.permission > mutates heuristic > policy.defaultPermission.
+     * Then the ceiling clamps to the more restrictive of base and ceiling.
+     */
+    resolveLevel(tool) {
+        return mostRestrictive(this.resolveBaseLevel(tool), this.resolveCeilingLevel(tool));
+    }
+    resolveBaseLevel(tool) {
+        const matched = this.policy.permissions && matchLevel(tool, this.policy.permissions);
+        if (matched)
+            return matched;
+        // A policy's mutating backstop outranks a tool's own declared default, so a
+        // mutating tool can't downgrade a strict policy's "deny side effects" floor to
+        // ask/allow via its self-declared `permission` (e.g. shell_exec's permission:'ask').
+        if (tool.mutates && this.policy.mutatingDefault)
+            return this.policy.mutatingDefault;
+        if (tool.permission)
+            return tool.permission;
+        if (this.policy.defaultPermission)
+            return this.policy.defaultPermission;
+        if (tool.mutates)
+            return this.defaultForMutating;
+        return this.defaultForReadOnly;
+    }
+    resolveCeilingLevel(tool) {
+        const c = this.ceiling;
+        if (!c)
+            return 'allow';
+        const matched = c.overrides && matchLevel(tool, c.overrides);
+        if (matched)
+            return matched;
+        return c.defaultLevel ?? 'allow';
+    }
+    async decide(level, name, input) {
+        if (level === 'allow')
+            return 'allow';
+        if (level === 'deny')
+            return 'deny';
+        // level === 'ask'
+        if (this.sessionAllow.size && matchesAnyGlob(name, [...this.sessionAllow]))
+            return 'allow';
+        if (!this.prompt)
+            return 'deny';
+        return this.prompt.ask({ tool: name, input });
+    }
+}
+//# sourceMappingURL=permission-service.js.map

package/dist/guardrail/permission-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-service.js","sourceRoot":"","sources":["../../guardrail/permission-service.ts"],"names":[],"mappings":"AAAA;;;;;wEAKwE;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AA8BxC,MAAM,UAAU,GAAoC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAElF,wEAAwE;AACxE,SAAS,cAAc,CAAC,IAAuB,EAAE,IAAY;IAC3D,IAAI,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;6CAE6C;AAC7C,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;AACpD,CAAC;AAED;;oCAEoC;AACpC,SAAS,UAAU,CAAC,IAAuB,EAAE,KAAsC;IACjF,IAAI,IAAiC,CAAC;IACtC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;YAAC,SAAS,GAAG,KAAK,CAAC;YAAC,IAAI,GAAG,KAAK,CAAC;QAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,CAAkB,EAAE,CAAkB;IACpE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,OAAO,iBAAiB;IAQ5B,YAAY,IAA8B;QAPzB;;;;;WAAe;QACf;;;;;WAA0B;QAC1B;;;;;WAAoC;QACpC;;;;;WAAoC;QACpC;;;;;WAA4B;QAC5B;;;;mBAAe,IAAI,GAAG,EAAU;WAAC;QAGhD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3C,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,OAAO,CAAC;QAC7D,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,KAAK,CAAC;QAC3D,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAChD,CAAC;IAED,2FAA2F;IAC3F,UAAU,CAAC,QAAgB;QACzB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAuB,EAAE,KAAc;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,IAAuB;QAClC,OAAO,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtF,CAAC;IAEO,gBAAgB,CAAC,IAAuB;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrF,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,4EAA4E;QAC5E,+EAA+E;QAC/E,qFAAqF;QACrF,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QACpF,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACxE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjD,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAEO,mBAAmB,CAAC,IAAuB;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,IAAI,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,OAAO,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAsB,EAAE,IAAY,EAAE,KAAc;QACvE,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,OAAO,CAAC;QACtC,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QACpC,kBAAkB;QAClB,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;QAC3F,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAChC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,CAAC;CACF"}

package/dist/guardrail/serialize.d.ts

@@ -0,0 +1,9 @@
+import type { Policy } from '@corenel/protocol';
+import { type PolicyValidationResult } from './validate';
+/** Serialize a Policy to YAML with a stable, human-friendly key order. Undefined
+ * fields are dropped so the document only shows what the policy actually sets. */
+export declare function policyToYaml(p: Policy): string;
+/** Parse YAML text into a validated Policy. YAML syntax errors and schema errors
+ * are both reported through PolicyValidationResult.errors. */
+export declare function policyFromYaml(text: string): PolicyValidationResult;
+//# sourceMappingURL=serialize.d.ts.map

package/dist/guardrail/serialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../guardrail/serialize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzE;kFACkF;AAClF,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAgB9C;AAED;8DAC8D;AAC9D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAYnE"}

package/dist/guardrail/serialize.js

@@ -0,0 +1,53 @@
+/* YAML <-> Policy bridge. The policy is conceptually another Prompd artifact, so
+ * it is authored as YAML (matching .prmd/.pdflow house style). Parsing always
+ * routes through validatePolicy so the loop never trusts an unvalidated object.
+ *
+ * Uses the `yaml` package (pure JS, browser-safe) that @prompd/core already
+ * depends on — no Node/filesystem surface, consistent with this in-browser harness. */
+import { parse, stringify } from 'yaml';
+import { validatePolicy } from './validate';
+/** Serialize a Policy to YAML with a stable, human-friendly key order. Undefined
+ * fields are dropped so the document only shows what the policy actually sets. */
+export function policyToYaml(p) {
+    // Build an ordered plain object — `yaml` preserves insertion order on output.
+    const ordered = { version: p.version, name: p.name };
+    if (p.description !== undefined)
+        ordered.description = p.description;
+    if (p.onViolation !== undefined)
+        ordered.onViolation = p.onViolation;
+    if (p.maxTurns !== undefined)
+        ordered.maxTurns = p.maxTurns;
+    if (p.maxToolCalls !== undefined)
+        ordered.maxToolCalls = p.maxToolCalls;
+    if (p.tools !== undefined)
+        ordered.tools = p.tools;
+    if (p.mustCall !== undefined)
+        ordered.mustCall = p.mustCall;
+    if (p.permissions !== undefined)
+        ordered.permissions = p.permissions;
+    if (p.defaultPermission !== undefined)
+        ordered.defaultPermission = p.defaultPermission;
+    // The mutating-tool backstop must survive a YAML round-trip — it is the only rule
+    // denying unknown/dynamic mutating tools, so dropping it silently weakened a
+    // re-imported strict policy.
+    if (p.mutatingDefault !== undefined)
+        ordered.mutatingDefault = p.mutatingDefault;
+    return stringify(ordered, { lineWidth: 0 });
+}
+/** Parse YAML text into a validated Policy. YAML syntax errors and schema errors
+ * are both reported through PolicyValidationResult.errors. */
+export function policyFromYaml(text) {
+    let doc;
+    try {
+        doc = parse(text);
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return { ok: false, errors: [`YAML parse error: ${msg}`] };
+    }
+    if (doc === null || doc === undefined) {
+        return { ok: false, errors: ['Policy is empty.'] };
+    }
+    return validatePolicy(doc);
+}
+//# sourceMappingURL=serialize.js.map

package/dist/guardrail/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../guardrail/serialize.ts"],"names":[],"mappings":"AAAA;;;;;uFAKuF;AACvF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAExC,OAAO,EAAE,cAAc,EAA+B,MAAM,YAAY,CAAC;AAEzE;kFACkF;AAClF,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,8EAA8E;IAC9E,MAAM,OAAO,GAA4B,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACrE,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACrE,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC5D,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC5D,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACrE,IAAI,CAAC,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO,CAAC,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;IACvF,kFAAkF;IAClF,6EAA6E;IAC7E,6BAA6B;IAC7B,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;IACjF,OAAO,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;8DAC8D;AAC9D,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,qBAAqB,GAAG,EAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/guardrail/store.d.ts

@@ -0,0 +1,26 @@
+import type { Policy } from '@corenel/protocol';
+export interface PolicyEntry {
+    name: string;
+    policy: Policy;
+    builtin: boolean;
+}
+export declare function isBuiltinPolicy(name: string): boolean;
+/** Built-ins (in declared order) followed by custom policies (alphabetical). */
+export declare function listPolicies(): PolicyEntry[];
+/** Resolve a policy by name. Built-ins win; falls back to a stored custom. */
+export declare function getPolicy(name: string): Policy | undefined;
+export interface PolicySaveResult {
+    ok: boolean;
+    errors: string[];
+}
+/** Persist a custom policy. Rejects built-in names (rename to save a copy) and
+ * any policy that fails validation. */
+export declare function saveCustomPolicy(p: Policy): PolicySaveResult;
+/** Remove a custom policy. No-op on built-ins. Returns true if something was removed. */
+export declare function deleteCustomPolicy(name: string): boolean;
+/** The persisted selection, falling back to 'standard' if unset/stale. */
+export declare function getSelectedPolicyName(): string;
+export declare function setSelectedPolicyName(name: string): void;
+/** The selected policy object, always defined (defaults to STANDARD_POLICY). */
+export declare function resolveSelectedPolicy(): Policy;
+//# sourceMappingURL=store.d.ts.map

package/dist/guardrail/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../guardrail/store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAOhD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAkCD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,gFAAgF;AAChF,wBAAgB,YAAY,IAAI,WAAW,EAAE,CAU5C;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED,MAAM,WAAW,gBAAgB;IAAG,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE;AAEnE;uCACuC;AACvC,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAa5D;AAED,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOxD;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,IAAI,MAAM,CAM9C;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C"}