@dv.nghiem/flowdeck 0.4.12 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (78) hide show
  1. package/dist/agents/orchestrator.d.ts.map +1 -1
  2. package/dist/config/index.d.ts +1 -1
  3. package/dist/config/index.d.ts.map +1 -1
  4. package/dist/config/schema.d.ts +27 -1
  5. package/dist/config/schema.d.ts.map +1 -1
  6. package/dist/hooks/approval-hook.d.ts +16 -2
  7. package/dist/hooks/approval-hook.d.ts.map +1 -1
  8. package/dist/hooks/compaction-hook.d.ts +1 -1
  9. package/dist/hooks/compaction-hook.d.ts.map +1 -1
  10. package/dist/hooks/context-window-monitor.d.ts +7 -1
  11. package/dist/hooks/context-window-monitor.d.ts.map +1 -1
  12. package/dist/hooks/decision-trace-hook.d.ts +3 -0
  13. package/dist/hooks/decision-trace-hook.d.ts.map +1 -1
  14. package/dist/hooks/event-log-hook.d.ts +19 -3
  15. package/dist/hooks/event-log-hook.d.ts.map +1 -1
  16. package/dist/hooks/guard-rails.d.ts +16 -5
  17. package/dist/hooks/guard-rails.d.ts.map +1 -1
  18. package/dist/hooks/orchestrator-guard-hook.d.ts +8 -5
  19. package/dist/hooks/orchestrator-guard-hook.d.ts.map +1 -1
  20. package/dist/hooks/tool-guard.d.ts +19 -3
  21. package/dist/hooks/tool-guard.d.ts.map +1 -1
  22. package/dist/index.d.ts.map +1 -1
  23. package/dist/index.js +8367 -4620
  24. package/dist/services/agent-contract-registry.d.ts.map +1 -1
  25. package/dist/services/agent-trace-graph.d.ts +4 -0
  26. package/dist/services/agent-trace-graph.d.ts.map +1 -1
  27. package/dist/services/agent-validator.d.ts +2 -1
  28. package/dist/services/agent-validator.d.ts.map +1 -1
  29. package/dist/services/approval-manager.d.ts +14 -1
  30. package/dist/services/approval-manager.d.ts.map +1 -1
  31. package/dist/services/audit-log.d.ts +23 -0
  32. package/dist/services/audit-log.d.ts.map +1 -0
  33. package/dist/services/context-ingress.d.ts +75 -0
  34. package/dist/services/context-ingress.d.ts.map +1 -0
  35. package/dist/services/deadlock-detector.d.ts.map +1 -1
  36. package/dist/services/delegation-budget.d.ts +55 -0
  37. package/dist/services/delegation-budget.d.ts.map +1 -0
  38. package/dist/services/event-logger.d.ts +3 -1
  39. package/dist/services/event-logger.d.ts.map +1 -1
  40. package/dist/services/execution-substrate.d.ts +35 -0
  41. package/dist/services/execution-substrate.d.ts.map +1 -0
  42. package/dist/services/harness-controller.d.ts +58 -0
  43. package/dist/services/harness-controller.d.ts.map +1 -0
  44. package/dist/services/harness-policy.d.ts +24 -0
  45. package/dist/services/harness-policy.d.ts.map +1 -0
  46. package/dist/services/harness-types.d.ts +178 -0
  47. package/dist/services/harness-types.d.ts.map +1 -0
  48. package/dist/services/lazy-rule-loader.d.ts +2 -0
  49. package/dist/services/lazy-rule-loader.d.ts.map +1 -1
  50. package/dist/services/prompt-cache.d.ts +25 -0
  51. package/dist/services/prompt-cache.d.ts.map +1 -0
  52. package/dist/services/recovery-layer.d.ts +26 -0
  53. package/dist/services/recovery-layer.d.ts.map +1 -0
  54. package/dist/services/run-trace.d.ts +17 -0
  55. package/dist/services/run-trace.d.ts.map +1 -1
  56. package/dist/services/state-persistence.d.ts +22 -0
  57. package/dist/services/state-persistence.d.ts.map +1 -0
  58. package/dist/services/supervisor-binding.d.ts +9 -0
  59. package/dist/services/supervisor-binding.d.ts.map +1 -1
  60. package/dist/services/token-metrics.d.ts +39 -0
  61. package/dist/services/token-metrics.d.ts.map +1 -0
  62. package/dist/services/verification-layer.d.ts +24 -0
  63. package/dist/services/verification-layer.d.ts.map +1 -0
  64. package/dist/services/workflow-scorecard.d.ts +5 -0
  65. package/dist/services/workflow-scorecard.d.ts.map +1 -1
  66. package/dist/tools/decision-trace.d.ts +4 -0
  67. package/dist/tools/decision-trace.d.ts.map +1 -1
  68. package/dist/tools/delegate.d.ts +16 -0
  69. package/dist/tools/delegate.d.ts.map +1 -0
  70. package/dist/tools/failure-replay.d.ts +8 -0
  71. package/dist/tools/failure-replay.d.ts.map +1 -1
  72. package/dist/tools/policy-engine.d.ts +1 -0
  73. package/dist/tools/policy-engine.d.ts.map +1 -1
  74. package/docs/concepts/HARNESS_ARCHITECTURE.md +241 -0
  75. package/docs/concepts/HARNESS_LAYERS.md +378 -0
  76. package/docs/concepts/HARNESS_WIRING.md +404 -0
  77. package/package.json +1 -1
  78. package/src/commands/fd-guarded-edit.md +69 -0
@@ -1 +1 @@
1
- {"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/agents/orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAsV/C,wBAAgB,uBAAuB,CACrC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5B,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CA6BR;AAED,wBAAgB,uBAAuB,CACrC,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EACjE,YAAY,CAAC,EAAE,MAAM,EACrB,kBAAkB,CAAC,EAAE,MAAM,EAC3B,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5B,aAAa,CAAC,EAAE,MAAM,GACrB,eAAe,CAuBjB"}
1
+ {"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/agents/orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAwV/C,wBAAgB,uBAAuB,CACrC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5B,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CA6BR;AAED,wBAAgB,uBAAuB,CACrC,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EACjE,YAAY,CAAC,EAAE,MAAM,EACrB,kBAAkB,CAAC,EAAE,MAAM,EAC3B,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5B,aAAa,CAAC,EAAE,MAAM,GACrB,eAAe,CAuBjB"}
@@ -1,3 +1,3 @@
1
1
  export { loadFlowDeckConfig, resolveDesignFirstConfig } from './loader';
2
- export type { FlowDeckConfig, AgentModelConfig } from './schema';
2
+ export type { FlowDeckConfig, AgentModelConfig, HarnessConfig, GovernanceConfig } from './schema';
3
3
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACxE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACxE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC"}
@@ -11,6 +11,16 @@ export interface AgentModelConfig {
11
11
  /** Model to use for this agent (e.g. "github-copilot/sonnet-4.6"). If not set, uses the currently selected model. */
12
12
  model?: string;
13
13
  }
14
+ export interface HarnessConfig {
15
+ /** Whether the runtime harness is active. Default: true */
16
+ enabled?: boolean;
17
+ /**
18
+ * strict: policy denials block execution
19
+ * advisory: policy violations are logged but do not block
20
+ * Default: "strict"
21
+ */
22
+ mode?: "strict" | "advisory";
23
+ }
14
24
  export interface GovernanceConfig {
15
25
  validator?: {
16
26
  /**
@@ -34,6 +44,12 @@ export interface GovernanceConfig {
34
44
  /** Automatically stop the run when a signal fires. Default: false */
35
45
  autoStop?: boolean;
36
46
  };
47
+ /** Whether the tool-guard layer is active. Default: true */
48
+ toolGuard?: boolean;
49
+ /** Whether the guard-rails layer is active. Default: true */
50
+ guardRails?: boolean;
51
+ /** Whether approval gating is active. Default: true */
52
+ approvals?: boolean;
37
53
  scorecard?: {
38
54
  /** Whether to generate scorecards after each run. Default: true */
39
55
  enabled?: boolean;
@@ -69,10 +85,18 @@ export interface GovernanceConfig {
69
85
  */
70
86
  onExhaustion?: "warn" | "stop" | "escalate";
71
87
  };
88
+ delegationBudget?: {
89
+ /** Maximum number of tool calls allowed per run. Default: 200 */
90
+ maxToolCalls?: number;
91
+ /** Maximum delegation depth (parent-child run nesting). Default: 3 */
92
+ maxDepth?: number;
93
+ /** Maximum retries for the same step before escalation. Default: 3 */
94
+ maxSameStepRetries?: number;
95
+ };
72
96
  supervisor?: {
73
97
  /**
74
98
  * Whether the supervisor review layer is active.
75
- * Default: false (opt-in)
99
+ * Default: true
76
100
  */
77
101
  enabled?: boolean;
78
102
  /**
@@ -119,6 +143,8 @@ export interface FlowDeckConfig {
119
143
  modelOverrides?: Record<string, string>;
120
144
  defaultSkillsByTaskType?: Record<string, string[]>;
121
145
  };
146
+ /** Runtime harness configuration */
147
+ harness?: HarnessConfig;
122
148
  /** Reliability and governance layer: contracts, validation, tracing, budgets, loop detection, scoring */
123
149
  governance?: GovernanceConfig;
124
150
  }
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,qHAAqH;IACrH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE;QACV;;;;WAIG;QACH,IAAI,CAAC,EAAE,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC;QACrC,kFAAkF;QAClF,mBAAmB,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;KACjD,CAAC;IACF,iBAAiB,CAAC,EAAE;QAClB,0DAA0D;QAC1D,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,iFAAiF;QACjF,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,+EAA+E;QAC/E,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,yFAAyF;QACzF,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,qEAAqE;QACrE,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,mEAAmE;QACnE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,qCAAqC;QACrC,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAChC,CAAC;IACF,aAAa,CAAC,EAAE;QACd,sDAAsD;QACtD,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,gFAAgF;QAChF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mFAAmF;QACnF,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,2EAA2E;QAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,UAAU,CAAC,EAAE;QACX;;;WAGG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,iEAAiE;QACjE,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kEAAkE;QAClE,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB;;;;;;WAMG;QACH,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;KAC7C,CAAC;IACF,UAAU,CAAC,EAAE;QACX;;;WAGG;QACH,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB;;;;WAIG;QACH,IAAI,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;QAC7B;;;;WAIG;QACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B;;;;WAIG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB;;;;WAIG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B;;;WAGG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,WAAW,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;QACpC,mCAAmC,CAAC,EAAE,OAAO,CAAC;QAC9C,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxC,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;KACpD,CAAC;IACF,yGAAyG;IACzG,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,qHAAqH;IACrH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE;QACV;;;;WAIG;QACH,IAAI,CAAC,EAAE,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC;QACrC,kFAAkF;QAClF,mBAAmB,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;KACjD,CAAC;IACF,iBAAiB,CAAC,EAAE;QAClB,0DAA0D;QAC1D,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,iFAAiF;QACjF,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,+EAA+E;QAC/E,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,yFAAyF;QACzF,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,qEAAqE;QACrE,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,4DAA4D;IAC5D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uDAAuD;IACvD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE;QACV,mEAAmE;QACnE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,qCAAqC;QACrC,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAChC,CAAC;IACF,aAAa,CAAC,EAAE;QACd,sDAAsD;QACtD,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,gFAAgF;QAChF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mFAAmF;QACnF,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,2EAA2E;QAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,UAAU,CAAC,EAAE;QACX;;;WAGG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,iEAAiE;QACjE,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kEAAkE;QAClE,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB;;;;;;WAMG;QACH,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;KAC7C,CAAC;IACF,gBAAgB,CAAC,EAAE;QACjB,iEAAiE;QACjE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,sEAAsE;QACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,sEAAsE;QACtE,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,UAAU,CAAC,EAAE;QACX;;;WAGG;QACH,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB;;;;WAIG;QACH,IAAI,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;QAC7B;;;;WAIG;QACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B;;;;WAIG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB;;;;WAIG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B;;;WAGG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,WAAW,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;QACpC,mCAAmC,CAAC,EAAE,OAAO,CAAC;QAC9C,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxC,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;KACpD,CAAC;IACF,oCAAoC;IACpC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,yGAAyG;IACzG,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B"}
@@ -1,8 +1,22 @@
1
1
  /**
2
2
  * Approval Hook
3
3
  * Intercepts write/edit operations on sensitive files and blocks them
4
- * unless a recent approval exists. Throws to block (per OpenCode hook contract).
5
- * To enable: set FLOWDECK_APPROVAL_HOOK_ENABLED=on. Default is OFF.
4
+ * unless a recent approval exists.
5
+ *
6
+ * The exported evaluate() function returns a PolicyDecision so the harness
7
+ * can compose it with other governance layers. The legacy approvalHook
8
+ * remains a thin adapter that throws on ask/deny for existing hook wiring.
9
+ */
10
+ import type { PolicyDecision, PolicyInput } from "../services/harness-types";
11
+ /**
12
+ * Evaluate whether a write/edit tool on a sensitive path needs approval.
13
+ *
14
+ * No longer gated by environment variables — the harness decides whether to
15
+ * invoke this layer via `governance.approvals` in flowdeck.json.
16
+ */
17
+ export declare function evaluate(input: PolicyInput): PolicyDecision;
18
+ /**
19
+ * Legacy hook adapter. Throws when approval is required.
6
20
  */
7
21
  export declare function approvalHook(context: {
8
22
  directory?: string;
@@ -1 +1 @@
1
- {"version":3,"file":"approval-hook.d.ts","sourceRoot":"","sources":["../../src/hooks/approval-hook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,wBAAsB,YAAY,CAChC,OAAO,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC/B,SAAS,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,MAAM,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAuBf"}
1
+ {"version":3,"file":"approval-hook.d.ts","sourceRoot":"","sources":["../../src/hooks/approval-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAiB,MAAM,2BAA2B,CAAA;AAyB3F;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CA6B3D;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC/B,SAAS,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,MAAM,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAuBf"}
@@ -19,7 +19,7 @@
19
19
  import type { SessionFileTracker } from "./file-tracker";
20
20
  export declare function createCompactionHook(ctx: {
21
21
  directory: string;
22
- }, tracker: SessionFileTracker): (input: {
22
+ }, tracker: SessionFileTracker, promptFragment?: string | ((sessionID: string) => string | undefined)): (input: {
23
23
  sessionID: string;
24
24
  }, output: {
25
25
  context: string[];
@@ -1 +1 @@
1
- {"version":3,"file":"compaction-hook.d.ts","sourceRoot":"","sources":["../../src/hooks/compaction-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAmExD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,OAAO,EAAE,kBAAkB,IAGzB,OAAO;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC5B,QAAQ;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,mBAiEjD"}
1
+ {"version":3,"file":"compaction-hook.d.ts","sourceRoot":"","sources":["../../src/hooks/compaction-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAmExD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,OAAO,EAAE,kBAAkB,EAC3B,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC,IAGnE,OAAO;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC5B,QAAQ;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,mBA2EjD"}
@@ -5,7 +5,13 @@
5
5
  *
6
6
  * Inspired by oh-my-openagent's context-window-monitor.ts.
7
7
  */
8
- export declare function createContextWindowMonitorHook(): {
8
+ export interface ContextWindowMonitorOptions {
9
+ /** Optional source for the total token budget for a session. */
10
+ getTotalBudget?: (sessionID: string) => number;
11
+ /** Fallback limit when no budget source is provided or returns nothing. */
12
+ defaultLimit?: number;
13
+ }
14
+ export declare function createContextWindowMonitorHook(options?: ContextWindowMonitorOptions): {
9
15
  "tool.execute.after": (input: {
10
16
  sessionID: string;
11
17
  }, output: {
@@ -1 +1 @@
1
- {"version":3,"file":"context-window-monitor.d.ts","sourceRoot":"","sources":["../../src/hooks/context-window-monitor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA0BH,wBAAgB,8BAA8B;kCAKnC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,UACpB;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;uBAwBI;QAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE;EAsBlF"}
1
+ {"version":3,"file":"context-window-monitor.d.ts","sourceRoot":"","sources":["../../src/hooks/context-window-monitor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4BH,MAAM,WAAW,2BAA2B;IAC1C,gEAAgE;IAChE,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,8BAA8B,CAAC,OAAO,CAAC,EAAE,2BAA2B;kCAKzE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,UACpB;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;uBAyBI;QAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE;EAuBlF"}
@@ -9,5 +9,8 @@ export declare function decisionTraceHook(ctx: {
9
9
  tool: string;
10
10
  }, output: {
11
11
  args: any;
12
+ }, options?: {
13
+ policyReason?: string;
14
+ auditEntryId?: string;
12
15
  }): Promise<void>;
13
16
  //# sourceMappingURL=decision-trace-hook.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"decision-trace-hook.d.ts","sourceRoot":"","sources":["../../src/hooks/decision-trace-hook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACvB,MAAM,EAAE;IAAE,IAAI,EAAE,GAAG,CAAA;CAAE,GACpB,OAAO,CAAC,IAAI,CAAC,CA8Bf"}
1
+ {"version":3,"file":"decision-trace-hook.d.ts","sourceRoot":"","sources":["../../src/hooks/decision-trace-hook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACvB,MAAM,EAAE;IAAE,IAAI,EAAE,GAAG,CAAA;CAAE,EACrB,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD,OAAO,CAAC,IAAI,CAAC,CAgCf"}
@@ -1,5 +1,21 @@
1
+ import type { SpanStatus } from "@/services/harness-types";
1
2
  type AppLog = (msg: string) => void;
2
3
  export type OnToolAfterCallback = (toolName: string, args: Record<string, unknown>, output: unknown, sessionId: string, status: string) => void;
4
+ export interface SpanLifecycleCallbacks {
5
+ /** Called when a delegated session starts (span open). */
6
+ onSpanOpen?: (props: {
7
+ spanId: string;
8
+ agent: string;
9
+ sessionId: string;
10
+ parentSessionId?: string;
11
+ }) => void;
12
+ /** Called when a delegated session ends (span close). */
13
+ onSpanClose?: (props: {
14
+ spanId: string;
15
+ status: Exclude<SpanStatus, "running">;
16
+ sessionId: string;
17
+ }) => void;
18
+ }
3
19
  export declare function setStaleThresholdMs(ms: number): void;
4
20
  export declare function cleanupStaleToolStartTimes(): void;
5
21
  /**
@@ -7,7 +23,7 @@ export declare function cleanupStaleToolStartTimes(): void;
7
23
  * All tool and session events are persisted to .opencode/flowdeck-events.jsonl
8
24
  * AND displayed in the TUI's bounded log panel through the provided appLog fn.
9
25
  */
10
- export declare function createEventLogHooks(appLog: AppLog, onToolAfter?: OnToolAfterCallback): {
26
+ export declare function createEventLogHooks(appLog: AppLog, onToolAfter?: OnToolAfterCallback, spanLifecycle?: SpanLifecycleCallbacks): {
11
27
  before(ctx: {
12
28
  directory: string;
13
29
  }, toolInput: any, toolOutput: any): Promise<void>;
@@ -16,7 +32,7 @@ export declare function createEventLogHooks(appLog: AppLog, onToolAfter?: OnTool
16
32
  }, toolInput: any, toolOutput: any): Promise<boolean>;
17
33
  session(ctx: {
18
34
  directory: string;
19
- }, event: any): Promise<void>;
35
+ }, event: any): Promise<boolean>;
20
36
  };
21
37
  export declare function eventLogBeforeHook(ctx: {
22
38
  directory: string;
@@ -26,6 +42,6 @@ export declare function eventLogAfterHook(ctx: {
26
42
  }, toolInput: any, toolOutput: any): Promise<boolean>;
27
43
  export declare function eventLogSessionHook(ctx: {
28
44
  directory: string;
29
- }, event: any): Promise<void>;
45
+ }, event: any): Promise<boolean>;
30
46
  export {};
31
47
  //# sourceMappingURL=event-log-hook.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"event-log-hook.d.ts","sourceRoot":"","sources":["../../src/hooks/event-log-hook.ts"],"names":[],"mappings":"AAQA,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;AAEnC,MAAM,MAAM,mBAAmB,GAAG,CAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,OAAO,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,KACX,IAAI,CAAA;AAST,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAOjD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,mBAAmB;gBAGb;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,aAAa,GAAG,cAAc,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;eA2BvE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,aAAa,GAAG,cAAc,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;iBA0CvE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,SAAS,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;EA+CvE;AAGD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,SAAS,EAAE,GAAG,EACd,UAAU,EAAE,GAAG,GACd,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,SAAS,EAAE,GAAG,EACd,UAAU,EAAE,GAAG,GACd,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,KAAK,EAAE,GAAG,GACT,OAAO,CAAC,IAAI,CAAC,CAEf"}
1
+ {"version":3,"file":"event-log-hook.d.ts","sourceRoot":"","sources":["../../src/hooks/event-log-hook.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAE1D,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;AAEnC,MAAM,MAAM,mBAAmB,GAAG,CAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,OAAO,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,KACX,IAAI,CAAA;AAET,MAAM,WAAW,sBAAsB;IACrC,0DAA0D;IAC1D,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE;QACnB,MAAM,EAAE,MAAM,CAAA;QACd,KAAK,EAAE,MAAM,CAAA;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,eAAe,CAAC,EAAE,MAAM,CAAA;KACzB,KAAK,IAAI,CAAA;IACV,yDAAyD;IACzD,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QACpB,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QACtC,SAAS,EAAE,MAAM,CAAA;KAClB,KAAK,IAAI,CAAA;CACX;AASD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAOjD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,mBAAmB,EACjC,aAAa,CAAC,EAAE,sBAAsB;gBASlB;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,aAAa,GAAG,cAAc,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;eA2BvE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,aAAa,GAAG,cAAc,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;iBA0CvE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,SAAS,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;EA4G1E;AAGD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,SAAS,EAAE,GAAG,EACd,UAAU,EAAE,GAAG,GACd,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,SAAS,EAAE,GAAG,EACd,UAAU,EAAE,GAAG,GACd,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,KAAK,EAAE,GAAG,GACT,OAAO,CAAC,OAAO,CAAC,CAElB"}
@@ -1,3 +1,4 @@
1
+ import type { PolicyDecision, PolicyInput } from "../services/harness-types";
1
2
  /**
2
3
  * Safe Execution Mode — three tiers of AI edit safety.
3
4
  * auto: AI can apply edits without confirmation (default, low-risk changes)
@@ -12,14 +13,24 @@ export type ExecutionMode = "auto" | "guarded" | "review-only";
12
13
  export declare function resolveExecutionMode(configPath: string, trustScore: number | null, // 0–100, null = unknown
13
14
  volatility?: string): ExecutionMode;
14
15
  export type Severity = "warn" | "block" | null;
15
- export declare function guardRailsHook(ctx: {
16
- directory: string;
17
- }, input: {
18
- tool: string;
19
- }, _output: any): Promise<void>;
16
+ /**
17
+ * Evaluate a tool call against workspace, plan-confirmation, design-gate, and
18
+ * build/deploy guard rules.
19
+ */
20
+ export declare function evaluate(input: PolicyInput): PolicyDecision;
20
21
  /**
21
22
  * Determine effective severity based on config.json override or STATE.md plan_confirmed.
22
23
  */
23
24
  export declare function effectiveSeverity(configPath: string, statePath: string): Severity;
24
25
  export declare function getPlanConfirmed(statePath: string): boolean;
26
+ /**
27
+ * Legacy hook adapter. Throws when evaluate returns deny.
28
+ */
29
+ export declare function guardRailsHook(ctx: {
30
+ directory: string;
31
+ }, input: {
32
+ tool: string;
33
+ }, output: {
34
+ args?: Record<string, unknown>;
35
+ }): Promise<void>;
25
36
  //# sourceMappingURL=guard-rails.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"guard-rails.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-rails.ts"],"names":[],"mappings":"AAWA;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,aAAa,CAAA;AAE9D;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GAAG,IAAI,EAAG,wBAAwB;AACpD,UAAU,CAAC,EAAE,MAAM,GAClB,aAAa,CAkBf;AAgBD,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;AAa9C,wBAAsB,cAAc,CAClC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACvB,OAAO,EAAE,GAAG,GACX,OAAO,CAAC,IAAI,CAAC,CAqEf;AA0BD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CAWjF;AAMD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAS3D"}
1
+ {"version":3,"file":"guard-rails.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-rails.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAiB,MAAM,2BAA2B,CAAA;AAM3F;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,aAAa,CAAA;AAE9D;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GAAG,IAAI,EAAG,wBAAwB;AACpD,UAAU,CAAC,EAAE,MAAM,GAClB,aAAa,CAkBf;AAgBD,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;AA6B9C;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CA0E3D;AA0BD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CAWjF;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAS3D;AAgBD;;GAEG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACvB,MAAM,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAaf"}
@@ -2,15 +2,18 @@
2
2
  * Orchestrator Guard Hook
3
3
  *
4
4
  * Enforces the "orchestrator as coordinator, not executor" rule for the primary session.
5
- * The orchestrator may inspect files and planning state directly, but it CANNOT
6
- * use file-write, edit, or shell tools. Those MUST be routed to specialist agents
7
- * or the default-executor.
5
+ * The guard consults the orchestrator capability contract in agent-contract-registry
6
+ * and the harness policy. Any tool not in the orchestrator's allowedTools list is
7
+ * blocked when run from the primary session.
8
8
  *
9
9
  * To disable: set FLOWDECK_ORCHESTRATOR_GUARD=off in the environment.
10
10
  * Default is ON.
11
11
  */
12
+ import type { HarnessPolicy } from "../services/harness-policy";
12
13
  export declare class OrchestratorGuard {
13
14
  private primarySessionId;
15
+ private policy?;
16
+ setPolicy(policy: HarnessPolicy): void;
14
17
  onEvent(event: {
15
18
  type?: string;
16
19
  properties?: unknown;
@@ -19,9 +22,9 @@ export declare class OrchestratorGuard {
19
22
  sessionId?: string;
20
23
  }): void;
21
24
  check(sessionId: string, toolName: string): void;
22
- /** Exposed for testing. */
25
+ /** Returns true if the tool is not in the orchestrator contract allowlist. */
23
26
  _isBlockedForTest(name: string): boolean;
24
- /** Exposed for testing. */
27
+ /** Returns true if the tool is in the orchestrator contract allowlist. */
25
28
  _isAllowedForTest(name: string): boolean;
26
29
  /** Exposed for testing. */
27
30
  _setPrimarySessionIdForTest(id: string | null): void;
@@ -1 +1 @@
1
- {"version":3,"file":"orchestrator-guard-hook.d.ts","sourceRoot":"","sources":["../../src/hooks/orchestrator-guard-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAoHH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,gBAAgB,CAAsB;IAE9C,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAkBtH,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAUhD,2BAA2B;IAC3B,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIxC,2BAA2B;IAC3B,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIxC,2BAA2B;IAC3B,2BAA2B,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;CAGrD"}
1
+ {"version":3,"file":"orchestrator-guard-hook.d.ts","sourceRoot":"","sources":["../../src/hooks/orchestrator-guard-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,4BAA4B,CAAA;AA6B/E,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,gBAAgB,CAAsB;IAC9C,OAAO,CAAC,MAAM,CAAC,CAAe;IAE9B,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAItC,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAkBtH,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAyBhD,8EAA8E;IAC9E,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAOxC,0EAA0E;IAC1E,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIxC,2BAA2B;IAC3B,2BAA2B,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;CAGrD"}
@@ -3,14 +3,23 @@
3
3
  * Pattern matching on tool arguments to prevent destructive commands.
4
4
  * D-04: pure string.includes() matching, no path filtering, no regex/glob.
5
5
  * Also enforces architectural constraints from .codebase/CONSTRAINTS.md.
6
- * To enable: set FLOWDECK_TOOL_GUARD_ENABLED=on. Default is OFF.
6
+ *
7
+ * The exported evaluate() function returns a PolicyDecision so the harness
8
+ * can compose it with other governance layers. The legacy toolGuardHook
9
+ * remains a thin adapter that throws on deny for existing hook wiring.
7
10
  */
11
+ import type { PolicyDecision, PolicyInput } from "../services/harness-types";
8
12
  export type BlockReason = string | null;
13
+ /**
14
+ * Extract the target path from tool arguments using the canonical key precedence:
15
+ * path > file_path > filename > filePath.
16
+ */
17
+ export declare function extractTargetPath(args: Record<string, unknown>): string;
9
18
  /**
10
19
  * Check if a tool operation should be blocked.
11
20
  * Returns error message if blocked, null if allowed.
12
21
  */
13
- export declare function isBlocked(tool: string, args: any): BlockReason;
22
+ export declare function isBlocked(tool: string, args: Record<string, unknown>): BlockReason;
14
23
  /**
15
24
  * Architectural Constraint Guard.
16
25
  * Reads .codebase/CONSTRAINTS.md for forbidden path patterns and boundary rules.
@@ -27,6 +36,13 @@ export declare function checkArchConstraint(directory: string, filePath: string)
27
36
  * Prevents writing to the codebase during planning phases.
28
37
  */
29
38
  export declare function checkPhaseEnforcement(directory: string): BlockReason;
39
+ /**
40
+ * Evaluate a tool call against dangerous-pattern, phase, and arch-constraint rules.
41
+ *
42
+ * No longer gated by environment variables — the harness decides whether to
43
+ * invoke this layer via `governance.toolGuard` in flowdeck.json.
44
+ */
45
+ export declare function evaluate(input: PolicyInput): PolicyDecision;
30
46
  /**
31
47
  * HOOK-04: Tool guard hook
32
48
  * Called on tool.execute.before for all tools.
@@ -37,6 +53,6 @@ export declare function toolGuardHook(ctx: {
37
53
  }, input: {
38
54
  tool: string;
39
55
  }, output: {
40
- args: any;
56
+ args: Record<string, unknown>;
41
57
  }): Promise<void>;
42
58
  //# sourceMappingURL=tool-guard.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"tool-guard.d.ts","sourceRoot":"","sources":["../../src/hooks/tool-guard.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAiBH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,IAAI,CAAA;AAEvC;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,WAAW,CAsC9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,CAepF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAmBpE;AAkBD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACvB,MAAM,EAAE;IAAE,IAAI,EAAE,GAAG,CAAA;CAAE,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
1
+ {"version":3,"file":"tool-guard.d.ts","sourceRoot":"","sources":["../../src/hooks/tool-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAiB,MAAM,2BAA2B,CAAA;AAyB3F,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,IAAI,CAAA;AAEvC;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEvE;AAuDD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAwBlF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,CAepF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAmBpE;AAgCD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CA+B3D;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1B,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACvB,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACxC,OAAO,CAAC,IAAI,CAAC,CAaf"}
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AA2GjD,QAAA,MAAM,MAAM,EAAE,MA2Rb,CAAA;AAED,eAAe,MAAM,CAAA"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAwGjD,QAAA,MAAM,MAAM,EAAE,MAqSb,CAAA;AAED,eAAe,MAAM,CAAA"}