@element47/ag 4.5.1 → 4.5.3

package/dist/core/guardrails.js

@@ -0,0 +1,149 @@
+export const GUARDRAIL_PATTERNS = [
+    // Direct injection — attempts to override system instructions
+    { pattern: /ignore\s+(all\s+)?previous\s+instructions/i, severity: 'block', category: 'direct-injection', message: 'prompt injection: "ignore previous instructions"' },
+    { pattern: /you\s+are\s+now\s+(in\s+)?developer\s+mode/i, severity: 'block', category: 'direct-injection', message: 'prompt injection: "developer mode" activation' },
+    { pattern: /system\s+override/i, severity: 'block', category: 'direct-injection', message: 'prompt injection: "system override"' },
+    { pattern: /reveal\s+(your\s+)?(system\s+)?prompt/i, severity: 'block', category: 'direct-injection', message: 'prompt injection: prompt exfiltration attempt' },
+    { pattern: /disregard\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions|rules|guidelines)/i, severity: 'block', category: 'direct-injection', message: 'prompt injection: "disregard previous instructions"' },
+    { pattern: /forget\s+(all\s+)?(previous|prior|your)\s+(instructions|rules|guidelines)/i, severity: 'block', category: 'direct-injection', message: 'prompt injection: "forget instructions"' },
+    { pattern: /new\s+instructions?\s*:/i, severity: 'block', category: 'direct-injection', message: 'prompt injection: "new instructions" directive' },
+    { pattern: /act\s+as\s+(if\s+you\s+are\s+|a\s+)?(unrestricted|jailbroken|unfiltered)/i, severity: 'block', category: 'direct-injection', message: 'prompt injection: jailbreak attempt' },
+    { pattern: /do\s+not\s+follow\s+(any\s+)?(your\s+)?(previous|original)\s+(instructions|rules)/i, severity: 'block', category: 'direct-injection', message: 'prompt injection: "do not follow" directive' },
+    { pattern: /pretend\s+(you\s+are|to\s+be)\s+(a\s+)?(different|new|unrestricted|unfiltered)/i, severity: 'block', category: 'direct-injection', message: 'prompt injection: identity override' },
+    // Suspicious override — language specifically targeting the agent's security/permission system
+    { pattern: /\b(always|never|must)\s+(ignore|override|skip|bypass)\s+(permission|security|guard|confirmation|prompt|rule)/i, severity: 'warn', category: 'suspicious-override', message: 'suspicious instruction-like language targeting agent security' },
+    { pattern: /\boverride\s+(system\s+prompt|security|permission|guardrail)/i, severity: 'warn', category: 'suspicious-override', message: 'suspicious "override system/security" language' },
+    { pattern: /\b(bypass|disable|skip)\s+(permission|security|confirmation|guard)/i, severity: 'warn', category: 'suspicious-override', message: 'suspicious "bypass security" language', skipInCodeBlocks: true },
+    { pattern: /\brun\s+without\s+(permission|confirmation|asking)/i, severity: 'warn', category: 'suspicious-override', message: 'suspicious "run without permission" language' },
+    { pattern: /\bauto[\s-]?approve\s+(all|every|tool|action|command)/i, severity: 'warn', category: 'suspicious-override', message: 'suspicious "auto-approve" language' },
+    // Hidden content — invisible payloads
+    { pattern: /<!--[\s\S]*?\b(ignore|override|instruction|disregard|forget|reveal)\b[\s\S]*?-->/i, severity: 'block', category: 'hidden-content', message: 'HTML comment contains suspicious instruction' },
+    { pattern: /[\x00-\x08\x0E-\x1F]/, severity: 'block', category: 'hidden-content', message: 'content contains control characters' },
+    // Exfiltration — data exfil attempts in descriptions
+    { pattern: /\b(fetch|curl|wget|axios)\s*\(/i, severity: 'block', category: 'exfiltration', message: 'description contains network call invocation' },
+    { pattern: /https?:\/\/[^\s"')<>]{10,}/i, severity: 'warn', category: 'exfiltration', message: 'description contains URL', skipInCodeBlocks: true },
+    { pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/i, severity: 'warn', category: 'exfiltration', message: 'description contains email address', skipInCodeBlocks: true },
+    { pattern: /\bwebhook\b/i, severity: 'warn', category: 'exfiltration', message: 'description references webhook', skipInCodeBlocks: true },
+    // Encoded payload — HTML entities that could hide instructions
+    { pattern: /&#x?[0-9a-fA-F]+;.*&#x?[0-9a-fA-F]+;/i, severity: 'warn', category: 'encoded-payload', message: 'content contains HTML entity encoding' },
+];
+// Zero-width and bidirectional characters
+const ZERO_WIDTH_RE = /[\u200B\u200C\u200D\uFEFF\u2060\u200E\u200F\u202A-\u202E]/;
+// Base64: 40+ chars from the base64 alphabet, optionally ending with = or ==
+const BASE64_RE = /[A-Za-z0-9+/]{40,}={0,2}/g;
+// Suspicious tool names
+const SUSPICIOUS_TOOL_NAME_RE = /\b(system_override|admin_override|sudo|root_access)\b/i;
+// Fenced code block pattern — used to strip code blocks before exfiltration checks
+const FENCED_CODE_BLOCK_RE = /```[\s\S]*?```/g;
+// Inline code pattern
+const INLINE_CODE_RE = /`[^`]+`/g;
+/** Strip fenced and inline code blocks from content */
+export function stripCodeBlocks(content) {
+    return content.replace(FENCED_CODE_BLOCK_RE, '').replace(INLINE_CODE_RE, '');
+}
+// ── Helpers ──────────────────────────────────────────────────────────────────
+export function decodeBase64Safe(str) {
+    try {
+        const buf = Buffer.from(str, 'base64');
+        // Reject if it doesn't round-trip (not valid base64)
+        if (buf.toString('base64').replace(/=+$/, '') !== str.replace(/=+$/, ''))
+            return null;
+        const decoded = buf.toString('utf-8');
+        // Reject binary content (contains null bytes)
+        if (decoded.includes('\0'))
+            return null;
+        return decoded;
+    }
+    catch {
+        return null;
+    }
+}
+export function hasZeroWidthChars(content) {
+    return ZERO_WIDTH_RE.test(content);
+}
+export function mergeResults(...results) {
+    const findings = [];
+    for (const r of results)
+        findings.push(...r.findings);
+    return { ok: findings.every(f => f.severity !== 'block'), findings };
+}
+// ── Core Scanning ────────────────────────────────────────────────────────────
+export function scanContent(content, context, _depth = 0) {
+    if (!content)
+        return { ok: true, findings: [] };
+    const findings = [];
+    const strippedContent = stripCodeBlocks(content);
+    // Run all regex patterns
+    for (const { pattern, severity, category, message, skipInCodeBlocks } of GUARDRAIL_PATTERNS) {
+        const target = skipInCodeBlocks ? strippedContent : content;
+        const match = target.match(pattern);
+        if (match) {
+            findings.push({ severity, category, message: `${context}: ${message}`, matched: match[0] });
+        }
+    }
+    // Check for zero-width characters
+    if (hasZeroWidthChars(content)) {
+        findings.push({
+            severity: 'block',
+            category: 'hidden-content',
+            message: `${context}: content contains zero-width or bidirectional characters`,
+            matched: content.match(ZERO_WIDTH_RE)[0],
+        });
+    }
+    // Check for base64-encoded payloads (one level of recursion)
+    if (_depth === 0) {
+        const b64Matches = content.match(BASE64_RE);
+        if (b64Matches) {
+            for (const b64 of b64Matches) {
+                const decoded = decodeBase64Safe(b64);
+                if (decoded) {
+                    const inner = scanContent(decoded, `${context} (decoded base64)`, 1);
+                    if (!inner.ok) {
+                        findings.push({
+                            severity: 'block',
+                            category: 'encoded-payload',
+                            message: `${context}: base64-encoded content contains injection`,
+                            matched: b64.slice(0, 60) + (b64.length > 60 ? '...' : ''),
+                        });
+                        findings.push(...inner.findings);
+                    }
+                }
+            }
+        }
+    }
+    return { ok: findings.every(f => f.severity !== 'block'), findings };
+}
+export function scanTool(tool) {
+    const name = tool.function.name;
+    const results = [];
+    // Scan tool description
+    results.push(scanContent(tool.function.description, `tool "${name}" description`));
+    // Scan parameter descriptions
+    const props = tool.function.parameters?.properties;
+    if (props) {
+        for (const [paramName, paramDef] of Object.entries(props)) {
+            const desc = paramDef.description;
+            if (desc) {
+                results.push(scanContent(desc, `tool "${name}" param "${paramName}"`));
+            }
+        }
+    }
+    // Check for suspicious tool names
+    if (SUSPICIOUS_TOOL_NAME_RE.test(name)) {
+        const finding = {
+            severity: 'warn',
+            category: 'suspicious-override',
+            message: `tool "${name}": suspicious tool name`,
+            matched: name,
+        };
+        results.push({ ok: true, findings: [finding] });
+    }
+    return mergeResults(...results);
+}
+export function scanSkill(skill) {
+    const results = [];
+    results.push(scanContent(skill.content, `skill "${skill.name}"`));
+    results.push(scanContent(skill.description, `skill "${skill.name}" description`));
+    return mergeResults(...results);
+}
+//# sourceMappingURL=guardrails.js.map

package/dist/core/guardrails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/core/guardrails.ts"],"names":[],"mappings":"AAqCA,MAAM,CAAC,MAAM,kBAAkB,GAAuB;IACpD,8DAA8D;IAC9D,EAAE,OAAO,EAAE,4CAA4C,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,kDAAkD,EAAE;IACvK,EAAE,OAAO,EAAE,6CAA6C,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,+CAA+C,EAAE;IACrK,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAClI,EAAE,OAAO,EAAE,wCAAwC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,+CAA+C,EAAE;IAChK,EAAE,OAAO,EAAE,wFAAwF,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,qDAAqD,EAAE;IACtN,EAAE,OAAO,EAAE,4EAA4E,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,yCAAyC,EAAE;IAC9L,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,gDAAgD,EAAE;IACnJ,EAAE,OAAO,EAAE,2EAA2E,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,qCAAqC,EAAE;IACzL,EAAE,OAAO,EAAE,oFAAoF,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,6CAA6C,EAAE;IAC1M,EAAE,OAAO,EAAE,iFAAiF,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAE/L,+FAA+F;IAC/F,EAAE,OAAO,EAAE,+GAA+G,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,+DAA+D,EAAE;IACzP,EAAE,OAAO,EAAE,+DAA+D,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,gDAAgD,EAAE;IAC1L,EAAE,OAAO,EAAE,qEAAqE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,uCAAuC,EAAE,gBAAgB,EAAE,IAAI,EAAE;IAC/M,EAAE,OAAO,EAAE,qDAAqD,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,8CAA8C,EAAE;IAC9K,EAAE,OAAO,EAAE,wDAAwD,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,oCAAoC,EAAE;IAEvK,sCAAsC;IACtC,EAAE,OAAO,EAAE,mFAAmF,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,8CAA8C,EAAE;IACxM,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAElI,qDAAqD;IACrD,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,8CAA8C,EAAE;IACpJ,EAAE,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,IAAI,EAAE;IACnJ,EAAE,OAAO,EAAE,iDAAiD,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,oCAAoC,EAAE,gBAAgB,EAAE,IAAI,EAAE;IACjL,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,gCAAgC,EAAE,gBAAgB,EAAE,IAAI,EAAE;IAE1I,+DAA+D;IAC/D,EAAE,OAAO,EAAE,uCAAuC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,uCAAuC,EAAE;CACtJ,CAAC;AAEF,0CAA0C;AAC1C,MAAM,aAAa,GAAG,2DAA2D,CAAC;AAElF,6EAA6E;AAC7E,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAE9C,wBAAwB;AACxB,MAAM,uBAAuB,GAAG,wDAAwD,CAAC;AAEzF,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAE/C,sBAAsB;AACtB,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,gFAAgF;AAEhF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvC,qDAAqD;QACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAG,OAAqB;IACnD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;AACvE,CAAC;AAED,gFAAgF;AAEhF,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAAe,EAAE,MAAM,GAAG,CAAC;IACtE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEhD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,eAAe,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAEjD,yBAAyB;IACzB,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,kBAAkB,EAAE,CAAC;QAC5F,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,KAAK,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,gBAAgB;YAC1B,OAAO,EAAE,GAAG,OAAO,2DAA2D;YAC9E,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,aAAa,CAAE,CAAC,CAAC,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,OAAO,mBAAmB,EAAE,CAAC,CAAC,CAAC;oBACrE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;wBACd,QAAQ,CAAC,IAAI,CAAC;4BACZ,QAAQ,EAAE,OAAO;4BACjB,QAAQ,EAAE,iBAAiB;4BAC3B,OAAO,EAAE,GAAG,OAAO,6CAA6C;4BAChE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC3D,CAAC,CAAC;wBACH,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACnC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAU;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAChC,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,wBAAwB;IACxB,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC;IAEnF,8BAA8B;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IACnD,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAI,QAAqC,CAAC,WAAW,CAAC;YAChE,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,IAAI,YAAY,SAAS,GAAG,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAgB;YAC3B,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,qBAAqB;YAC/B,OAAO,EAAE,SAAS,IAAI,yBAAyB;YAC/C,OAAO,EAAE,IAAI;SACd,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,YAAY,CAAC,GAAG,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAgB;IACxC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC;IAClF,OAAO,YAAY,CAAC,GAAG,OAAO,CAAC,CAAC;AAClC,CAAC"}

package/dist/core/loader.d.ts

@@ -1,3 +1,7 @@
-import { Tool } from './types.js';
-export declare function loadUserTools(cwd: string): Promise<Tool[]>;
+import { Tool, ToolLoadFailure } from './types.js';
+export interface LoadUserToolsResult {
+    tools: Tool[];
+    failures: ToolLoadFailure[];
+}
+export declare function loadUserTools(cwd: string): Promise<LoadUserToolsResult>;
 //# sourceMappingURL=loader.d.ts.map

package/dist/core/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/core/loader.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAwBlC,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAShE"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/core/loader.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAwCnD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAY7E"}

package/dist/core/loader.js

@@ -2,38 +2,52 @@ import { existsSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { AG_DIR } from './constants.js';
+import { scanTool } from './guardrails.js';
 async function loadToolsFromDir(dir) {
     if (!existsSync(dir))
-        return [];
+        return { tools: [], failures: [] };
     const files = readdirSync(dir).filter(f => f.endsWith('.mjs'));
     const tools = [];
+    const failures = [];
     for (const file of files) {
         try {
             const mod = await import(pathToFileURL(join(dir, file)).href);
             const tool = mod.default;
             if (tool?.type === 'function' && tool?.function?.name && typeof tool?.execute === 'function') {
+                if (tool.permissionKey && typeof tool.permissionKey?.qualifier !== 'string') {
+                    tool.permissionKey = undefined;
+                }
+                const scan = scanTool(tool);
+                if (!scan.ok) {
+                    const reasons = scan.findings.filter(f => f.severity === 'block').map(f => f.message).join('; ');
+                    failures.push({ file, name: tool.function.name, reason: reasons });
+                    continue;
+                }
                 tools.push(tool);
             }
             else {
-                process.stderr.write(`Warning: ${file} skipped (invalid tool format)\n`);
+                failures.push({ file, reason: 'invalid tool format' });
             }
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
-            process.stderr.write(`Warning: ${file} failed to load: ${msg}\n`);
+            failures.push({ file, reason: msg });
         }
     }
-    return tools;
+    return { tools, failures };
 }
 export async function loadUserTools(cwd) {
-    const globalTools = await loadToolsFromDir(join(AG_DIR, 'tools'));
-    const localTools = await loadToolsFromDir(join(cwd, '.ag', 'tools'));
+    const global = await loadToolsFromDir(join(AG_DIR, 'tools'));
+    const local = await loadToolsFromDir(join(cwd, '.ag', 'tools'));
     // Local tools override global if same name
     const byName = new Map();
-    for (const t of globalTools)
+    for (const t of global.tools)
         byName.set(t.function.name, t);
-    for (const t of localTools)
+    for (const t of local.tools)
         byName.set(t.function.name, t);
-    return Array.from(byName.values());
+    return {
+        tools: Array.from(byName.values()),
+        failures: [...global.failures, ...local.failures],
+    };
 }
 //# sourceMappingURL=loader.js.map

package/dist/core/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/core/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC;YACzB,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC7F,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,kCAAkC,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,oBAAoB,GAAG,IAAI,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAErE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/core/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAO3C,KAAK,UAAU,gBAAgB,CAAC,GAAW;IACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC;YACzB,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC7F,IAAI,IAAI,CAAC,aAAa,IAAI,OAAO,IAAI,CAAC,aAAa,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC5E,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;gBACjC,CAAC;gBACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACjG,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;oBACnE,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAEhE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/core/permissions.d.ts

@@ -0,0 +1,60 @@
+import type { PermissionKey } from './types.js';
+export type PermissionEffect = 'allow' | 'deny';
+export type PermissionScope = 'session' | 'project' | 'global';
+export interface PermissionRule {
+    pattern: string;
+    effect: PermissionEffect;
+}
+export interface PermissionFile {
+    allow?: string[];
+    deny?: string[];
+}
+export interface ParsedPattern {
+    tool: string;
+    qualifier: string;
+    glob: string | null;
+}
+/** Hand-rolled glob matcher — supports *, **, ? with no dependencies */
+export declare function globMatch(pattern: string, value: string): boolean;
+/**
+ * Parse a pattern string like "bash(npm:*)" into structured form.
+ * Supports: "Tool(qualifier:glob)", "Tool(qualifier)", "Tool(*)", "*"
+ */
+export declare function parsePattern(str: string): ParsedPattern;
+interface MatchKey {
+    qualifier: string;
+    value: string;
+}
+/** Extract qualifier + value from a tool call for pattern matching */
+export declare function extractMatchKey(toolName: string, args: Record<string, unknown>, permissionKey?: PermissionKey): MatchKey;
+/** Generate a reasonable permission pattern from a concrete tool call */
+export declare function inferPattern(toolName: string, args: Record<string, unknown>, permissionKey?: PermissionKey): string;
+export declare class PermissionManager {
+    private readonly cwd;
+    private readonly projectPath;
+    private readonly globalPath;
+    private sessionRules;
+    private projectRules;
+    private globalRules;
+    constructor(cwd: string);
+    /** Reload project + global rules from disk */
+    reload(): void;
+    /** Check whether a tool call is allowed, denied, or needs prompting */
+    check(toolName: string, args: Record<string, unknown>, permissionKey?: PermissionKey): 'allow' | 'deny' | 'ask';
+    /** Add a permission rule to a scope */
+    addRule(rule: PermissionRule, scope: PermissionScope): void;
+    /** Remove a rule by pattern from a scope */
+    removeRule(pattern: string, scope: PermissionScope): boolean;
+    /** Get rules, optionally filtered by scope */
+    getRules(scope?: PermissionScope): Array<PermissionRule & {
+        scope: PermissionScope;
+    }>;
+    /** Persist rules to disk */
+    save(scope: 'project' | 'global'): void;
+    /** Clear rules for a scope */
+    clear(scope: PermissionScope): void;
+    private rulesForScope;
+    private loadFile;
+}
+export {};
+//# sourceMappingURL=permissions.d.ts.map

package/dist/core/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/core/permissions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,CAAC;AAChD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/D,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAID,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAejE;AAID;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAsBvD;AAID,UAAU,QAAQ;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,aAAa,CAAC,EAAE,aAAa,GAC5B,QAAQ,CAmCV;AAID,yEAAyE;AACzE,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,aAAa,CAAC,EAAE,aAAa,GAC5B,MAAM,CAwCR;AAgBD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,OAAO,CAAC,YAAY,CAAwB;IAC5C,OAAO,CAAC,YAAY,CAAwB;IAC5C,OAAO,CAAC,WAAW,CAAwB;gBAE/B,GAAG,EAAE,MAAM;IAOvB,8CAA8C;IAC9C,MAAM,IAAI,IAAI;IAKd,uEAAuE;IACvE,KAAK,CACH,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,GAAG,MAAM,GAAG,KAAK;IAqB3B,uCAAuC;IACvC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI;IAQ3D,4CAA4C;IAC5C,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO;IAO5D,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC,cAAc,GAAG;QAAE,KAAK,EAAE,eAAe,CAAA;KAAE,CAAC;IAWrF,4BAA4B;IAC5B,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,IAAI;IAYvC,8BAA8B;IAC9B,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAQnC,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,QAAQ;CAWjB"}

package/dist/core/permissions.js

@@ -0,0 +1,252 @@
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { AG_DIR } from './constants.js';
+// ── Glob Matching ───────────────────────────────────────────────────────────
+/** Hand-rolled glob matcher — supports *, **, ? with no dependencies */
+export function globMatch(pattern, value) {
+    if (pattern === '*')
+        return true;
+    // Convert glob to regex:
+    // 1. Escape regex-special chars (except our glob chars)
+    // 2. Replace ** → any sequence (including /)
+    // 3. Replace * → any sequence (excluding /)
+    // 4. Replace ? → single char
+    const SENTINEL = '\0GLOBSTAR\0';
+    const re = pattern
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&') // escape regex specials
+        .replace(/\*\*/g, SENTINEL) // protect **
+        .replace(/\*/g, '[^/]*') // * = non-slash seq
+        .replace(new RegExp(SENTINEL.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'g'), '.*') // ** = any seq
+        .replace(/\?/g, '.'); // ? = single char
+    return new RegExp(`^${re}$`).test(value);
+}
+// ── Pattern Parsing ─────────────────────────────────────────────────────────
+/**
+ * Parse a pattern string like "bash(npm:*)" into structured form.
+ * Supports: "Tool(qualifier:glob)", "Tool(qualifier)", "Tool(*)", "*"
+ */
+export function parsePattern(str) {
+    const s = str.trim();
+    if (s === '*')
+        return { tool: '*', qualifier: '*', glob: null };
+    const parenIdx = s.indexOf('(');
+    if (parenIdx === -1) {
+        // Bare tool name: "bash" → bash(*)
+        return { tool: s.toLowerCase(), qualifier: '*', glob: null };
+    }
+    const tool = s.slice(0, parenIdx).toLowerCase();
+    const inner = s.slice(parenIdx + 1, s.endsWith(')') ? s.length - 1 : s.length);
+    const colonIdx = inner.indexOf(':');
+    if (colonIdx === -1) {
+        // No glob: "git(commit)" or "bash(*)"
+        return { tool, qualifier: inner || '*', glob: null };
+    }
+    const qualifier = inner.slice(0, colonIdx) || '*';
+    const glob = inner.slice(colonIdx + 1) || '*';
+    return { tool, qualifier, glob };
+}
+/** Extract qualifier + value from a tool call for pattern matching */
+export function extractMatchKey(toolName, args, permissionKey) {
+    const name = toolName.toLowerCase();
+    // Built-in tools have hardcoded extraction
+    switch (name) {
+        case 'bash': {
+            const cmd = String(args.command || '');
+            const firstWord = cmd.trimStart().split(/\s+/)[0] || '';
+            return { qualifier: firstWord, value: cmd };
+        }
+        case 'file':
+            return { qualifier: String(args.action || '*'), value: String(args.path || '') };
+        case 'git':
+            return { qualifier: String(args.action || '*'), value: '' };
+        case 'web': {
+            const action = String(args.action || '*');
+            if (action === 'fetch' && args.url) {
+                try {
+                    const hostname = new URL(String(args.url)).hostname;
+                    return { qualifier: action, value: hostname };
+                }
+                catch { /* fall through */ }
+            }
+            return { qualifier: action, value: String(args.url || args.query || '') };
+        }
+    }
+    // Custom tools: use permissionKey if provided
+    if (permissionKey?.qualifier) {
+        const q = String(args[permissionKey.qualifier] ?? '*');
+        const v = permissionKey.value ? String(args[permissionKey.value] ?? '') : '';
+        return { qualifier: q, value: v };
+    }
+    // No permissionKey: opaque tool
+    return { qualifier: '*', value: '' };
+}
+// ── Pattern Inference ───────────────────────────────────────────────────────
+/** Generate a reasonable permission pattern from a concrete tool call */
+export function inferPattern(toolName, args, permissionKey) {
+    const name = toolName.toLowerCase();
+    switch (name) {
+        case 'bash': {
+            const cmd = String(args.command || '');
+            const firstWord = cmd.trimStart().split(/\s+/)[0] || '*';
+            return `bash(${firstWord}:*)`;
+        }
+        case 'file': {
+            const action = String(args.action || '*');
+            const path = String(args.path || '');
+            const firstDir = path.split('/')[0];
+            const glob = firstDir && firstDir !== path ? `${firstDir}/**` : '*';
+            return `file(${action}:${glob})`;
+        }
+        case 'git':
+            return `git(${String(args.action || '*')})`;
+        case 'web': {
+            const action = String(args.action || '*');
+            if (action === 'fetch' && args.url) {
+                try {
+                    const hostname = new URL(String(args.url)).hostname;
+                    return `web(fetch:*${hostname}*)`;
+                }
+                catch { /* fall through */ }
+            }
+            return `web(${action}:*)`;
+        }
+    }
+    // Custom tools
+    if (permissionKey?.qualifier) {
+        const q = String(args[permissionKey.qualifier] ?? '*');
+        if (permissionKey.value) {
+            return `${name}(${q}:*)`;
+        }
+        return `${name}(${q})`;
+    }
+    return `${name}(*)`;
+}
+// ── Pattern Matching ────────────────────────────────────────────────────────
+function matchesRule(pattern, toolName, key) {
+    // Tool name check
+    if (pattern.tool !== '*' && pattern.tool !== toolName.toLowerCase())
+        return false;
+    // Qualifier check
+    if (pattern.qualifier !== '*' && !globMatch(pattern.qualifier, key.qualifier))
+        return false;
+    // Glob check (if pattern has one)
+    if (pattern.glob !== null && key.value && !globMatch(pattern.glob, key.value))
+        return false;
+    return true;
+}
+// ── PermissionManager ───────────────────────────────────────────────────────
+export class PermissionManager {
+    cwd;
+    projectPath;
+    globalPath;
+    sessionRules = [];
+    projectRules = [];
+    globalRules = [];
+    constructor(cwd) {
+        this.cwd = cwd;
+        this.projectPath = join(cwd, '.ag', 'permissions.json');
+        this.globalPath = join(AG_DIR, 'permissions.json');
+        this.reload();
+    }
+    /** Reload project + global rules from disk */
+    reload() {
+        this.projectRules = this.loadFile(this.projectPath);
+        this.globalRules = this.loadFile(this.globalPath);
+    }
+    /** Check whether a tool call is allowed, denied, or needs prompting */
+    check(toolName, args, permissionKey) {
+        const key = extractMatchKey(toolName, args, permissionKey);
+        const allRules = [...this.sessionRules, ...this.projectRules, ...this.globalRules];
+        // Deny wins: check deny rules first across all scopes
+        for (const rule of allRules) {
+            if (rule.effect === 'deny' && matchesRule(parsePattern(rule.pattern), toolName, key)) {
+                return 'deny';
+            }
+        }
+        // Then check allow rules
+        for (const rule of allRules) {
+            if (rule.effect === 'allow' && matchesRule(parsePattern(rule.pattern), toolName, key)) {
+                return 'allow';
+            }
+        }
+        return 'ask';
+    }
+    /** Add a permission rule to a scope */
+    addRule(rule, scope) {
+        const list = this.rulesForScope(scope);
+        // Avoid duplicates
+        if (!list.some(r => r.pattern === rule.pattern && r.effect === rule.effect)) {
+            list.push(rule);
+        }
+    }
+    /** Remove a rule by pattern from a scope */
+    removeRule(pattern, scope) {
+        const list = this.rulesForScope(scope);
+        const idx = list.findIndex(r => r.pattern === pattern);
+        if (idx !== -1) {
+            list.splice(idx, 1);
+            return true;
+        }
+        return false;
+    }
+    /** Get rules, optionally filtered by scope */
+    getRules(scope) {
+        const result = [];
+        const add = (rules, s) => {
+            for (const r of rules)
+                result.push({ ...r, scope: s });
+        };
+        if (!scope || scope === 'session')
+            add(this.sessionRules, 'session');
+        if (!scope || scope === 'project')
+            add(this.projectRules, 'project');
+        if (!scope || scope === 'global')
+            add(this.globalRules, 'global');
+        return result;
+    }
+    /** Persist rules to disk */
+    save(scope) {
+        const path = scope === 'project' ? this.projectPath : this.globalPath;
+        const rules = scope === 'project' ? this.projectRules : this.globalRules;
+        const dir = join(path, '..');
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        const data = {
+            allow: rules.filter(r => r.effect === 'allow').map(r => r.pattern),
+            deny: rules.filter(r => r.effect === 'deny').map(r => r.pattern),
+        };
+        writeFileSync(path, JSON.stringify(data, null, 2) + '\n');
+    }
+    /** Clear rules for a scope */
+    clear(scope) {
+        if (scope === 'session')
+            this.sessionRules = [];
+        else if (scope === 'project')
+            this.projectRules = [];
+        else if (scope === 'global')
+            this.globalRules = [];
+    }
+    // ── Private helpers ─────────────────────────────────────────────────────
+    rulesForScope(scope) {
+        switch (scope) {
+            case 'session': return this.sessionRules;
+            case 'project': return this.projectRules;
+            case 'global': return this.globalRules;
+        }
+    }
+    loadFile(path) {
+        try {
+            const raw = JSON.parse(readFileSync(path, 'utf-8'));
+            const rules = [];
+            for (const p of raw.allow ?? [])
+                rules.push({ pattern: p, effect: 'allow' });
+            for (const p of raw.deny ?? [])
+                rules.push({ pattern: p, effect: 'deny' });
+            return rules;
+        }
+        catch {
+            return [];
+        }
+    }
+}
+//# sourceMappingURL=permissions.js.map

package/dist/core/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/core/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAwBxC,+EAA+E;AAE/E,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,KAAa;IACtD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,yBAAyB;IACzB,wDAAwD;IACxD,6CAA6C;IAC7C,4CAA4C;IAC5C,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,cAAc,CAAC;IAChC,MAAM,EAAE,GAAG,OAAO;SACf,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,wBAAwB;SAC7D,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAa,aAAa;SACpD,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAe,oBAAoB;SAC1D,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,eAAe;SAC/F,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAkB,kBAAkB;IAC3D,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEhE,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,mCAAmC;QACnC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE/E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,sCAAsC;QACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;IAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AASD,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,IAA6B,EAC7B,aAA6B;IAE7B,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAEpC,2CAA2C;IAC3C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC9C,CAAC;QACD,KAAK,MAAM;YACT,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACnF,KAAK,KAAK;YACR,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC9D,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;oBACpD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,IAAI,aAAa,EAAE,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,gCAAgC;IAChC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,+EAA+E;AAE/E,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,IAA6B,EAC7B,aAA6B;IAE7B,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAEpC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YACzD,OAAO,QAAQ,SAAS,KAAK,CAAC;QAChC,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;YACpE,OAAO,QAAQ,MAAM,IAAI,IAAI,GAAG,CAAC;QACnC,CAAC;QACD,KAAK,KAAK;YACR,OAAO,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC;QAC9C,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;oBACpD,OAAO,cAAc,QAAQ,IAAI,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,OAAO,MAAM,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,eAAe;IACf,IAAI,aAAa,EAAE,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;QACvD,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;YACxB,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACzB,CAAC;IAED,OAAO,GAAG,IAAI,KAAK,CAAC;AACtB,CAAC;AAED,+EAA+E;AAE/E,SAAS,WAAW,CAAC,OAAsB,EAAE,QAAgB,EAAE,GAAa;IAC1E,kBAAkB;IAClB,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAC;IAClF,kBAAkB;IAClB,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,kCAAkC;IAClC,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAE/E,MAAM,OAAO,iBAAiB;IACX,GAAG,CAAS;IACZ,WAAW,CAAS;IACpB,UAAU,CAAS;IAE5B,YAAY,GAAqB,EAAE,CAAC;IACpC,YAAY,GAAqB,EAAE,CAAC;IACpC,WAAW,GAAqB,EAAE,CAAC;IAE3C,YAAY,GAAW;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;IAED,8CAA8C;IAC9C,MAAM;QACJ,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,uEAAuE;IACvE,KAAK,CACH,QAAgB,EAChB,IAA6B,EAC7B,aAA6B;QAE7B,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAEnF,sDAAsD;QACtD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;gBACrF,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;gBACtF,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uCAAuC;IACvC,OAAO,CAAC,IAAoB,EAAE,KAAsB;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,UAAU,CAAC,OAAe,EAAE,KAAsB;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QACvD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8CAA8C;IAC9C,QAAQ,CAAC,KAAuB;QAC9B,MAAM,MAAM,GAAuD,EAAE,CAAC;QACtE,MAAM,GAAG,GAAG,CAAC,KAAuB,EAAE,CAAkB,EAAE,EAAE;YAC1D,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,KAA2B;QAC9B,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QACtE,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAmB;YAC3B,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAClE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACjE,CAAC;QACF,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,8BAA8B;IAC9B,KAAK,CAAC,KAAsB;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;aAC3C,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;aAChD,IAAI,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;IACrD,CAAC;IAED,2EAA2E;IAEnE,aAAa,CAAC,KAAsB;QAC1C,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,SAAS,CAAC,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC;YACzC,KAAK,SAAS,CAAC,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC;YACzC,KAAK,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC;QACzC,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,IAAY;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAmB,CAAC;YACtE,MAAM,KAAK,GAAqB,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}

package/dist/core/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/core/registry.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAK5E;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA6ClE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAGhD"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/core/registry.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAK5E;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2DlE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAGhD"}

package/dist/core/registry.js

@@ -1,6 +1,7 @@
 import { writeFileSync, mkdirSync, existsSync, rmSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
+import { scanContent } from './guardrails.js';
 const SKILLS_DIR = join(homedir(), '.ag', 'skills');
 const SEARCH_API = 'https://skills.sh/api/search';
 function githubHeaders() {
@@ -84,6 +85,21 @@ export async function installSkill(source) {
                 continue;
             }
             const buffer = Buffer.from(await res.arrayBuffer());
+            if (relativePath.endsWith('.md') || relativePath.endsWith('.mjs')) {
+                const text = buffer.toString('utf-8');
+                const scan = scanContent(text, `installed file "${relativePath}" from ${repo}`);
+                if (!scan.ok) {
+                    const reasons = scan.findings.filter(f => f.severity === 'block').map(f => f.message).join('; ');
+                    errors.push(`Blocked ${relativePath}: ${reasons}`);
+                    if (relativePath === 'SKILL.md') {
+                        // Core skill file is compromised — abort entire installation
+                        if (existsSync(skillDir))
+                            rmSync(skillDir, { recursive: true });
+                        throw new Error(`Skill "${skillName}" blocked by guardrails: ${reasons}`);
+                    }
+                    continue;
+                }
+            }
             writeFileSync(destPath, buffer);
         }
         catch (err) {