@elmoxbt/agentskillguard 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Elmo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,180 @@
+# AgentSkillGuard
+
+**A static security scanner for AI agent tools before they get anywhere near a Solana wallet.**
+
+Agents increasingly install tools (MCP servers, plugins, "skills") from third parties. Every wallet-security effort so far has assumed the *agent* is the thing to secure. AgentSkillGuard's thesis: **the tool supply chain is the attack surface.** A perfectly secure agent handing a perfectly signed transaction to a malicious swap-tool is still a drained wallet.
+
+Think `npm audit` + ClamAV, scoped to the specific things an agent tool can do to a Solana wallet.
+
+```
+skillguard scan ./my-agent-tool --policy policies/example-swap-agent.yaml
+```
+
+```
+AGENTSKILLGUARD
+target: /home/user/my-agent-tool
+files scanned: 3
+
+Capabilities detected:
+  [x] CRITICAL  wallet.private_key_access — Tool references private key / secret / mnemonic material directly.
+        index.js:12  const secretKey = process.env.WALLET_PRIVATE_KEY;
+  [x] CRITICAL  system.shell_exec — Tool can execute OS shell commands via child_process.
+        index.js:34  exec('curl -s ' + relayHost + '/beacon');
+  [x] CRITICAL  code.dynamic_load — Tool loads or executes code dynamically at runtime.
+        index.js:30  eval(Buffer.from(patch, 'base64').toString());
+  ...
+
+Policy violations:
+  [!] CRITICAL  wallet.private_key_access is never permitted, regardless of policy
+  [!] CRITICAL  system.shell_exec is never permitted, regardless of policy
+  [!] CRITICAL  code.dynamic_load is never permitted, regardless of policy
+
+Recommended action:  BLOCK
+3 critical violation(s): wallet.private_key_access, system.shell_exec, code.dynamic_load.
+```
+
+---
+
+## How it works
+
+```
+              ┌────────────────────┐
+  tool code → │  static analyzer    │ → findings (capability + severity + line)
+              │  (rule engine)      │
+              └─────────┬──────────┘
+                         │
+              ┌──────────▼──────────┐
+   policy.yml → │  policy enforcer   │ → violations (findings checked against
+              │  (capability manifest│    the manifest + a hard floor of
+              │   + hard floor)      │    never-allowed capabilities)
+              └─────────┬──────────┘
+                         │
+              ┌──────────▼──────────┐
+              │   verdict engine     │ → ALLOW / WARN / BLOCK
+              └──────────────────────┘
+```
+
+1. **Static analyzer** (`src/scanner/staticAnalyzer.ts`) walks every `.js`/`.ts` file in the target and runs a rule set (`src/rules/rules.ts`) against it line-by-line, tagging matches with a **capability** (e.g. `wallet.signing`, `system.shell_exec`) and severity.
+2. **Policy enforcer** (`src/policy/enforcer.ts`) loads a YAML **capability manifest** and checks detected capabilities against it. A small set of capabilities (private-key access, shell exec, dynamic code loading, obfuscated execution, unlimited approvals) are an **always-blocked floor** — no policy can grant them.
+3. **Verdict engine** (`src/report/verdict.ts`) turns violations into a single recommendation: `BLOCK` (critical violation), `WARN` (needs manual review), or `ALLOW`.
+4. Every scan is optionally persisted to a local SQLite database (`~/.agentskillguard/scans.db`) so you can build a `skillguard history` audit trail across every tool you've ever vetted.
+
+### Detected capabilities
+
+| Capability | Checks for | Severity |
+|---|---|---|
+| `wallet.signing` | Can the tool sign transactions/messages? | CRITICAL |
+| `wallet.private_key_access` | Does it touch raw private keys / mnemonics? | CRITICAL |
+| `network.http` | Does it make outbound HTTP requests? | MEDIUM |
+| `network.dynamic_url` | Are request URLs built dynamically (unverifiable)? | HIGH |
+| `solana.tx_modification` | Does it mutate transaction instructions/destinations? | HIGH |
+| `system.shell_exec` | Can it run OS shell commands? | CRITICAL |
+| `code.dynamic_load` | Does it `eval`/`new Function`/dynamic `require`? | CRITICAL |
+| `solana.unlimited_approval` | Does it request unlimited token approvals? | HIGH |
+| `system.env_read` | Does it read `process.env`? | MEDIUM |
+| `code.obfuscation` | Does it decode+execute base64/hex payloads? | CRITICAL |
+| `system.filesystem_write` | Does it write/delete files? | MEDIUM |
+
+This maps directly to the "tool permissions" checklist a human reviewer would ask about — the scanner just does it automatically, on every install.
+
+## The capability manifest
+
+```yaml
+name: swap-agent
+description: "Allows a swap tool to route trades through Jupiter and call its price API."
+
+permissions:
+  solana:
+    programs:
+      - Jupiter
+    max_sol: 0.5
+    tokens:
+      - USDC
+
+  network:
+    domains:
+      - api.jup.ag
+      - quote-api.jup.ag
+
+  wallet:
+    signing: true
+    max_transactions_per_hour: 10
+```
+
+The scanner statically enforces `wallet.signing`, `network.domains`, and `solana.programs`. `max_sol` and `max_transactions_per_hour` describe the intended **runtime** ceiling — static analysis can prove a tool is *capable* of signing, but it can't prove what amount it will sign at runtime. See Roadmap below.
+
+## Install & run
+
+```bash
+npm install
+npm run build
+
+# scan the bundled "malicious" fixture — should BLOCK
+npm run scan:demo:malicious
+
+# scan the bundled "safe" fixture — should ALLOW
+npm run scan:demo:safe
+
+# scan any tool on your machine
+node dist/cli.js scan ./path/to/tool --policy policies/example-swap-agent.yaml
+
+# scan without a policy — only the hard-blocked floor applies
+node dist/cli.js scan ./path/to/tool
+
+# machine-readable output (for CI / pre-install hooks)
+node dist/cli.js scan ./path/to/tool --json
+
+# generate a starter deny-by-default policy
+node dist/cli.js init-policy -o my-tool.policy.yaml
+
+# see everything you've scanned so far
+node dist/cli.js history
+```
+
+Exit codes are CI-friendly: `0` = ALLOW, `1` = WARN, `2` = BLOCK — so you can wire `skillguard scan` into a pre-install hook and have it actually stop an install.
+
+Run the smoke tests directly with `npm test` (no test framework, just assertions — see `test/scanner.test.ts`).
+
+## Project structure
+
+```
+agentskillguard/
+├── src/
+│   ├── cli.ts                  # commander-based CLI entry point
+│   ├── types.ts                # shared types (Finding, Violation, ScanResult...)
+│   ├── rules/rules.ts           # the rule set — add new detection rules here
+│   ├── scanner/
+│   │   ├── index.ts             # orchestrates a scan end-to-end
+│   │   ├── staticAnalyzer.ts    # line-based rule matching + URL extraction
+│   │   └── mcpMetadata.ts       # reads package.json / mcp.json for tool identity
+│   ├── policy/
+│   │   ├── schema.ts            # zod schema for the YAML capability manifest
+│   │   ├── loader.ts            # loads + validates a policy file
+│   │   └── enforcer.ts          # findings + policy -> violations
+│   ├── report/
+│   │   ├── verdict.ts           # violations -> ALLOW / WARN / BLOCK
+│   │   └── formatter.ts         # colored CLI report
+│   ├── db/store.ts              # SQLite scan history (better-sqlite3)
+│   └── utils/fileWalker.ts      # recursive source-file discovery
+├── policies/example-swap-agent.yaml
+├── examples/
+│   ├── malicious-tool/          # fixture that trips nearly every rule (inert — do not run)
+│   └── safe-tool/                # fixture that scans clean
+└── test/scanner.test.ts         # smoke test asserting both fixtures verdict correctly
+```
+
+## Scope & honesty about limitations
+
+This is a portfolio-grade MVP, not a production security product. Specifically:
+
+- **Detection is regex/line-based, not a real AST.** It's fast and dependency-light, but it can be evaded by anyone who tries (multi-line obfuscation, string-splitting `"ev" + "al"`, etc). The natural upgrade path is a Tree-sitter-based AST pass (`tree-sitter-javascript`/`tree-sitter-typescript`) doing call-graph and data-flow analysis instead of pattern matching — the rule *interface* (`Rule.pattern` → `Rule.check(ast)`) is designed so that swap is additive, not a rewrite.
+- **Static analysis can't enforce runtime limits.** `max_sol` and `max_transactions_per_hour` in the manifest are real intents but need a runtime wrapper (a proxy the agent calls through, which meters actual transaction amounts/frequency against the manifest) to actually enforce — the scanner can only flag that a tool *is capable* of exceeding them if it doesn't hard-code such limits itself.
+- **No sandboxed dynamic analysis yet.** A tool that decrypts its payload only at runtime (fetched from a CDN post-install, key derived from an unpredictable seed) won't be caught by source scanning at all. That needs an actual sandboxed execution pass — out of scope for the MVP.
+
+## Roadmap
+
+- [ ] Tree-sitter AST engine (real call-graph analysis instead of regex)
+- [ ] Runtime enforcement proxy: wraps `@solana/web3.js` calls so `max_sol` / `max_transactions_per_hour` are enforced live, not just requested
+- [ ] MCP-native scanning: intercept tool registration at the protocol level and scan before an agent is ever allowed to call it
+- [ ] Signature/hash database of previously-scanned malicious tools (the "ClamAV" half of the pitch)
+- [ ] `skillguard watch` — scan on every `npm install` in an agent's tool directory

package/dist/cli.js

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
+const scanner_1 = require("./scanner");
+const loader_1 = require("./policy/loader");
+const formatter_1 = require("./report/formatter");
+const store_1 = require("./db/store");
+const program = new commander_1.Command();
+program
+    .name('skillguard')
+    .description('AgentSkillGuard — static security scanner for AI agent tools that touch a Solana wallet.')
+    .version('0.1.0');
+program
+    .command('scan <target>')
+    .description('Scan a tool directory or file for dangerous capabilities')
+    .option('-p, --policy <file>', 'Path to a YAML capability manifest to enforce')
+    .option('--json', 'Print machine-readable JSON instead of the formatted report')
+    .option('--no-save', 'Do not persist this scan to the local history database')
+    .action((target, opts) => {
+    const resolvedTarget = path.resolve(target);
+    if (!fs.existsSync(resolvedTarget)) {
+        console.error(chalk_1.default.red(`Target not found: ${resolvedTarget}`));
+        process.exitCode = 1;
+        return;
+    }
+    const policy = opts.policy ? (0, loader_1.loadPolicy)(path.resolve(opts.policy)) : null;
+    const result = (0, scanner_1.scanTarget)(resolvedTarget, policy);
+    if (opts.save) {
+        try {
+            (0, store_1.saveScan)(result);
+        }
+        catch (err) {
+            console.error(chalk_1.default.yellow(`Warning: could not save scan history (${err.message})`));
+        }
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else {
+        (0, formatter_1.printReport)(result);
+    }
+    if (result.verdict === 'BLOCK') {
+        process.exitCode = 2;
+    }
+    else if (result.verdict === 'WARN') {
+        process.exitCode = 1;
+    }
+});
+program
+    .command('init-policy')
+    .description('Write a starter deny-by-default policy manifest')
+    .option('-o, --out <file>', 'Output path', 'skillguard.policy.yaml')
+    .action((opts) => {
+    const outPath = path.resolve(opts.out);
+    if (fs.existsSync(outPath)) {
+        console.error(chalk_1.default.red(`Refusing to overwrite existing file: ${outPath}`));
+        process.exitCode = 1;
+        return;
+    }
+    fs.writeFileSync(outPath, loader_1.DEFAULT_POLICY_YAML, 'utf-8');
+    console.log(chalk_1.default.green(`Wrote starter policy to ${outPath}`));
+});
+program
+    .command('history')
+    .description('Show recent scans from local history')
+    .option('-n, --limit <n>', 'Number of rows to show', '20')
+    .action((opts) => {
+    const rows = (0, store_1.listScans)(parseInt(opts.limit, 10));
+    if (rows.length === 0) {
+        console.log(chalk_1.default.dim('No scans recorded yet. Run `skillguard scan <target>` first.'));
+        return;
+    }
+    for (const r of rows) {
+        const label = String(r.verdict).padEnd(6);
+        const colored = r.verdict === 'BLOCK' ? chalk_1.default.red(label) : r.verdict === 'WARN' ? chalk_1.default.yellow(label) : chalk_1.default.green(label);
+        console.log(`#${r.id}  ${r.scanned_at}  ${colored}  ${r.tool_name ?? '(unnamed)'}  ${r.target}  ` +
+            chalk_1.default.dim(`(${r.findings_count} findings, ${r.violations_count} violations)`));
+    }
+});
+program.parse(process.argv);

package/dist/db/store.js

@@ -0,0 +1,99 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.saveScan = saveScan;
+exports.listScans = listScans;
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const DB_DIR = path.join(os.homedir(), '.agentskillguard');
+const DB_PATH = path.join(DB_DIR, 'scans.db');
+function getDb() {
+    if (!fs.existsSync(DB_DIR))
+        fs.mkdirSync(DB_DIR, { recursive: true });
+    const db = new better_sqlite3_1.default(DB_PATH);
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS scans (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      target TEXT NOT NULL,
+      tool_name TEXT,
+      verdict TEXT NOT NULL,
+      verdict_reason TEXT,
+      findings_count INTEGER,
+      violations_count INTEGER,
+      result_json TEXT NOT NULL,
+      scanned_at TEXT NOT NULL
+    );
+  `);
+    return db;
+}
+function saveScan(result) {
+    const db = getDb();
+    try {
+        const stmt = db.prepare(`
+      INSERT INTO scans (target, tool_name, verdict, verdict_reason, findings_count, violations_count, result_json, scanned_at)
+      VALUES (@target, @tool_name, @verdict, @verdict_reason, @findings_count, @violations_count, @result_json, @scanned_at)
+    `);
+        const info = stmt.run({
+            target: result.target,
+            tool_name: result.metadata?.name ?? null,
+            verdict: result.verdict,
+            verdict_reason: result.verdictReason,
+            findings_count: result.findings.length,
+            violations_count: result.violations.length,
+            result_json: JSON.stringify(result),
+            scanned_at: result.scannedAt,
+        });
+        return info.lastInsertRowid;
+    }
+    finally {
+        db.close();
+    }
+}
+function listScans(limit = 20) {
+    const db = getDb();
+    try {
+        return db
+            .prepare(`SELECT id, target, tool_name, verdict, findings_count, violations_count, scanned_at FROM scans ORDER BY id DESC LIMIT ?`)
+            .all(limit);
+    }
+    finally {
+        db.close();
+    }
+}

package/dist/policy/enforcer.js

@@ -0,0 +1,111 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluatePolicy = evaluatePolicy;
+const fs = __importStar(require("fs"));
+const staticAnalyzer_1 = require("../scanner/staticAnalyzer");
+/**
+ * Capabilities that are never acceptable for an agent tool, regardless of
+ * what a policy manifest grants. A policy can only narrow permissions
+ * below this floor — it can never widen past it.
+ */
+const ALWAYS_BLOCKED_CAPABILITIES = new Set([
+    'wallet.private_key_access',
+    'system.shell_exec',
+    'code.dynamic_load',
+    'code.obfuscation',
+    'solana.unlimited_approval',
+]);
+function evaluatePolicy(findings, policy, filesScanned) {
+    const violations = [];
+    const capabilitiesSeen = new Set(findings.map((f) => f.capability));
+    // 1. Hard floor — applies even with no policy supplied at all.
+    for (const cap of capabilitiesSeen) {
+        if (ALWAYS_BLOCKED_CAPABILITIES.has(cap)) {
+            const f = findings.find((x) => x.capability === cap);
+            violations.push({
+                capability: cap,
+                severity: 'CRITICAL',
+                message: `${cap} is never permitted, regardless of policy (${f.description})`,
+            });
+        }
+    }
+    if (!policy) {
+        return violations;
+    }
+    // 2. Wallet signing must be explicitly granted.
+    if (capabilitiesSeen.has('wallet.signing') && !policy.permissions.wallet.signing) {
+        violations.push({
+            capability: 'wallet.signing',
+            severity: 'CRITICAL',
+            message: 'Tool signs transactions but policy.permissions.wallet.signing is false.',
+        });
+    }
+    // 3. Dynamic URLs can never be verified against an allowlist.
+    if (capabilitiesSeen.has('network.dynamic_url')) {
+        violations.push({
+            capability: 'network.dynamic_url',
+            severity: 'HIGH',
+            message: 'Tool builds request URLs dynamically — the target domain cannot be statically verified against the allowlist.',
+        });
+    }
+    // 4. Any literal domain contacted must be in the allowlist.
+    if (capabilitiesSeen.has('network.http')) {
+        const allowlist = new Set(policy.permissions.network.domains);
+        const seenDomains = new Set();
+        for (const file of filesScanned) {
+            const content = fs.readFileSync(file, 'utf-8');
+            (0, staticAnalyzer_1.extractDomains)((0, staticAnalyzer_1.extractLiteralUrls)(content)).forEach((d) => seenDomains.add(d));
+        }
+        for (const domain of seenDomains) {
+            if (!allowlist.has(domain)) {
+                violations.push({
+                    capability: 'network.http',
+                    severity: 'HIGH',
+                    message: `Tool contacts domain "${domain}", which is not in the policy's network.domains allowlist.`,
+                });
+            }
+        }
+    }
+    // 5. Transaction manipulation requires at least one granted Solana program.
+    if (capabilitiesSeen.has('solana.tx_modification') && policy.permissions.solana.programs.length === 0) {
+        violations.push({
+            capability: 'solana.tx_modification',
+            severity: 'HIGH',
+            message: 'Tool modifies transaction instructions but the policy grants no Solana program permissions.',
+        });
+    }
+    return violations;
+}

package/dist/policy/loader.js

@@ -0,0 +1,66 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_POLICY_YAML = void 0;
+exports.loadPolicy = loadPolicy;
+const fs = __importStar(require("fs"));
+const yaml = __importStar(require("js-yaml"));
+const schema_1 = require("./schema");
+function loadPolicy(policyPath) {
+    const raw = fs.readFileSync(policyPath, 'utf-8');
+    const parsed = yaml.load(raw);
+    const result = schema_1.PolicySchema.safeParse(parsed);
+    if (!result.success) {
+        const issues = result.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ');
+        throw new Error(`Invalid policy manifest (${policyPath}): ${issues}`);
+    }
+    return result.data;
+}
+exports.DEFAULT_POLICY_YAML = `name: default-deny
+description: "Starter policy — deny everything until explicitly granted."
+
+permissions:
+  solana:
+    programs: []
+    max_sol: 0
+    tokens: []
+
+  network:
+    domains: []
+
+  wallet:
+    signing: false
+    max_transactions_per_hour: 0
+`;

package/dist/policy/schema.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicySchema = void 0;
+const zod_1 = require("zod");
+/**
+ * The Solana-specific capability manifest schema.
+ *
+ * This is intentionally narrow for the MVP: it describes the *ceiling* of
+ * what a tool is allowed to do. The static scanner's findings are checked
+ * against it in src/policy/enforcer.ts. Fields like max_sol and
+ * max_transactions_per_hour are captured here and are enforced at *runtime*
+ * by a wrapping guard (see README "Roadmap") — they cannot be verified by
+ * static analysis alone.
+ */
+exports.PolicySchema = zod_1.z.object({
+    name: zod_1.z.string(),
+    description: zod_1.z.string().optional(),
+    permissions: zod_1.z.object({
+        solana: zod_1.z
+            .object({
+            programs: zod_1.z.array(zod_1.z.string()).default([]),
+            max_sol: zod_1.z.number().default(0),
+            tokens: zod_1.z.array(zod_1.z.string()).default([]),
+        })
+            .default({ programs: [], max_sol: 0, tokens: [] }),
+        network: zod_1.z
+            .object({
+            domains: zod_1.z.array(zod_1.z.string()).default([]),
+        })
+            .default({ domains: [] }),
+        wallet: zod_1.z
+            .object({
+            signing: zod_1.z.boolean().default(false),
+            max_transactions_per_hour: zod_1.z.number().default(0),
+        })
+            .default({ signing: false, max_transactions_per_hour: 0 }),
+    }),
+});