@evalops/maestro 0.10.18 → 0.10.20

package/dist/safety/permission-profile.js

@@ -0,0 +1,349 @@
+import { realpathSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+import { isPathWithin } from "../utils/path-containment.js";
+const ACCESS_RANK = {
+    none: 0,
+    "read-only": 1,
+    "read-write": 2,
+};
+const PROFILE_DEFAULT_CWD = process.cwd();
+function canonicalizePath(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
+function normalizeConcretePath(path, cwd) {
+    return canonicalizePath(isAbsolute(path) ? resolve(path) : resolve(cwd, path));
+}
+function permissionPathKey(path) {
+    switch (path.kind) {
+        case "path":
+            return `path:${path.path}`;
+        case "special":
+            return `special:${path.value}`;
+        case "glob":
+            return `glob:${path.pattern}`;
+    }
+}
+function entryKey(entry) {
+    return `${permissionPathKey(entry.path)}:${entry.access}`;
+}
+function normalizeEntry(entry, cwd) {
+    if (entry.path.kind === "glob" && entry.access !== "none") {
+        throw new Error("Permission profile glob entries may only be deny rules for now");
+    }
+    if (entry.path.kind !== "path") {
+        return entry;
+    }
+    return {
+        ...entry,
+        path: {
+            kind: "path",
+            path: normalizeConcretePath(entry.path.path, cwd),
+        },
+    };
+}
+function maxGlobScanDepth(left, right) {
+    if (left === undefined) {
+        return right;
+    }
+    if (right === undefined) {
+        return left;
+    }
+    return Math.max(left, right);
+}
+function resolveSpecialPath(value, cwd) {
+    switch (value) {
+        case "workspace":
+            return normalizeConcretePath(cwd, cwd);
+        case "tmp":
+            return normalizeConcretePath("/tmp", cwd);
+        case "tmpdir":
+            return process.env.TMPDIR
+                ? normalizeConcretePath(process.env.TMPDIR, cwd)
+                : undefined;
+        case "full-disk":
+            return "/";
+    }
+}
+function materializePath(path, cwd) {
+    switch (path.kind) {
+        case "path":
+            return path.path;
+        case "special":
+            return resolveSpecialPath(path.value, cwd);
+        case "glob":
+            return undefined;
+    }
+}
+function constrainAccess(requested, granted) {
+    return ACCESS_RANK[requested] <= ACCESS_RANK[granted] ? requested : granted;
+}
+function intersectConcretePathEntries(requestedEntry, requestedPath, grantedEntry, grantedPath) {
+    if (isPathWithin(requestedPath, grantedPath)) {
+        return {
+            path: requestedEntry.path,
+            access: constrainAccess(requestedEntry.access, grantedEntry.access),
+        };
+    }
+    if (isPathWithin(grantedPath, requestedPath)) {
+        return {
+            path: grantedEntry.path,
+            access: constrainAccess(requestedEntry.access, grantedEntry.access),
+        };
+    }
+    return undefined;
+}
+function intersectionEntryKey(entry, cwd) {
+    const concretePath = materializePath(entry.path, cwd);
+    return concretePath
+        ? `concrete:${concretePath}`
+        : permissionPathKey(entry.path);
+}
+function coalesceToMostRestrictiveEntries(entries, cwd) {
+    const entriesByPath = new Map();
+    for (const entry of entries) {
+        const key = intersectionEntryKey(entry, cwd);
+        const existing = entriesByPath.get(key);
+        if (!existing || ACCESS_RANK[entry.access] < ACCESS_RANK[existing.access]) {
+            entriesByPath.set(key, entry);
+        }
+    }
+    return [...entriesByPath.values()];
+}
+function readWriteEntries(profile) {
+    return (profile.fileSystem?.entries ?? []).filter((entry) => entry.access === "read-write");
+}
+function denyEntries(profile) {
+    return (profile.fileSystem?.entries ?? []).filter((entry) => entry.access === "none");
+}
+function entryGrantsFullDisk(entry, cwd) {
+    const concretePath = materializePath(entry.path, cwd);
+    return (concretePath !== undefined &&
+        normalizeConcretePath(concretePath, cwd) === "/");
+}
+function profileHasFullDiskWrite(profile, cwd) {
+    return readWriteEntries(profile).some((entry) => entryGrantsFullDisk(entry, cwd));
+}
+export function normalizePermissionProfile(profile, options = {}) {
+    const cwd = options.cwd ?? PROFILE_DEFAULT_CWD;
+    const entriesByKey = new Map();
+    for (const entry of profile.fileSystem?.entries ?? []) {
+        const normalized = normalizeEntry(entry, cwd);
+        entriesByKey.set(entryKey(normalized), normalized);
+    }
+    const entries = [...entriesByKey.values()].sort((left, right) => entryKey(left).localeCompare(entryKey(right)));
+    return {
+        ...(entries.length > 0 || profile.fileSystem?.globScanMaxDepth !== undefined
+            ? {
+                fileSystem: {
+                    entries,
+                    ...(profile.fileSystem?.globScanMaxDepth !== undefined
+                        ? {
+                            globScanMaxDepth: profile.fileSystem.globScanMaxDepth,
+                        }
+                        : {}),
+                },
+            }
+            : {}),
+        ...(profile.network
+            ? { network: { enabled: profile.network.enabled === true } }
+            : {}),
+    };
+}
+export function mergePermissionProfiles(base, additional, options = {}) {
+    const cwd = options.cwd ?? PROFILE_DEFAULT_CWD;
+    const normalizedBase = normalizePermissionProfile(base, { cwd });
+    const normalizedAdditional = normalizePermissionProfile(additional, { cwd });
+    return normalizePermissionProfile({
+        fileSystem: {
+            entries: [
+                ...(normalizedBase.fileSystem?.entries ?? []),
+                ...(normalizedAdditional.fileSystem?.entries ?? []),
+            ],
+            globScanMaxDepth: maxGlobScanDepth(normalizedBase.fileSystem?.globScanMaxDepth, normalizedAdditional.fileSystem?.globScanMaxDepth),
+        },
+        network: normalizedBase.network || normalizedAdditional.network
+            ? {
+                enabled: normalizedBase.network?.enabled === true ||
+                    normalizedAdditional.network?.enabled === true,
+            }
+            : undefined,
+    }, { cwd });
+}
+export function intersectPermissionProfiles(requested, granted, options = {}) {
+    const cwd = options.cwd ?? PROFILE_DEFAULT_CWD;
+    const normalizedRequested = normalizePermissionProfile(requested, { cwd });
+    const normalizedGranted = normalizePermissionProfile(granted, { cwd });
+    const acceptedEntries = [];
+    for (const grantedEntry of normalizedGranted.fileSystem?.entries ?? []) {
+        if (grantedEntry.access === "none") {
+            continue;
+        }
+        const grantedPath = materializePath(grantedEntry.path, cwd);
+        if (!grantedPath) {
+            continue;
+        }
+        for (const requestedEntry of normalizedRequested.fileSystem?.entries ??
+            []) {
+            if (requestedEntry.access === "none") {
+                continue;
+            }
+            const requestedPath = materializePath(requestedEntry.path, cwd);
+            if (!requestedPath) {
+                continue;
+            }
+            const intersection = intersectConcretePathEntries(requestedEntry, requestedPath, grantedEntry, grantedPath);
+            if (intersection) {
+                acceptedEntries.push(intersection);
+            }
+        }
+    }
+    const deniedEntries = [
+        ...denyEntries(normalizedRequested),
+        ...denyEntries(normalizedGranted),
+    ];
+    return normalizePermissionProfile({
+        fileSystem: {
+            entries: coalesceToMostRestrictiveEntries([...acceptedEntries, ...deniedEntries], cwd),
+            globScanMaxDepth: maxGlobScanDepth(normalizedRequested.fileSystem?.globScanMaxDepth, normalizedGranted.fileSystem?.globScanMaxDepth),
+        },
+        network: normalizedRequested.network || normalizedGranted.network
+            ? {
+                enabled: normalizedRequested.network?.enabled === true &&
+                    normalizedGranted.network?.enabled === true,
+            }
+            : undefined,
+    }, { cwd });
+}
+export function permissionProfileFromNativeSandboxPolicy(policy, cwd = PROFILE_DEFAULT_CWD) {
+    if (policy.mode === "danger-full-access") {
+        return normalizePermissionProfile({
+            fileSystem: {
+                entries: [
+                    {
+                        path: { kind: "special", value: "full-disk" },
+                        access: "read-write",
+                    },
+                ],
+            },
+            network: { enabled: policy.networkAccess !== false },
+        }, { cwd });
+    }
+    const entries = [];
+    if (policy.mode === "read-only") {
+        entries.push({
+            path: { kind: "special", value: "full-disk" },
+            access: "read-only",
+        });
+    }
+    else if (policy.mode === "workspace-write") {
+        entries.push({
+            path: { kind: "special", value: "workspace" },
+            access: "read-write",
+        });
+        for (const root of policy.writableRoots ?? []) {
+            entries.push({
+                path: { kind: "path", path: root },
+                access: "read-write",
+            });
+        }
+        if (!policy.excludeSlashTmp) {
+            entries.push({
+                path: { kind: "special", value: "tmp" },
+                access: "read-write",
+            });
+        }
+        if (!policy.excludeTmpdir) {
+            entries.push({
+                path: { kind: "special", value: "tmpdir" },
+                access: "read-write",
+            });
+        }
+    }
+    return normalizePermissionProfile({
+        ...(entries.length > 0 ? { fileSystem: { entries } } : {}),
+        network: { enabled: policy.networkAccess === true },
+    }, { cwd });
+}
+export function nativeSandboxPolicyFromPermissionProfile(profile, cwd = PROFILE_DEFAULT_CWD) {
+    const normalized = normalizePermissionProfile(profile, { cwd });
+    if (denyEntries(normalized).length > 0) {
+        throw new Error("Cannot convert permission profile with deny rules to native sandbox policy without widening permissions");
+    }
+    if (profileHasFullDiskWrite(normalized, cwd)) {
+        return {
+            mode: "danger-full-access",
+            networkAccess: normalized.network?.enabled === true,
+        };
+    }
+    const writeEntries = readWriteEntries(normalized);
+    if (writeEntries.length === 0) {
+        const readOnlyEntries = (normalized.fileSystem?.entries ?? []).filter((entry) => entry.access === "read-only");
+        const hasFullDiskRead = readOnlyEntries.some((entry) => entryGrantsFullDisk(entry, cwd));
+        const hasScopedReadOnly = readOnlyEntries.some((entry) => !entryGrantsFullDisk(entry, cwd));
+        if (hasScopedReadOnly && !hasFullDiskRead) {
+            throw new Error("Cannot convert scoped read-only permission profile to native read-only policy without widening read permissions");
+        }
+        return {
+            mode: "read-only",
+            networkAccess: normalized.network?.enabled === true,
+        };
+    }
+    const writableRoots = [];
+    let includesWorkspace = false;
+    let includesSlashTmp = false;
+    let includesTmpdir = false;
+    for (const entry of writeEntries) {
+        if (entry.path.kind === "special") {
+            switch (entry.path.value) {
+                case "workspace":
+                    includesWorkspace = true;
+                    break;
+                case "tmp":
+                    includesSlashTmp = true;
+                    break;
+                case "tmpdir":
+                    includesTmpdir = true;
+                    break;
+                case "full-disk":
+                    break;
+            }
+            continue;
+        }
+        if (entry.path.kind === "path") {
+            if (isPathWithin(cwd, entry.path.path)) {
+                includesWorkspace = true;
+                if (!isPathWithin(entry.path.path, cwd)) {
+                    writableRoots.push(entry.path.path);
+                }
+            }
+            else {
+                writableRoots.push(entry.path.path);
+            }
+        }
+    }
+    if (!includesWorkspace) {
+        throw new Error("Cannot convert permission profile to native workspace-write policy without granting workspace write");
+    }
+    return {
+        mode: "workspace-write",
+        ...(writableRoots.length > 0 ? { writableRoots } : {}),
+        networkAccess: normalized.network?.enabled === true,
+        excludeSlashTmp: !includesSlashTmp,
+        excludeTmpdir: !includesTmpdir,
+    };
+}
+export function buildNativeSandboxPolicy(input, cwd = PROFILE_DEFAULT_CWD) {
+    return nativeSandboxPolicyFromPermissionProfile(permissionProfileFromNativeSandboxPolicy({
+        mode: input.mode,
+        writableRoots: input.writableRoots,
+        networkAccess: input.networkAccess,
+        excludeTmpdir: input.excludeTmpdir,
+        excludeSlashTmp: input.excludeSlashTmp,
+    }, cwd), cwd);
+}
+//# sourceMappingURL=permission-profile.js.map

package/dist/safety/permission-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-profile.js","sourceRoot":"","sources":["../../src/safety/permission-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKhD,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAoC5D,MAAM,WAAW,GAAyC;IACzD,IAAI,EAAE,CAAC;IACP,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;CACf,CAAC;AAEF,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAE1C,SAAS,gBAAgB,CAAC,IAAY;IACrC,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,GAAW;IACvD,OAAO,gBAAgB,CACtB,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CACrD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA8B;IACxD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACV,OAAO,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,KAAK,SAAS;YACb,OAAO,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,KAAK,MAAM;YACV,OAAO,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAgC;IACjD,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CACtB,KAAgC,EAChC,GAAW;IAEX,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACd,gEAAgE,CAChE,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO;QACN,GAAG,KAAK;QACR,IAAI,EAAE;YACL,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;SACjD;KACD,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACxB,IAAwB,EACxB,KAAyB;IAEzB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,kBAAkB,CAC1B,KAAsE,EACtE,GAAW;IAEX,QAAQ,KAAK,EAAE,CAAC;QACf,KAAK,WAAW;YACf,OAAO,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,KAAK,KAAK;YACT,OAAO,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3C,KAAK,QAAQ;YACZ,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM;gBACxB,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;gBAChD,CAAC,CAAC,SAAS,CAAC;QACd,KAAK,WAAW;YACf,OAAO,GAAG,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CACvB,IAA8B,EAC9B,GAAW;IAEX,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACV,OAAO,IAAI,CAAC,IAAI,CAAC;QAClB,KAAK,SAAS;YACb,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,KAAK,MAAM;YACV,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CACvB,SAA+B,EAC/B,OAA6B;IAE7B,OAAO,WAAW,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7E,CAAC;AAED,SAAS,4BAA4B,CACpC,cAAyC,EACzC,aAAqB,EACrB,YAAuC,EACvC,WAAmB;IAEnB,IAAI,YAAY,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9C,OAAO;YACN,IAAI,EAAE,cAAc,CAAC,IAAI;YACzB,MAAM,EAAE,eAAe,CAAC,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;SACnE,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;QAC9C,OAAO;YACN,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,MAAM,EAAE,eAAe,CAAC,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;SACnE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAC5B,KAAgC,EAChC,GAAW;IAEX,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,YAAY;QAClB,CAAC,CAAC,YAAY,YAAY,EAAE;QAC5B,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,gCAAgC,CACxC,OAAoC,EACpC,GAAW;IAEX,MAAM,aAAa,GAAG,IAAI,GAAG,EAAqC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACF,CAAC;IACD,OAAO,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CACxB,OAA0B;IAE1B,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAChD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,YAAY,CACxC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAA0B;IAC9C,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAChD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAClC,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC3B,KAAgC,EAChC,GAAW;IAEX,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,CACN,YAAY,KAAK,SAAS;QAC1B,qBAAqB,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,GAAG,CAChD,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC/B,OAA0B,EAC1B,GAAW;IAEX,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/C,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAC/B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,OAA0B,EAC1B,UAA6C,EAAE;IAE/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,mBAAmB,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAqC,CAAC;IAElE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9C,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC/D,QAAQ,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAC7C,CAAC;IAEF,OAAO;QACN,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,gBAAgB,KAAK,SAAS;YAC3E,CAAC,CAAC;gBACA,UAAU,EAAE;oBACX,OAAO;oBACP,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,gBAAgB,KAAK,SAAS;wBACrD,CAAC,CAAC;4BACA,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,gBAAgB;yBACrD;wBACF,CAAC,CAAC,EAAE,CAAC;iBACN;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,OAAO;YAClB,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,EAAE;YAC5D,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACtC,IAAuB,EACvB,UAA6B,EAC7B,UAA6C,EAAE;IAE/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,mBAAmB,CAAC;IAC/C,MAAM,cAAc,GAAG,0BAA0B,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAE7E,OAAO,0BAA0B,CAChC;QACC,UAAU,EAAE;YACX,OAAO,EAAE;gBACR,GAAG,CAAC,cAAc,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC;gBAC7C,GAAG,CAAC,oBAAoB,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC;aACnD;YACD,gBAAgB,EAAE,gBAAgB,CACjC,cAAc,CAAC,UAAU,EAAE,gBAAgB,EAC3C,oBAAoB,CAAC,UAAU,EAAE,gBAAgB,CACjD;SACD;QACD,OAAO,EACN,cAAc,CAAC,OAAO,IAAI,oBAAoB,CAAC,OAAO;YACrD,CAAC,CAAC;gBACA,OAAO,EACN,cAAc,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI;oBACxC,oBAAoB,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI;aAC/C;YACF,CAAC,CAAC,SAAS;KACb,EACD,EAAE,GAAG,EAAE,CACP,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,SAA4B,EAC5B,OAA0B,EAC1B,UAA6C,EAAE;IAE/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,mBAAmB,CAAC;IAC/C,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvE,MAAM,eAAe,GAAgC,EAAE,CAAC;IAExD,KAAK,MAAM,YAAY,IAAI,iBAAiB,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACxE,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACpC,SAAS;QACV,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,SAAS;QACV,CAAC;QAED,KAAK,MAAM,cAAc,IAAI,mBAAmB,CAAC,UAAU,EAAE,OAAO;YACnE,EAAE,EAAE,CAAC;YACL,IAAI,cAAc,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtC,SAAS;YACV,CAAC;YAED,MAAM,aAAa,GAAG,eAAe,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChE,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,SAAS;YACV,CAAC;YAED,MAAM,YAAY,GAAG,4BAA4B,CAChD,cAAc,EACd,aAAa,EACb,YAAY,EACZ,WAAW,CACX,CAAC;YACF,IAAI,YAAY,EAAE,CAAC;gBAClB,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACpC,CAAC;QACF,CAAC;IACF,CAAC;IAED,MAAM,aAAa,GAAG;QACrB,GAAG,WAAW,CAAC,mBAAmB,CAAC;QACnC,GAAG,WAAW,CAAC,iBAAiB,CAAC;KACjC,CAAC;IAEF,OAAO,0BAA0B,CAChC;QACC,UAAU,EAAE;YACX,OAAO,EAAE,gCAAgC,CACxC,CAAC,GAAG,eAAe,EAAE,GAAG,aAAa,CAAC,EACtC,GAAG,CACH;YACD,gBAAgB,EAAE,gBAAgB,CACjC,mBAAmB,CAAC,UAAU,EAAE,gBAAgB,EAChD,iBAAiB,CAAC,UAAU,EAAE,gBAAgB,CAC9C;SACD;QACD,OAAO,EACN,mBAAmB,CAAC,OAAO,IAAI,iBAAiB,CAAC,OAAO;YACvD,CAAC,CAAC;gBACA,OAAO,EACN,mBAAmB,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI;oBAC7C,iBAAiB,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI;aAC5C;YACF,CAAC,CAAC,SAAS;KACb,EACD,EAAE,GAAG,EAAE,CACP,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wCAAwC,CACvD,MAA2B,EAC3B,MAAc,mBAAmB;IAEjC,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC1C,OAAO,0BAA0B,CAChC;YACC,UAAU,EAAE;gBACX,OAAO,EAAE;oBACR;wBACC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE;wBAC7C,MAAM,EAAE,YAAY;qBACpB;iBACD;aACD;YACD,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,KAAK,KAAK,EAAE;SACpD,EACD,EAAE,GAAG,EAAE,CACP,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE;YAC7C,MAAM,EAAE,WAAW;SACnB,CAAC,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE;YAC7C,MAAM,EAAE,YAAY;SACpB,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;gBAClC,MAAM,EAAE,YAAY;aACpB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE;gBACvC,MAAM,EAAE,YAAY;aACpB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE;gBAC1C,MAAM,EAAE,YAAY;aACpB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,0BAA0B,CAChC;QACC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,KAAK,IAAI,EAAE;KACnD,EACD,EAAE,GAAG,EAAE,CACP,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wCAAwC,CACvD,OAA0B,EAC1B,MAAc,mBAAmB;IAEjC,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAEhE,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACd,yGAAyG,CACzG,CAAC;IACH,CAAC;IAED,IAAI,uBAAuB,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO;YACN,IAAI,EAAE,oBAAoB;YAC1B,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI;SACnD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,eAAe,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,CACvC,CAAC;QACF,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACtD,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAC/B,CAAC;QACF,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAC7C,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAC3C,CAAC;QACF,IAAI,iBAAiB,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACd,iHAAiH,CACjH,CAAC;QACH,CAAC;QAED,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI;SACnD,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,QAAQ,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC1B,KAAK,WAAW;oBACf,iBAAiB,GAAG,IAAI,CAAC;oBACzB,MAAM;gBACP,KAAK,KAAK;oBACT,gBAAgB,GAAG,IAAI,CAAC;oBACxB,MAAM;gBACP,KAAK,QAAQ;oBACZ,cAAc,GAAG,IAAI,CAAC;oBACtB,MAAM;gBACP,KAAK,WAAW;oBACf,MAAM;YACR,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAChC,IAAI,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,iBAAiB,GAAG,IAAI,CAAC;gBACzB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;oBACzC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrC,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACd,qGAAqG,CACrG,CAAC;IACH,CAAC;IAED,OAAO;QACN,IAAI,EAAE,iBAAiB;QACvB,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI;QACnD,eAAe,EAAE,CAAC,gBAAgB;QAClC,aAAa,EAAE,CAAC,cAAc;KAC9B,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,wBAAwB,CACvC,KAA+B,EAC/B,MAAc,mBAAmB;IAEjC,OAAO,wCAAwC,CAC9C,wCAAwC,CACvC;QACC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,eAAe,EAAE,KAAK,CAAC,eAAe;KACtC,EACD,GAAG,CACH,EACD,GAAG,CACH,CAAC;AACH,CAAC","sourcesContent":["import { realpathSync } from \"node:fs\";\nimport { isAbsolute, resolve } from \"node:path\";\nimport type {\n\tNativeSandboxMode,\n\tNativeSandboxPolicy,\n} from \"../sandbox/native-sandbox.js\";\nimport { isPathWithin } from \"../utils/path-containment.js\";\n\nexport type FileSystemAccessMode = \"none\" | \"read-only\" | \"read-write\";\n\nexport type FileSystemPermissionPath =\n\t| { kind: \"path\"; path: string }\n\t| { kind: \"special\"; value: \"workspace\" | \"tmp\" | \"tmpdir\" | \"full-disk\" }\n\t| { kind: \"glob\"; pattern: string };\n\nexport interface FileSystemPermissionEntry {\n\tpath: FileSystemPermissionPath;\n\taccess: FileSystemAccessMode;\n}\n\nexport interface FileSystemPermissions {\n\tentries: FileSystemPermissionEntry[];\n\tglobScanMaxDepth?: number;\n}\n\nexport interface NetworkPermissions {\n\tenabled: boolean;\n}\n\nexport interface PermissionProfile {\n\tfileSystem?: FileSystemPermissions;\n\tnetwork?: NetworkPermissions;\n}\n\nexport interface NormalizePermissionProfileOptions {\n\tcwd?: string;\n}\n\nexport interface IntersectPermissionProfileOptions {\n\tcwd?: string;\n}\n\nconst ACCESS_RANK: Record<FileSystemAccessMode, number> = {\n\tnone: 0,\n\t\"read-only\": 1,\n\t\"read-write\": 2,\n};\n\nconst PROFILE_DEFAULT_CWD = process.cwd();\n\nfunction canonicalizePath(path: string): string {\n\ttry {\n\t\treturn realpathSync(path);\n\t} catch {\n\t\treturn path;\n\t}\n}\n\nfunction normalizeConcretePath(path: string, cwd: string): string {\n\treturn canonicalizePath(\n\t\tisAbsolute(path) ? resolve(path) : resolve(cwd, path),\n\t);\n}\n\nfunction permissionPathKey(path: FileSystemPermissionPath): string {\n\tswitch (path.kind) {\n\t\tcase \"path\":\n\t\t\treturn `path:${path.path}`;\n\t\tcase \"special\":\n\t\t\treturn `special:${path.value}`;\n\t\tcase \"glob\":\n\t\t\treturn `glob:${path.pattern}`;\n\t}\n}\n\nfunction entryKey(entry: FileSystemPermissionEntry): string {\n\treturn `${permissionPathKey(entry.path)}:${entry.access}`;\n}\n\nfunction normalizeEntry(\n\tentry: FileSystemPermissionEntry,\n\tcwd: string,\n): FileSystemPermissionEntry {\n\tif (entry.path.kind === \"glob\" && entry.access !== \"none\") {\n\t\tthrow new Error(\n\t\t\t\"Permission profile glob entries may only be deny rules for now\",\n\t\t);\n\t}\n\n\tif (entry.path.kind !== \"path\") {\n\t\treturn entry;\n\t}\n\n\treturn {\n\t\t...entry,\n\t\tpath: {\n\t\t\tkind: \"path\",\n\t\t\tpath: normalizeConcretePath(entry.path.path, cwd),\n\t\t},\n\t};\n}\n\nfunction maxGlobScanDepth(\n\tleft: number | undefined,\n\tright: number | undefined,\n): number | undefined {\n\tif (left === undefined) {\n\t\treturn right;\n\t}\n\tif (right === undefined) {\n\t\treturn left;\n\t}\n\treturn Math.max(left, right);\n}\n\nfunction resolveSpecialPath(\n\tvalue: Extract<FileSystemPermissionPath, { kind: \"special\" }>[\"value\"],\n\tcwd: string,\n): string | undefined {\n\tswitch (value) {\n\t\tcase \"workspace\":\n\t\t\treturn normalizeConcretePath(cwd, cwd);\n\t\tcase \"tmp\":\n\t\t\treturn normalizeConcretePath(\"/tmp\", cwd);\n\t\tcase \"tmpdir\":\n\t\t\treturn process.env.TMPDIR\n\t\t\t\t? normalizeConcretePath(process.env.TMPDIR, cwd)\n\t\t\t\t: undefined;\n\t\tcase \"full-disk\":\n\t\t\treturn \"/\";\n\t}\n}\n\nfunction materializePath(\n\tpath: FileSystemPermissionPath,\n\tcwd: string,\n): string | undefined {\n\tswitch (path.kind) {\n\t\tcase \"path\":\n\t\t\treturn path.path;\n\t\tcase \"special\":\n\t\t\treturn resolveSpecialPath(path.value, cwd);\n\t\tcase \"glob\":\n\t\t\treturn undefined;\n\t}\n}\n\nfunction constrainAccess(\n\trequested: FileSystemAccessMode,\n\tgranted: FileSystemAccessMode,\n): FileSystemAccessMode {\n\treturn ACCESS_RANK[requested] <= ACCESS_RANK[granted] ? requested : granted;\n}\n\nfunction intersectConcretePathEntries(\n\trequestedEntry: FileSystemPermissionEntry,\n\trequestedPath: string,\n\tgrantedEntry: FileSystemPermissionEntry,\n\tgrantedPath: string,\n): FileSystemPermissionEntry | undefined {\n\tif (isPathWithin(requestedPath, grantedPath)) {\n\t\treturn {\n\t\t\tpath: requestedEntry.path,\n\t\t\taccess: constrainAccess(requestedEntry.access, grantedEntry.access),\n\t\t};\n\t}\n\tif (isPathWithin(grantedPath, requestedPath)) {\n\t\treturn {\n\t\t\tpath: grantedEntry.path,\n\t\t\taccess: constrainAccess(requestedEntry.access, grantedEntry.access),\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction intersectionEntryKey(\n\tentry: FileSystemPermissionEntry,\n\tcwd: string,\n): string {\n\tconst concretePath = materializePath(entry.path, cwd);\n\treturn concretePath\n\t\t? `concrete:${concretePath}`\n\t\t: permissionPathKey(entry.path);\n}\n\nfunction coalesceToMostRestrictiveEntries(\n\tentries: FileSystemPermissionEntry[],\n\tcwd: string,\n): FileSystemPermissionEntry[] {\n\tconst entriesByPath = new Map<string, FileSystemPermissionEntry>();\n\tfor (const entry of entries) {\n\t\tconst key = intersectionEntryKey(entry, cwd);\n\t\tconst existing = entriesByPath.get(key);\n\t\tif (!existing || ACCESS_RANK[entry.access] < ACCESS_RANK[existing.access]) {\n\t\t\tentriesByPath.set(key, entry);\n\t\t}\n\t}\n\treturn [...entriesByPath.values()];\n}\n\nfunction readWriteEntries(\n\tprofile: PermissionProfile,\n): FileSystemPermissionEntry[] {\n\treturn (profile.fileSystem?.entries ?? []).filter(\n\t\t(entry) => entry.access === \"read-write\",\n\t);\n}\n\nfunction denyEntries(profile: PermissionProfile): FileSystemPermissionEntry[] {\n\treturn (profile.fileSystem?.entries ?? []).filter(\n\t\t(entry) => entry.access === \"none\",\n\t);\n}\n\nfunction entryGrantsFullDisk(\n\tentry: FileSystemPermissionEntry,\n\tcwd: string,\n): boolean {\n\tconst concretePath = materializePath(entry.path, cwd);\n\treturn (\n\t\tconcretePath !== undefined &&\n\t\tnormalizeConcretePath(concretePath, cwd) === \"/\"\n\t);\n}\n\nfunction profileHasFullDiskWrite(\n\tprofile: PermissionProfile,\n\tcwd: string,\n): boolean {\n\treturn readWriteEntries(profile).some((entry) =>\n\t\tentryGrantsFullDisk(entry, cwd),\n\t);\n}\n\nexport function normalizePermissionProfile(\n\tprofile: PermissionProfile,\n\toptions: NormalizePermissionProfileOptions = {},\n): PermissionProfile {\n\tconst cwd = options.cwd ?? PROFILE_DEFAULT_CWD;\n\tconst entriesByKey = new Map<string, FileSystemPermissionEntry>();\n\n\tfor (const entry of profile.fileSystem?.entries ?? []) {\n\t\tconst normalized = normalizeEntry(entry, cwd);\n\t\tentriesByKey.set(entryKey(normalized), normalized);\n\t}\n\n\tconst entries = [...entriesByKey.values()].sort((left, right) =>\n\t\tentryKey(left).localeCompare(entryKey(right)),\n\t);\n\n\treturn {\n\t\t...(entries.length > 0 || profile.fileSystem?.globScanMaxDepth !== undefined\n\t\t\t? {\n\t\t\t\t\tfileSystem: {\n\t\t\t\t\t\tentries,\n\t\t\t\t\t\t...(profile.fileSystem?.globScanMaxDepth !== undefined\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tglobScanMaxDepth: profile.fileSystem.globScanMaxDepth,\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(profile.network\n\t\t\t? { network: { enabled: profile.network.enabled === true } }\n\t\t\t: {}),\n\t};\n}\n\nexport function mergePermissionProfiles(\n\tbase: PermissionProfile,\n\tadditional: PermissionProfile,\n\toptions: NormalizePermissionProfileOptions = {},\n): PermissionProfile {\n\tconst cwd = options.cwd ?? PROFILE_DEFAULT_CWD;\n\tconst normalizedBase = normalizePermissionProfile(base, { cwd });\n\tconst normalizedAdditional = normalizePermissionProfile(additional, { cwd });\n\n\treturn normalizePermissionProfile(\n\t\t{\n\t\t\tfileSystem: {\n\t\t\t\tentries: [\n\t\t\t\t\t...(normalizedBase.fileSystem?.entries ?? []),\n\t\t\t\t\t...(normalizedAdditional.fileSystem?.entries ?? []),\n\t\t\t\t],\n\t\t\t\tglobScanMaxDepth: maxGlobScanDepth(\n\t\t\t\t\tnormalizedBase.fileSystem?.globScanMaxDepth,\n\t\t\t\t\tnormalizedAdditional.fileSystem?.globScanMaxDepth,\n\t\t\t\t),\n\t\t\t},\n\t\t\tnetwork:\n\t\t\t\tnormalizedBase.network || normalizedAdditional.network\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tenabled:\n\t\t\t\t\t\t\t\tnormalizedBase.network?.enabled === true ||\n\t\t\t\t\t\t\t\tnormalizedAdditional.network?.enabled === true,\n\t\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t},\n\t\t{ cwd },\n\t);\n}\n\nexport function intersectPermissionProfiles(\n\trequested: PermissionProfile,\n\tgranted: PermissionProfile,\n\toptions: IntersectPermissionProfileOptions = {},\n): PermissionProfile {\n\tconst cwd = options.cwd ?? PROFILE_DEFAULT_CWD;\n\tconst normalizedRequested = normalizePermissionProfile(requested, { cwd });\n\tconst normalizedGranted = normalizePermissionProfile(granted, { cwd });\n\tconst acceptedEntries: FileSystemPermissionEntry[] = [];\n\n\tfor (const grantedEntry of normalizedGranted.fileSystem?.entries ?? []) {\n\t\tif (grantedEntry.access === \"none\") {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst grantedPath = materializePath(grantedEntry.path, cwd);\n\t\tif (!grantedPath) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tfor (const requestedEntry of normalizedRequested.fileSystem?.entries ??\n\t\t\t[]) {\n\t\t\tif (requestedEntry.access === \"none\") {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst requestedPath = materializePath(requestedEntry.path, cwd);\n\t\t\tif (!requestedPath) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst intersection = intersectConcretePathEntries(\n\t\t\t\trequestedEntry,\n\t\t\t\trequestedPath,\n\t\t\t\tgrantedEntry,\n\t\t\t\tgrantedPath,\n\t\t\t);\n\t\t\tif (intersection) {\n\t\t\t\tacceptedEntries.push(intersection);\n\t\t\t}\n\t\t}\n\t}\n\n\tconst deniedEntries = [\n\t\t...denyEntries(normalizedRequested),\n\t\t...denyEntries(normalizedGranted),\n\t];\n\n\treturn normalizePermissionProfile(\n\t\t{\n\t\t\tfileSystem: {\n\t\t\t\tentries: coalesceToMostRestrictiveEntries(\n\t\t\t\t\t[...acceptedEntries, ...deniedEntries],\n\t\t\t\t\tcwd,\n\t\t\t\t),\n\t\t\t\tglobScanMaxDepth: maxGlobScanDepth(\n\t\t\t\t\tnormalizedRequested.fileSystem?.globScanMaxDepth,\n\t\t\t\t\tnormalizedGranted.fileSystem?.globScanMaxDepth,\n\t\t\t\t),\n\t\t\t},\n\t\t\tnetwork:\n\t\t\t\tnormalizedRequested.network || normalizedGranted.network\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tenabled:\n\t\t\t\t\t\t\t\tnormalizedRequested.network?.enabled === true &&\n\t\t\t\t\t\t\t\tnormalizedGranted.network?.enabled === true,\n\t\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t},\n\t\t{ cwd },\n\t);\n}\n\nexport function permissionProfileFromNativeSandboxPolicy(\n\tpolicy: NativeSandboxPolicy,\n\tcwd: string = PROFILE_DEFAULT_CWD,\n): PermissionProfile {\n\tif (policy.mode === \"danger-full-access\") {\n\t\treturn normalizePermissionProfile(\n\t\t\t{\n\t\t\t\tfileSystem: {\n\t\t\t\t\tentries: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tpath: { kind: \"special\", value: \"full-disk\" },\n\t\t\t\t\t\t\taccess: \"read-write\",\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t},\n\t\t\t\tnetwork: { enabled: policy.networkAccess !== false },\n\t\t\t},\n\t\t\t{ cwd },\n\t\t);\n\t}\n\n\tconst entries: FileSystemPermissionEntry[] = [];\n\tif (policy.mode === \"read-only\") {\n\t\tentries.push({\n\t\t\tpath: { kind: \"special\", value: \"full-disk\" },\n\t\t\taccess: \"read-only\",\n\t\t});\n\t} else if (policy.mode === \"workspace-write\") {\n\t\tentries.push({\n\t\t\tpath: { kind: \"special\", value: \"workspace\" },\n\t\t\taccess: \"read-write\",\n\t\t});\n\n\t\tfor (const root of policy.writableRoots ?? []) {\n\t\t\tentries.push({\n\t\t\t\tpath: { kind: \"path\", path: root },\n\t\t\t\taccess: \"read-write\",\n\t\t\t});\n\t\t}\n\n\t\tif (!policy.excludeSlashTmp) {\n\t\t\tentries.push({\n\t\t\t\tpath: { kind: \"special\", value: \"tmp\" },\n\t\t\t\taccess: \"read-write\",\n\t\t\t});\n\t\t}\n\n\t\tif (!policy.excludeTmpdir) {\n\t\t\tentries.push({\n\t\t\t\tpath: { kind: \"special\", value: \"tmpdir\" },\n\t\t\t\taccess: \"read-write\",\n\t\t\t});\n\t\t}\n\t}\n\n\treturn normalizePermissionProfile(\n\t\t{\n\t\t\t...(entries.length > 0 ? { fileSystem: { entries } } : {}),\n\t\t\tnetwork: { enabled: policy.networkAccess === true },\n\t\t},\n\t\t{ cwd },\n\t);\n}\n\nexport function nativeSandboxPolicyFromPermissionProfile(\n\tprofile: PermissionProfile,\n\tcwd: string = PROFILE_DEFAULT_CWD,\n): NativeSandboxPolicy {\n\tconst normalized = normalizePermissionProfile(profile, { cwd });\n\n\tif (denyEntries(normalized).length > 0) {\n\t\tthrow new Error(\n\t\t\t\"Cannot convert permission profile with deny rules to native sandbox policy without widening permissions\",\n\t\t);\n\t}\n\n\tif (profileHasFullDiskWrite(normalized, cwd)) {\n\t\treturn {\n\t\t\tmode: \"danger-full-access\",\n\t\t\tnetworkAccess: normalized.network?.enabled === true,\n\t\t};\n\t}\n\n\tconst writeEntries = readWriteEntries(normalized);\n\tif (writeEntries.length === 0) {\n\t\tconst readOnlyEntries = (normalized.fileSystem?.entries ?? []).filter(\n\t\t\t(entry) => entry.access === \"read-only\",\n\t\t);\n\t\tconst hasFullDiskRead = readOnlyEntries.some((entry) =>\n\t\t\tentryGrantsFullDisk(entry, cwd),\n\t\t);\n\t\tconst hasScopedReadOnly = readOnlyEntries.some(\n\t\t\t(entry) => !entryGrantsFullDisk(entry, cwd),\n\t\t);\n\t\tif (hasScopedReadOnly && !hasFullDiskRead) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Cannot convert scoped read-only permission profile to native read-only policy without widening read permissions\",\n\t\t\t);\n\t\t}\n\n\t\treturn {\n\t\t\tmode: \"read-only\",\n\t\t\tnetworkAccess: normalized.network?.enabled === true,\n\t\t};\n\t}\n\n\tconst writableRoots: string[] = [];\n\tlet includesWorkspace = false;\n\tlet includesSlashTmp = false;\n\tlet includesTmpdir = false;\n\n\tfor (const entry of writeEntries) {\n\t\tif (entry.path.kind === \"special\") {\n\t\t\tswitch (entry.path.value) {\n\t\t\t\tcase \"workspace\":\n\t\t\t\t\tincludesWorkspace = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"tmp\":\n\t\t\t\t\tincludesSlashTmp = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"tmpdir\":\n\t\t\t\t\tincludesTmpdir = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"full-disk\":\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (entry.path.kind === \"path\") {\n\t\t\tif (isPathWithin(cwd, entry.path.path)) {\n\t\t\t\tincludesWorkspace = true;\n\t\t\t\tif (!isPathWithin(entry.path.path, cwd)) {\n\t\t\t\t\twritableRoots.push(entry.path.path);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\twritableRoots.push(entry.path.path);\n\t\t\t}\n\t\t}\n\t}\n\n\tif (!includesWorkspace) {\n\t\tthrow new Error(\n\t\t\t\"Cannot convert permission profile to native workspace-write policy without granting workspace write\",\n\t\t);\n\t}\n\n\treturn {\n\t\tmode: \"workspace-write\",\n\t\t...(writableRoots.length > 0 ? { writableRoots } : {}),\n\t\tnetworkAccess: normalized.network?.enabled === true,\n\t\texcludeSlashTmp: !includesSlashTmp,\n\t\texcludeTmpdir: !includesTmpdir,\n\t};\n}\n\nexport interface NativeSandboxPolicyInput {\n\tmode: NativeSandboxMode;\n\twritableRoots?: string[];\n\tnetworkAccess?: boolean;\n\texcludeTmpdir?: boolean;\n\texcludeSlashTmp?: boolean;\n}\n\nexport function buildNativeSandboxPolicy(\n\tinput: NativeSandboxPolicyInput,\n\tcwd: string = PROFILE_DEFAULT_CWD,\n): NativeSandboxPolicy {\n\treturn nativeSandboxPolicyFromPermissionProfile(\n\t\tpermissionProfileFromNativeSandboxPolicy(\n\t\t\t{\n\t\t\t\tmode: input.mode,\n\t\t\t\twritableRoots: input.writableRoots,\n\t\t\t\tnetworkAccess: input.networkAccess,\n\t\t\t\texcludeTmpdir: input.excludeTmpdir,\n\t\t\t\texcludeSlashTmp: input.excludeSlashTmp,\n\t\t\t},\n\t\t\tcwd,\n\t\t),\n\t\tcwd,\n\t);\n}\n"]}

package/dist/safety/safety-middleware.d.ts

@@ -72,6 +72,10 @@ export interface PreExecutionResult {
         firewallResult?: ContextFirewallResult;
     };
 }
+export interface PreExecutionOptions {
+    /** Skip only loop detection for a transport-managed duplicate; firewall and sequence checks still run. */
+    skipLoopDetection?: boolean;
+}
 /**
  * Configuration for SafetyMiddleware
  */
@@ -106,7 +110,7 @@ export declare class SafetyMiddleware {
      * Call this before executing a tool. Returns whether execution should proceed
      * and provides sanitized arguments for logging.
      */
-    preExecution(toolName: string, args: Record<string, unknown>): PreExecutionResult;
+    preExecution(toolName: string, args: Record<string, unknown>, options?: PreExecutionOptions): PreExecutionResult;
     /**
      * Record tool execution outcome
      *

package/dist/safety/safety-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safety-middleware.d.ts","sourceRoot":"","sources":["../../src/safety/safety-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAUH,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAK1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACN,KAAK,mBAAmB,EACxB,YAAY,EACZ,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AACH,UAAU,0BAA0B;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAID;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;IAC/C,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,wBAAwB;IACxB,OAAO,CAAC,EAAE;QACT,UAAU,CAAC,EAAE,mBAAmB,CAAC;QACjC,cAAc,CAAC,EAAE,sBAAsB,CAAC;QACxC,cAAc,CAAC,EAAE,qBAAqB,CAAC;KACvC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACtC,kCAAkC;IAClC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C,gEAAgE;IAChE,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,yDAAyD;IACzD,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAOZ;gBAEU,MAAM,CAAC,EAAE,sBAAsB;IAuC3C;;;;;OAKG;IACH,YAAY,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,kBAAkB;IAwKrB;;;;;OAKG;IACH,aAAa,CACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,OAAO,EAChB,QAAQ,UAAO,GACb,IAAI;IAYP;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAU1E;;;;;OAKG;IACH,oBAAoB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC;IAWnC;;OAEG;IACH,mBAAmB,IAAI,IAAI;IAI3B;;OAEG;IACH,oBAAoB,IAAI,OAAO;IAI/B;;OAEG;IACH,kBAAkB,IAAI,MAAM,GAAG,SAAS;IAIxC;;OAEG;IACH,KAAK,IAAI,IAAI;IAMb;;OAEG;IACH,QAAQ,IAAI;QACX,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QACnD,gBAAgB,EAAE,UAAU,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;KACjE;IAOD;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC;IAIjC;;OAEG;IACH,kBAAkB,IAAI,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAI7D;;OAEG;IACH,gBAAgB,IAAI,IAAI;CAGxB;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,kBAAyB,CAAC;AAE9D;;GAEG;AACH,wBAAgB,sBAAsB,CACrC,MAAM,CAAC,EAAE,sBAAsB,GAC7B,gBAAgB,CAElB"}
+{"version":3,"file":"safety-middleware.d.ts","sourceRoot":"","sources":["../../src/safety/safety-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAUH,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAK1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACN,KAAK,mBAAmB,EACxB,YAAY,EACZ,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AACH,UAAU,0BAA0B;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAID;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;IAC/C,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,wBAAwB;IACxB,OAAO,CAAC,EAAE;QACT,UAAU,CAAC,EAAE,mBAAmB,CAAC;QACjC,cAAc,CAAC,EAAE,sBAAsB,CAAC;QACxC,cAAc,CAAC,EAAE,qBAAqB,CAAC;KACvC,CAAC;CACF;AAED,MAAM,WAAW,mBAAmB;IACnC,0GAA0G;IAC1G,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACtC,kCAAkC;IAClC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C,gEAAgE;IAChE,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,yDAAyD;IACzD,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAOZ;gBAEU,MAAM,CAAC,EAAE,sBAAsB;IAuC3C;;;;;OAKG;IACH,YAAY,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,mBAAmB,GAC3B,kBAAkB;IA2KrB;;;;;OAKG;IACH,aAAa,CACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,OAAO,EAChB,QAAQ,UAAO,GACb,IAAI;IAYP;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAU1E;;;;;OAKG;IACH,oBAAoB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC;IAWnC;;OAEG;IACH,mBAAmB,IAAI,IAAI;IAI3B;;OAEG;IACH,oBAAoB,IAAI,OAAO;IAI/B;;OAEG;IACH,kBAAkB,IAAI,MAAM,GAAG,SAAS;IAIxC;;OAEG;IACH,KAAK,IAAI,IAAI;IAMb;;OAEG;IACH,QAAQ,IAAI;QACX,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QACnD,gBAAgB,EAAE,UAAU,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;KACjE;IAOD;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC;IAIjC;;OAEG;IACH,kBAAkB,IAAI,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAI7D;;OAEG;IACH,gBAAgB,IAAI,IAAI;CAGxB;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,kBAAyB,CAAC;AAE9D;;GAEG;AACH,wBAAgB,sBAAsB,CACrC,MAAM,CAAC,EAAE,sBAAsB,GAC7B,gBAAgB,CAElB"}

package/dist/safety/safety-middleware.js

@@ -93,7 +93,7 @@ export class SafetyMiddleware {
      * Call this before executing a tool. Returns whether execution should proceed
      * and provides sanitized arguments for logging.
      */
-    preExecution(toolName, args) {
+    preExecution(toolName, args, options) {
         const details = {};
         // 1. Context Firewall - sanitize and check for high-severity content
         let sanitizedArgs = args;
@@ -137,7 +137,8 @@ export class SafetyMiddleware {
             }
         }
         // 2. Loop Detection - check for repetitive patterns
-        if (this.config.enableLoopDetection) {
+        if (this.config.enableLoopDetection &&
+            options?.skipLoopDetection !== true) {
             const loopResult = this.loopDetector.check(toolName, args);
             details.loopResult = loopResult;
             if (loopResult.detected) {

package/dist/safety/safety-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"safety-middleware.js","sourceRoot":"","sources":["../../src/safety/safety-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EACN,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,gBAAgB,GAChB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAGN,uBAAuB,EACvB,oBAAoB,EACpB,eAAe,EACf,yBAAyB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAEN,YAAY,GAEZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEN,oBAAoB,GACpB,MAAM,6BAA6B,CAAC;AAUrC,MAAM,MAAM,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;AA4CjD;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IAa5B,YAAY,MAA+B;QAC1C,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC;YACpC,wDAAwD;YACxD,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,IAAI,CAAC;YAC/D,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,IAAI,EAAE;YAC5D,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,IAAI,GAAG;YACjE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,IAAI,KAAK,EAAE,yCAAyC;YAC9F,GAAG,MAAM,EAAE,YAAY;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,GAAG,IAAI,oBAAoB,CAAC;YAChD,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,IAAI,GAAG;YACvD,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,IAAI,MAAM,EAAE,YAAY;YACpE,GAAG,MAAM,EAAE,gBAAgB;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG;YACb,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,IAAI,IAAI;YACxD,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,IAAI,IAAI;YAC9D,qBAAqB,EAAE,MAAM,EAAE,qBAAqB,IAAI,IAAI;YAC5D,eAAe,EAAE;gBAChB,aAAa,EAAE,IAAI;gBACnB,eAAe,EAAE,IAAI;gBACrB,kBAAkB,EAAE,IAAI;gBACxB,kBAAkB,EAAE,IAAI;gBACxB,GAAG,MAAM,EAAE,eAAe;gBAC1B,kFAAkF;gBAClF,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,IAAI,KAAK;gBACpE,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,sDAAsD;gBACtD,QAAQ,EAAE;oBACT,GAAG,uBAAuB;oBAC1B,GAAG,MAAM,EAAE,eAAe,EAAE,QAAQ;iBACpC;aACD;SACD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,YAAY,CACX,QAAgB,EAChB,IAA6B;QAE7B,MAAM,OAAO,GAAkC,EAAE,CAAC;QAElD,qEAAqE;QACrE,IAAI,aAAa,GAAG,IAAI,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACvC,MAAM,cAAc,GAAG,oBAAoB,CAC1C,IAAI,EACJ,IAAI,CAAC,MAAM,CAAC,eAAe,CAC3B,CAAC;YACF,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;YACxC,aAAa,GAAG,cAAc,CAAC,gBAG9B,CAAC;YAEF,wCAAwC;YACxC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,oBAAoB,CAAC;oBACpB,YAAY,EAAE;wBACb,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;qBACtD;oBACD,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,MAAM;oBAC5C,OAAO,EAAE,cAAc,CAAC,OAAO,IAAI,KAAK;oBACxC,QAAQ;oBACR,MAAM,EAAE,cAAc,CAAC,WAAW;iBAClC,CAAC,CAAC;YACJ,CAAC;YAED,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBACtD,QAAQ;oBACR,MAAM,EAAE,cAAc,CAAC,WAAW;oBAClC,aAAa,EAAE,cAAc,CAAC,QAAQ,CAAC,MAAM;iBAC7C,CAAC,CAAC;gBAEH,gBAAgB,CAAC;oBAChB,QAAQ;oBACR,MAAM,EAAE,cAAc,CAAC,WAAW,IAAI,4BAA4B;oBAClE,MAAM,EAAE,UAAU;oBAClB,QAAQ,EAAE,MAAM;iBAChB,CAAC,CAAC;gBAEH,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,KAAK;oBACvB,MAAM,EAAE,cAAc,CAAC,WAAW;oBAClC,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,UAAU;oBACvB,aAAa;oBACb,OAAO;iBACP,CAAC;YACH,CAAC;QACF,CAAC;QAED,oDAAoD;QACpD,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC3D,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;YAEhC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;oBACpC,QAAQ;oBACR,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;iBACnC,CAAC,CAAC;gBAEH,kBAAkB,CAAC;oBAClB,QAAQ,EAAE,UAAU,CAAC,IAAI,IAAI,OAAO;oBACpC,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,CAAC;oBACxC,QAAQ;oBACR,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,MAAM;oBACnC,MAAM,EAAE,UAAU,CAAC,MAAM;iBACzB,CAAC,CAAC;gBAEH,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnE,gBAAgB,CAAC;wBAChB,QAAQ;wBACR,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,eAAe;wBAC5C,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;qBAC1D,CAAC,CAAC;oBAEH,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,gBAAgB,EAAE,UAAU,CAAC,MAAM,KAAK,OAAO;wBAC/C,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,UAAU,EAAE,UAAU,CAAC,UAAU;wBACjC,WAAW,EAAE,MAAM;wBACnB,aAAa;wBACb,OAAO;qBACP,CAAC;gBACH,CAAC;gBACD,sCAAsC;YACvC,CAAC;QACF,CAAC;QAED,kEAAkE;QAClE,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACxC,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvE,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;YAExC,IAAI,cAAc,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;oBAChD,QAAQ;oBACR,SAAS,EAAE,cAAc,CAAC,SAAS;oBACnC,MAAM,EAAE,cAAc,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBAEH,oBAAoB,CAAC;oBACpB,SAAS,EAAE,cAAc,CAAC,SAAS,IAAI,SAAS;oBAChD,QAAQ;oBACR,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,cAAc,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBAEH,yBAAyB,CAAC;oBACzB,QAAQ;oBACR,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,8BAA8B;oBAC/D,MAAM,EAAE,UAAU;iBAClB,CAAC,CAAC;gBAEH,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,IAAI;oBACtB,MAAM,EAAE,cAAc,CAAC,MAAM;oBAC7B,WAAW,EAAE,UAAU;oBACvB,aAAa;oBACb,OAAO;iBACP,CAAC;YACH,CAAC;YAED,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvC,oBAAoB,CAAC;oBACpB,SAAS,EAAE,cAAc,CAAC,SAAS,IAAI,SAAS;oBAChD,QAAQ;oBACR,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,cAAc,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBAEH,gBAAgB,CAAC;oBAChB,QAAQ;oBACR,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,8BAA8B;oBAC/D,MAAM,EAAE,UAAU;oBAClB,QAAQ,EAAE,MAAM;iBAChB,CAAC,CAAC;gBAEH,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,KAAK;oBACvB,MAAM,EAAE,cAAc,CAAC,MAAM;oBAC7B,WAAW,EAAE,UAAU;oBACvB,aAAa;oBACb,OAAO;iBACP,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO;YACN,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE,KAAK;YACvB,aAAa;YACb,OAAO;SACP,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,aAAa,CACZ,QAAgB,EAChB,IAA6B,EAC7B,OAAgB,EAChB,QAAQ,GAAG,IAAI;QAEf,0BAA0B;QAC1B,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACrC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACxC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,IAA6B;QAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAGvD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAAI,IAAO;QAC9B,IACC,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB;YAClC,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,gBAAgB,EAC5C,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;QAED,OAAO,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,CAAM,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,mBAAmB;QAClB,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,oBAAoB;QACnB,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,kBAAkB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK;QACJ,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,QAAQ;QAIP,OAAO;YACN,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAC1C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE;SACpD,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,kBAAkB,CAAI,IAAO;QAC5B,OAAO,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,kBAAkB;QACjB,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,gBAAgB;QACf,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACD;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAE9D;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACrC,MAA+B;IAE/B,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC","sourcesContent":["/**\n * Safety Middleware - Unified Security Layer for Tool Execution\n *\n * This module consolidates all security checks into a single middleware layer\n * that integrates with the agent transport. It provides:\n *\n * 1. **Loop Detection**: Enhanced pattern detection (exact, similar, cyclic, frequency)\n * 2. **Sequence Analysis**: Behavioral threat detection (exfiltration, reconnaissance, etc.)\n * 3. **Context Firewall**: Argument sanitization before logging/storage\n *\n * ## Integration Points\n *\n * ```\n * Tool Call → preExecution() → [Firewall] → [Execute] → postExecution()\n *                  ↓                                         ↓\n *            Loop check                               Record outcome\n *            Sequence check                           Update state\n *            Sanitize args\n * ```\n *\n * ## Usage\n *\n * ```typescript\n * const middleware = new SafetyMiddleware();\n *\n * // Before execution\n * const check = middleware.preExecution(toolName, args);\n * if (check.blocked) {\n *   // Handle block/approval requirement\n * }\n *\n * // After execution\n * middleware.postExecution(toolName, args, success);\n *\n * // For audit logging\n * const sanitized = middleware.sanitizeForLogging(args);\n * ```\n *\n * @module safety/safety-middleware\n */\n\nimport {\n\ttrackContextFirewall,\n\ttrackLoopDetection,\n\ttrackSequencePattern,\n\ttrackToolApprovalRequired,\n\ttrackToolBlocked,\n} from \"../telemetry/security-events.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\ttype ContextFirewallOptions,\n\ttype ContextFirewallResult,\n\tDEFAULT_BLOCKING_CONFIG,\n\tcheckContextFirewall,\n\tsanitizePayload,\n\tvaultCredentialsInPayload,\n} from \"./context-firewall.js\";\nimport { CredentialStore } from \"./credential-store.js\";\nimport {\n\ttype LoopDetectionResult,\n\tLoopDetector,\n\ttype LoopDetectorConfig,\n} from \"./loop-detector.js\";\nimport {\n\ttype SequenceAnalysisResult,\n\tToolSequenceAnalyzer,\n} from \"./tool-sequence-analyzer.js\";\n\n/**\n * Configuration for ToolSequenceAnalyzer\n */\ninterface ToolSequenceAnalyzerConfig {\n\tmaxRecords?: number;\n\tmaxAgeMs?: number;\n}\n\nconst logger = createLogger(\"safety:middleware\");\n\n/**\n * Result of pre-execution safety check\n */\nexport interface PreExecutionResult {\n\t/** Whether tool execution should proceed */\n\tallowed: boolean;\n\t/** Whether user approval is required */\n\trequiresApproval: boolean;\n\t/** Reason for block or approval requirement */\n\treason?: string;\n\t/** Suggestion for resolving the issue */\n\tsuggestion?: string;\n\t/** Which check triggered (loop, sequence, firewall) */\n\ttriggeredBy?: \"loop\" | \"sequence\" | \"firewall\";\n\t/** Sanitized arguments safe for logging */\n\tsanitizedArgs: Record<string, unknown>;\n\t/** Detection details */\n\tdetails?: {\n\t\tloopResult?: LoopDetectionResult;\n\t\tsequenceResult?: SequenceAnalysisResult;\n\t\tfirewallResult?: ContextFirewallResult;\n\t};\n}\n\n/**\n * Configuration for SafetyMiddleware\n */\nexport interface SafetyMiddlewareConfig {\n\t/** Loop detector configuration */\n\tloopDetector?: LoopDetectorConfig;\n\t/** Sequence analyzer configuration */\n\tsequenceAnalyzer?: ToolSequenceAnalyzerConfig;\n\t/** Context firewall options including blocking configuration */\n\tcontextFirewall?: ContextFirewallOptions;\n\t/** Whether to enable loop detection (default: true) */\n\tenableLoopDetection?: boolean;\n\t/** Whether to enable sequence analysis (default: true) */\n\tenableSequenceAnalysis?: boolean;\n\t/** Whether to enable context firewall (default: true) */\n\tenableContextFirewall?: boolean;\n}\n\n/**\n * Safety Middleware class\n *\n * Provides a unified interface for all security checks in the tool execution pipeline.\n */\nexport class SafetyMiddleware {\n\tprivate loopDetector: LoopDetector;\n\tprivate sequenceAnalyzer: ToolSequenceAnalyzer;\n\tprivate credentialStore: CredentialStore;\n\tprivate config: Required<\n\t\tOmit<\n\t\t\tSafetyMiddlewareConfig,\n\t\t\t\"loopDetector\" | \"sequenceAnalyzer\" | \"contextFirewall\"\n\t\t>\n\t> & {\n\t\tcontextFirewall: ContextFirewallOptions;\n\t};\n\n\tconstructor(config?: SafetyMiddlewareConfig) {\n\t\tthis.credentialStore = new CredentialStore();\n\t\tthis.loopDetector = new LoopDetector({\n\t\t\t// Default: more lenient than standalone for integration\n\t\t\tmaxIdenticalCalls: config?.loopDetector?.maxIdenticalCalls ?? 5,\n\t\t\tmaxSimilarCalls: config?.loopDetector?.maxSimilarCalls ?? 10,\n\t\t\tmaxCallsPerMinute: config?.loopDetector?.maxCallsPerMinute ?? 120,\n\t\t\tautoPause: config?.loopDetector?.autoPause ?? false, // Don't auto-pause, let transport handle\n\t\t\t...config?.loopDetector,\n\t\t});\n\n\t\tthis.sequenceAnalyzer = new ToolSequenceAnalyzer({\n\t\t\tmaxRecords: config?.sequenceAnalyzer?.maxRecords ?? 100,\n\t\t\tmaxAgeMs: config?.sequenceAnalyzer?.maxAgeMs ?? 300000, // 5 minutes\n\t\t\t...config?.sequenceAnalyzer,\n\t\t});\n\n\t\tthis.config = {\n\t\t\tenableLoopDetection: config?.enableLoopDetection ?? true,\n\t\t\tenableSequenceAnalysis: config?.enableSequenceAnalysis ?? true,\n\t\t\tenableContextFirewall: config?.enableContextFirewall ?? true,\n\t\t\tcontextFirewall: {\n\t\t\t\tredactSecrets: true,\n\t\t\t\tmaxStringLength: 1000,\n\t\t\t\tremoveControlChars: true,\n\t\t\t\ttruncateLargeBlobs: true,\n\t\t\t\t...config?.contextFirewall,\n\t\t\t\t// Enable credential vaulting - stores credentials securely and replaces with refs\n\t\t\t\tvaultCredentials: config?.contextFirewall?.vaultCredentials ?? false,\n\t\t\t\tcredentialStore: this.credentialStore,\n\t\t\t\t// Enable blocking by default with sensible thresholds\n\t\t\t\tblocking: {\n\t\t\t\t\t...DEFAULT_BLOCKING_CONFIG,\n\t\t\t\t\t...config?.contextFirewall?.blocking,\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * Run all pre-execution safety checks\n\t *\n\t * Call this before executing a tool. Returns whether execution should proceed\n\t * and provides sanitized arguments for logging.\n\t */\n\tpreExecution(\n\t\ttoolName: string,\n\t\targs: Record<string, unknown>,\n\t): PreExecutionResult {\n\t\tconst details: PreExecutionResult[\"details\"] = {};\n\n\t\t// 1. Context Firewall - sanitize and check for high-severity content\n\t\tlet sanitizedArgs = args;\n\t\tif (this.config.enableContextFirewall) {\n\t\t\tconst firewallResult = checkContextFirewall(\n\t\t\t\targs,\n\t\t\t\tthis.config.contextFirewall,\n\t\t\t);\n\t\t\tdetails.firewallResult = firewallResult;\n\t\t\tsanitizedArgs = firewallResult.sanitizedPayload as Record<\n\t\t\t\tstring,\n\t\t\t\tunknown\n\t\t\t>;\n\n\t\t\t// Track findings even when not blocking\n\t\t\tif (firewallResult.findings.length > 0) {\n\t\t\t\ttrackContextFirewall({\n\t\t\t\t\tfindingTypes: [\n\t\t\t\t\t\t...new Set(firewallResult.findings.map((f) => f.type)),\n\t\t\t\t\t],\n\t\t\t\t\tfindingCount: firewallResult.findings.length,\n\t\t\t\t\tblocked: firewallResult.blocked ?? false,\n\t\t\t\t\ttoolName,\n\t\t\t\t\treason: firewallResult.blockReason,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (firewallResult.blocked) {\n\t\t\t\tlogger.warn(\"Context firewall blocked tool execution\", {\n\t\t\t\t\ttoolName,\n\t\t\t\t\treason: firewallResult.blockReason,\n\t\t\t\t\tfindingsCount: firewallResult.findings.length,\n\t\t\t\t});\n\n\t\t\t\ttrackToolBlocked({\n\t\t\t\t\ttoolName,\n\t\t\t\t\treason: firewallResult.blockReason ?? \"Sensitive content detected\",\n\t\t\t\t\tsource: \"firewall\",\n\t\t\t\t\tseverity: \"high\",\n\t\t\t\t});\n\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\trequiresApproval: false,\n\t\t\t\t\treason: firewallResult.blockReason,\n\t\t\t\t\tsuggestion: \"Remove sensitive content from tool arguments\",\n\t\t\t\t\ttriggeredBy: \"firewall\",\n\t\t\t\t\tsanitizedArgs,\n\t\t\t\t\tdetails,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// 2. Loop Detection - check for repetitive patterns\n\t\tif (this.config.enableLoopDetection) {\n\t\t\tconst loopResult = this.loopDetector.check(toolName, args);\n\t\t\tdetails.loopResult = loopResult;\n\n\t\t\tif (loopResult.detected) {\n\t\t\t\tlogger.info(\"Loop pattern detected\", {\n\t\t\t\t\ttoolName,\n\t\t\t\t\ttype: loopResult.type,\n\t\t\t\t\trepetitions: loopResult.repetitions,\n\t\t\t\t});\n\n\t\t\t\ttrackLoopDetection({\n\t\t\t\t\tloopType: loopResult.type ?? \"exact\",\n\t\t\t\t\trepetitions: loopResult.repetitions ?? 0,\n\t\t\t\t\ttoolName,\n\t\t\t\t\taction: loopResult.action ?? \"warn\",\n\t\t\t\t\treason: loopResult.reason,\n\t\t\t\t});\n\n\t\t\t\tif (loopResult.action === \"pause\" || loopResult.action === \"halt\") {\n\t\t\t\t\ttrackToolBlocked({\n\t\t\t\t\t\ttoolName,\n\t\t\t\t\t\treason: loopResult.reason ?? \"Loop detected\",\n\t\t\t\t\t\tsource: \"loop\",\n\t\t\t\t\t\tseverity: loopResult.action === \"halt\" ? \"high\" : \"medium\",\n\t\t\t\t\t});\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\trequiresApproval: loopResult.action === \"pause\",\n\t\t\t\t\t\treason: loopResult.reason,\n\t\t\t\t\t\tsuggestion: loopResult.suggestion,\n\t\t\t\t\t\ttriggeredBy: \"loop\",\n\t\t\t\t\t\tsanitizedArgs,\n\t\t\t\t\t\tdetails,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t\t// For \"warn\" action, log but continue\n\t\t\t}\n\t\t}\n\n\t\t// 3. Sequence Analysis - check for suspicious behavioral patterns\n\t\tif (this.config.enableSequenceAnalysis) {\n\t\t\tconst sequenceResult = this.sequenceAnalyzer.checkTool(toolName, args);\n\t\t\tdetails.sequenceResult = sequenceResult;\n\n\t\t\tif (sequenceResult.action === \"require_approval\") {\n\t\t\t\tlogger.warn(\"Suspicious tool sequence detected\", {\n\t\t\t\t\ttoolName,\n\t\t\t\t\tpatternId: sequenceResult.patternId,\n\t\t\t\t\treason: sequenceResult.reason,\n\t\t\t\t});\n\n\t\t\t\ttrackSequencePattern({\n\t\t\t\t\tpatternId: sequenceResult.patternId ?? \"unknown\",\n\t\t\t\t\ttoolName,\n\t\t\t\t\taction: \"require_approval\",\n\t\t\t\t\tseverity: \"medium\",\n\t\t\t\t\treason: sequenceResult.reason,\n\t\t\t\t});\n\n\t\t\t\ttrackToolApprovalRequired({\n\t\t\t\t\ttoolName,\n\t\t\t\t\treason: sequenceResult.reason ?? \"Suspicious sequence detected\",\n\t\t\t\t\tsource: \"sequence\",\n\t\t\t\t});\n\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\trequiresApproval: true,\n\t\t\t\t\treason: sequenceResult.reason,\n\t\t\t\t\ttriggeredBy: \"sequence\",\n\t\t\t\t\tsanitizedArgs,\n\t\t\t\t\tdetails,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (sequenceResult.action === \"block\") {\n\t\t\t\ttrackSequencePattern({\n\t\t\t\t\tpatternId: sequenceResult.patternId ?? \"unknown\",\n\t\t\t\t\ttoolName,\n\t\t\t\t\taction: \"block\",\n\t\t\t\t\tseverity: \"high\",\n\t\t\t\t\treason: sequenceResult.reason,\n\t\t\t\t});\n\n\t\t\t\ttrackToolBlocked({\n\t\t\t\t\ttoolName,\n\t\t\t\t\treason: sequenceResult.reason ?? \"Blocked by sequence analysis\",\n\t\t\t\t\tsource: \"sequence\",\n\t\t\t\t\tseverity: \"high\",\n\t\t\t\t});\n\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\trequiresApproval: false,\n\t\t\t\t\treason: sequenceResult.reason,\n\t\t\t\t\ttriggeredBy: \"sequence\",\n\t\t\t\t\tsanitizedArgs,\n\t\t\t\t\tdetails,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tallowed: true,\n\t\t\trequiresApproval: false,\n\t\t\tsanitizedArgs,\n\t\t\tdetails,\n\t\t};\n\t}\n\n\t/**\n\t * Record tool execution outcome\n\t *\n\t * Call this after tool execution completes (success or failure).\n\t * Updates internal state for pattern detection.\n\t */\n\tpostExecution(\n\t\ttoolName: string,\n\t\targs: Record<string, unknown>,\n\t\tsuccess: boolean,\n\t\tapproved = true,\n\t): void {\n\t\t// Record in loop detector\n\t\tif (this.config.enableLoopDetection) {\n\t\t\tthis.loopDetector.record(toolName, args);\n\t\t}\n\n\t\t// Record in sequence analyzer\n\t\tif (this.config.enableSequenceAnalysis) {\n\t\t\tthis.sequenceAnalyzer.recordTool(toolName, args, approved, success);\n\t\t}\n\t}\n\n\t/**\n\t * Sanitize arguments for logging/storage\n\t *\n\t * Use this to get a safe version of tool arguments for audit logs.\n\t */\n\tsanitizeForLogging(args: Record<string, unknown>): Record<string, unknown> {\n\t\tif (!this.config.enableContextFirewall) {\n\t\t\treturn args;\n\t\t}\n\t\treturn sanitizePayload(args, this.config.contextFirewall) as Record<\n\t\t\tstring,\n\t\t\tunknown\n\t\t>;\n\t}\n\n\t/**\n\t * Prepare arguments for execution when credential vaulting is enabled.\n\t *\n\t * Replaces detected credentials with vault references without mutating\n\t * other argument content.\n\t */\n\tprepareExecutionArgs<T>(args: T): T {\n\t\tif (\n\t\t\t!this.config.enableContextFirewall ||\n\t\t\t!this.config.contextFirewall.vaultCredentials\n\t\t) {\n\t\t\treturn args;\n\t\t}\n\n\t\treturn vaultCredentialsInPayload(args, this.credentialStore) as T;\n\t}\n\n\t/**\n\t * Resume from paused state (loop detection)\n\t */\n\tresumeLoopDetection(): void {\n\t\tthis.loopDetector.resume();\n\t}\n\n\t/**\n\t * Check if loop detector is paused\n\t */\n\tisLoopDetectorPaused(): boolean {\n\t\treturn this.loopDetector.isPausedState();\n\t}\n\n\t/**\n\t * Get loop detector pause reason\n\t */\n\tgetLoopPauseReason(): string | undefined {\n\t\treturn this.loopDetector.getPauseReason();\n\t}\n\n\t/**\n\t * Reset all internal state\n\t */\n\treset(): void {\n\t\tthis.loopDetector.reset();\n\t\tthis.sequenceAnalyzer.clear();\n\t\tthis.clearCredentials();\n\t}\n\n\t/**\n\t * Get statistics about safety checks\n\t */\n\tgetStats(): {\n\t\tloopDetector: ReturnType<LoopDetector[\"getStats\"]>;\n\t\tsequenceAnalyzer: ReturnType<ToolSequenceAnalyzer[\"getSummary\"]>;\n\t} {\n\t\treturn {\n\t\t\tloopDetector: this.loopDetector.getStats(),\n\t\t\tsequenceAnalyzer: this.sequenceAnalyzer.getSummary(),\n\t\t};\n\t}\n\n\t/**\n\t * Resolve credential references in tool arguments before execution\n\t *\n\t * When vaultCredentials is enabled, credentials detected during sanitization\n\t * are stored securely and replaced with references like `{{CRED:api_key:abc123}}`.\n\t * This method resolves those references back to their original values so tools\n\t * can actually use the credentials.\n\t *\n\t * @param args - Tool arguments that may contain credential references\n\t * @returns New object with credential references resolved to actual values\n\t */\n\tresolveCredentials<T>(args: T): T {\n\t\treturn this.credentialStore.resolveInObject(args);\n\t}\n\n\t/**\n\t * Get credential store statistics (for diagnostics)\n\t */\n\tgetCredentialStats(): ReturnType<CredentialStore[\"getStats\"]> {\n\t\treturn this.credentialStore.getStats();\n\t}\n\n\t/**\n\t * Clear stored credentials (for session reset)\n\t */\n\tclearCredentials(): void {\n\t\tthis.credentialStore.clear();\n\t}\n}\n\n/**\n * Default safety middleware instance\n */\nexport const defaultSafetyMiddleware = new SafetyMiddleware();\n\n/**\n * Create a safety middleware with custom configuration\n */\nexport function createSafetyMiddleware(\n\tconfig?: SafetyMiddlewareConfig,\n): SafetyMiddleware {\n\treturn new SafetyMiddleware(config);\n}\n"]}
+{"version":3,"file":"safety-middleware.js","sourceRoot":"","sources":["../../src/safety/safety-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EACN,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,gBAAgB,GAChB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAGN,uBAAuB,EACvB,oBAAoB,EACpB,eAAe,EACf,yBAAyB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAEN,YAAY,GAEZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEN,oBAAoB,GACpB,MAAM,6BAA6B,CAAC;AAUrC,MAAM,MAAM,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;AAiDjD;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IAa5B,YAAY,MAA+B;QAC1C,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC;YACpC,wDAAwD;YACxD,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,IAAI,CAAC;YAC/D,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,IAAI,EAAE;YAC5D,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,IAAI,GAAG;YACjE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,IAAI,KAAK,EAAE,yCAAyC;YAC9F,GAAG,MAAM,EAAE,YAAY;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,GAAG,IAAI,oBAAoB,CAAC;YAChD,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,IAAI,GAAG;YACvD,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,IAAI,MAAM,EAAE,YAAY;YACpE,GAAG,MAAM,EAAE,gBAAgB;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG;YACb,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,IAAI,IAAI;YACxD,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,IAAI,IAAI;YAC9D,qBAAqB,EAAE,MAAM,EAAE,qBAAqB,IAAI,IAAI;YAC5D,eAAe,EAAE;gBAChB,aAAa,EAAE,IAAI;gBACnB,eAAe,EAAE,IAAI;gBACrB,kBAAkB,EAAE,IAAI;gBACxB,kBAAkB,EAAE,IAAI;gBACxB,GAAG,MAAM,EAAE,eAAe;gBAC1B,kFAAkF;gBAClF,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,IAAI,KAAK;gBACpE,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,sDAAsD;gBACtD,QAAQ,EAAE;oBACT,GAAG,uBAAuB;oBAC1B,GAAG,MAAM,EAAE,eAAe,EAAE,QAAQ;iBACpC;aACD;SACD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,YAAY,CACX,QAAgB,EAChB,IAA6B,EAC7B,OAA6B;QAE7B,MAAM,OAAO,GAAkC,EAAE,CAAC;QAElD,qEAAqE;QACrE,IAAI,aAAa,GAAG,IAAI,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACvC,MAAM,cAAc,GAAG,oBAAoB,CAC1C,IAAI,EACJ,IAAI,CAAC,MAAM,CAAC,eAAe,CAC3B,CAAC;YACF,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;YACxC,aAAa,GAAG,cAAc,CAAC,gBAG9B,CAAC;YAEF,wCAAwC;YACxC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,oBAAoB,CAAC;oBACpB,YAAY,EAAE;wBACb,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;qBACtD;oBACD,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,MAAM;oBAC5C,OAAO,EAAE,cAAc,CAAC,OAAO,IAAI,KAAK;oBACxC,QAAQ;oBACR,MAAM,EAAE,cAAc,CAAC,WAAW;iBAClC,CAAC,CAAC;YACJ,CAAC;YAED,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBACtD,QAAQ;oBACR,MAAM,EAAE,cAAc,CAAC,WAAW;oBAClC,aAAa,EAAE,cAAc,CAAC,QAAQ,CAAC,MAAM;iBAC7C,CAAC,CAAC;gBAEH,gBAAgB,CAAC;oBAChB,QAAQ;oBACR,MAAM,EAAE,cAAc,CAAC,WAAW,IAAI,4BAA4B;oBAClE,MAAM,EAAE,UAAU;oBAClB,QAAQ,EAAE,MAAM;iBAChB,CAAC,CAAC;gBAEH,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,KAAK;oBACvB,MAAM,EAAE,cAAc,CAAC,WAAW;oBAClC,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,UAAU;oBACvB,aAAa;oBACb,OAAO;iBACP,CAAC;YACH,CAAC;QACF,CAAC;QAED,oDAAoD;QACpD,IACC,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAC/B,OAAO,EAAE,iBAAiB,KAAK,IAAI,EAClC,CAAC;YACF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC3D,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;YAEhC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;oBACpC,QAAQ;oBACR,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;iBACnC,CAAC,CAAC;gBAEH,kBAAkB,CAAC;oBAClB,QAAQ,EAAE,UAAU,CAAC,IAAI,IAAI,OAAO;oBACpC,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,CAAC;oBACxC,QAAQ;oBACR,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,MAAM;oBACnC,MAAM,EAAE,UAAU,CAAC,MAAM;iBACzB,CAAC,CAAC;gBAEH,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnE,gBAAgB,CAAC;wBAChB,QAAQ;wBACR,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,eAAe;wBAC5C,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;qBAC1D,CAAC,CAAC;oBAEH,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,gBAAgB,EAAE,UAAU,CAAC,MAAM,KAAK,OAAO;wBAC/C,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,UAAU,EAAE,UAAU,CAAC,UAAU;wBACjC,WAAW,EAAE,MAAM;wBACnB,aAAa;wBACb,OAAO;qBACP,CAAC;gBACH,CAAC;gBACD,sCAAsC;YACvC,CAAC;QACF,CAAC;QAED,kEAAkE;QAClE,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACxC,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvE,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;YAExC,IAAI,cAAc,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;oBAChD,QAAQ;oBACR,SAAS,EAAE,cAAc,CAAC,SAAS;oBACnC,MAAM,EAAE,cAAc,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBAEH,oBAAoB,CAAC;oBACpB,SAAS,EAAE,cAAc,CAAC,SAAS,IAAI,SAAS;oBAChD,QAAQ;oBACR,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,cAAc,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBAEH,yBAAyB,CAAC;oBACzB,QAAQ;oBACR,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,8BAA8B;oBAC/D,MAAM,EAAE,UAAU;iBAClB,CAAC,CAAC;gBAEH,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,IAAI;oBACtB,MAAM,EAAE,cAAc,CAAC,MAAM;oBAC7B,WAAW,EAAE,UAAU;oBACvB,aAAa;oBACb,OAAO;iBACP,CAAC;YACH,CAAC;YAED,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvC,oBAAoB,CAAC;oBACpB,SAAS,EAAE,cAAc,CAAC,SAAS,IAAI,SAAS;oBAChD,QAAQ;oBACR,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,cAAc,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBAEH,gBAAgB,CAAC;oBAChB,QAAQ;oBACR,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,8BAA8B;oBAC/D,MAAM,EAAE,UAAU;oBAClB,QAAQ,EAAE,MAAM;iBAChB,CAAC,CAAC;gBAEH,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,KAAK;oBACvB,MAAM,EAAE,cAAc,CAAC,MAAM;oBAC7B,WAAW,EAAE,UAAU;oBACvB,aAAa;oBACb,OAAO;iBACP,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO;YACN,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE,KAAK;YACvB,aAAa;YACb,OAAO;SACP,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,aAAa,CACZ,QAAgB,EAChB,IAA6B,EAC7B,OAAgB,EAChB,QAAQ,GAAG,IAAI;QAEf,0BAA0B;QAC1B,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACrC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACxC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,IAA6B;QAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAGvD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAAI,IAAO;QAC9B,IACC,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB;YAClC,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,gBAAgB,EAC5C,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;QAED,OAAO,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,CAAM,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,mBAAmB;QAClB,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,oBAAoB;QACnB,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,kBAAkB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK;QACJ,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,QAAQ;QAIP,OAAO;YACN,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAC1C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE;SACpD,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,kBAAkB,CAAI,IAAO;QAC5B,OAAO,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,kBAAkB;QACjB,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,gBAAgB;QACf,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACD;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAE9D;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACrC,MAA+B;IAE/B,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC","sourcesContent":["/**\n * Safety Middleware - Unified Security Layer for Tool Execution\n *\n * This module consolidates all security checks into a single middleware layer\n * that integrates with the agent transport. It provides:\n *\n * 1. **Loop Detection**: Enhanced pattern detection (exact, similar, cyclic, frequency)\n * 2. **Sequence Analysis**: Behavioral threat detection (exfiltration, reconnaissance, etc.)\n * 3. **Context Firewall**: Argument sanitization before logging/storage\n *\n * ## Integration Points\n *\n * ```\n * Tool Call → preExecution() → [Firewall] → [Execute] → postExecution()\n *                  ↓                                         ↓\n *            Loop check                               Record outcome\n *            Sequence check                           Update state\n *            Sanitize args\n * ```\n *\n * ## Usage\n *\n * ```typescript\n * const middleware = new SafetyMiddleware();\n *\n * // Before execution\n * const check = middleware.preExecution(toolName, args);\n * if (check.blocked) {\n *   // Handle block/approval requirement\n * }\n *\n * // After execution\n * middleware.postExecution(toolName, args, success);\n *\n * // For audit logging\n * const sanitized = middleware.sanitizeForLogging(args);\n * ```\n *\n * @module safety/safety-middleware\n */\n\nimport {\n\ttrackContextFirewall,\n\ttrackLoopDetection,\n\ttrackSequencePattern,\n\ttrackToolApprovalRequired,\n\ttrackToolBlocked,\n} from \"../telemetry/security-events.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\ttype ContextFirewallOptions,\n\ttype ContextFirewallResult,\n\tDEFAULT_BLOCKING_CONFIG,\n\tcheckContextFirewall,\n\tsanitizePayload,\n\tvaultCredentialsInPayload,\n} from \"./context-firewall.js\";\nimport { CredentialStore } from \"./credential-store.js\";\nimport {\n\ttype LoopDetectionResult,\n\tLoopDetector,\n\ttype LoopDetectorConfig,\n} from \"./loop-detector.js\";\nimport {\n\ttype SequenceAnalysisResult,\n\tToolSequenceAnalyzer,\n} from \"./tool-sequence-analyzer.js\";\n\n/**\n * Configuration for ToolSequenceAnalyzer\n */\ninterface ToolSequenceAnalyzerConfig {\n\tmaxRecords?: number;\n\tmaxAgeMs?: number;\n}\n\nconst logger = createLogger(\"safety:middleware\");\n\n/**\n * Result of pre-execution safety check\n */\nexport interface PreExecutionResult {\n\t/** Whether tool execution should proceed */\n\tallowed: boolean;\n\t/** Whether user approval is required */\n\trequiresApproval: boolean;\n\t/** Reason for block or approval requirement */\n\treason?: string;\n\t/** Suggestion for resolving the issue */\n\tsuggestion?: string;\n\t/** Which check triggered (loop, sequence, firewall) */\n\ttriggeredBy?: \"loop\" | \"sequence\" | \"firewall\";\n\t/** Sanitized arguments safe for logging */\n\tsanitizedArgs: Record<string, unknown>;\n\t/** Detection details */\n\tdetails?: {\n\t\tloopResult?: LoopDetectionResult;\n\t\tsequenceResult?: SequenceAnalysisResult;\n\t\tfirewallResult?: ContextFirewallResult;\n\t};\n}\n\nexport interface PreExecutionOptions {\n\t/** Skip only loop detection for a transport-managed duplicate; firewall and sequence checks still run. */\n\tskipLoopDetection?: boolean;\n}\n\n/**\n * Configuration for SafetyMiddleware\n */\nexport interface SafetyMiddlewareConfig {\n\t/** Loop detector configuration */\n\tloopDetector?: LoopDetectorConfig;\n\t/** Sequence analyzer configuration */\n\tsequenceAnalyzer?: ToolSequenceAnalyzerConfig;\n\t/** Context firewall options including blocking configuration */\n\tcontextFirewall?: ContextFirewallOptions;\n\t/** Whether to enable loop detection (default: true) */\n\tenableLoopDetection?: boolean;\n\t/** Whether to enable sequence analysis (default: true) */\n\tenableSequenceAnalysis?: boolean;\n\t/** Whether to enable context firewall (default: true) */\n\tenableContextFirewall?: boolean;\n}\n\n/**\n * Safety Middleware class\n *\n * Provides a unified interface for all security checks in the tool execution pipeline.\n */\nexport class SafetyMiddleware {\n\tprivate loopDetector: LoopDetector;\n\tprivate sequenceAnalyzer: ToolSequenceAnalyzer;\n\tprivate credentialStore: CredentialStore;\n\tprivate config: Required<\n\t\tOmit<\n\t\t\tSafetyMiddlewareConfig,\n\t\t\t\"loopDetector\" | \"sequenceAnalyzer\" | \"contextFirewall\"\n\t\t>\n\t> & {\n\t\tcontextFirewall: ContextFirewallOptions;\n\t};\n\n\tconstructor(config?: SafetyMiddlewareConfig) {\n\t\tthis.credentialStore = new CredentialStore();\n\t\tthis.loopDetector = new LoopDetector({\n\t\t\t// Default: more lenient than standalone for integration\n\t\t\tmaxIdenticalCalls: config?.loopDetector?.maxIdenticalCalls ?? 5,\n\t\t\tmaxSimilarCalls: config?.loopDetector?.maxSimilarCalls ?? 10,\n\t\t\tmaxCallsPerMinute: config?.loopDetector?.maxCallsPerMinute ?? 120,\n\t\t\tautoPause: config?.loopDetector?.autoPause ?? false, // Don't auto-pause, let transport handle\n\t\t\t...config?.loopDetector,\n\t\t});\n\n\t\tthis.sequenceAnalyzer = new ToolSequenceAnalyzer({\n\t\t\tmaxRecords: config?.sequenceAnalyzer?.maxRecords ?? 100,\n\t\t\tmaxAgeMs: config?.sequenceAnalyzer?.maxAgeMs ?? 300000, // 5 minutes\n\t\t\t...config?.sequenceAnalyzer,\n\t\t});\n\n\t\tthis.config = {\n\t\t\tenableLoopDetection: config?.enableLoopDetection ?? true,\n\t\t\tenableSequenceAnalysis: config?.enableSequenceAnalysis ?? true,\n\t\t\tenableContextFirewall: config?.enableContextFirewall ?? true,\n\t\t\tcontextFirewall: {\n\t\t\t\tredactSecrets: true,\n\t\t\t\tmaxStringLength: 1000,\n\t\t\t\tremoveControlChars: true,\n\t\t\t\ttruncateLargeBlobs: true,\n\t\t\t\t...config?.contextFirewall,\n\t\t\t\t// Enable credential vaulting - stores credentials securely and replaces with refs\n\t\t\t\tvaultCredentials: config?.contextFirewall?.vaultCredentials ?? false,\n\t\t\t\tcredentialStore: this.credentialStore,\n\t\t\t\t// Enable blocking by default with sensible thresholds\n\t\t\t\tblocking: {\n\t\t\t\t\t...DEFAULT_BLOCKING_CONFIG,\n\t\t\t\t\t...config?.contextFirewall?.blocking,\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * Run all pre-execution safety checks\n\t *\n\t * Call this before executing a tool. Returns whether execution should proceed\n\t * and provides sanitized arguments for logging.\n\t */\n\tpreExecution(\n\t\ttoolName: string,\n\t\targs: Record<string, unknown>,\n\t\toptions?: PreExecutionOptions,\n\t): PreExecutionResult {\n\t\tconst details: PreExecutionResult[\"details\"] = {};\n\n\t\t// 1. Context Firewall - sanitize and check for high-severity content\n\t\tlet sanitizedArgs = args;\n\t\tif (this.config.enableContextFirewall) {\n\t\t\tconst firewallResult = checkContextFirewall(\n\t\t\t\targs,\n\t\t\t\tthis.config.contextFirewall,\n\t\t\t);\n\t\t\tdetails.firewallResult = firewallResult;\n\t\t\tsanitizedArgs = firewallResult.sanitizedPayload as Record<\n\t\t\t\tstring,\n\t\t\t\tunknown\n\t\t\t>;\n\n\t\t\t// Track findings even when not blocking\n\t\t\tif (firewallResult.findings.length > 0) {\n\t\t\t\ttrackContextFirewall({\n\t\t\t\t\tfindingTypes: [\n\t\t\t\t\t\t...new Set(firewallResult.findings.map((f) => f.type)),\n\t\t\t\t\t],\n\t\t\t\t\tfindingCount: firewallResult.findings.length,\n\t\t\t\t\tblocked: firewallResult.blocked ?? false,\n\t\t\t\t\ttoolName,\n\t\t\t\t\treason: firewallResult.blockReason,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (firewallResult.blocked) {\n\t\t\t\tlogger.warn(\"Context firewall blocked tool execution\", {\n\t\t\t\t\ttoolName,\n\t\t\t\t\treason: firewallResult.blockReason,\n\t\t\t\t\tfindingsCount: firewallResult.findings.length,\n\t\t\t\t});\n\n\t\t\t\ttrackToolBlocked({\n\t\t\t\t\ttoolName,\n\t\t\t\t\treason: firewallResult.blockReason ?? \"Sensitive content detected\",\n\t\t\t\t\tsource: \"firewall\",\n\t\t\t\t\tseverity: \"high\",\n\t\t\t\t});\n\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\trequiresApproval: false,\n\t\t\t\t\treason: firewallResult.blockReason,\n\t\t\t\t\tsuggestion: \"Remove sensitive content from tool arguments\",\n\t\t\t\t\ttriggeredBy: \"firewall\",\n\t\t\t\t\tsanitizedArgs,\n\t\t\t\t\tdetails,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// 2. Loop Detection - check for repetitive patterns\n\t\tif (\n\t\t\tthis.config.enableLoopDetection &&\n\t\t\toptions?.skipLoopDetection !== true\n\t\t) {\n\t\t\tconst loopResult = this.loopDetector.check(toolName, args);\n\t\t\tdetails.loopResult = loopResult;\n\n\t\t\tif (loopResult.detected) {\n\t\t\t\tlogger.info(\"Loop pattern detected\", {\n\t\t\t\t\ttoolName,\n\t\t\t\t\ttype: loopResult.type,\n\t\t\t\t\trepetitions: loopResult.repetitions,\n\t\t\t\t});\n\n\t\t\t\ttrackLoopDetection({\n\t\t\t\t\tloopType: loopResult.type ?? \"exact\",\n\t\t\t\t\trepetitions: loopResult.repetitions ?? 0,\n\t\t\t\t\ttoolName,\n\t\t\t\t\taction: loopResult.action ?? \"warn\",\n\t\t\t\t\treason: loopResult.reason,\n\t\t\t\t});\n\n\t\t\t\tif (loopResult.action === \"pause\" || loopResult.action === \"halt\") {\n\t\t\t\t\ttrackToolBlocked({\n\t\t\t\t\t\ttoolName,\n\t\t\t\t\t\treason: loopResult.reason ?? \"Loop detected\",\n\t\t\t\t\t\tsource: \"loop\",\n\t\t\t\t\t\tseverity: loopResult.action === \"halt\" ? \"high\" : \"medium\",\n\t\t\t\t\t});\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\trequiresApproval: loopResult.action === \"pause\",\n\t\t\t\t\t\treason: loopResult.reason,\n\t\t\t\t\t\tsuggestion: loopResult.suggestion,\n\t\t\t\t\t\ttriggeredBy: \"loop\",\n\t\t\t\t\t\tsanitizedArgs,\n\t\t\t\t\t\tdetails,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t\t// For \"warn\" action, log but continue\n\t\t\t}\n\t\t}\n\n\t\t// 3. Sequence Analysis - check for suspicious behavioral patterns\n\t\tif (this.config.enableSequenceAnalysis) {\n\t\t\tconst sequenceResult = this.sequenceAnalyzer.checkTool(toolName, args);\n\t\t\tdetails.sequenceResult = sequenceResult;\n\n\t\t\tif (sequenceResult.action === \"require_approval\") {\n\t\t\t\tlogger.warn(\"Suspicious tool sequence detected\", {\n\t\t\t\t\ttoolName,\n\t\t\t\t\tpatternId: sequenceResult.patternId,\n\t\t\t\t\treason: sequenceResult.reason,\n\t\t\t\t});\n\n\t\t\t\ttrackSequencePattern({\n\t\t\t\t\tpatternId: sequenceResult.patternId ?? \"unknown\",\n\t\t\t\t\ttoolName,\n\t\t\t\t\taction: \"require_approval\",\n\t\t\t\t\tseverity: \"medium\",\n\t\t\t\t\treason: sequenceResult.reason,\n\t\t\t\t});\n\n\t\t\t\ttrackToolApprovalRequired({\n\t\t\t\t\ttoolName,\n\t\t\t\t\treason: sequenceResult.reason ?? \"Suspicious sequence detected\",\n\t\t\t\t\tsource: \"sequence\",\n\t\t\t\t});\n\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\trequiresApproval: true,\n\t\t\t\t\treason: sequenceResult.reason,\n\t\t\t\t\ttriggeredBy: \"sequence\",\n\t\t\t\t\tsanitizedArgs,\n\t\t\t\t\tdetails,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (sequenceResult.action === \"block\") {\n\t\t\t\ttrackSequencePattern({\n\t\t\t\t\tpatternId: sequenceResult.patternId ?? \"unknown\",\n\t\t\t\t\ttoolName,\n\t\t\t\t\taction: \"block\",\n\t\t\t\t\tseverity: \"high\",\n\t\t\t\t\treason: sequenceResult.reason,\n\t\t\t\t});\n\n\t\t\t\ttrackToolBlocked({\n\t\t\t\t\ttoolName,\n\t\t\t\t\treason: sequenceResult.reason ?? \"Blocked by sequence analysis\",\n\t\t\t\t\tsource: \"sequence\",\n\t\t\t\t\tseverity: \"high\",\n\t\t\t\t});\n\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\trequiresApproval: false,\n\t\t\t\t\treason: sequenceResult.reason,\n\t\t\t\t\ttriggeredBy: \"sequence\",\n\t\t\t\t\tsanitizedArgs,\n\t\t\t\t\tdetails,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tallowed: true,\n\t\t\trequiresApproval: false,\n\t\t\tsanitizedArgs,\n\t\t\tdetails,\n\t\t};\n\t}\n\n\t/**\n\t * Record tool execution outcome\n\t *\n\t * Call this after tool execution completes (success or failure).\n\t * Updates internal state for pattern detection.\n\t */\n\tpostExecution(\n\t\ttoolName: string,\n\t\targs: Record<string, unknown>,\n\t\tsuccess: boolean,\n\t\tapproved = true,\n\t): void {\n\t\t// Record in loop detector\n\t\tif (this.config.enableLoopDetection) {\n\t\t\tthis.loopDetector.record(toolName, args);\n\t\t}\n\n\t\t// Record in sequence analyzer\n\t\tif (this.config.enableSequenceAnalysis) {\n\t\t\tthis.sequenceAnalyzer.recordTool(toolName, args, approved, success);\n\t\t}\n\t}\n\n\t/**\n\t * Sanitize arguments for logging/storage\n\t *\n\t * Use this to get a safe version of tool arguments for audit logs.\n\t */\n\tsanitizeForLogging(args: Record<string, unknown>): Record<string, unknown> {\n\t\tif (!this.config.enableContextFirewall) {\n\t\t\treturn args;\n\t\t}\n\t\treturn sanitizePayload(args, this.config.contextFirewall) as Record<\n\t\t\tstring,\n\t\t\tunknown\n\t\t>;\n\t}\n\n\t/**\n\t * Prepare arguments for execution when credential vaulting is enabled.\n\t *\n\t * Replaces detected credentials with vault references without mutating\n\t * other argument content.\n\t */\n\tprepareExecutionArgs<T>(args: T): T {\n\t\tif (\n\t\t\t!this.config.enableContextFirewall ||\n\t\t\t!this.config.contextFirewall.vaultCredentials\n\t\t) {\n\t\t\treturn args;\n\t\t}\n\n\t\treturn vaultCredentialsInPayload(args, this.credentialStore) as T;\n\t}\n\n\t/**\n\t * Resume from paused state (loop detection)\n\t */\n\tresumeLoopDetection(): void {\n\t\tthis.loopDetector.resume();\n\t}\n\n\t/**\n\t * Check if loop detector is paused\n\t */\n\tisLoopDetectorPaused(): boolean {\n\t\treturn this.loopDetector.isPausedState();\n\t}\n\n\t/**\n\t * Get loop detector pause reason\n\t */\n\tgetLoopPauseReason(): string | undefined {\n\t\treturn this.loopDetector.getPauseReason();\n\t}\n\n\t/**\n\t * Reset all internal state\n\t */\n\treset(): void {\n\t\tthis.loopDetector.reset();\n\t\tthis.sequenceAnalyzer.clear();\n\t\tthis.clearCredentials();\n\t}\n\n\t/**\n\t * Get statistics about safety checks\n\t */\n\tgetStats(): {\n\t\tloopDetector: ReturnType<LoopDetector[\"getStats\"]>;\n\t\tsequenceAnalyzer: ReturnType<ToolSequenceAnalyzer[\"getSummary\"]>;\n\t} {\n\t\treturn {\n\t\t\tloopDetector: this.loopDetector.getStats(),\n\t\t\tsequenceAnalyzer: this.sequenceAnalyzer.getSummary(),\n\t\t};\n\t}\n\n\t/**\n\t * Resolve credential references in tool arguments before execution\n\t *\n\t * When vaultCredentials is enabled, credentials detected during sanitization\n\t * are stored securely and replaced with references like `{{CRED:api_key:abc123}}`.\n\t * This method resolves those references back to their original values so tools\n\t * can actually use the credentials.\n\t *\n\t * @param args - Tool arguments that may contain credential references\n\t * @returns New object with credential references resolved to actual values\n\t */\n\tresolveCredentials<T>(args: T): T {\n\t\treturn this.credentialStore.resolveInObject(args);\n\t}\n\n\t/**\n\t * Get credential store statistics (for diagnostics)\n\t */\n\tgetCredentialStats(): ReturnType<CredentialStore[\"getStats\"]> {\n\t\treturn this.credentialStore.getStats();\n\t}\n\n\t/**\n\t * Clear stored credentials (for session reset)\n\t */\n\tclearCredentials(): void {\n\t\tthis.credentialStore.clear();\n\t}\n}\n\n/**\n * Default safety middleware instance\n */\nexport const defaultSafetyMiddleware = new SafetyMiddleware();\n\n/**\n * Create a safety middleware with custom configuration\n */\nexport function createSafetyMiddleware(\n\tconfig?: SafetyMiddlewareConfig,\n): SafetyMiddleware {\n\treturn new SafetyMiddleware(config);\n}\n"]}

package/dist/safety/suspicious-patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suspicious-patterns.d.ts","sourceRoot":"","sources":["../../src/safety/suspicious-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,eAAe,EAqfhD,CAAC"}
+{"version":3,"file":"suspicious-patterns.d.ts","sourceRoot":"","sources":["../../src/safety/suspicious-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,eAAe,EA4fhD,CAAC"}

package/dist/safety/suspicious-patterns.js

@@ -6,6 +6,7 @@
  *
  * @module safety/suspicious-patterns
  */
+import { parseApplyPatchPaths } from "../tools/apply-patch-parser.js";
 import { containsSensitivePath, getToolTags } from "./tool-categorization.js";
 /**
  * Suspicious sequence patterns
@@ -83,15 +84,19 @@ export const SUSPICIOUS_PATTERNS = [
                 "C:\\Windows",
                 "C:\\Program Files",
             ];
-            const targetPath = (currentArgs.path ||
-                currentArgs.file_path ||
-                currentArgs.target);
-            if (targetPath &&
-                (currentTags.has("write") || currentTags.has("delete")) &&
-                systemPaths.some((sp) => targetPath.startsWith(sp))) {
+            const targetPaths = currentTool.toLowerCase() === "apply_patch" &&
+                typeof currentArgs.patch === "string"
+                ? parseApplyPatchPaths(currentArgs.patch)
+                : [
+                    (currentArgs.path ||
+                        currentArgs.file_path ||
+                        currentArgs.target),
+                ].filter((path) => typeof path === "string");
+            if ((currentTags.has("write") || currentTags.has("delete")) &&
+                targetPaths.some((targetPath) => systemPaths.some((sp) => targetPath.startsWith(sp)))) {
                 return {
                     matched: true,
-                    reason: `Modification of system path detected: ${targetPath}`,
+                    reason: `Modification of system path detected: ${targetPaths.join(", ")}`,
                 };
             }
             return { matched: false };