@evalops/maestro 0.10.8 → 0.10.11

package/dist/safety/governance-service-client.js

@@ -0,0 +1,279 @@
+import { Buffer } from "node:buffer";
+import { loadOAuthCredentials } from "../oauth/storage.js";
+import { CONNECT_PROTOCOL_VERSION } from "../platform/client.js";
+import { PLATFORM_CONNECT_METHODS, PLATFORM_CONNECT_SERVICES, platformConnectMethodPath, platformConnectServicePath, } from "../platform/core-services.js";
+import { fetchDownstream, } from "../utils/downstream-http.js";
+import * as downstream from "../utils/downstream.js";
+const DEFAULT_AGENT_ID = "maestro";
+const DEFAULT_MAX_ATTEMPTS = 2;
+const DEFAULT_TIMEOUT_MS = 2_000;
+const EVALUATE_ACTION_PATH = platformConnectMethodPath(PLATFORM_CONNECT_METHODS.governance.evaluateAction);
+export const GOVERNANCE_CALL_FAILURE_MODES = {
+    evaluateAction: {
+        optional: downstream.FailOpen,
+        required: downstream.FailClosed,
+    },
+};
+const downstreamClients = new Map();
+function trimString(value) {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+function getEnvValue(names) {
+    for (const name of names) {
+        const value = trimString(process.env[name]);
+        if (value) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function parsePositiveInt(value, fallback) {
+    const parsed = Number.parseInt(value ?? "", 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function stripTrailingSlashes(value) {
+    return value.replace(/\/+$/, "");
+}
+function normalizeBaseUrl(baseUrl) {
+    let normalized = stripTrailingSlashes(baseUrl.trim());
+    for (const suffix of [
+        EVALUATE_ACTION_PATH,
+        platformConnectServicePath(PLATFORM_CONNECT_SERVICES.governance),
+    ]) {
+        if (normalized.endsWith(suffix)) {
+            normalized = stripTrailingSlashes(normalized.slice(0, -suffix.length));
+        }
+    }
+    return normalized;
+}
+function resolveWorkspaceId(config, context) {
+    const configuredWorkspaceId = trimString(config?.workspaceId);
+    const envWorkspaceId = getEnvValue([
+        "GOVERNANCE_SERVICE_WORKSPACE_ID",
+        "MAESTRO_GOVERNANCE_WORKSPACE_ID",
+        "MAESTRO_EVALOPS_WORKSPACE_ID",
+        "MAESTRO_WORKSPACE_ID",
+        "MAESTRO_EVALOPS_ORG_ID",
+        "EVALOPS_ORGANIZATION_ID",
+        "MAESTRO_ENTERPRISE_ORG_ID",
+    ]);
+    if (configuredWorkspaceId ??
+        trimString(context.user?.orgId) ??
+        envWorkspaceId) {
+        return (configuredWorkspaceId ?? trimString(context.user?.orgId) ?? envWorkspaceId);
+    }
+    const stored = loadOAuthCredentials("evalops")?.metadata?.organizationId;
+    return typeof stored === "string" && stored.trim().length > 0
+        ? stored.trim()
+        : undefined;
+}
+export function resolveActionFirewallGovernanceServiceConfig(config, context) {
+    if (config === false) {
+        return null;
+    }
+    const baseUrl = trimString(config?.baseUrl) ??
+        getEnvValue([
+            "GOVERNANCE_SERVICE_URL",
+            "MAESTRO_GOVERNANCE_SERVICE_URL",
+            "MAESTRO_PLATFORM_BASE_URL",
+            "MAESTRO_EVALOPS_BASE_URL",
+            "EVALOPS_BASE_URL",
+        ]);
+    if (!baseUrl) {
+        return null;
+    }
+    const workspaceId = resolveWorkspaceId(config, context);
+    if (!workspaceId) {
+        return null;
+    }
+    const storedToken = trimString(loadOAuthCredentials("evalops")?.access);
+    const required = config?.required ??
+        getEnvValue([
+            "GOVERNANCE_SERVICE_REQUIRED",
+            "MAESTRO_GOVERNANCE_SERVICE_REQUIRED",
+        ]) === "1";
+    return {
+        agentId: trimString(config?.agentId) ??
+            getEnvValue([
+                "GOVERNANCE_SERVICE_AGENT_ID",
+                "MAESTRO_GOVERNANCE_AGENT_ID",
+                "MAESTRO_EVALOPS_AGENT_ID",
+                "MAESTRO_AGENT_ID",
+            ]) ??
+            DEFAULT_AGENT_ID,
+        baseUrl: normalizeBaseUrl(baseUrl),
+        circuitFailureThreshold: config?.circuitFailureThreshold ??
+            parsePositiveInt(getEnvValue([
+                "GOVERNANCE_SERVICE_CIRCUIT_FAILURE_THRESHOLD",
+                "MAESTRO_GOVERNANCE_SERVICE_CIRCUIT_FAILURE_THRESHOLD",
+            ]), 5),
+        circuitResetTimeoutMs: config?.circuitResetTimeoutMs ??
+            parsePositiveInt(getEnvValue([
+                "GOVERNANCE_SERVICE_CIRCUIT_RESET_TIMEOUT_MS",
+                "MAESTRO_GOVERNANCE_SERVICE_CIRCUIT_RESET_TIMEOUT_MS",
+            ]), 30_000),
+        circuitSuccessThreshold: config?.circuitSuccessThreshold ??
+            parsePositiveInt(getEnvValue([
+                "GOVERNANCE_SERVICE_CIRCUIT_SUCCESS_THRESHOLD",
+                "MAESTRO_GOVERNANCE_SERVICE_CIRCUIT_SUCCESS_THRESHOLD",
+            ]), 2),
+        failureMode: required ? "required" : "optional",
+        maxAttempts: config?.maxAttempts ??
+            parsePositiveInt(getEnvValue([
+                "GOVERNANCE_SERVICE_MAX_ATTEMPTS",
+                "MAESTRO_GOVERNANCE_SERVICE_MAX_ATTEMPTS",
+            ]), DEFAULT_MAX_ATTEMPTS),
+        timeoutMs: config?.timeoutMs ??
+            parsePositiveInt(getEnvValue([
+                "GOVERNANCE_SERVICE_TIMEOUT_MS",
+                "MAESTRO_GOVERNANCE_SERVICE_TIMEOUT_MS",
+            ]), DEFAULT_TIMEOUT_MS),
+        token: trimString(config?.token) ??
+            getEnvValue([
+                "GOVERNANCE_SERVICE_TOKEN",
+                "MAESTRO_GOVERNANCE_SERVICE_TOKEN",
+                "MAESTRO_EVALOPS_ACCESS_TOKEN",
+                "EVALOPS_TOKEN",
+            ]) ??
+            storedToken,
+        workspaceId,
+    };
+}
+function getDownstreamClient(config, op) {
+    const failureMode = GOVERNANCE_CALL_FAILURE_MODES[op][config.failureMode];
+    const key = JSON.stringify({
+        baseUrl: config.baseUrl,
+        failureMode,
+        op,
+        reset: config.circuitResetTimeoutMs,
+        success: config.circuitSuccessThreshold,
+        threshold: config.circuitFailureThreshold,
+    });
+    const cached = downstreamClients.get(key);
+    if (cached) {
+        return cached;
+    }
+    const client = downstream.New(`governance.${op}`, {
+        failureMode,
+        breaker: {
+            failureThreshold: config.circuitFailureThreshold,
+            resetTimeoutMs: config.circuitResetTimeoutMs,
+            successThreshold: config.circuitSuccessThreshold,
+            toolName: `governance.${op}`,
+        },
+    });
+    downstreamClients.set(key, client);
+    return client;
+}
+function toHttpFailureMode(client) {
+    return client.failureMode === downstream.FailClosed ? "required" : "optional";
+}
+function buildHeaders(config) {
+    return {
+        ...(config.token ? { Authorization: `Bearer ${config.token}` } : {}),
+        "Connect-Protocol-Version": CONNECT_PROTOCOL_VERSION,
+        "Content-Type": "application/json",
+    };
+}
+function buildActionContext() {
+    const environment = getEnvValue([
+        "GOVERNANCE_SERVICE_ENVIRONMENT",
+        "NODE_ENV",
+    ]);
+    return environment ? { environment } : undefined;
+}
+function encodeActionPayload(context) {
+    return Buffer.from(JSON.stringify({
+        args: context.args,
+        metadata: context.metadata,
+        session: context.session
+            ? {
+                id: context.session.id,
+                startedAt: context.session.startedAt.toISOString(),
+            }
+            : undefined,
+        toolName: context.toolName,
+        user: context.user,
+        userIntent: context.userIntent,
+    }), "utf8").toString("base64");
+}
+function normalizeDecision(decision) {
+    switch (decision) {
+        case "ACTION_DECISION_ALLOW":
+        case "allow":
+        case 1:
+            return "allow";
+        case "ACTION_DECISION_DENY":
+        case "deny":
+        case 2:
+            return "block";
+        case "ACTION_DECISION_REQUIRE_APPROVAL":
+        case "require_approval":
+        case 3:
+            return "require_approval";
+        default:
+            throw new Error("governance service response did not include a decision");
+    }
+}
+function normalizeStringArray(value) {
+    return Array.isArray(value)
+        ? value.map((item) => item.trim()).filter((item) => item.length > 0)
+        : [];
+}
+function normalizeEvaluationResponse(payload) {
+    const evaluation = payload.evaluation;
+    if (!evaluation) {
+        throw new Error("governance service response did not include evaluation");
+    }
+    const action = normalizeDecision(evaluation.decision);
+    if (action === "allow") {
+        return { action };
+    }
+    const reasons = normalizeStringArray(evaluation.reasons);
+    const matchedRules = normalizeStringArray(evaluation.matchedRules);
+    const ruleId = matchedRules[0] ?? "governance-service";
+    const reason = reasons.join("; ") || "Action denied by governance service";
+    if (action === "block") {
+        return {
+            action,
+            ruleId,
+            reason,
+        };
+    }
+    return {
+        action: "require_approval",
+        ruleId,
+        reason,
+    };
+}
+export async function evaluateActionWithActionFirewallGovernanceService(config, context) {
+    const client = getDownstreamClient(config, "evaluateAction");
+    return downstream.CallOp(client, "evaluateAction", async () => {
+        const response = await fetchDownstream(`${config.baseUrl}${EVALUATE_ACTION_PATH}`, {
+            method: "POST",
+            headers: buildHeaders(config),
+            body: JSON.stringify({
+                workspaceId: config.workspaceId,
+                agentId: config.agentId,
+                actionType: context.toolName,
+                actionPayload: encodeActionPayload(context),
+                context: buildActionContext(),
+            }),
+        }, {
+            serviceName: "governance service",
+            failureMode: toHttpFailureMode(client),
+            timeoutMs: config.timeoutMs,
+            maxAttempts: config.maxAttempts,
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            throw new Error(`governance service returned ${response.status}: ${text || response.statusText}`);
+        }
+        return normalizeEvaluationResponse((await response.json()));
+    }, () => null);
+}
+export function resetActionFirewallGovernanceDownstreamForTests() {
+    downstreamClients.clear();
+}
+//# sourceMappingURL=governance-service-client.js.map

package/dist/safety/governance-service-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-service-client.js","sourceRoot":"","sources":["../../src/safety/governance-service-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAKrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,eAAe,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAErD,MAAM,gBAAgB,GAAG,SAAS,CAAC;AACnC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,oBAAoB,GAAG,yBAAyB,CACrD,wBAAwB,CAAC,UAAU,CAAC,cAAc,CAClD,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC5C,cAAc,EAAE;QACf,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,UAAU;KAC/B;CACQ,CAAC;AAsCX,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAuC,CAAC;AAEzE,SAAS,UAAU,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACxC,IAAI,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,MAAM,IAAI;QACpB,oBAAoB;QACpB,0BAA0B,CAAC,yBAAyB,CAAC,UAAU,CAAC;KAChE,EAAE,CAAC;QACH,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,UAAU,GAAG,oBAAoB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAyD,EACzD,OAA8B;IAE9B,MAAM,qBAAqB,GAAG,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,iCAAiC;QACjC,iCAAiC;QACjC,8BAA8B;QAC9B,sBAAsB;QACtB,wBAAwB;QACxB,yBAAyB;QACzB,2BAA2B;KAC3B,CAAC,CAAC;IACH,IACC,qBAAqB;QACrB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;QAC/B,cAAc,EACb,CAAC;QACF,OAAO,CACN,qBAAqB,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,cAAc,CAC1E,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC;IACzE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC5D,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACf,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC3D,MAAiE,EACjE,OAA8B;IAE9B,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GACZ,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC;QAC3B,WAAW,CAAC;YACX,wBAAwB;YACxB,gCAAgC;YAChC,2BAA2B;YAC3B,0BAA0B;YAC1B,kBAAkB;SAClB,CAAC,CAAC;IACJ,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,QAAQ,GACb,MAAM,EAAE,QAAQ;QAChB,WAAW,CAAC;YACX,6BAA6B;YAC7B,qCAAqC;SACrC,CAAC,KAAK,GAAG,CAAC;IAEZ,OAAO;QACN,OAAO,EACN,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3B,WAAW,CAAC;gBACX,6BAA6B;gBAC7B,6BAA6B;gBAC7B,0BAA0B;gBAC1B,kBAAkB;aAClB,CAAC;YACF,gBAAgB;QACjB,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAClC,uBAAuB,EACtB,MAAM,EAAE,uBAAuB;YAC/B,gBAAgB,CACf,WAAW,CAAC;gBACX,8CAA8C;gBAC9C,sDAAsD;aACtD,CAAC,EACF,CAAC,CACD;QACF,qBAAqB,EACpB,MAAM,EAAE,qBAAqB;YAC7B,gBAAgB,CACf,WAAW,CAAC;gBACX,6CAA6C;gBAC7C,qDAAqD;aACrD,CAAC,EACF,MAAM,CACN;QACF,uBAAuB,EACtB,MAAM,EAAE,uBAAuB;YAC/B,gBAAgB,CACf,WAAW,CAAC;gBACX,8CAA8C;gBAC9C,sDAAsD;aACtD,CAAC,EACF,CAAC,CACD;QACF,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;QAC/C,WAAW,EACV,MAAM,EAAE,WAAW;YACnB,gBAAgB,CACf,WAAW,CAAC;gBACX,iCAAiC;gBACjC,yCAAyC;aACzC,CAAC,EACF,oBAAoB,CACpB;QACF,SAAS,EACR,MAAM,EAAE,SAAS;YACjB,gBAAgB,CACf,WAAW,CAAC;gBACX,+BAA+B;gBAC/B,uCAAuC;aACvC,CAAC,EACF,kBAAkB,CAClB;QACF,KAAK,EACJ,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC;YACzB,WAAW,CAAC;gBACX,0BAA0B;gBAC1B,kCAAkC;gBAClC,8BAA8B;gBAC9B,eAAe;aACf,CAAC;YACF,WAAW;QACZ,WAAW;KACX,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC3B,MAAqD,EACrD,EAAkB;IAElB,MAAM,WAAW,GAAG,6BAA6B,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW;QACX,EAAE;QACF,KAAK,EAAE,MAAM,CAAC,qBAAqB;QACnC,OAAO,EAAE,MAAM,CAAC,uBAAuB;QACvC,SAAS,EAAE,MAAM,CAAC,uBAAuB;KACzC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE;QACjD,WAAW;QACX,OAAO,EAAE;YACR,gBAAgB,EAAE,MAAM,CAAC,uBAAuB;YAChD,cAAc,EAAE,MAAM,CAAC,qBAAqB;YAC5C,gBAAgB,EAAE,MAAM,CAAC,uBAAuB;YAChD,QAAQ,EAAE,cAAc,EAAE,EAAE;SAC5B;KACD,CAAC,CAAC;IACH,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACzB,MAAmC;IAEnC,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CACpB,MAAqD;IAErD,OAAO;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,0BAA0B,EAAE,wBAAwB;QACpD,cAAc,EAAE,kBAAkB;KAClC,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB;IAC1B,MAAM,WAAW,GAAG,WAAW,CAAC;QAC/B,gCAAgC;QAChC,UAAU;KACV,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA8B;IAC1D,OAAO,MAAM,CAAC,IAAI,CACjB,IAAI,CAAC,SAAS,CAAC;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACvB,CAAC,CAAC;gBACA,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;gBACtB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;aAClD;YACF,CAAC,CAAC,SAAS;QACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC9B,CAAC,EACF,MAAM,CACN,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CACzB,QAAqC;IAErC,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,uBAAuB,CAAC;QAC7B,KAAK,OAAO,CAAC;QACb,KAAK,CAAC;YACL,OAAO,OAAO,CAAC;QAChB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,MAAM,CAAC;QACZ,KAAK,CAAC;YACL,OAAO,OAAO,CAAC;QAChB,KAAK,kCAAkC,CAAC;QACxC,KAAK,kBAAkB,CAAC;QACxB,KAAK,CAAC;YACL,OAAO,kBAAkB,CAAC;QAC3B;YACC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2B;IACxD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,2BAA2B,CACnC,OAA+B;IAE/B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,oBAAoB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qCAAqC,CAAC;IAC3E,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO;YACN,MAAM;YACN,MAAM;YACN,MAAM;SACN,CAAC;IACH,CAAC;IACD,OAAO;QACN,MAAM,EAAE,kBAAkB;QAC1B,MAAM;QACN,MAAM;KACN,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iDAAiD,CACtE,MAAqD,EACrD,OAA8B;IAE9B,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC,MAAM,CACvB,MAAM,EACN,gBAAgB,EAChB,KAAK,IAAI,EAAE;QACV,MAAM,QAAQ,GAAG,MAAM,eAAe,CACrC,GAAG,MAAM,CAAC,OAAO,GAAG,oBAAoB,EAAE,EAC1C;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,UAAU,EAAE,OAAO,CAAC,QAAQ;gBAC5B,aAAa,EAAE,mBAAmB,CAAC,OAAO,CAAC;gBAC3C,OAAO,EAAE,kBAAkB,EAAE;aAC7B,CAAC;SACF,EACD;YACC,WAAW,EAAE,oBAAoB;YACjC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;YACtC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;SAC/B,CACD,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACd,+BAA+B,QAAQ,CAAC,MAAM,KAC7C,IAAI,IAAI,QAAQ,CAAC,UAClB,EAAE,CACF,CAAC;QACH,CAAC;QAED,OAAO,2BAA2B,CACjC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CACjD,CAAC;IACH,CAAC,EACD,GAAG,EAAE,CAAC,IAAI,CACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+CAA+C;IAC9D,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["import { Buffer } from \"node:buffer\";\nimport type {\n\tActionApprovalContext,\n\tActionFirewallVerdict,\n} from \"../agent/action-approval.js\";\nimport { loadOAuthCredentials } from \"../oauth/storage.js\";\nimport { CONNECT_PROTOCOL_VERSION } from \"../platform/client.js\";\nimport {\n\tPLATFORM_CONNECT_METHODS,\n\tPLATFORM_CONNECT_SERVICES,\n\tplatformConnectMethodPath,\n\tplatformConnectServicePath,\n} from \"../platform/core-services.js\";\nimport {\n\ttype DownstreamFailureMode as DownstreamHttpFailureMode,\n\tfetchDownstream,\n} from \"../utils/downstream-http.js\";\nimport * as downstream from \"../utils/downstream.js\";\n\nconst DEFAULT_AGENT_ID = \"maestro\";\nconst DEFAULT_MAX_ATTEMPTS = 2;\nconst DEFAULT_TIMEOUT_MS = 2_000;\nconst EVALUATE_ACTION_PATH = platformConnectMethodPath(\n\tPLATFORM_CONNECT_METHODS.governance.evaluateAction,\n);\n\nexport const GOVERNANCE_CALL_FAILURE_MODES = {\n\tevaluateAction: {\n\t\toptional: downstream.FailOpen,\n\t\trequired: downstream.FailClosed,\n\t},\n} as const;\n\ntype GovernanceCall = keyof typeof GOVERNANCE_CALL_FAILURE_MODES;\n\nexport interface ActionFirewallGovernanceServiceConfig {\n\tbaseUrl?: string;\n\ttoken?: string;\n\tworkspaceId?: string;\n\tagentId?: string;\n\ttimeoutMs?: number;\n\tmaxAttempts?: number;\n\tcircuitFailureThreshold?: number;\n\tcircuitResetTimeoutMs?: number;\n\tcircuitSuccessThreshold?: number;\n\trequired?: boolean;\n}\n\nexport interface ResolvedActionFirewallGovernanceServiceConfig {\n\tbaseUrl: string;\n\ttoken?: string;\n\tworkspaceId: string;\n\tagentId: string;\n\ttimeoutMs: number;\n\tmaxAttempts: number;\n\tcircuitFailureThreshold: number;\n\tcircuitResetTimeoutMs: number;\n\tcircuitSuccessThreshold: number;\n\tfailureMode: DownstreamHttpFailureMode;\n}\n\ninterface EvaluateActionResponse {\n\tevaluation?: {\n\t\tdecision?: string | number;\n\t\treasons?: string[];\n\t\tmatchedRules?: string[];\n\t};\n}\n\nconst downstreamClients = new Map<string, downstream.DownstreamClient>();\n\nfunction trimString(value: string | undefined): string | undefined {\n\tconst trimmed = value?.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\nfunction getEnvValue(names: string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = trimString(process.env[name]);\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction parsePositiveInt(value: string | undefined, fallback: number): number {\n\tconst parsed = Number.parseInt(value ?? \"\", 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\nfunction stripTrailingSlashes(value: string): string {\n\treturn value.replace(/\\/+$/, \"\");\n}\n\nfunction normalizeBaseUrl(baseUrl: string): string {\n\tlet normalized = stripTrailingSlashes(baseUrl.trim());\n\tfor (const suffix of [\n\t\tEVALUATE_ACTION_PATH,\n\t\tplatformConnectServicePath(PLATFORM_CONNECT_SERVICES.governance),\n\t]) {\n\t\tif (normalized.endsWith(suffix)) {\n\t\t\tnormalized = stripTrailingSlashes(normalized.slice(0, -suffix.length));\n\t\t}\n\t}\n\treturn normalized;\n}\n\nfunction resolveWorkspaceId(\n\tconfig: ActionFirewallGovernanceServiceConfig | undefined,\n\tcontext: ActionApprovalContext,\n): string | undefined {\n\tconst configuredWorkspaceId = trimString(config?.workspaceId);\n\tconst envWorkspaceId = getEnvValue([\n\t\t\"GOVERNANCE_SERVICE_WORKSPACE_ID\",\n\t\t\"MAESTRO_GOVERNANCE_WORKSPACE_ID\",\n\t\t\"MAESTRO_EVALOPS_WORKSPACE_ID\",\n\t\t\"MAESTRO_WORKSPACE_ID\",\n\t\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\t\"EVALOPS_ORGANIZATION_ID\",\n\t\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n\t]);\n\tif (\n\t\tconfiguredWorkspaceId ??\n\t\ttrimString(context.user?.orgId) ??\n\t\tenvWorkspaceId\n\t) {\n\t\treturn (\n\t\t\tconfiguredWorkspaceId ?? trimString(context.user?.orgId) ?? envWorkspaceId\n\t\t);\n\t}\n\n\tconst stored = loadOAuthCredentials(\"evalops\")?.metadata?.organizationId;\n\treturn typeof stored === \"string\" && stored.trim().length > 0\n\t\t? stored.trim()\n\t\t: undefined;\n}\n\nexport function resolveActionFirewallGovernanceServiceConfig(\n\tconfig: ActionFirewallGovernanceServiceConfig | false | undefined,\n\tcontext: ActionApprovalContext,\n): ResolvedActionFirewallGovernanceServiceConfig | null {\n\tif (config === false) {\n\t\treturn null;\n\t}\n\n\tconst baseUrl =\n\t\ttrimString(config?.baseUrl) ??\n\t\tgetEnvValue([\n\t\t\t\"GOVERNANCE_SERVICE_URL\",\n\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_URL\",\n\t\t\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\t\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\t\t\"EVALOPS_BASE_URL\",\n\t\t]);\n\tif (!baseUrl) {\n\t\treturn null;\n\t}\n\n\tconst workspaceId = resolveWorkspaceId(config, context);\n\tif (!workspaceId) {\n\t\treturn null;\n\t}\n\n\tconst storedToken = trimString(loadOAuthCredentials(\"evalops\")?.access);\n\tconst required =\n\t\tconfig?.required ??\n\t\tgetEnvValue([\n\t\t\t\"GOVERNANCE_SERVICE_REQUIRED\",\n\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_REQUIRED\",\n\t\t]) === \"1\";\n\n\treturn {\n\t\tagentId:\n\t\t\ttrimString(config?.agentId) ??\n\t\t\tgetEnvValue([\n\t\t\t\t\"GOVERNANCE_SERVICE_AGENT_ID\",\n\t\t\t\t\"MAESTRO_GOVERNANCE_AGENT_ID\",\n\t\t\t\t\"MAESTRO_EVALOPS_AGENT_ID\",\n\t\t\t\t\"MAESTRO_AGENT_ID\",\n\t\t\t]) ??\n\t\t\tDEFAULT_AGENT_ID,\n\t\tbaseUrl: normalizeBaseUrl(baseUrl),\n\t\tcircuitFailureThreshold:\n\t\t\tconfig?.circuitFailureThreshold ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_CIRCUIT_FAILURE_THRESHOLD\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_CIRCUIT_FAILURE_THRESHOLD\",\n\t\t\t\t]),\n\t\t\t\t5,\n\t\t\t),\n\t\tcircuitResetTimeoutMs:\n\t\t\tconfig?.circuitResetTimeoutMs ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_CIRCUIT_RESET_TIMEOUT_MS\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_CIRCUIT_RESET_TIMEOUT_MS\",\n\t\t\t\t]),\n\t\t\t\t30_000,\n\t\t\t),\n\t\tcircuitSuccessThreshold:\n\t\t\tconfig?.circuitSuccessThreshold ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_CIRCUIT_SUCCESS_THRESHOLD\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_CIRCUIT_SUCCESS_THRESHOLD\",\n\t\t\t\t]),\n\t\t\t\t2,\n\t\t\t),\n\t\tfailureMode: required ? \"required\" : \"optional\",\n\t\tmaxAttempts:\n\t\t\tconfig?.maxAttempts ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_MAX_ATTEMPTS\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_MAX_ATTEMPTS\",\n\t\t\t\t]),\n\t\t\t\tDEFAULT_MAX_ATTEMPTS,\n\t\t\t),\n\t\ttimeoutMs:\n\t\t\tconfig?.timeoutMs ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_TIMEOUT_MS\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_TIMEOUT_MS\",\n\t\t\t\t]),\n\t\t\t\tDEFAULT_TIMEOUT_MS,\n\t\t\t),\n\t\ttoken:\n\t\t\ttrimString(config?.token) ??\n\t\t\tgetEnvValue([\n\t\t\t\t\"GOVERNANCE_SERVICE_TOKEN\",\n\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_TOKEN\",\n\t\t\t\t\"MAESTRO_EVALOPS_ACCESS_TOKEN\",\n\t\t\t\t\"EVALOPS_TOKEN\",\n\t\t\t]) ??\n\t\t\tstoredToken,\n\t\tworkspaceId,\n\t};\n}\n\nfunction getDownstreamClient(\n\tconfig: ResolvedActionFirewallGovernanceServiceConfig,\n\top: GovernanceCall,\n): downstream.DownstreamClient {\n\tconst failureMode = GOVERNANCE_CALL_FAILURE_MODES[op][config.failureMode];\n\tconst key = JSON.stringify({\n\t\tbaseUrl: config.baseUrl,\n\t\tfailureMode,\n\t\top,\n\t\treset: config.circuitResetTimeoutMs,\n\t\tsuccess: config.circuitSuccessThreshold,\n\t\tthreshold: config.circuitFailureThreshold,\n\t});\n\tconst cached = downstreamClients.get(key);\n\tif (cached) {\n\t\treturn cached;\n\t}\n\tconst client = downstream.New(`governance.${op}`, {\n\t\tfailureMode,\n\t\tbreaker: {\n\t\t\tfailureThreshold: config.circuitFailureThreshold,\n\t\t\tresetTimeoutMs: config.circuitResetTimeoutMs,\n\t\t\tsuccessThreshold: config.circuitSuccessThreshold,\n\t\t\ttoolName: `governance.${op}`,\n\t\t},\n\t});\n\tdownstreamClients.set(key, client);\n\treturn client;\n}\n\nfunction toHttpFailureMode(\n\tclient: downstream.DownstreamClient,\n): DownstreamHttpFailureMode {\n\treturn client.failureMode === downstream.FailClosed ? \"required\" : \"optional\";\n}\n\nfunction buildHeaders(\n\tconfig: ResolvedActionFirewallGovernanceServiceConfig,\n): Record<string, string> {\n\treturn {\n\t\t...(config.token ? { Authorization: `Bearer ${config.token}` } : {}),\n\t\t\"Connect-Protocol-Version\": CONNECT_PROTOCOL_VERSION,\n\t\t\"Content-Type\": \"application/json\",\n\t};\n}\n\nfunction buildActionContext(): Record<string, string> | undefined {\n\tconst environment = getEnvValue([\n\t\t\"GOVERNANCE_SERVICE_ENVIRONMENT\",\n\t\t\"NODE_ENV\",\n\t]);\n\treturn environment ? { environment } : undefined;\n}\n\nfunction encodeActionPayload(context: ActionApprovalContext): string {\n\treturn Buffer.from(\n\t\tJSON.stringify({\n\t\t\targs: context.args,\n\t\t\tmetadata: context.metadata,\n\t\t\tsession: context.session\n\t\t\t\t? {\n\t\t\t\t\t\tid: context.session.id,\n\t\t\t\t\t\tstartedAt: context.session.startedAt.toISOString(),\n\t\t\t\t\t}\n\t\t\t\t: undefined,\n\t\t\ttoolName: context.toolName,\n\t\t\tuser: context.user,\n\t\t\tuserIntent: context.userIntent,\n\t\t}),\n\t\t\"utf8\",\n\t).toString(\"base64\");\n}\n\nfunction normalizeDecision(\n\tdecision: string | number | undefined,\n): ActionFirewallVerdict[\"action\"] {\n\tswitch (decision) {\n\t\tcase \"ACTION_DECISION_ALLOW\":\n\t\tcase \"allow\":\n\t\tcase 1:\n\t\t\treturn \"allow\";\n\t\tcase \"ACTION_DECISION_DENY\":\n\t\tcase \"deny\":\n\t\tcase 2:\n\t\t\treturn \"block\";\n\t\tcase \"ACTION_DECISION_REQUIRE_APPROVAL\":\n\t\tcase \"require_approval\":\n\t\tcase 3:\n\t\t\treturn \"require_approval\";\n\t\tdefault:\n\t\t\tthrow new Error(\"governance service response did not include a decision\");\n\t}\n}\n\nfunction normalizeStringArray(value: string[] | undefined): string[] {\n\treturn Array.isArray(value)\n\t\t? value.map((item) => item.trim()).filter((item) => item.length > 0)\n\t\t: [];\n}\n\nfunction normalizeEvaluationResponse(\n\tpayload: EvaluateActionResponse,\n): ActionFirewallVerdict {\n\tconst evaluation = payload.evaluation;\n\tif (!evaluation) {\n\t\tthrow new Error(\"governance service response did not include evaluation\");\n\t}\n\n\tconst action = normalizeDecision(evaluation.decision);\n\tif (action === \"allow\") {\n\t\treturn { action };\n\t}\n\n\tconst reasons = normalizeStringArray(evaluation.reasons);\n\tconst matchedRules = normalizeStringArray(evaluation.matchedRules);\n\tconst ruleId = matchedRules[0] ?? \"governance-service\";\n\tconst reason = reasons.join(\"; \") || \"Action denied by governance service\";\n\tif (action === \"block\") {\n\t\treturn {\n\t\t\taction,\n\t\t\truleId,\n\t\t\treason,\n\t\t};\n\t}\n\treturn {\n\t\taction: \"require_approval\",\n\t\truleId,\n\t\treason,\n\t};\n}\n\nexport async function evaluateActionWithActionFirewallGovernanceService(\n\tconfig: ResolvedActionFirewallGovernanceServiceConfig,\n\tcontext: ActionApprovalContext,\n): Promise<ActionFirewallVerdict | null> {\n\tconst client = getDownstreamClient(config, \"evaluateAction\");\n\treturn downstream.CallOp(\n\t\tclient,\n\t\t\"evaluateAction\",\n\t\tasync () => {\n\t\t\tconst response = await fetchDownstream(\n\t\t\t\t`${config.baseUrl}${EVALUATE_ACTION_PATH}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: \"POST\",\n\t\t\t\t\theaders: buildHeaders(config),\n\t\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\t\tworkspaceId: config.workspaceId,\n\t\t\t\t\t\tagentId: config.agentId,\n\t\t\t\t\t\tactionType: context.toolName,\n\t\t\t\t\t\tactionPayload: encodeActionPayload(context),\n\t\t\t\t\t\tcontext: buildActionContext(),\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tserviceName: \"governance service\",\n\t\t\t\t\tfailureMode: toHttpFailureMode(client),\n\t\t\t\t\ttimeoutMs: config.timeoutMs,\n\t\t\t\t\tmaxAttempts: config.maxAttempts,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\tif (!response.ok) {\n\t\t\t\tconst text = await response.text();\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`governance service returned ${response.status}: ${\n\t\t\t\t\t\ttext || response.statusText\n\t\t\t\t\t}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn normalizeEvaluationResponse(\n\t\t\t\t(await response.json()) as EvaluateActionResponse,\n\t\t\t);\n\t\t},\n\t\t() => null,\n\t);\n}\n\nexport function resetActionFirewallGovernanceDownstreamForTests(): void {\n\tdownstreamClients.clear();\n}\n"]}

package/dist/safety/policy.d.ts

@@ -7,8 +7,11 @@
  *
  * ## Policy File Location
  *
- * Policies are loaded from `~/.maestro/policy.json`. This file is typically
- * deployed by enterprise IT and should be protected with appropriate permissions.
+ * Policies are loaded from `~/.maestro/policy.json` (or the legacy Composer
+ * policy file as a fallback) and `.maestro/workspace.toml` in the current
+ * workspace. The global JSON file is typically deployed by enterprise IT and
+ * should be protected with appropriate permissions. Workspace TOML applies a
+ * stricter project-specific layer.
  *
  * ## Policy Structure
  *
@@ -41,6 +44,9 @@
  * }
  * ```
  *
+ * Workspace policies use TOML keys such as `allowed_models`, `blocked_tools`,
+ * `file_boundaries`, and `max_tokens_per_session`.
+ *
  * ## Rule Evaluation
  *
  * Policies use an allow/block list pattern with the following evaluation order:
@@ -119,6 +125,11 @@ export interface EnterprisePolicy {
         /** Blacklist of blocked model patterns */
         blocked?: string[];
     };
+    /** Required skill names for workspace-controlled workflows */
+    skills?: {
+        /** Skills that must be available for this workspace */
+        required?: string[];
+    };
     /** File system path restrictions */
     paths?: {
         /** Whitelist of allowed path patterns (e.g., "/home/user/projects/**") */

package/dist/safety/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAWH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAiBzE;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,sEAAsE;IACtE,KAAK,CAAC,EAAE;QACP,gEAAgE;QAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,sEAAsE;QACtE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,mDAAmD;IACnD,YAAY,CAAC,EAAE;QACd,4CAA4C;QAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,4CAA4C;QAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,8DAA8D;IAC9D,MAAM,CAAC,EAAE;QACR,gEAAgE;QAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,0CAA0C;QAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,oCAAoC;IACpC,KAAK,CAAC,EAAE;QACP,0EAA0E;QAC1E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,2DAA2D;QAC3D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,kCAAkC;IAClC,OAAO,CAAC,EAAE;QACT,8DAA8D;QAC9D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,+DAA+D;QAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,iDAAiD;QACjD,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,uEAAuE;QACvE,eAAe,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QACR,oDAAoD;QACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,0CAA0C;QAC1C,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,yCAAyC;QACzC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;CACF;AAkFD,wBAAgB,UAAU,CAAC,KAAK,UAAQ,GAAG,gBAAgB,GAAG,IAAI,CAwCjE;AA0BD,wBAAsB,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC1E,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAoJD;AAED,qBAAa,WAAY,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAgBA;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,EAC5B,KAAK,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D;IACF,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAmEA;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,IAAI,CASnE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,gBAAgB,GAAG,IAAI,CAM1D"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAYH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAmBzE;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,sEAAsE;IACtE,KAAK,CAAC,EAAE;QACP,gEAAgE;QAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,sEAAsE;QACtE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,mDAAmD;IACnD,YAAY,CAAC,EAAE;QACd,4CAA4C;QAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,4CAA4C;QAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,8DAA8D;IAC9D,MAAM,CAAC,EAAE;QACR,gEAAgE;QAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,0CAA0C;QAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,8DAA8D;IAC9D,MAAM,CAAC,EAAE;QACR,uDAAuD;QACvD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IAEF,oCAAoC;IACpC,KAAK,CAAC,EAAE;QACP,0EAA0E;QAC1E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,2DAA2D;QAC3D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,kCAAkC;IAClC,OAAO,CAAC,EAAE;QACT,8DAA8D;QAC9D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,+DAA+D;QAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,iDAAiD;QACjD,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,uEAAuE;QACvE,eAAe,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QACR,oDAAoD;QACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,0CAA0C;QAC1C,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,yCAAyC;QACzC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;CACF;AAimBD,wBAAgB,UAAU,CAAC,KAAK,UAAQ,GAAG,gBAAgB,GAAG,IAAI,CAgDjE;AAoGD,wBAAsB,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC1E,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAuBD;AAqJD,qBAAa,WAAY,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CA0BA;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,EAC5B,KAAK,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D;IACF,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAmEA;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,IAAI,CASnE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,gBAAgB,GAAG,IAAI,CAM1D"}