@gaunt-sloth/core 2.0.0-alpha.8 → 2.0.0-beta.0

package/dist/core/shell/allowlist.d.ts

@@ -1,75 +0,0 @@
-import type { ToolApprovalScope } from '#src/core/types.js';
-/**
- * Approval persistence scopes, widest-lived last. Alias of the canonical
- * {@link ToolApprovalScope} so the allow-list engine and the decision vocabulary stay in sync.
- */
-export type ApprovalScope = ToolApprovalScope;
-/**
- * Decide whether a candidate argv contains a flag that *widens* the approved operation.
- *
- * Rule implemented (documented for the coordinator):
- *  - Re-derive the meaningful prefix from the candidate's actual argv.
- *  - Inspect every token of the candidate that is a flag (starts with `-`).
- *  - If any flag token — normalized by stripping a trailing `=value` and lowercasing —
- *    is in {@link WIDENING_FLAGS}, the command is considered a widening of the approved
- *    operation and the match is REFUSED (returns true).
- *
- * This is purposely a deny-list of operation-changing flags rather than an allow-list of
- * benign flags: benign flag variants (`-b`, `--oneline`, `-la`) are exactly what we WANT
- * to keep auto-approving, while the handful of "run-an-arbitrary-program / redirect-the-
- * transport" flags are what an injected approval must never silently enable.
- */
-export declare function hasWideningFlag(argv: string[]): boolean;
-/**
- * A holder of approved prefixes with set semantics. Used for both the in-memory session
- * store and the loaded persisted store. Pure data + membership; persistence is layered on
- * top by {@link PersistedAllowlist}.
- */
-export declare class AllowlistStore {
-    private readonly prefixes;
-    constructor(initial?: Iterable<string>);
-    has(prefix: string): boolean;
-    add(prefix: string): void;
-    list(): string[];
-}
-/**
- * The persisted (`always`) allow-list, backed by a JSON file. The path is injected (the
- * runner resolves it via fileUtils → `.gsloth/.gsloth-settings/shell-allowlist.json`) so
- * tests can point it at a temp dir. Loads lazily/defensively: a missing or malformed file
- * yields an empty store rather than throwing (fail-open on READ is safe — an empty
- * allow-list just means "prompt"; it never auto-approves anything).
- */
-export declare class PersistedAllowlist {
-    private readonly store;
-    private readonly filePath;
-    constructor(filePath: string);
-    private static load;
-    has(prefix: string): boolean;
-    list(): string[];
-    /** Add a prefix and persist the whole set to disk. */
-    add(prefix: string): void;
-    private persist;
-}
-/**
- * Read-only view over the stores consulted for an auto-approval check. The runner passes
- * its per-instance session store and (optionally) the persisted store.
- */
-export interface ApprovalStores {
-    session: Pick<AllowlistStore, 'has'>;
-    always?: Pick<PersistedAllowlist, 'has'>;
-}
-/**
- * Decide whether `command` is already approved by the given stores — the gate the runner
- * consults BEFORE prompting the human.
- *
- * Returns true ONLY when ALL of the following hold:
- *  1. {@link classifyCommand} returns a non-null classification (so composition /
- *     substitution / redirection commands can never match — anti-injection layer 1);
- *  2. the classified prefix is present in the session OR persisted (`always`) store; AND
- *  3. the safe-bin re-validation passes: the candidate's actual argv contains no
- *     operation-widening flag (anti-injection layer 2 — see {@link hasWideningFlag}).
- *
- * Anything else (unclassifiable, unknown prefix, or a widening flag) → false → the human
- * is prompted. Fail-closed by construction.
- */
-export declare function matchesApproval(command: string, stores: ApprovalStores): boolean;

package/dist/core/shell/allowlist.js

@@ -1,187 +0,0 @@
-/**
- * @module core/shell/allowlist
- *
- * EXT-9 Tier-2: the persisted + session-scoped allow-list engine for the opt-in
- * `run_shell_command` tool. Once a human approves a command at `session` or `always`
- * scope, future commands with the same classified prefix ({@link classifyCommand}) are
- * auto-approved without re-prompting — the ergonomics improvement mature agents
- * (opencode/openclaw/hermes) ship.
- *
- * SECURITY — a naive "remember the prefix" allow-list is an injection vector. Two layers
- * guard it:
- *  1. **Classification fail-closed** (arity.ts): any command with shell composition,
- *     substitution, or redirection returns `null` and can NEVER match, so
- *     `git checkout x; rm -rf /` does not ride an approved `git checkout *`.
- *  2. **Safe-bin anti-widening re-validation** (here, after opencode/openclaw): a stored
- *     approval is matched ONLY if the candidate command's first non-flag operand region
- *     does not introduce a flag that *widens or redirects* the approved operation. The
- *     exact rule is documented on {@link matchesApproval} / {@link hasWideningFlag}.
- *
- * No module-global mutable state: the session store is a per-instance class so concurrent
- * sessions (ACP / AG-UI multi-session) cannot stomp each other. The persisted (`always`)
- * store is a small JSON file the runner loads once per instance.
- */
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
-import { classifyCommand, tokenize } from '#src/core/shell/arity.js';
-import { normalizeCommand } from '#src/core/shell/normalize.js';
-const PERSISTED_VERSION = 1;
-/**
- * Flags that, if present in a candidate command but not implied by the approved prefix,
- * could change the *operation* the human approved (point it at a different transport,
- * exec a hook, follow an attacker-controlled URL). Approving `git clone` must not
- * green-light `git clone --upload-pack=evil`. This list is intentionally conservative:
- * it is the openclaw "safe-bin" idea reduced to a deny-set of operation-changing flags
- * that commonly appear in shell-injection / supply-chain abuse.
- *
- * Matched against the flag token with any `=value` stripped, case-insensitively.
- */
-const WIDENING_FLAGS = new Set([
-    // git: remote command / hook overrides.
-    '--upload-pack',
-    '--receive-pack',
-    '--exec',
-    '-u', // git clone -u <upload-pack>
-    '--config', // git -c is the short form; --config can inject core.sshCommand etc.
-    '-c', // git -c core.sshCommand='...' — arbitrary command execution
-    // generic "run this program" escape hatches across tools.
-    '--exec-path',
-    '-exec', // find -exec <cmd>
-    '--use-askpass',
-    '--ssh-command',
-    // package managers: lifecycle-script / arbitrary-script toggles.
-    '--unsafe-perm',
-    '--ignore-scripts=false',
-    '--allow-scripts',
-    // curl/wget style follow/exec (in case a bare binary is approved).
-    '-o', // write to arbitrary path
-    '--output',
-    '-T', // upload
-    '--upload-file',
-]);
-/**
- * Decide whether a candidate argv contains a flag that *widens* the approved operation.
- *
- * Rule implemented (documented for the coordinator):
- *  - Re-derive the meaningful prefix from the candidate's actual argv.
- *  - Inspect every token of the candidate that is a flag (starts with `-`).
- *  - If any flag token — normalized by stripping a trailing `=value` and lowercasing —
- *    is in {@link WIDENING_FLAGS}, the command is considered a widening of the approved
- *    operation and the match is REFUSED (returns true).
- *
- * This is purposely a deny-list of operation-changing flags rather than an allow-list of
- * benign flags: benign flag variants (`-b`, `--oneline`, `-la`) are exactly what we WANT
- * to keep auto-approving, while the handful of "run-an-arbitrary-program / redirect-the-
- * transport" flags are what an injected approval must never silently enable.
- */
-export function hasWideningFlag(argv) {
-    for (const tok of argv) {
-        if (!tok.startsWith('-'))
-            continue;
-        const bare = tok.split('=', 1)[0].toLowerCase();
-        if (WIDENING_FLAGS.has(bare))
-            return true;
-    }
-    return false;
-}
-/**
- * A holder of approved prefixes with set semantics. Used for both the in-memory session
- * store and the loaded persisted store. Pure data + membership; persistence is layered on
- * top by {@link PersistedAllowlist}.
- */
-export class AllowlistStore {
-    prefixes;
-    constructor(initial = []) {
-        this.prefixes = new Set(initial);
-    }
-    has(prefix) {
-        return this.prefixes.has(prefix);
-    }
-    add(prefix) {
-        this.prefixes.add(prefix);
-    }
-    list() {
-        return [...this.prefixes];
-    }
-}
-/**
- * The persisted (`always`) allow-list, backed by a JSON file. The path is injected (the
- * runner resolves it via fileUtils → `.gsloth/.gsloth-settings/shell-allowlist.json`) so
- * tests can point it at a temp dir. Loads lazily/defensively: a missing or malformed file
- * yields an empty store rather than throwing (fail-open on READ is safe — an empty
- * allow-list just means "prompt"; it never auto-approves anything).
- */
-export class PersistedAllowlist {
-    store;
-    filePath;
-    constructor(filePath) {
-        this.filePath = filePath;
-        this.store = new AllowlistStore(PersistedAllowlist.load(filePath));
-    }
-    static load(filePath) {
-        try {
-            if (!existsSync(filePath))
-                return [];
-            const raw = readFileSync(filePath, 'utf8');
-            const parsed = JSON.parse(raw);
-            if (!parsed || !Array.isArray(parsed.prefixes))
-                return [];
-            return parsed.prefixes.filter((p) => typeof p === 'string');
-        }
-        catch {
-            // Corrupt/unreadable file → behave as empty (fail-closed on auto-approval).
-            return [];
-        }
-    }
-    has(prefix) {
-        return this.store.has(prefix);
-    }
-    list() {
-        return this.store.list();
-    }
-    /** Add a prefix and persist the whole set to disk. */
-    add(prefix) {
-        if (this.store.has(prefix))
-            return;
-        this.store.add(prefix);
-        this.persist();
-    }
-    persist() {
-        const file = {
-            version: PERSISTED_VERSION,
-            prefixes: this.store.list().sort(),
-        };
-        writeFileSync(this.filePath, JSON.stringify(file, null, 2) + '\n', 'utf8');
-    }
-}
-/**
- * Decide whether `command` is already approved by the given stores — the gate the runner
- * consults BEFORE prompting the human.
- *
- * Returns true ONLY when ALL of the following hold:
- *  1. {@link classifyCommand} returns a non-null classification (so composition /
- *     substitution / redirection commands can never match — anti-injection layer 1);
- *  2. the classified prefix is present in the session OR persisted (`always`) store; AND
- *  3. the safe-bin re-validation passes: the candidate's actual argv contains no
- *     operation-widening flag (anti-injection layer 2 — see {@link hasWideningFlag}).
- *
- * Anything else (unclassifiable, unknown prefix, or a widening flag) → false → the human
- * is prompted. Fail-closed by construction.
- */
-export function matchesApproval(command, stores) {
-    const classification = classifyCommand(command, normalizeCommand);
-    if (!classification)
-        return false; // layer 1: composition/redirection/substitution.
-    const approved = stores.session.has(classification.prefix) ||
-        (stores.always?.has(classification.prefix) ?? false);
-    if (!approved)
-        return false;
-    // Layer 2: re-derive argv from the normalized command and refuse if an operation-
-    // widening flag is present that the human's prefix-level approval never implied.
-    const argv = tokenize(normalizeCommand(command));
-    if (!argv)
-        return false; // unbalanced quoting → fail-closed.
-    if (hasWideningFlag(argv))
-        return false;
-    return true;
-}
-//# sourceMappingURL=allowlist.js.map

package/dist/core/shell/allowlist.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../../src/core/shell/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAgBhE,MAAM,iBAAiB,GAAG,CAAU,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,wCAAwC;IACxC,eAAe;IACf,gBAAgB;IAChB,QAAQ;IACR,IAAI,EAAE,6BAA6B;IACnC,UAAU,EAAE,qEAAqE;IACjF,IAAI,EAAE,6DAA6D;IACnE,0DAA0D;IAC1D,aAAa;IACb,OAAO,EAAE,mBAAmB;IAC5B,eAAe;IACf,eAAe;IACf,iEAAiE;IACjE,eAAe;IACf,wBAAwB;IACxB,iBAAiB;IACjB,mEAAmE;IACnE,IAAI,EAAE,0BAA0B;IAChC,UAAU;IACV,IAAI,EAAE,SAAS;IACf,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IACR,QAAQ,CAAc;IAEvC,YAAY,UAA4B,EAAE;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACZ,KAAK,CAAiB;IACtB,QAAQ,CAAS;IAElC,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,MAAM,CAAC,IAAI,CAAC,QAAgB;QAClC,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoC,CAAC;YAClE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC1D,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,sDAAsD;IACtD,GAAG,CAAC,MAAc;QAChB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,OAAO;QACb,MAAM,IAAI,GAA2B;YACnC,OAAO,EAAE,iBAAiB;YAC1B,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;SACnC,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;CACF;AAWD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAAsB;IACrE,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAClE,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC,CAAC,iDAAiD;IAEpF,MAAM,QAAQ,GACZ,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC;QACzC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,kFAAkF;IAClF,iFAAiF;IACjF,MAAM,IAAI,GAAG,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,oCAAoC;IAC7D,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAExC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/shell/judge.d.ts

@@ -1,161 +0,0 @@
-/**
- * @module core/shell/judge
- *
- * EXT-10 — LLM-as-judge bash-safety gate. An optional, opt-in pre-filter that sits *in front
- * of* the human approval prompt for `run_shell_command` (EXT-9). It is a tiered
- * fatigue-reducer, NOT merely a blocker: clearly-safe commands auto-approve, the rest escalate
- * to the human, and clearly-catastrophic ones may be rejected outright. Default OFF — it costs
- * one LLM call per command — opt-in via {@link GthDevToolsConfig.shell}'s `judge` knob.
- *
- * Validated prior art (both place the judge in front of the human prompt as an auto-approve
- * fatigue-reducer): openclaw `exec-auto-reviewer.ts` and hermes-agent `approval.py` "smart" mode.
- *
- * Two hardening guarantees are baked in here:
- *
- * 1. **Prompt-injection defense.** The command is attacker-controlled text. It is normalized
- *    (reusing {@link normalizeCommand} + home-path folding) and embedded inside an XML
- *    `<command_to_evaluate>` tag, behind a preamble that states the tagged text is UNTRUSTED
- *    DATA to be analyzed, never instructions to follow. See {@link buildJudgePrompt}.
- * 2. **Fail-closed on error.** If the LLM call throws, times out, or returns unparseable
- *    output, the verdict returned NEVER auto-approves — it is `high`/escalate. A judge failure
- *    can never silently green-light a command. See {@link FAIL_CLOSED_VERDICT}.
- *
- * Fail-closed-on-AMBIGUITY (when the command's target can't be statically resolved) lives in the
- * decision mapping ({@link mapVerdictToAction}), not here, so it applies regardless of what the
- * judge says.
- *
- * Mirrors the QA-3 judge substrate (`packages/review/src/middleware/reviewRateMiddleware.ts`):
- * structured-output evaluation over `config.llm`, wrapped in try/catch.
- */
-import type { BaseChatModel } from '@langchain/core/language_models/chat_models';
-import * as z from 'zod';
-import type { GthConfig } from '#src/config.js';
-/**
- * Structured verdict the judge model must return. Kept small and conservative:
- * - `risk` is the primary tier driving the decision (low → auto-approve, medium/high → escalate).
- * - `destructive` flags data-loss / irreversible operations (rm, drop, format, force-push, …).
- * - `outOfScope` flags actions outside the current project/work (network exfil, system mutation,
- *   touching paths well outside cwd) — a signal to escalate even when not strictly destructive.
- * - `reason` is one short sentence surfaced to the human when escalating.
- */
-export declare const ShellSafetyVerdictSchema: z.ZodObject<{
-    risk: z.ZodEnum<{
-        low: "low";
-        medium: "medium";
-        high: "high";
-    }>;
-    destructive: z.ZodBoolean;
-    outOfScope: z.ZodBoolean;
-    reason: z.ZodString;
-}, z.core.$strip>;
-/**
- * The judge's structured verdict on a single shell command.
- */
-export type ShellSafetyVerdict = z.infer<typeof ShellSafetyVerdictSchema>;
-/**
- * The verdict returned whenever the judge cannot produce a trustworthy answer (LLM throws,
- * times out, or returns unparseable output). Fail-closed: `high` + escalate, never auto-approve.
- */
-export declare const FAIL_CLOSED_VERDICT: ShellSafetyVerdict;
-/**
- * Default wall-clock budget (ms) for the judge LLM call. Kept low so a slow/hung judge can't
- * wedge the approval flow — on timeout we fail closed and escalate. Mirrors openclaw's low
- * exec-reviewer timeout minimum.
- */
-export declare const JUDGE_DEFAULT_TIMEOUT_MS = 30000;
-/**
- * System preamble for the judge. States the role, the untrusted-input contract (the tagged
- * command is DATA, not instructions), and the bias toward escalation when unsure. Patterned
- * after openclaw's `DEFAULT_EXEC_REVIEWER_SYSTEM_PROMPT` and hermes' untrusted-input framing.
- */
-export declare const JUDGE_SYSTEM_PROMPT: string;
-/**
- * Detect whether the command invokes an interpreter on a script target AND passes an
- * `$ALL_CAPS` shell-variable expansion in its arguments — openclaw's "script preflight". Such a
- * command can leak environment (often secrets) into the script, so it should bias toward
- * escalation. Lightweight heuristic over the normalized command; a positive flag is fed to the
- * judge prompt AND forces escalation in the decision mapping.
- *
- * @returns true when an interpreter+script invocation also expands an ALL_CAPS env var.
- */
-export declare function hasScriptEnvLeakRisk(normalizedCommand: string): boolean;
-/**
- * Fold an absolute home path to `~` so the judge sees a stable, less-identifying form (mirrors
- * hermes `_normalize_command_for_detection` path folding). Best-effort: only the literal home
- * dir prefix is folded.
- */
-export declare function foldHomePath(command: string, home: string | undefined): string;
-/**
- * Build the messages for the judge call: a system preamble ({@link JUDGE_SYSTEM_PROMPT}) plus a
- * human message that embeds the NORMALIZED command inside an XML `<command_to_evaluate>` tag and
- * (optionally) notes the script-env-leak preflight flag. The command text is only ever DATA in
- * the tag — the builder never executes or interpolates it as instructions.
- *
- * Exposed (and returning plain strings) so tests can assert the structure: the tag is present,
- * the untrusted-input preamble is present, and an injection string inside the command lands
- * inside the tag rather than being acted on.
- */
-export declare function buildJudgePrompt(command: string, options?: {
-    home?: string;
-}): {
-    system: string;
-    user: string;
-};
-/**
- * Vet a single shell command with the judge model and return a structured {@link ShellSafetyVerdict}.
- *
- * - Builds an injection-hardened, normalized prompt ({@link buildJudgePrompt}).
- * - Calls the judge model (defaults to `config.llm`) via `withStructuredOutput(schema)`.
- * - Races the call against {@link JUDGE_DEFAULT_TIMEOUT_MS}.
- * - **Fail-closed:** any throw / timeout / parse failure returns {@link FAIL_CLOSED_VERDICT}
- *   (`high`/escalate), never an auto-approve.
- *
- * Note: this only produces a verdict; the auto-approve / escalate / reject decision (including
- * fail-closed-on-ambiguity) is made by {@link mapVerdictToAction} in the runner.
- */
-export declare function judgeShellCommand(command: string, config: GthConfig, options?: {
-    model?: BaseChatModel;
-    home?: string;
-    timeoutMs?: number;
-}): Promise<ShellSafetyVerdict>;
-/**
- * The action the judge gate resolves to for a single command, BEFORE the human prompt.
- * - `auto-approve` — clearly safe; approve once, do NOT touch the human or the allow-list.
- * - `escalate` — fall through to the existing human approval callback (carrying the verdict).
- * - `reject` — refuse outright without prompting (reserved for clearly-catastrophic verdicts).
- */
-export type JudgeAction = 'auto-approve' | 'escalate' | 'reject';
-/**
- * Behaviour knobs for the decision mapping, derived from config with safe defaults.
- */
-export interface JudgeDecisionOptions {
-    /** Auto-approve `low`-risk, non-ambiguous, non-flagged commands. Default true. */
-    autoApproveLow: boolean;
-    /**
-     * Reject (without prompting) a clearly-catastrophic verdict (`high` + `destructive`). Default
-     * false — keep the gate conservative; EXT-9's hardline floor already refuses truly
-     * catastrophic commands at exec time, so the judge's main jobs are auto-approve-low + escalate.
-     */
-    blockHigh: boolean;
-}
-/**
- * Pure, testable mapping from a {@link ShellSafetyVerdict} + ambiguity to a {@link JudgeAction}.
- *
- * Order of precedence (fail-closed first):
- * 1. **Fail-closed on ambiguity:** when {@link classifyCommand} returns null — the command
- *    composes / substitutes / redirects so its target can't be statically resolved — NEVER
- *    auto-approve. Escalate (or reject if `blockHigh` and the verdict is catastrophic). This is
- *    enforced regardless of what the judge said, so an unresolvable command can't be slipped
- *    through by a manipulated `low` verdict.
- * 2. **Script-env-leak preflight:** if the (normalized) command leaks an ALL_CAPS env var into a
- *    script/interpreter, never auto-approve — escalate.
- * 3. `blockHigh` + catastrophic (`high` + `destructive`) → reject.
- * 4. `low` + autoApproveLow + not ambiguous + not flagged → auto-approve.
- * 5. otherwise → escalate.
- *
- * @param command The raw command string (used to recompute ambiguity + preflight independently
- *   of the judge, so the gate is robust even if the judge is wrong).
- * @param verdict The judge's verdict (or the fail-closed verdict).
- * @param opts Behaviour knobs.
- */
-export declare function mapVerdictToAction(command: string, verdict: ShellSafetyVerdict, opts: JudgeDecisionOptions): JudgeAction;