@guilz-dev/belay 0.4.0 → 0.6.0

package/dist/core/capability/gate-policy-shadow.js

@@ -0,0 +1,108 @@
+import path from 'node:path';
+import { belayStateDir } from '../config.js';
+import { buildTier1Prompt } from '../verdict/judge.js';
+import { normalizeJudgeRuntimeConfig } from '../verdict/judge-runtime-config.js';
+import { judgeShadowAuditFields, recordShadowComparison, shouldRunShadowComparison, triggerJudgeSessionKillSwitch, } from '../verdict/judge-shadow.js';
+import { evaluateWithJudgeTransport } from '../verdict/judge-transport.js';
+import { recordPolicyJudgeComparison } from './gate-shadow-ratchet.js';
+export { recordGateApprovalAsk } from './gate-shadow-ratchet.js';
+export function capabilityDecisionAuditFields(result) {
+    const fields = {};
+    if (result.capabilityRequests?.length) {
+        fields.capabilityRequestCount = result.capabilityRequests.length;
+        fields.capabilityActions = result.capabilityRequests.map((request) => request.action);
+    }
+    if (result.authorizationDecision) {
+        fields.policyOutcome = result.authorizationDecision.outcome;
+        fields.policyReason = result.authorizationDecision.reason;
+        if (result.authorizationDecision.matchedRule) {
+            fields.policyMatchedRule = result.authorizationDecision.matchedRule;
+        }
+    }
+    if (result.boundaryProfile) {
+        fields.boundaryProfile = result.boundaryProfile;
+    }
+    if (result.authorizationDecision?.signals.includes('boundary_materialized_grant')) {
+        fields.boundaryGrantMaterialized = true;
+    }
+    return fields;
+}
+export function policyWouldBlock(result) {
+    const outcome = result.authorizationDecision?.outcome;
+    if (outcome === 'allow') {
+        return false;
+    }
+    if (outcome === 'require_approval' || outcome === 'deny') {
+        return true;
+    }
+    return result.verdict === 'deny_pending_approval';
+}
+export function judgeWouldBlock(verdict) {
+    return !verdict.local_recoverable || verdict.destroys_history_or_secrets === true;
+}
+export function policyJudgeMismatch(result, judgeVerdict) {
+    return policyWouldBlock(result) !== judgeWouldBlock(judgeVerdict);
+}
+function queueDeferredGatePolicyShadow(params) {
+    setImmediate(() => {
+        void runGatePolicyShadowComparison(params).catch(() => { });
+    });
+}
+export function scheduleGateShadowAudit(params) {
+    const trace = capabilityDecisionAuditFields(params.result);
+    const judge = params.config.judge;
+    const mode = judge?.mode ?? 'shadow';
+    if (mode !== 'shadow' || !judge.runtime?.shadow?.enabled) {
+        return trace;
+    }
+    const deferredTrace = {
+        ...trace,
+        ...judgeShadowAuditFields(params.repoRoot),
+        judgeShadowScheduled: false,
+        judgeShadowDeferred: true,
+    };
+    const command = params.command?.trim();
+    if (!command ||
+        params.providerId === 'ollama' ||
+        !shouldRunShadowComparison(params.repoRoot, params.providerId, judge.runtime.shadow)) {
+        return deferredTrace;
+    }
+    queueDeferredGatePolicyShadow({
+        repoRoot: params.repoRoot,
+        config: params.config,
+        providerId: params.providerId,
+        command,
+        result: params.result,
+        stateDir: params.stateDir,
+    });
+    return {
+        ...deferredTrace,
+        judgeShadowQueued: true,
+    };
+}
+export async function runGatePolicyShadowComparison(params) {
+    const judge = params.config.judge;
+    const runtime = normalizeJudgeRuntimeConfig(judge.runtime);
+    const stateDir = params.stateDir ?? belayStateDir(params.config, path.join(params.repoRoot, '.belay'));
+    const transport = await evaluateWithJudgeTransport({
+        prompt: buildTier1Prompt(params.command),
+        context: {
+            providerId: params.providerId,
+            model: judge.model ?? 'default',
+            repoRoot: params.repoRoot,
+            stateDir,
+            judgeMode: judge.mode ?? 'shadow',
+            runtime,
+            judgeTimeoutMs: judge.timeoutMs ?? 25_000,
+        },
+    }, { skipTransportShadow: true, spawnOnly: true });
+    if (!transport.verdict) {
+        return;
+    }
+    const mismatch = policyJudgeMismatch(params.result, transport.verdict);
+    const shadow = recordShadowComparison(params.repoRoot, runtime.shadow, mismatch);
+    await recordPolicyJudgeComparison(params.repoRoot, stateDir, mismatch);
+    if (shadow.killSwitchTriggered) {
+        await triggerJudgeSessionKillSwitch(params.repoRoot, stateDir);
+    }
+}

package/dist/core/capability/gate-shadow-audit.d.ts

@@ -0,0 +1 @@
+export { capabilityDecisionAuditFields, judgeWouldBlock, policyJudgeMismatch, policyWouldBlock, recordGateApprovalAsk, runGatePolicyShadowComparison, scheduleGateShadowAudit, } from './gate-policy-shadow.js';

package/dist/core/capability/gate-shadow-audit.js

@@ -0,0 +1 @@
+export { capabilityDecisionAuditFields, judgeWouldBlock, policyJudgeMismatch, policyWouldBlock, recordGateApprovalAsk, runGatePolicyShadowComparison, scheduleGateShadowAudit, } from './gate-policy-shadow.js';

package/dist/core/capability/gate-shadow-ratchet.d.ts

@@ -0,0 +1,14 @@
+export interface GateShadowRatchetState {
+    version: 1;
+    policyJudgeComparisons: number;
+    policyJudgeMismatches: number;
+    approvalByReason: Record<string, {
+        asks: number;
+        approved: number;
+    }>;
+    updatedAt: string;
+}
+export declare function recordPolicyJudgeComparison(repoRoot: string, stateDir: string, mismatch: boolean): Promise<void>;
+export declare function recordGateApprovalAsk(stateDir: string, reason: string, approved: boolean): Promise<void>;
+export declare function evaluateShadowRatchetWarnings(state: GateShadowRatchetState): string[];
+export declare function loadShadowRatchetWarnings(stateDir: string): Promise<string[]>;

package/dist/core/capability/gate-shadow-ratchet.js

@@ -0,0 +1,81 @@
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+const DEFAULT_STATE = {
+    version: 1,
+    policyJudgeComparisons: 0,
+    policyJudgeMismatches: 0,
+    approvalByReason: {},
+    updatedAt: new Date(0).toISOString(),
+};
+const MISMATCH_RATE_THRESHOLD = 0.25;
+const APPROVAL_RATE_THRESHOLD = 0.5;
+const MIN_SAMPLES = 10;
+function ratchetPath(stateDir) {
+    return path.join(stateDir, 'gate-shadow-ratchet.json');
+}
+async function loadState(stateDir) {
+    const filePath = ratchetPath(stateDir);
+    if (!existsSync(filePath)) {
+        return { ...DEFAULT_STATE, updatedAt: new Date().toISOString() };
+    }
+    try {
+        const raw = JSON.parse(await readFile(filePath, 'utf8'));
+        return {
+            ...DEFAULT_STATE,
+            ...raw,
+            approvalByReason: raw.approvalByReason ?? {},
+        };
+    }
+    catch {
+        return { ...DEFAULT_STATE, updatedAt: new Date().toISOString() };
+    }
+}
+async function saveState(stateDir, state) {
+    await mkdir(stateDir, { recursive: true, mode: 0o700 });
+    await writeFile(ratchetPath(stateDir), `${JSON.stringify({ ...state, updatedAt: new Date().toISOString() }, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+}
+export async function recordPolicyJudgeComparison(repoRoot, stateDir, mismatch) {
+    void repoRoot;
+    const state = await loadState(stateDir);
+    state.policyJudgeComparisons += 1;
+    if (mismatch) {
+        state.policyJudgeMismatches += 1;
+    }
+    await saveState(stateDir, state);
+}
+export async function recordGateApprovalAsk(stateDir, reason, approved) {
+    const state = await loadState(stateDir);
+    const entry = state.approvalByReason[reason] ?? { asks: 0, approved: 0 };
+    if (approved) {
+        entry.approved += 1;
+    }
+    else {
+        entry.asks += 1;
+    }
+    state.approvalByReason[reason] = entry;
+    await saveState(stateDir, state);
+}
+export function evaluateShadowRatchetWarnings(state) {
+    const warnings = [];
+    if (state.policyJudgeComparisons >= MIN_SAMPLES) {
+        const rate = state.policyJudgeMismatches / state.policyJudgeComparisons;
+        if (rate > MISMATCH_RATE_THRESHOLD) {
+            warnings.push(`Policy/judge shadow mismatch rate ${(rate * 100).toFixed(0)}% exceeds ${(MISMATCH_RATE_THRESHOLD * 100).toFixed(0)}% threshold (${state.policyJudgeMismatches}/${state.policyJudgeComparisons}).`);
+        }
+    }
+    for (const [reason, counts] of Object.entries(state.approvalByReason)) {
+        if (counts.asks < MIN_SAMPLES) {
+            continue;
+        }
+        const approvalRate = counts.approved / counts.asks;
+        if (approvalRate >= APPROVAL_RATE_THRESHOLD) {
+            warnings.push(`High approval rate for "${reason}": ${(approvalRate * 100).toFixed(0)}% (${counts.approved}/${counts.asks}). Consider tightening policy.`);
+        }
+    }
+    return warnings;
+}
+export async function loadShadowRatchetWarnings(stateDir) {
+    const state = await loadState(stateDir);
+    return evaluateShadowRatchetWarnings(state);
+}

package/dist/core/capability/grant-lease.d.ts

@@ -0,0 +1,9 @@
+import type { ApprovalStateFile } from '../types.js';
+import type { CapabilityGrantV1 } from './grant.js';
+import type { CapabilityRequestV1 } from './request.js';
+export declare function grantsFromApprovedState(state: ApprovalStateFile, repoRoot: string): CapabilityGrantV1[];
+export declare function consumeGrantLease(state: ApprovalStateFile, grantId: string): {
+    state: ApprovalStateFile;
+    consumed: boolean;
+};
+export declare function findMatchingGrant(grants: CapabilityGrantV1[] | undefined, request: CapabilityRequestV1): CapabilityGrantV1 | undefined;

package/dist/core/capability/grant-lease.js

@@ -0,0 +1,46 @@
+import { isGrantScopeTooBroad } from './grant.js';
+import { grantMatchesRequest } from './grant-match.js';
+export function grantsFromApprovedState(state, repoRoot) {
+    const now = Date.now();
+    return state.approvals
+        .filter((approval) => approval.repoRoot === repoRoot)
+        .map((approval) => approval.grant)
+        .filter((grant) => {
+        if (!grant) {
+            return false;
+        }
+        if (isGrantScopeTooBroad(grant)) {
+            return false;
+        }
+        const expires = Date.parse(grant.expiresAt);
+        return Number.isFinite(expires) && expires > now && grant.usesRemaining > 0;
+    });
+}
+export function consumeGrantLease(state, grantId) {
+    let consumed = false;
+    const approvals = state.approvals.map((approval) => {
+        const grant = approval.grant;
+        if (!grant || grant.grantId !== grantId || grant.usesRemaining <= 0) {
+            return approval;
+        }
+        consumed = true;
+        const usesRemaining = grant.usesRemaining - 1;
+        return {
+            ...approval,
+            grant: {
+                ...grant,
+                usesRemaining,
+            },
+        };
+    });
+    return {
+        state: { ...state, approvals },
+        consumed,
+    };
+}
+export function findMatchingGrant(grants, request) {
+    if (!grants?.length) {
+        return undefined;
+    }
+    return grants.find((grant) => grantMatchesRequest(grant, request));
+}

package/dist/core/capability/grant-loader.d.ts

@@ -0,0 +1,12 @@
+import type { BelayConfigV4 } from '../config.js';
+import type { ApprovalStateFile, ClassifierOptions } from '../types.js';
+import type { BoundaryAttestation } from './attestation.js';
+import type { CapabilityGrantV1 } from './grant.js';
+export declare function capabilityGrantsEnabled(config: BelayConfigV4): boolean;
+export declare function grantsFromApprovalState(state: ApprovalStateFile, repoRoot: string, config: BelayConfigV4): CapabilityGrantV1[] | undefined;
+export declare function loadClassifierAuthorization(params: {
+    repoRoot: string;
+    config: BelayConfigV4;
+    approvedState: ApprovalStateFile;
+}): Promise<Pick<ClassifierOptions, 'grants' | 'attestation' | 'boundaryProfile'>>;
+export type { BoundaryAttestation, CapabilityGrantV1 };

package/dist/core/capability/grant-loader.js

@@ -0,0 +1,23 @@
+import { configuredControlPlaneDir } from '../config.js';
+import { resolveBoundaryProfile } from './boundary-profile.js';
+import { boundaryAttestationPath, loadBoundaryAttestation } from './boundary-session.js';
+import { grantsFromApprovedState } from './grant-lease.js';
+export function capabilityGrantsEnabled(config) {
+    return config.capability?.grantsEnabled !== false;
+}
+export function grantsFromApprovalState(state, repoRoot, config) {
+    if (!capabilityGrantsEnabled(config)) {
+        return undefined;
+    }
+    const grants = grantsFromApprovedState(state, repoRoot);
+    return grants.length > 0 ? grants : undefined;
+}
+export async function loadClassifierAuthorization(params) {
+    const grants = grantsFromApprovalState(params.approvedState, params.repoRoot, params.config);
+    const attestation = await loadBoundaryAttestation(boundaryAttestationPath(params.repoRoot, params.config), params.repoRoot, configuredControlPlaneDir(params.config));
+    const boundaryProfile = resolveBoundaryProfile({
+        config: params.config,
+        attestation,
+    });
+    return { grants, attestation, boundaryProfile };
+}

package/dist/core/capability/grant-match.d.ts

@@ -0,0 +1,6 @@
+import type { CapabilityGrantV1 } from './grant.js';
+import type { CapabilityRequestV1 } from './request.js';
+export declare function grantTargetsRequest(grant: CapabilityGrantV1, request: CapabilityRequestV1): boolean;
+/** Repo-scoped target match for forged broad-grant detection (principal may be incomplete). */
+export declare function broadGrantTargetsRequest(grant: CapabilityGrantV1, request: CapabilityRequestV1): boolean;
+export declare function grantMatchesRequest(grant: CapabilityGrantV1, request: CapabilityRequestV1): boolean;

package/dist/core/capability/grant-match.js

@@ -0,0 +1,93 @@
+import { canonicalPath } from '../path-utils.js';
+import { isGrantScopeTooBroad } from './grant.js';
+function principalMatches(grant, request) {
+    if (grant.repoRoot !== request.repoRoot) {
+        return false;
+    }
+    if (request.adapter !== undefined && grant.adapter !== request.adapter) {
+        return false;
+    }
+    if (request.sessionHash !== undefined && grant.sessionHash !== request.sessionHash) {
+        return false;
+    }
+    if (grant.adapter !== undefined && grant.adapter !== request.adapter) {
+        return false;
+    }
+    if (grant.sessionHash !== undefined && grant.sessionHash !== request.sessionHash) {
+        return false;
+    }
+    return true;
+}
+function networkResourceMatches(grant, request) {
+    if (grant.host !== request.host) {
+        return false;
+    }
+    if (grant.port !== undefined && grant.port !== request.port) {
+        return false;
+    }
+    if (grant.protocol !== undefined &&
+        grant.protocol !== 'unknown' &&
+        request.protocol !== undefined &&
+        request.protocol !== 'unknown' &&
+        grant.protocol !== request.protocol) {
+        return false;
+    }
+    return true;
+}
+function grantTargetsResource(grant, request) {
+    if (grant.action !== request.action) {
+        if (grant.action === 'indeterminate') {
+            return request.action === 'indeterminate';
+        }
+        return false;
+    }
+    if (grant.inputFingerprint && grant.inputFingerprint !== request.context.inputFingerprint) {
+        return false;
+    }
+    if (grant.resource.kind === 'path' && request.resource.kind === 'path') {
+        return canonicalPath(grant.resource.path) === canonicalPath(request.resource.path);
+    }
+    if (grant.resource.kind === 'network' && request.resource.kind === 'network') {
+        return networkResourceMatches(grant.resource, request.resource);
+    }
+    if (grant.resource.kind === 'executable' && request.resource.kind === 'executable') {
+        return grant.resource.command === request.resource.command;
+    }
+    if (grant.resource.kind === 'git-ref' && request.resource.kind === 'git-ref') {
+        return grant.resource.ref === request.resource.ref;
+    }
+    if (grant.resource.kind === 'unknown') {
+        if (grant.action === 'network.connect' && request.resource.kind === 'network') {
+            return true;
+        }
+        if (grant.action === 'fs.write' && request.resource.kind === 'path') {
+            return true;
+        }
+        if (grant.action === 'indeterminate') {
+            return request.action === 'indeterminate';
+        }
+    }
+    return grant.resource.kind === request.resource.kind;
+}
+export function grantTargetsRequest(grant, request) {
+    if (grant.usesRemaining <= 0) {
+        return false;
+    }
+    if (!principalMatches(grant.principal, request.principal)) {
+        return false;
+    }
+    return grantTargetsResource(grant, request);
+}
+/** Repo-scoped target match for forged broad-grant detection (principal may be incomplete). */
+export function broadGrantTargetsRequest(grant, request) {
+    if (grant.principal.repoRoot !== request.principal.repoRoot) {
+        return false;
+    }
+    return grantTargetsResource(grant, request);
+}
+export function grantMatchesRequest(grant, request) {
+    if (isGrantScopeTooBroad(grant)) {
+        return false;
+    }
+    return grantTargetsRequest(grant, request);
+}

package/dist/core/capability/grant.d.ts

@@ -0,0 +1,16 @@
+import type { CapabilityAction, CapabilityPrincipal, CapabilityResource } from './request.js';
+export declare const CAPABILITY_GRANT_VERSION: 1;
+export interface CapabilityGrantV1 {
+    version: typeof CAPABILITY_GRANT_VERSION;
+    grantId: string;
+    principal: CapabilityPrincipal;
+    action: CapabilityAction;
+    resource: CapabilityResource;
+    inputFingerprint?: string;
+    issuedAt: string;
+    expiresAt: string;
+    maxUses: number;
+    usesRemaining: number;
+    issuer: string;
+}
+export declare function isGrantScopeTooBroad(grant: CapabilityGrantV1): boolean;

package/dist/core/capability/grant.js

@@ -0,0 +1,16 @@
+export const CAPABILITY_GRANT_VERSION = 1;
+export function isGrantScopeTooBroad(grant) {
+    if (grant.action === 'network.connect' && grant.resource.kind === 'unknown') {
+        return true;
+    }
+    if (grant.resource.kind === 'network' && grant.resource.host === '*') {
+        return true;
+    }
+    if (grant.action === 'fs.write' && grant.resource.kind === 'unknown') {
+        return true;
+    }
+    if (grant.action === 'indeterminate') {
+        return true;
+    }
+    return false;
+}

package/dist/core/capability/index.d.ts

@@ -1,6 +1,14 @@
 export { addPathToAllowlist, allPathsAllowlisted, fsScopeAllowlistPath, isPathAllowlisted, loadFsScopeAllowlist, loadFsScopeAllowlistSync, saveFsScopeAllowlist, } from './allowlist.js';
+export { BOUNDARY_ATTESTATION_VERSION, type BoundaryAttestation, type BoundaryDriverId, isAttestationFresh, } from './attestation.js';
+export { BOUNDARY_PROFILE_L1_ATTESTED, BOUNDARY_PROFILE_L3_L4_ONLY, BOUNDARY_PROFILE_L3_POLICY, boundaryVerifiedAllowEnabled, isAttestedBoundary, resolveBoundaryProfile, } from './boundary-profile.js';
 export { evaluateL1FullStatus, hasSandboxRuntime, isCapabilityBrokerDemotionActive, isSandboxBrokerEnabled, } from './broker.js';
+export { CAPABILITY_GRANT_VERSION, type CapabilityGrantV1, isGrantScopeTooBroad, } from './grant.js';
+export { checkGatedActionLimits, MAX_SHELL_COMMAND_BYTES, MAX_TOOL_PAYLOAD_BYTES, } from './limits.js';
 export { collectOutsideRepoPaths, collectOutsideRepoPathsFromToolPayload } from './paths.js';
+export { type CapabilityAuthorizationMetadata, type PolicyLegacyReasonHints, policyDecisionToLegacyReason, policyReasonToLegacyReason, singleCapabilityMetadata, } from './policy-bridge.js';
+export { buildFileMutationCapabilityRequest, buildShellCapabilityRequest, createTypeScriptPolicyEngine, evaluateFileMutationPolicy, evaluateShellPolicy, evaluateSubagentPolicy, type FileMutationCapabilityAnalysis, getDefaultPolicyEngine, policyDecisionRequiresAsk, type ShellCapabilityAnalysis, type SubagentCapabilityAnalysis, } from './policy-engine.js';
+export type { AuthorizationContext, PolicyDecision, PolicyEngine, PolicyOutcome, } from './policy-types.js';
 export { FS_SCOPE_REASONS, shouldSkipBrokerApprovedOnce, shouldSkipBrokerApprovedRecord, } from './reasons.js';
+export { CAPABILITY_REQUEST_VERSION, type CapabilityAction, type CapabilityEvidence, type CapabilityEvidenceLevel, type CapabilityHookKind, type CapabilityPrincipal, type CapabilityRequestContext, type CapabilityRequestV1, type CapabilityResource, } from './request.js';
 export { addTrustedWorkspaceRoot, isBroadTrustedWorkspaceRoot, isHighStakesTrustedWorkspaceRoot, isPathWithinTrustedWorkspaceRoots, loadTrustedWorkspaceRoots, loadTrustedWorkspaceRootsSync, normalizeTrustedWorkspaceRootPath, saveTrustedWorkspaceRoots, trustedWorkspaceRootsPath, validateTrustedWorkspaceRootCandidate, } from './trusted-workspace-roots.js';
 export type { CapabilityApprovalScope, FsScopeAllowlistEntry, FsScopeAllowlistFile, TrustedWorkspaceRootEntry, TrustedWorkspaceRootsFile, } from './types.js';

package/dist/core/capability/index.js

@@ -1,5 +1,12 @@
 export { addPathToAllowlist, allPathsAllowlisted, fsScopeAllowlistPath, isPathAllowlisted, loadFsScopeAllowlist, loadFsScopeAllowlistSync, saveFsScopeAllowlist, } from './allowlist.js';
+export { BOUNDARY_ATTESTATION_VERSION, isAttestationFresh, } from './attestation.js';
+export { BOUNDARY_PROFILE_L1_ATTESTED, BOUNDARY_PROFILE_L3_L4_ONLY, BOUNDARY_PROFILE_L3_POLICY, boundaryVerifiedAllowEnabled, isAttestedBoundary, resolveBoundaryProfile, } from './boundary-profile.js';
 export { evaluateL1FullStatus, hasSandboxRuntime, isCapabilityBrokerDemotionActive, isSandboxBrokerEnabled, } from './broker.js';
+export { CAPABILITY_GRANT_VERSION, isGrantScopeTooBroad, } from './grant.js';
+export { checkGatedActionLimits, MAX_SHELL_COMMAND_BYTES, MAX_TOOL_PAYLOAD_BYTES, } from './limits.js';
 export { collectOutsideRepoPaths, collectOutsideRepoPathsFromToolPayload } from './paths.js';
+export { policyDecisionToLegacyReason, policyReasonToLegacyReason, singleCapabilityMetadata, } from './policy-bridge.js';
+export { buildFileMutationCapabilityRequest, buildShellCapabilityRequest, createTypeScriptPolicyEngine, evaluateFileMutationPolicy, evaluateShellPolicy, evaluateSubagentPolicy, getDefaultPolicyEngine, policyDecisionRequiresAsk, } from './policy-engine.js';
 export { FS_SCOPE_REASONS, shouldSkipBrokerApprovedOnce, shouldSkipBrokerApprovedRecord, } from './reasons.js';
+export { CAPABILITY_REQUEST_VERSION, } from './request.js';
 export { addTrustedWorkspaceRoot, isBroadTrustedWorkspaceRoot, isHighStakesTrustedWorkspaceRoot, isPathWithinTrustedWorkspaceRoots, loadTrustedWorkspaceRoots, loadTrustedWorkspaceRootsSync, normalizeTrustedWorkspaceRootPath, saveTrustedWorkspaceRoots, trustedWorkspaceRootsPath, validateTrustedWorkspaceRootCandidate, } from './trusted-workspace-roots.js';

package/dist/core/capability/limits.d.ts

@@ -0,0 +1,7 @@
+import type { GatedAction } from '../gate-contract.js';
+import type { ClassifyResult } from '../types.js';
+import { BOUNDARY_PROFILE_L3_POLICY } from './boundary-profile.js';
+export { BOUNDARY_PROFILE_L3_POLICY };
+export declare const MAX_SHELL_COMMAND_BYTES: number;
+export declare const MAX_TOOL_PAYLOAD_BYTES: number;
+export declare function checkGatedActionLimits(action: GatedAction): ClassifyResult | null;

package/dist/core/capability/limits.js

@@ -0,0 +1,55 @@
+import { BOUNDARY_PROFILE_L3_POLICY } from './boundary-profile.js';
+export { BOUNDARY_PROFILE_L3_POLICY };
+export const MAX_SHELL_COMMAND_BYTES = 64 * 1024;
+export const MAX_TOOL_PAYLOAD_BYTES = 1024 * 1024;
+function limitExceededResult(reason, summary) {
+    return {
+        verdict: 'deny_pending_approval',
+        reason,
+        fingerprint: `limit:${reason}`,
+        summary,
+        assessment: {
+            reversibility: 'irreversible',
+            external: false,
+            blastRadius: 'gate input budget',
+            confidence: 1,
+            signals: [reason, 'analysis_budget_exceeded'],
+        },
+        boundaryProfile: BOUNDARY_PROFILE_L3_POLICY,
+    };
+}
+function shellCommandFromAction(action) {
+    if (action.command?.trim()) {
+        return action.command.trim();
+    }
+    const payload = action.payload;
+    if (!payload) {
+        return '';
+    }
+    const direct = payload.command;
+    if (typeof direct === 'string' && direct.trim()) {
+        return direct.trim();
+    }
+    const toolInput = payload.tool_input;
+    if (toolInput && typeof toolInput === 'object') {
+        const command = toolInput.command;
+        if (typeof command === 'string' && command.trim()) {
+            return command.trim();
+        }
+    }
+    return '';
+}
+export function checkGatedActionLimits(action) {
+    if (action.kind === 'shell') {
+        const command = shellCommandFromAction(action);
+        if (Buffer.byteLength(command, 'utf8') > MAX_SHELL_COMMAND_BYTES) {
+            return limitExceededResult('input_too_large', command.slice(0, 120));
+        }
+        return null;
+    }
+    const payloadBytes = Buffer.byteLength(JSON.stringify(action.payload ?? {}), 'utf8');
+    if (payloadBytes > MAX_TOOL_PAYLOAD_BYTES) {
+        return limitExceededResult('input_too_large', action.toolName ?? action.kind);
+    }
+    return null;
+}

package/dist/core/capability/policy-bridge.d.ts

@@ -0,0 +1,18 @@
+import type { PolicyDecision } from './policy-types.js';
+import type { CapabilityRequestV1 } from './request.js';
+export interface CapabilityAuthorizationMetadata {
+    capabilityRequests: CapabilityRequestV1[];
+    authorizationDecision: PolicyDecision;
+}
+export interface PolicyLegacyReasonHints {
+    outsideMutation?: boolean;
+    effect?: 'read_only' | 'local_mutation' | 'remote_mutation' | 'unknown';
+}
+export declare function singleCapabilityMetadata(request: CapabilityRequestV1, decision: PolicyDecision): CapabilityAuthorizationMetadata;
+/**
+ * Maps a PolicyDecision to hook-facing legacy reason strings.
+ * Pass hints when the shell segment context is known (outside-repo mutation, etc.).
+ */
+export declare function policyDecisionToLegacyReason(decision: PolicyDecision, hints?: PolicyLegacyReasonHints): string;
+/** @deprecated Use policyDecisionToLegacyReason for shell segments that need outside-repo hints. */
+export declare function policyReasonToLegacyReason(decision: PolicyDecision): string;

package/dist/core/capability/policy-bridge.js

@@ -0,0 +1,51 @@
+export function singleCapabilityMetadata(request, decision) {
+    return {
+        capabilityRequests: [request],
+        authorizationDecision: decision,
+    };
+}
+/**
+ * Maps a PolicyDecision to hook-facing legacy reason strings.
+ * Pass hints when the shell segment context is known (outside-repo mutation, etc.).
+ */
+export function policyDecisionToLegacyReason(decision, hints = {}) {
+    if (decision.reason === 'outside_repo_mutation') {
+        return 'outside_repo_mutation';
+    }
+    if (decision.reason === 'external_effect' || decision.reason === 'network_connect') {
+        return 'external_effect';
+    }
+    if (decision.reason === 'high_stakes_path' || decision.reason === 'secret_path') {
+        return 'tier1_catastrophic';
+    }
+    if (decision.reason === 'indeterminate_effect') {
+        return 'unknown_local_effect';
+    }
+    if (decision.reason === 'opaque_execution') {
+        return 'opaque_execution';
+    }
+    if (decision.reason === 'control_plane_mutation') {
+        return 'control_plane_mutation';
+    }
+    if (decision.reason === 'policy_default') {
+        if (decision.signals.includes('outside_repo_path') ||
+            decision.signals.includes('outside_repo_mutation')) {
+            return 'outside_repo_mutation';
+        }
+        if (hints.outsideMutation && hints.effect !== 'read_only') {
+            return 'outside_repo_mutation';
+        }
+        return 'unknown_local_effect';
+    }
+    if (decision.reason === 'subagent_review') {
+        return 'subagent_review';
+    }
+    if (decision.outcome === 'deny') {
+        return decision.reason;
+    }
+    return decision.reason;
+}
+/** @deprecated Use policyDecisionToLegacyReason for shell segments that need outside-repo hints. */
+export function policyReasonToLegacyReason(decision) {
+    return policyDecisionToLegacyReason(decision);
+}