@intutic/gate 1.10.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Intutic Community
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,261 @@
+# @intutic/gate
+
+Pre-execution tool gate for JS/TS agent frameworks without a shipped Intutic
+harness. Port of the Python SDK's gate subpackage
+(`packages/intutic-clawde/intutic_clawde/gate/`) — see that package for the
+canonical description of the enforcement contract this one mirrors.
+
+This package is the **core** library plus framework-specific adapters built
+on top of it: `@intutic/gate/dsh` (a Cordis plugin for DeepSeek's "dsh"
+harness), `@intutic/gate/mastra` (`intuticHooks()` on Mastra's
+`beforeToolCall`), `@intutic/gate/vercel` (`intuticToolApproval()` on the
+`ai` package's `toolApproval`), `@intutic/gate/openai` (the OpenAI Agents SDK
+for TypeScript — see below), `@intutic/gate/eve` (`intuticApproval()` on
+eve's per-tool/per-connection `approval` policy surface — Vercel's
+filesystem-first durable-agent framework, a pre-1.0 **Preview** product),
+`@intutic/gate/harness` (Vercel's `@ai-sdk/harness` sandboxed coding-agent
+runtime), `@intutic/gate/workflow` (Vercel's `@ai-sdk/workflow` durable
+workflow agents), and `@intutic/gate/managed-agents` (Anthropic's Managed
+Agents — a session-confirmation responder, not a hook, since Anthropic hosts
+the tool-call loop; see below). LangChain.js has no dedicated adapter planned
+and instead uses the generic `wrapTool`/`wrapTools` helper directly.
+
+## Quick start
+
+```ts
+import { Gate, GateClient, install, wrapTools } from '@intutic/gate'
+
+const gate = new Gate(
+  { workspaceId: process.env.INTUTIC_WORKSPACE_ID },
+  GateClient.fromEnv({ harness: 'my-framework' }),
+)
+install(gate) // process-wide default; wrapTool()/wrapTools() pick it up
+
+const guardedTools = wrapTools(myTools) // array or {name: tool} record
+```
+
+On a refused call, the wrapped tool throws `IntuticGateRefusal` (message
+prefixed `[Intutic Governance] BLOCKED:`) BEFORE the real implementation
+runs — this package's throw-based refusal contract, the same one
+`services/sync-daemon/src/harness/gateBody.ts`'s emitted gates and
+`packages/mcp-proxy/src/policy.ts` use elsewhere in this repo's gate
+vocabulary.
+
+## Public API surface
+
+| Export | From | What it is |
+|---|---|---|
+| `Gate`, `GateConfig` | `gate.ts` | The four-tier evaluator. `new Gate(cfg, client?)`, `await gate.guard(toolName, toolInput)`. |
+| `install(gate)`, `active()` | `gate.ts` | Process-wide default gate, so wrapped tools don't need the instance threaded through every call site. |
+| `IntuticGateRefusal`, `GateError`, `GateConnectionError` | `errors.ts` | Thrown on refusal. `.reason`, `.code`, `.incidentId` carry the structured verdict; `.message` carries the `[Intutic Governance] BLOCKED: ...` text. |
+| `GateClient` | `client.ts` | Control-plane client (`hookGate`, `emit`, `GateClient.fromEnv(...)`). |
+| `wrapTool(fn \| tool, opts?)`, `wrapTools(list \| record, gate?)` | `wrapTools.ts` | Generic wrapping for a plain async function or an `{ execute, ... }`-shaped tool object. **This is the integration point for any JS framework without a dedicated adapter — LangChain.js included.** |
+| `intuticHeaders(opts?)` | `headers.ts` | Headers for a proxy-pointed HTTP/OpenAI-compatible client (`x-session-id`, `x-workspace-id`, `x-intutic-harness`). |
+| `loadSnapshot`, `evaluate`, `Snapshot`, `guardDisabledFromEnv` | `snapshot.ts` | Tier A1: reads `~/.intutic/hooks/policy-snapshot.rules`. |
+| `parseRules`, `firstMatch`, `fetchRules`, `SopRule` | `soprules.ts` | Tier A3: SOP-authored `WHERE`-clause rules. |
+| `checkCommand`, `checkImages`, `checkWrittenManifest`, `ImageVerdict` | `imagecheck.ts` | Tier A2: container-image provenance on deploy commands. |
+| `classify`, `isDeploy`, `isTest`, `touchesInfra` | `actions.ts` | Command classifier shared by A2's deploy trigger. |
+
+### A note for sibling adapter phases
+
+`Gate.guard()` is **async** (`Promise<void>`), unlike the Python SDK's
+synchronous `Gate.guard()` — the network-backed tiers (SOP-rule fetch,
+`POST /hook-gate`) use `fetch` here rather than Python's blocking
+`urllib.request`. Every adapter built on this package must `await` it.
+
+### What Tier A1 does and does not cover
+
+Like the Python SDK it ports, this package's snapshot reader (Tier A1) reads
+**only** `~/.intutic/hooks/policy-snapshot.rules`. It does **not** separately
+compile in the "static floor" patterns
+(`services/sync-daemon/src/harness/protectedPaths.ts`'s
+`staticFloorPatterns()` — the bypass/secret-content/skill-surface pattern
+tables) the way the shipped shell/JS gate emitters do (`INTUTIC_FLOOR`,
+concatenated ahead of the snapshot's own rules in `gateBody.ts`'s
+`intuticGate()`). Only what actually flows through the `.rules` file —
+SOP-authored rules, the destructive-command tier, and the tier-promoted
+skill-surface rules — is enforced by Tier A1 here. This gap already exists in
+`intutic_clawde`; it is preserved, not introduced, by this port. See
+`src/__tests__/fidelity.test.ts` for exactly which parts of the shipped
+contract Tier A1 DOES reproduce, verified against the real pattern tables.
+
+## `@intutic/gate/openai` — OpenAI Agents SDK (TypeScript)
+
+The adapter for `@openai/agents` (the TypeScript twin of the Python SDK's
+`intutic_clawde.gate.adapters.openai_agents`). The SDK's documented per-tool
+veto point is a **tool input guardrail** (`@openai/agents-core` >= 0.3.8):
+the runner executes guardrails before the tool body, and a
+`rejectContent` result skips the tool and hands the message to the model.
+
+```ts
+import { Agent, run } from '@openai/agents'
+import { installOpenAiGate, wrapAgent } from '@intutic/gate/openai'
+
+installOpenAiGate({ workspaceId: process.env.INTUTIC_WORKSPACE_ID })
+
+const agent = wrapAgent(new Agent({ name: 'ops', tools, mcpServers }))
+const result = await run(agent, prompt)
+```
+
+* `intuticToolGuardrail()` — the raw guardrail, attachable via
+  `tool({ inputGuardrails: [...] })`. Refusal → `rejectContent` with the
+  `[Intutic Governance] BLOCKED: ...` message; unexpected gate crash →
+  `rejectContent` too (fail closed).
+* `wrapTools(tools)` / `wrapAgent(agent)` — inject the guardrail into every
+  `FunctionTool`, **including `mcpServers`-derived tools** (`wrapAgent`
+  patches `getAllTools`, the only place those ever appear — mapping over
+  `agent.tools` misses them); rewrite `hostedMcpTool` entries to
+  `require_approval: 'always'` plus an Intutic `on_approval`; install a
+  composed gate-driven `onApproval` on local `shellTool`/`applyPatchTool`;
+  and gate `computerTool` through its `needsApproval` predicate (refusal →
+  pending interruption your code must reject — the SDK has no auto-reject
+  hook for computer actions).
+* `installOpenAiGate()` — builds + `install()`s a `Gate` and, by default,
+  sets `OPENAI_AGENTS_DISABLE_TRACING=1`: the SDK's tracing exporter posts
+  tool inputs/outputs to a **hardcoded** `api.openai.com/v1/traces/ingest`
+  that ignores `OPENAI_BASE_URL` (a DLP leak around the proxy). Pass
+  `{ tracingExport: 'keep' }` only once the exporter endpoint is re-pointed.
+* Truly hosted tools (`webSearchTool`, `fileSearchTool`,
+  `codeInterpreterTool`, image generation, hosted-environment `shellTool`)
+  execute server-side at OpenAI — **no client-side hook exists**; they pass
+  through unwrapped, stated plainly rather than pretended otherwise.
+
+LLM egress: the underlying `openai` client honours `OPENAI_BASE_URL`, so a
+sourced `.env.intutic` routes chat traffic through the Intutic proxy with
+zero code. See `apps/docs/integrations/openai-agents.md` for the full
+operator-facing version (guardrail-vs-approval ordering, realtime coverage,
+minimum versions).
+
+## `@intutic/gate/harness` — Vercel `@ai-sdk/harness` (sandboxed coding agents)
+
+`HarnessAgent` runs coding-agent runtimes (Claude Code, Grok Build, ...)
+**server-side, in Vercel Sandbox microVMs** — a materially different execution
+model from every other adapter in this package, and its veto surface differs
+to match. Confirmed against `@ai-sdk/harness@1.0.75` (a devDependency,
+type-checked and exercised in `src/__tests__/harness.test.ts`):
+
+- The `toolApproval` setting is a **static** `Readonly<Record<string,
+  ToolApprovalStatus>>` — "without callback support" (the shipped doc's own
+  words). Per-call gating therefore routes through the tool-approval **flow**:
+  `intuticStaticApprovals(tools)` marks every custom tool `'user-approval'`
+  (pausing each call), and `intuticApprovalResponder()` answers each pause
+  with a real `Gate.guard()` verdict, producing the
+  `toolApprovalContinuations` array for `continueGenerate`/`continueStream`.
+  `intuticSubmitApprovals(session, ...)` uses the optional
+  `session.submitToolApproval` instead when the adapter implements it
+  (harness-claude-code does; harness-grok-build does not).
+- **Built-in sandbox tools (read/write/edit/bash/...) never consult
+  `toolApproval`.** They are governed only by `permissionMode`, which
+  **defaults to `'allow-all'`**. `recommendedHarnessSettings()` returns the
+  posture this integration recommends instead (`'allow-edits'`, plus a
+  sandbox `networkPolicy` — deny-all, or a host allow-list — plus
+  `inactiveTools: ['bash']` by default, dropping `bash` from the tool set
+  entirely rather than merely gating it; opt out with `filterBash: false`)
+  — because the laptop Intutic proxy never sees sandbox egress, host-level
+  network policy is the only egress control available there, and it is
+  coarse (no DLP).
+- **`intuticSandboxBootstrap()`** injects a Tier A1 (policy-snapshot)
+  `PreToolUse` hook + `.claude/settings.json` directly into the sandbox
+  filesystem via `HarnessAgentSettings.sandboxConfig.onBootstrap` — the only
+  way to put anything resembling the native Intutic gate inside the
+  microVM. Claude Code only; a strict subset of a laptop gate (no SOP tier,
+  review-hold, or event draining — those need a live control-plane
+  connection a bootstrap function can't have). Spread its output into
+  `sandboxConfig` alongside `recommendedHarnessSettings()`. See TD-417 and
+  `apps/docs/integrations/ai-sdk-harness.md` for what has and hasn't been
+  live-verified.
+
+## `@intutic/gate/workflow` — Vercel `@ai-sdk/workflow` (durable workflow agents)
+
+`WorkflowAgent` has **zero approval fields** (confirmed against
+`@ai-sdk/workflow@1.0.69`); its veto surface is per-tool `needsApproval`,
+which pauses a call **durably** (a human can approve hours later).
+`intuticNeedsApproval(toolName)` builds that function from `Gate.guard()`;
+`withIntuticApproval(tools)` attaches it to a whole record, composing with any
+`needsApproval` a tool already declares.
+
+The durable runtime **retries** thrown errors — and its retry/abort decision
+duck-types on `error.name === 'FatalError'` (`FatalError.is()`, confirmed
+against `workflow@4.8.3`'s real machinery, because workflows run in a separate
+`vm` realm where `instanceof` fails). A plain `IntuticGateRefusal` thrown from
+`needsApproval` would be retried toward max attempts — a governance denial
+replayed on a timer. This adapter therefore throws `IntuticWorkflowRefusal`:
+still an `IntuticGateRefusal` (message, `.reason`/`.code`/`.incidentId`
+intact) but with `name = 'FatalError'`, so a denial **aborts** instead of
+retry-looping. On allow it resolves `false` (no human pause) or `true` (with
+`{ onAllow: 'human' }` — gate allows AND a human still approves).
+`wrapWorkflowTools()` is the execute-level variant: `wrapTools` semantics with
+the throw contract converted to the fatal shape.
+
+## `@intutic/gate/managed-agents` — Anthropic Managed Agents (session responder)
+
+Anthropic hosts the tool-call loop for a Managed Agents session — your process
+never executes a call directly, so there is no hook to attach. Instead your
+backend answers session events. `evaluated_permission: "ask"` on an
+`agent.tool_use`/`agent.mcp_tool_use` event (e.g. a tool configured
+`always_ask`) **pauses the session** until a `user.tool_confirmation` event
+arrives — a real, documented pre-execution veto ("Denied tools do not run.").
+`IntuticSessionConfirmer` answers those pauses with a `Gate.guard()` verdict,
+via polling, a webhook (`session.requires_action`), or a live stream. A tool
+configured `always_allow` never pauses and is therefore never seen by
+Intutic at all — see TD-425.
+
+`agent.custom_tool_use` (your own tools) has no pause concept — it is gated
+at the point YOUR code executes it instead, via
+`wrapManagedAgentsCustomTool`/`wrapManagedAgentsCustomTools` (the
+`BetaRunnableTool.run()` shape, not `.execute` — the generic `wrapTools()`
+does not apply here). See `apps/docs/integrations/anthropic-managed-agents.md`
+for the full operator-facing version, including the self-hosted
+`EnvironmentWorker` coverage story and the Python-side custom-tool decorator
+ordering gotcha (TD-427).
+
+## Subpath convention
+
+Eight adapters exist today, one source file each: `@intutic/gate/dsh`
+(`src/dsh.ts` — a Cordis plugin; see its module doc for the veto contract and
+`services/sync-daemon/src/harness/dshHooks.ts` for profile registration),
+`@intutic/gate/mastra` (`src/mastra.ts`), `@intutic/gate/vercel`
+(`src/vercel.ts`), `@intutic/gate/openai` (`src/openai.ts` — see above),
+`@intutic/gate/eve` (`src/eve.ts` — approval policies for eve's
+per-tool/per-connection `approval` surface, plus the observe-only
+`intuticAuditHooks()`; verified against a pinned `eve@0.39.1` install — a
+pre-1.0 Preview product, see its module doc and TD-410), `@intutic/gate/harness`
+(`src/harness.ts` — see above), `@intutic/gate/workflow` (`src/workflow.ts`
+— see above), and `@intutic/gate/managed-agents` (`src/managedAgents.ts` — see
+above). Later adapter phases follow the SAME convention (also
+`services/sync-daemon`'s existing subpath convention — see that package's
+`package.json`):
+
+1. One source file per adapter: `src/vercel.ts`, `src/mastra.ts`,
+   `src/dsh.ts`, `src/harness.ts`, `src/workflow.ts`, `src/managedAgents.ts`.
+2. An `exports` entry per adapter in `package.json`:
+   ```json
+   "./vercel": { "import": "./dist/vercel.js", "types": "./dist/vercel.d.ts" }
+   ```
+3. A matching `typesVersions` entry so editors resolve types from source
+   pre-build:
+   ```json
+   "typesVersions": { "*": { "vercel": ["src/vercel.ts"] } }
+   ```
+4. Each adapter file imports from `./gate.js`, `./errors.js`, etc. (this
+   package's core, already built) rather than re-implementing any tier —
+   the whole point of splitting core from adapters is that the four-tier
+   evaluation logic lives in exactly one place.
+
+No stub files are checked in for future adapters; the `exports` map above
+documents the shape they should take rather than pre-committing to file
+names a later phase might want to change.
+
+## Fidelity suite
+
+`src/__tests__/fidelity.test.ts` builds a synthetic `.rules` snapshot from a
+point-in-time copy of the REAL pattern tables in
+`services/sync-daemon/src/harness/protectedPaths.ts`
+(`src/__tests__/fixtures/protectedPathsFixtures.ts` — see that file's header
+for why it is a copy rather than a live cross-package import, and how to
+re-sync it) and asserts `evaluate()` reproduces the same block/warn/shadow
+verdict as each pattern's own `matches`/`notMatches` fixtures, for every
+pattern whose `subject` a `.rules` file can actually carry (`command`,
+`target`, `tool`, `any` — `content`-subject patterns, i.e.
+`SECRET_CONTENT_PATTERNS`, are out of scope: they never reach the snapshot
+channel in the first place, matching the Python SDK's own limitation).

package/dist/actions.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Port of the proxy's command classifier.
+ *
+ * Source of truth: `packages/proxy/src/plugins/anomaly/actions.rs`, by way of
+ * `packages/intutic-clawde/intutic_clawde/gate/actions.py` (the Python SDK's
+ * own transliteration, which this file mirrors line for line rather than
+ * re-deriving from the Rust — see that module's docstring for why: two
+ * independent readings of the Rust drift, one faithful copy of the Python
+ * reading does not).
+ *
+ * The proxy synthesises abstract `action:` tokens from tool calls and
+ * evaluates ordering rules over them. A pre-execution gate has to reach the
+ * SAME verdict the proxy would, one turn earlier — if the two disagree, the
+ * gate either blocks something the proxy would allow, or waves through
+ * something the proxy then refuses.
+ *
+ * Note the trailing spaces in `'update '`, `'truncate '` and `'curl -d '` —
+ * they are load-bearing and must survive editing.
+ */
+export declare const ACTION_PREFIX = "action:";
+/** Commands that put code or artefacts somewhere real. */
+export declare const DEPLOY_PATTERNS: readonly string[];
+/** Commands that publish a package or a release to the outside world. */
+export declare const PUBLISH_PATTERNS: readonly string[];
+/** Commands that cut a release. */
+export declare const RELEASE_PATTERNS: readonly string[];
+/** Commands that run a test suite. */
+export declare const TEST_PATTERNS: readonly string[];
+/** Commands that send data somewhere over the network. */
+export declare const HTTP_POST_PATTERNS: readonly string[];
+/** Commands that write to a database. */
+export declare const DB_WRITE_PATTERNS: readonly string[];
+/**
+ * Path fragments that indicate credential material.
+ *
+ * `kubeconfig` and `service-account` are in here, so any command mentioning
+ * either synthesises `action:secret_read`.
+ */
+export declare const SECRET_PATH_FRAGMENTS: readonly string[];
+/** Path fragments that indicate personal data leaving the system. */
+export declare const PII_PATH_FRAGMENTS: readonly string[];
+/** Tool names harnesses use for "run a shell command". */
+export declare const SHELL_TOOLS: readonly string[];
+/** Tool names harnesses use for "read a file". */
+export declare const READ_TOOLS: readonly string[];
+/** Tool names harnesses use for "fetch a URL". */
+export declare const FETCH_TOOLS: readonly string[];
+/**
+ * Path fragments that indicate infrastructure-as-code.
+ * Source: `packages/proxy/src/manifest.rs:280` (`INFRA_PATH_FRAGMENTS`).
+ * Used to decide when a WRITE deserves an image-integrity check.
+ */
+export declare const INFRA_PATH_FRAGMENTS: readonly string[];
+/**
+ * Concatenate the string-ish values of a tool's arguments, lowercased.
+ *
+ * Which key holds the command varies by harness (`command`, `cmd`, `script`,
+ * `file_path`, `path`, `url`), and a new harness will invent another. Reading
+ * every string value means an unknown key still classifies correctly.
+ *
+ * Mirrors the Python/Rust exactly, including the leading space before each
+ * nested value — spacing changes which patterns can straddle a value
+ * boundary.
+ */
+export declare function flattenInput(value: unknown): string;
+export declare function matchesAny(haystack: string, patterns: readonly string[]): boolean;
+/**
+ * Match a tool name against a group.
+ *
+ * `endsWith` is what lets namespaced names like `mcp__sh__bash` classify.
+ */
+export declare function toolIs(name: string, group: readonly string[]): boolean;
+/**
+ * Classify one tool call into the abstract actions it performs.
+ *
+ * Returns prefixed tokens (`action:deploy`, ...) in the order the Rust/Python
+ * emit them. Order matters: the ordering detectors read position in the
+ * sequence.
+ */
+export declare function classify(toolName: string, toolInput: unknown): string[];
+/** True when this call would deploy — the trigger for the image check. */
+export declare function isDeploy(toolName: string, toolInput: unknown): boolean;
+export declare function isTest(toolName: string, toolInput: unknown): boolean;
+/** True when a written path is infrastructure-as-code. */
+export declare function touchesInfra(path: string | null | undefined): boolean;
+//# sourceMappingURL=actions.d.ts.map

package/dist/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAe5C,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAS7C,CAAA;AAED,mCAAmC;AACnC,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAO7C,CAAA;AAED,sCAAsC;AACtC,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAqB1C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,yCAAyC;AACzC,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAO9C,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAclD,CAAA;AAED,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAQxC,CAAA;AAED,kDAAkD;AAClD,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAAqD,CAAA;AAE7F,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAmE,CAAA;AAE5G;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EASjD,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUnD;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAoBvE;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEtE;AAED,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEpE;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErE"}

package/dist/actions.js

@@ -0,0 +1,239 @@
+/**
+ * Port of the proxy's command classifier.
+ *
+ * Source of truth: `packages/proxy/src/plugins/anomaly/actions.rs`, by way of
+ * `packages/intutic-clawde/intutic_clawde/gate/actions.py` (the Python SDK's
+ * own transliteration, which this file mirrors line for line rather than
+ * re-deriving from the Rust — see that module's docstring for why: two
+ * independent readings of the Rust drift, one faithful copy of the Python
+ * reading does not).
+ *
+ * The proxy synthesises abstract `action:` tokens from tool calls and
+ * evaluates ordering rules over them. A pre-execution gate has to reach the
+ * SAME verdict the proxy would, one turn earlier — if the two disagree, the
+ * gate either blocks something the proxy would allow, or waves through
+ * something the proxy then refuses.
+ *
+ * Note the trailing spaces in `'update '`, `'truncate '` and `'curl -d '` —
+ * they are load-bearing and must survive editing.
+ */
+export const ACTION_PREFIX = 'action:';
+/** Commands that put code or artefacts somewhere real. */
+export const DEPLOY_PATTERNS = [
+    'git push',
+    'kubectl apply',
+    'kubectl rollout',
+    'helm upgrade',
+    'helm install',
+    'terraform apply',
+    'docker push',
+    'serverless deploy',
+    'fly deploy',
+    'vercel deploy',
+    'gcloud run deploy',
+    'aws deploy',
+    'aws s3 sync',
+    'eb deploy',
+];
+/** Commands that publish a package or a release to the outside world. */
+export const PUBLISH_PATTERNS = [
+    'npm publish',
+    'pnpm publish',
+    'yarn publish',
+    'cargo publish',
+    'twine upload',
+    'poetry publish',
+    'gem push',
+    'docker manifest push',
+];
+/** Commands that cut a release. */
+export const RELEASE_PATTERNS = [
+    'gh release create',
+    'git tag',
+    'npm version',
+    'cargo release',
+    'goreleaser release',
+    'semantic-release',
+];
+/** Commands that run a test suite. */
+export const TEST_PATTERNS = [
+    'npm test',
+    'npm run test',
+    'pnpm test',
+    'pnpm run test',
+    'yarn test',
+    'cargo test',
+    'go test',
+    'pytest',
+    'python -m pytest',
+    'vitest',
+    'jest',
+    'mocha',
+    'rspec',
+    'phpunit',
+    'make test',
+    'gradle test',
+    'mvn test',
+    'dotnet test',
+    'bazel test',
+    'tox',
+];
+/** Commands that send data somewhere over the network. */
+export const HTTP_POST_PATTERNS = [
+    'curl -x post',
+    'curl --request post',
+    'curl -d ',
+    'curl --data',
+    'wget --post',
+    'http post',
+];
+/** Commands that write to a database. */
+export const DB_WRITE_PATTERNS = [
+    'insert into',
+    'update ',
+    'delete from',
+    'drop table',
+    'truncate ',
+    'alter table',
+];
+/**
+ * Path fragments that indicate credential material.
+ *
+ * `kubeconfig` and `service-account` are in here, so any command mentioning
+ * either synthesises `action:secret_read`.
+ */
+export const SECRET_PATH_FRAGMENTS = [
+    '.env',
+    'credentials',
+    'id_rsa',
+    'id_ed25519',
+    '.pem',
+    '.p12',
+    '.pfx',
+    'secrets.',
+    '.netrc',
+    '.aws/',
+    '.ssh/',
+    'kubeconfig',
+    'service-account',
+];
+/** Path fragments that indicate personal data leaving the system. */
+export const PII_PATH_FRAGMENTS = [
+    'customer',
+    'users.csv',
+    'pii',
+    'personal',
+    'gdpr',
+    'payroll',
+];
+/** Tool names harnesses use for "run a shell command". */
+export const SHELL_TOOLS = [
+    'bash',
+    'shell',
+    'run_command',
+    'runcommand',
+    'terminal',
+    'execute',
+    'exec',
+];
+/** Tool names harnesses use for "read a file". */
+export const READ_TOOLS = ['read', 'readfile', 'view', 'cat', 'open_file'];
+/** Tool names harnesses use for "fetch a URL". */
+export const FETCH_TOOLS = ['webfetch', 'fetch', 'http_request', 'browser', 'web_search'];
+/**
+ * Path fragments that indicate infrastructure-as-code.
+ * Source: `packages/proxy/src/manifest.rs:280` (`INFRA_PATH_FRAGMENTS`).
+ * Used to decide when a WRITE deserves an image-integrity check.
+ */
+export const INFRA_PATH_FRAGMENTS = [
+    'terraform',
+    '.tf',
+    'k8s/',
+    'kubernetes/',
+    'helm/',
+    'dockerfile',
+    'docker-compose',
+    '.tfstate',
+];
+/**
+ * Concatenate the string-ish values of a tool's arguments, lowercased.
+ *
+ * Which key holds the command varies by harness (`command`, `cmd`, `script`,
+ * `file_path`, `path`, `url`), and a new harness will invent another. Reading
+ * every string value means an unknown key still classifies correctly.
+ *
+ * Mirrors the Python/Rust exactly, including the leading space before each
+ * nested value — spacing changes which patterns can straddle a value
+ * boundary.
+ */
+export function flattenInput(value) {
+    if (typeof value === 'string')
+        return value.toLowerCase();
+    if (Array.isArray(value))
+        return value.map((v) => ' ' + flattenInput(v)).join('');
+    if (value !== null && typeof value === 'object') {
+        return Object.values(value)
+            .map((v) => ' ' + flattenInput(v))
+            .join('');
+    }
+    // Numbers, booleans and null/undefined contribute nothing.
+    return '';
+}
+export function matchesAny(haystack, patterns) {
+    return patterns.some((p) => haystack.includes(p));
+}
+/**
+ * Match a tool name against a group.
+ *
+ * `endsWith` is what lets namespaced names like `mcp__sh__bash` classify.
+ */
+export function toolIs(name, group) {
+    const lower = name.toLowerCase();
+    return group.some((t) => lower === t || lower.endsWith(t));
+}
+/**
+ * Classify one tool call into the abstract actions it performs.
+ *
+ * Returns prefixed tokens (`action:deploy`, ...) in the order the Rust/Python
+ * emit them. Order matters: the ordering detectors read position in the
+ * sequence.
+ */
+export function classify(toolName, toolInput) {
+    const args = flattenInput(toolInput);
+    const actions = [];
+    if (toolIs(toolName, SHELL_TOOLS)) {
+        // Tests first: `make test && git push` is both, and the ordering rule
+        // needs the test to be seen as having happened before the deploy.
+        if (matchesAny(args, TEST_PATTERNS))
+            actions.push('run_tests');
+        if (matchesAny(args, DEPLOY_PATTERNS))
+            actions.push('deploy');
+        if (matchesAny(args, PUBLISH_PATTERNS))
+            actions.push('publish');
+        if (matchesAny(args, RELEASE_PATTERNS))
+            actions.push('release');
+        // Source before sink, so that (secret_read -> http_post) can still fire
+        // on a single command that does both.
+        if (matchesAny(args, SECRET_PATH_FRAGMENTS))
+            actions.push('secret_read');
+        if (matchesAny(args, PII_PATH_FRAGMENTS))
+            actions.push('pii_export');
+        if (matchesAny(args, HTTP_POST_PATTERNS))
+            actions.push('http_post');
+        if (matchesAny(args, DB_WRITE_PATTERNS))
+            actions.push('db_write');
+    }
+    return actions.map((a) => ACTION_PREFIX + a);
+}
+/** True when this call would deploy — the trigger for the image check. */
+export function isDeploy(toolName, toolInput) {
+    return classify(toolName, toolInput).includes(ACTION_PREFIX + 'deploy');
+}
+export function isTest(toolName, toolInput) {
+    return classify(toolName, toolInput).includes(ACTION_PREFIX + 'run_tests');
+}
+/** True when a written path is infrastructure-as-code. */
+export function touchesInfra(path) {
+    return matchesAny((path ?? '').toLowerCase(), INFRA_PATH_FRAGMENTS);
+}
+//# sourceMappingURL=actions.js.map

package/dist/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAA;AAEtC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,mBAAmB;IACnB,YAAY;IACZ,eAAe;IACf,mBAAmB;IACnB,YAAY;IACZ,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,sBAAsB;CACvB,CAAA;AAED,mCAAmC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,mBAAmB;IACnB,SAAS;IACT,aAAa;IACb,eAAe;IACf,oBAAoB;IACpB,kBAAkB;CACnB,CAAA;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,UAAU;IACV,cAAc;IACd,WAAW;IACX,eAAe;IACf,WAAW;IACX,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,QAAQ;IACR,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;IACT,WAAW;IACX,aAAa;IACb,UAAU;IACV,aAAa;IACb,YAAY;IACZ,KAAK;CACN,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,cAAc;IACd,qBAAqB;IACrB,UAAU;IACV,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,aAAa;IACb,SAAS;IACT,aAAa;IACb,YAAY;IACZ,WAAW;IACX,aAAa;CACd,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,MAAM;IACN,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,QAAQ;IACR,OAAO;IACP,OAAO;IACP,YAAY;IACZ,iBAAiB;CAClB,CAAA;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,UAAU;IACV,WAAW;IACX,KAAK;IACL,UAAU;IACV,MAAM;IACN,SAAS;CACV,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,MAAM;IACN,OAAO;IACP,aAAa;IACb,YAAY;IACZ,UAAU;IACV,SAAS;IACT,MAAM;CACP,CAAA;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;AAE7F,kDAAkD;AAClD,MAAM,CAAC,MAAM,WAAW,GAAsB,CAAC,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AAE5G;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,WAAW;IACX,KAAK;IACL,MAAM;IACN,aAAa;IACb,OAAO;IACP,YAAY;IACZ,gBAAgB;IAChB,UAAU;CACX,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;aACjC,IAAI,CAAC,EAAE,CAAC,CAAA;IACb,CAAC;IACD,2DAA2D;IAC3D,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,QAA2B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAwB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,IAAI,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAClC,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC9D,IAAI,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC7D,IAAI,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC/D,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,UAAU,CAAC,IAAI,EAAE,qBAAqB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACxE,IAAI,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACpE,IAAI,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACnE,IAAI,UAAU,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACnE,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,QAAQ,CAAC,CAAA;AACzE,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,SAAkB;IACzD,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,WAAW,CAAC,CAAA;AAC5E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAA+B;IAC1D,OAAO,UAAU,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,oBAAoB,CAAC,CAAA;AACrE,CAAC"}