@intutic/gate 1.10.1

package/dist/harness.js

@@ -0,0 +1,504 @@
+/**
+ * `@ai-sdk/harness` adapter: `intuticApprovalResponder()`, `intuticSubmitApprovals()`,
+ * `intuticStaticApprovals()`, `recommendedHarnessSettings()`, and
+ * `intuticSandboxBootstrap()`.
+ *
+ * `@intutic/gate/harness` — the same idea `vercel.ts` implements for the base
+ * `ai` package (wrap the framework's own veto point around this package's
+ * `Gate.guard()`), reshaped for Vercel's sandboxed coding-agent runtime,
+ * whose veto surface is materially different from `generateText`'s.
+ *
+ * ## Confirmed against a real install
+ *
+ * `@ai-sdk/harness@1.0.75` (plus `@ai-sdk/harness-claude-code@1.0.78` and
+ * `@ai-sdk/harness-grok-build@1.0.12`) were installed and their shipped
+ * `.d.ts`/compiled source read directly (not inferred from docs alone):
+ *
+ * 1. **The `toolApproval` setting is STATIC.** `HarnessAgentSettings.toolApproval`
+ *    is `HarnessAgentToolApprovalConfiguration = Readonly<Record<string,
+ *    ToolApprovalStatus>>` (`dist/agent/index.d.ts`), whose own doc comment says
+ *    it mirrors "AI SDK `toolApproval` object configuration for host-executed
+ *    tools, **without callback support**". `vercel.ts`'s callback-shaped
+ *    `intuticToolApproval()` therefore does NOT apply here — there is no place
+ *    to hang a function. Per-call gating instead goes through the approval
+ *    FLOW: mark tools `'user-approval'` (see {@link intuticStaticApprovals}),
+ *    let the turn pause, and answer each pending approval with the gate
+ *    (see {@link intuticApprovalResponder}).
+ * 2. **The portable answer path is continuation-based.**
+ *    `HarnessAgentToolApprovalContinuation` carries `{ approvalResponse,
+ *    toolCall }`; `continueTurn`/`continueGenerate`/`continueStream` accept
+ *    `toolApprovalContinuations` (dist/agent/index.d.ts). The adapter-session
+ *    method `session.submitToolApproval?({approvalId, approved, reason})` is
+ *    OPTIONAL (`dist/index.d.ts` — `HarnessV1PromptControl`), and support
+ *    genuinely varies per adapter: `@ai-sdk/harness-claude-code@1.0.78`
+ *    implements it; `@ai-sdk/harness-grok-build@1.0.12` does not (zero
+ *    occurrences in its shipped dist). This module therefore builds the
+ *    responder on the continuation path and treats `submitToolApproval` as an
+ *    optimization when present ({@link intuticSubmitApprovals}).
+ * 3. **Built-in sandbox tools are NOT governed by `toolApproval` at all.**
+ *    They are governed only by `permissionMode: 'allow-reads' | 'allow-edits'
+ *    | 'allow-all'`, which **defaults to `'allow-all'`** — the shipped doc
+ *    comment says so verbatim: "Defaults to `'allow-all'`, preserving the
+ *    existing bypass-permissions behavior unless users opt in." A HarnessAgent
+ *    with default settings runs read/write/edit/bash/glob/grep in the sandbox
+ *    with no approval step this gate could hook.
+ *    {@link recommendedHarnessSettings} exists to steer callers off that
+ *    default.
+ * 4. **Execution is server-side, in a sandbox.** The agent's tools run inside
+ *    a microVM (`@ai-sdk/sandbox-vercel` and friends), NOT on the machine
+ *    where the Intutic proxy runs — the laptop proxy cannot see sandbox
+ *    egress. The only egress control available at this layer is the sandbox's
+ *    own `HarnessV1NetworkPolicy` (`{mode:'allow-all'|'deny-all'} | {mode:
+ *    'custom', allowedHosts/allowedCIDRs/deniedCIDRs}`), applied via the
+ *    sandbox session's optional `setNetworkPolicy?.()`. That is coarse
+ *    host-level filtering, not Intutic DLP — stated plainly in
+ *    `apps/docs/integrations/ai-sdk-harness.md` rather than oversold.
+ *
+ * ## What this module does NOT import
+ *
+ * Deliberately no runtime dependency on `@ai-sdk/harness` — the structural
+ * types below capture only the shapes this adapter touches, matching the
+ * convention `vercel.ts`/`mastra.ts`/`dsh.ts` established. The real package
+ * is a devDependency used by `__tests__/harness.test.ts` to (a) structurally
+ * check these types against the shipped ones and (b) run this responder's
+ * output through the REAL `collectHarnessAgentToolApprovalContinuations`
+ * machinery.
+ *
+ * @module
+ */
+import { createHash } from 'node:crypto';
+import { active as activeGate } from './gate.js';
+import { IntuticGateRefusal } from './errors.js';
+/**
+ * Render a pending approval's `input` as the `tool_input` object
+ * {@link Gate.guard} evaluates.
+ *
+ * Mirrors `dsh.ts`'s `renderDshToolInput`, plus one harness-specific case: a
+ * `HarnessAgentPendingToolApproval` carries its input as a JSON **string**,
+ * so strings are parsed first. A string that does not parse (or parses to a
+ * non-object) falls back to `{ args: [...] }` so the gate still has
+ * something to evaluate rather than throwing on a shape it does not
+ * recognise.
+ */
+export function renderHarnessToolInput(input) {
+    let value = input;
+    if (typeof value === 'string') {
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            return { args: [input] };
+        }
+    }
+    if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    return { args: [value] };
+}
+/** Parsed-if-possible view of a request's input, used on the continuation's
+ *  `toolCall.input` so the shape matches what the tool call actually carried
+ *  (a pending-approval row serializes it to a JSON string in transit). */
+function parsedInput(input) {
+    if (typeof input !== 'string')
+        return input;
+    try {
+        return JSON.parse(input);
+    }
+    catch {
+        return input;
+    }
+}
+/**
+ * Build an approval responder: a function that evaluates each pending
+ * tool-approval request via `Gate.guard()` and produces the
+ * `toolApprovalContinuations` array for the continue-turn call —
+ * `agent.continueGenerate({ session, toolApprovalContinuations })` /
+ * `continueStream(...)`:
+ *
+ * ```ts
+ * import { HarnessAgent } from '@ai-sdk/harness/agent'
+ * import { Gate, install } from '@intutic/gate'
+ * import {
+ *   intuticApprovalResponder,
+ *   intuticStaticApprovals,
+ *   recommendedHarnessSettings,
+ * } from '@intutic/gate/harness'
+ *
+ * install(new Gate({ workspaceId: process.env.INTUTIC_WORKSPACE_ID }))
+ *
+ * const agent = new HarnessAgent({
+ *   harness,
+ *   sandbox,
+ *   tools,
+ *   ...recommendedHarnessSettings(),           // permissionMode: 'allow-edits'
+ *   toolApproval: intuticStaticApprovals(tools), // every custom tool -> 'user-approval'
+ * })
+ *
+ * const respond = intuticApprovalResponder()
+ * // ...run a turn; when it pauses awaiting approval, collect the pending
+ * // tool-approval requests (stream parts or suspended-session rows), then:
+ * const toolApprovalContinuations = await respond(pendingApprovals)
+ * await agent.continueGenerate({ session, toolApprovalContinuations })
+ * ```
+ *
+ * Decision mapping, per request:
+ *
+ *   - gate allows              -> `approved: true`
+ *   - `IntuticGateRefusal`     -> `approved: false`, `reason` = the
+ *     `[Intutic Governance] BLOCKED: ...` message (the runtime submits an
+ *     `execution-denied` result to the model in place of a tool result)
+ *   - any OTHER throw          -> `approved: false` with a "gate crashed"
+ *     reason — **fail closed**, same posture as `dsh.ts`'s listener: this
+ *     responder's output is a decision list consumed by a paused turn, and a
+ *     deny is deliverable and auditable where an escaped throw could leave
+ *     the turn suspended with no answer at all.
+ *
+ * Requires a `Gate` — either passed via `{ gate }`, or installed process-wide
+ * with `install(new Gate(...))`. A call with neither rejects before
+ * evaluating anything, refusing to answer approvals unguarded.
+ */
+export function intuticApprovalResponder(opts = {}) {
+    return async (requests) => {
+        const g = opts.gate ?? activeGate();
+        if (g === null) {
+            throw new Error('No gate configured: call install(new Gate(...)) from @intutic/gate, or pass ' +
+                '{ gate } to intuticApprovalResponder(). Refusing to answer tool approvals unguarded.');
+        }
+        const continuations = [];
+        for (const req of requests) {
+            let approved = true;
+            let reason;
+            try {
+                await g.guard(req.toolName, renderHarnessToolInput(req.input));
+            }
+            catch (exc) {
+                approved = false;
+                if (exc instanceof IntuticGateRefusal) {
+                    reason = exc.message;
+                }
+                else {
+                    const detail = exc instanceof Error ? exc.message : String(exc);
+                    reason =
+                        `[Intutic Governance] BLOCKED: gate crashed (${detail}) — failing closed rather ` +
+                            'than approving an unevaluated call.';
+                }
+            }
+            continuations.push({
+                approvalResponse: {
+                    type: 'tool-approval-response',
+                    approvalId: req.approvalId,
+                    approved,
+                    ...(reason !== undefined ? { reason } : {}),
+                    ...(req.providerExecuted !== undefined ? { providerExecuted: req.providerExecuted } : {}),
+                },
+                toolCall: {
+                    type: 'tool-call',
+                    toolCallId: req.toolCallId,
+                    toolName: req.toolName,
+                    input: parsedInput(req.input),
+                    ...(req.providerExecuted !== undefined ? { providerExecuted: req.providerExecuted } : {}),
+                },
+            });
+        }
+        return continuations;
+    };
+}
+/**
+ * Evaluate pending approvals and deliver the decisions through
+ * `session.submitToolApproval` when the adapter supports it.
+ *
+ * `submitToolApproval` is an OPTIONAL adapter-session method and per-adapter
+ * support varies (`harness-claude-code` implements it, `harness-grok-build`
+ * does not — see module doc point 2). This helper treats it as an
+ * optimization: when present, every decision is submitted directly (the turn
+ * resumes in place); when absent, nothing is submitted and the caller passes
+ * the returned `continuations` to `continueGenerate`/`continueStream` — the
+ * portable path — instead. Either way the SAME evaluated decisions are
+ * returned, so the caller never re-runs the gate for one delivery mechanism
+ * vs. the other.
+ */
+export async function intuticSubmitApprovals(session, requests, opts = {}) {
+    const continuations = await intuticApprovalResponder(opts)(requests);
+    const submit = session.submitToolApproval?.bind(session);
+    if (submit === undefined) {
+        return { continuations, submitted: false };
+    }
+    for (const c of continuations) {
+        await submit({
+            approvalId: c.approvalResponse.approvalId,
+            approved: c.approvalResponse.approved,
+            ...(c.approvalResponse.reason !== undefined ? { reason: c.approvalResponse.reason } : {}),
+        });
+    }
+    return { continuations, submitted: true };
+}
+/**
+ * Build the static `toolApproval` record for `HarnessAgentSettings`.
+ *
+ * The record shape is `Readonly<Record<string, ToolApprovalStatus>>` — STATIC
+ * per-tool statuses "without callback support" (the shipped doc comment's own
+ * words), so a per-call gate function cannot be expressed here at all. What a
+ * static record CAN express is deny-by-default **routing**: every listed tool
+ * is marked `'user-approval'`, which pauses the turn on every call to it, and
+ * {@link intuticApprovalResponder} then answers each pause with a real
+ * per-call `Gate.guard()` verdict. `'denied'` is deliberately NOT the default
+ * here — it would refuse every call to the tool unconditionally, without the
+ * gate ever seeing the arguments; use `{ deny: [...] }` for tools where that
+ * is actually what you want.
+ *
+ * Two scope limits, stated plainly:
+ *
+ *   - This covers CUSTOM host-executed tools only. Built-in sandbox tools
+ *     (read/write/edit/bash/...) never consult `toolApproval` — they are
+ *     governed solely by `permissionMode`, which defaults to `'allow-all'`.
+ *     See {@link recommendedHarnessSettings}.
+ *   - A tool absent from this record has status `undefined` =
+ *     "not-applicable" and runs WITHOUT any approval pause. Pass the same
+ *     `tools` record you give the agent (or every tool name), not a subset.
+ */
+export function intuticStaticApprovals(tools, opts = {}) {
+    const names = Array.isArray(tools) ? tools : Object.keys(tools);
+    const denied = new Set(opts.deny ?? []);
+    const record = {};
+    for (const name of names) {
+        record[name] = denied.has(name) ? 'denied' : 'user-approval';
+    }
+    return record;
+}
+/**
+ * The settings posture this integration recommends, as a value callers can
+ * spread/apply rather than prose they have to transcribe:
+ *
+ *   - `permissionMode: 'allow-edits'` (or `'allow-reads'`) — because the
+ *     framework's own default is `'allow-all'`, under which built-in sandbox
+ *     tools (including `bash`) run with no approval surface this gate can
+ *     reach. There is no per-call gate for built-ins at ANY permissionMode;
+ *     the mode itself is the entire control, which is why steering it off
+ *     `'allow-all'` matters.
+ *   - a `networkPolicy` for the sandbox — `{ mode: 'deny-all' }` by default,
+ *     or a `custom` allow-list (with the cloud-metadata CIDR denied) when
+ *     `allowedHosts` is given. This is the honest egress-governance story for
+ *     server-side sandbox execution: the Intutic proxy on the developer's
+ *     machine never sees sandbox traffic, and host-level filtering is what
+ *     the sandbox layer actually offers. It is coarse — no DLP, no
+ *     per-request policy — and the integration docs say so.
+ */
+export function recommendedHarnessSettings(opts = {}) {
+    const networkPolicy = opts.allowedHosts !== undefined && opts.allowedHosts.length > 0
+        ? {
+            mode: 'custom',
+            allowedHosts: opts.allowedHosts,
+            // Cloud metadata endpoint — deny it even when the caller's allow
+            // list is broad; deniedCIDRs wins over allows in the real policy.
+            deniedCIDRs: ['169.254.169.254/32'],
+        }
+        : { mode: 'deny-all' };
+    return {
+        permissionMode: opts.permissionMode ?? 'allow-edits',
+        networkPolicy,
+        ...(opts.filterBash === false ? {} : { inactiveTools: ['bash'] }),
+    };
+}
+function sandboxJoin(workDir, relative) {
+    const base = workDir.endsWith('/') ? workDir.slice(0, -1) : workDir;
+    return `${base}/${relative}`;
+}
+/**
+ * Self-contained (zero-`require`) hand-port of `snapshot.ts`'s
+ * `normalise`/`evaluate` — Tier A1 only. See the module-level comment above
+ * for what this deliberately does and does not cover, and
+ * `__tests__/harness.test.ts` for the behavioural-parity check against the
+ * real `snapshot.evaluate()` this port is pinned to.
+ *
+ * Contract matches the laptop's `claude-code-check.js`
+ * (`services/sync-daemon/src/harness/claudeCodeHooks.ts`) deliberately:
+ * Claude Code's PreToolUse hook stdin carries `{tool_name, tool_input,
+ * session_id}` (this reads both the snake_case and camelCase field names,
+ * same as the laptop script); exit `2` blocks the call, exit `0` allows it;
+ * any parse/read error fails CLOSED (exit `2`), the same posture
+ * `emitJsFailClosedPrelude` documents for the laptop's version.
+ */
+function renderSandboxGateScript(rulesFileName) {
+    return `#!/usr/bin/env node
+'use strict';
+/**
+ * Intutic sandbox PreToolUse gate (Tier A1 only — policy-snapshot rules).
+ * Auto-generated by @intutic/gate's intuticSandboxBootstrap(). DO NOT EDIT.
+ *
+ * Unlike the laptop's claude-code-check.js, this script has no live
+ * control-plane connection at call time (the recommended sandbox network
+ * policy is deny-all) and therefore implements NEITHER the SOP tier (A3)
+ * NOR review-hold parking NOR governance-event draining. See TD-417.
+ */
+const fs = require('fs');
+const path = require('path');
+
+const RULES_PATH = path.join(__dirname, ${JSON.stringify(rulesFileName)});
+
+function normalise(v) {
+  const s = v === null || v === undefined ? '' : String(v);
+  return ' ' + s.replace(/\\s+/g, ' ').trim() + ' ';
+}
+
+function loadRules() {
+  let text;
+  try {
+    text = fs.readFileSync(RULES_PATH, 'utf-8');
+  } catch (e) {
+    return [];
+  }
+  const rules = [];
+  for (const line of text.split('\\n')) {
+    if (!line || line.charAt(0) === '#') continue;
+    const f = line.split('\\t');
+    if (f.length < 6 || !f[5]) continue;
+    try {
+      rules.push({
+        id: f[0],
+        severity: f[1],
+        subject: f[3] || 'any',
+        reason: f[4],
+        pattern: new RegExp(f[5], f[2] === 'i' ? 'i' : ''),
+      });
+    } catch (e) {
+      // Regex would not compile — dropped, not fatal. Matches snapshot.ts.
+    }
+  }
+  return rules;
+}
+
+function evaluate(toolName, target, command, rules) {
+  const nTool = normalise(toolName);
+  const nCommand = normalise(command);
+  const nTarget = normalise(target);
+  for (const rule of rules) {
+    const subjects =
+      rule.subject === 'tool' ? [nTool] :
+      rule.subject === 'command' ? [nCommand] :
+      rule.subject === 'target' ? [nTarget] :
+      [nCommand, nTarget];
+    for (const subject of subjects) {
+      if (!rule.pattern.test(subject)) continue;
+      return { severity: rule.severity, reason: rule.reason + ' [' + rule.id + ']' };
+    }
+  }
+  return null;
+}
+
+let inputData = '';
+process.stdin.on('data', (chunk) => { inputData += chunk; });
+process.stdin.on('end', () => {
+  try {
+    const ctx = JSON.parse(inputData || '{}');
+    const toolName = ctx.tool_name || ctx.toolName || '';
+    const toolInput = ctx.tool_input || ctx.toolInput || {};
+    const target = toolInput.path || toolInput.file_path || toolInput.filePath ||
+      toolInput.new_path || toolInput.target || toolInput.notebook_path || '';
+    const command = String(toolInput.command || toolInput.cmd || toolInput.script || '');
+    const rules = loadRules();
+    const decision = evaluate(toolName, target, command, rules);
+    if (decision && decision.severity === 'block') {
+      console.error('[Intutic Guardrail] BLOCKED: ' + decision.reason);
+      process.exit(2);
+    }
+    if (decision && (decision.severity === 'warn' || decision.severity === 'shadow')) {
+      console.error('[Intutic Guardrail] FLAGGED (' + decision.severity + '): ' + decision.reason);
+    }
+    process.exit(0);
+  } catch (err) {
+    // Fail CLOSED — any hook execution error blocks the tool call, the same
+    // posture emitJsFailClosedPrelude documents for the laptop script.
+    console.error('[Intutic Guardrail] Hook error (blocking for safety):', err && err.message ? err.message : err);
+    process.exit(2);
+  }
+});
+`;
+}
+/**
+ * Compiles the `.claude/settings.json` content that registers the generated
+ * hook script — same matcher set and hook shape as the laptop writer's
+ * `hookEntry()` (`services/sync-daemon/src/harness/claudeCodeHooks.ts`):
+ * `Bash`, `Edit`, `Write`, `MultiEdit`, and `mcp__.*`.
+ */
+function renderSandboxClaudeSettings(hookScriptSandboxPath) {
+    const hookEntry = (matcher) => ({
+        matcher,
+        hooks: [
+            {
+                type: 'command',
+                command: `node ${hookScriptSandboxPath}`,
+                timeout: 10,
+                statusMessage: 'Verifying tool execution against Intutic SOP policy...',
+            },
+        ],
+    });
+    const settings = {
+        permissions: { deny: [] },
+        hooks: {
+            PreToolUse: [hookEntry('Bash'), hookEntry('Edit'), hookEntry('Write'), hookEntry('MultiEdit'), hookEntry('mcp__.*')],
+        },
+    };
+    return JSON.stringify(settings, null, 2) + '\n';
+}
+/**
+ * Builds `{ bootstrapHash, onBootstrap }` for
+ * `HarnessAgentSettings.sandboxConfig` — the channel TD-417 identified as
+ * existing but unused:
+ *
+ * ```ts
+ * import { HarnessAgent } from '@ai-sdk/harness/agent'
+ * import { intuticSandboxBootstrap, recommendedHarnessSettings } from '@intutic/gate/harness'
+ *
+ * const agent = new HarnessAgent({
+ *   harness,
+ *   sandbox,
+ *   ...recommendedHarnessSettings(),
+ *   sandboxConfig: intuticSandboxBootstrap({
+ *     policySnapshotRules: fs.readFileSync(snapshotPath(), 'utf-8'),
+ *     workspaceId: process.env.INTUTIC_WORKSPACE_ID,
+ *   }),
+ * })
+ * ```
+ *
+ * Writes two files under `<workDir>/<bootstrapDir>` (default
+ * `.intutic/hooks`) — the rules text verbatim, and a self-contained hook
+ * script implementing Tier A1 against it (see
+ * {@link renderSandboxGateScript}) — plus `.claude/settings.json` at
+ * `<workDir>/.claude/settings.json` registering that script as a
+ * `PreToolUse` hook. See the module-level comment above this section for
+ * what this does and does not cover, and why.
+ */
+export function intuticSandboxBootstrap(opts = {}) {
+    const bootstrapDir = opts.bootstrapDir ?? '.intutic/hooks';
+    const rulesRelPath = `${bootstrapDir}/policy-snapshot.rules`;
+    const scriptRelPath = `${bootstrapDir}/claude-code-check.js`;
+    const rulesContent = opts.policySnapshotRules ?? '';
+    const scriptContent = renderSandboxGateScript('policy-snapshot.rules');
+    // Same hashing convention `snapshot.ts` already uses for the policy
+    // digest (`createHash('sha256')` from node:crypto) — not a new mechanism.
+    const bootstrapHash = createHash('sha256')
+        .update(`workspace:${opts.workspaceId ?? ''} `)
+        .update(`${rulesRelPath}\x00${rulesContent}\x00${scriptRelPath}\x00${scriptContent}`)
+        .digest('hex');
+    return {
+        bootstrapHash,
+        onBootstrap: async ({ session, workDir }) => {
+            // Absolute paths throughout, matching the laptop writer's own
+            // convention (claudeCodeHooks.ts's hookEntry() always joins an
+            // absolute workspaceRoot) - a PreToolUse hook's invocation cwd is not
+            // guaranteed to be workDir, so a relative command would be fragile.
+            const scriptAbsPath = sandboxJoin(workDir, scriptRelPath);
+            const files = [
+                { path: sandboxJoin(workDir, rulesRelPath), content: rulesContent },
+                { path: scriptAbsPath, content: scriptContent },
+                { path: sandboxJoin(workDir, '.claude/settings.json'), content: renderSandboxClaudeSettings(scriptAbsPath) },
+            ];
+            for (const f of files) {
+                await session.writeTextFile({ path: f.path, content: f.content });
+            }
+        },
+    };
+}
+// Exposed for the behavioural-parity test — not part of the public surface.
+export const _internal = { renderSandboxGateScript, renderSandboxClaudeSettings, sandboxJoin };
+//# sourceMappingURL=harness.js.map

package/dist/harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../src/harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,MAAM,IAAI,UAAU,EAA6B,MAAM,WAAW,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAoFhD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAAkB,CAAA;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1B,CAAC;AAED;;0EAE0E;AAC1E,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAwC,EAAE;IAE1C,OAAO,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,CAAA;QACnC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8EAA8E;gBAC5E,sFAAsF,CACzF,CAAA;QACH,CAAC;QAED,MAAM,aAAa,GAAsC,EAAE,CAAA;QAC3D,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,QAAQ,GAAG,IAAI,CAAA;YACnB,IAAI,MAA0B,CAAA;YAC9B,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;YAChE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,GAAG,KAAK,CAAA;gBAChB,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;oBACtC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAA;gBACtB,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;oBAC/D,MAAM;wBACJ,+CAA+C,MAAM,4BAA4B;4BACjF,qCAAqC,CAAA;gBACzC,CAAC;YACH,CAAC;YACD,aAAa,CAAC,IAAI,CAAC;gBACjB,gBAAgB,EAAE;oBAChB,IAAI,EAAE,wBAAwB;oBAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,QAAQ;oBACR,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3C,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1F;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,WAAW;oBACjB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC;oBAC7B,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1F;aACF,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC,CAAA;AACH,CAAC;AAYD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA2B,EAC3B,QAA2C,EAC3C,OAAwC,EAAE;IAE1C,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IAC5C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,CAAC;YACX,UAAU,EAAE,CAAC,CAAC,gBAAgB,CAAC,UAAU;YACzC,QAAQ,EAAE,CAAC,CAAC,gBAAgB,CAAC,QAAQ;YACrC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1F,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAC3C,CAAC;AASD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAkD,EAClD,OAAsC,EAAE;IAExC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IACvC,MAAM,MAAM,GAA+C,EAAE,CAAA;IAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAA;IAC9D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAsFD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0C,EAAE;IAE5C,MAAM,aAAa,GACjB,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAC7D,CAAC,CAAC;YACE,IAAI,EAAE,QAAQ;YACd,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,iEAAiE;YACjE,kEAAkE;YAClE,WAAW,EAAE,CAAC,oBAAoB,CAAC;SACpC;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IAC1B,OAAO;QACL,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,aAAa;QACpD,aAAa;QACb,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,MAAM,CAAU,EAAE,CAAC;KAC3E,CAAA;AACH,CAAC;AAuKD,SAAS,WAAW,CAAC,OAAe,EAAE,QAAgB;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IACnE,OAAO,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,uBAAuB,CAAC,aAAqB;IACpD,OAAO;;;;;;;;;;;;;;0CAciC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+EtE,CAAA;AACD,CAAC;AAED;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,qBAA6B;IAChE,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO;QACP,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,QAAQ,qBAAqB,EAAE;gBACxC,OAAO,EAAE,EAAE;gBACX,aAAa,EAAE,wDAAwD;aACxE;SACF;KACF,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG;QACf,WAAW,EAAE,EAAE,IAAI,EAAE,EAAc,EAAE;QACrC,KAAK,EAAE;YACL,UAAU,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;SACrH;KACF,CAAA;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAuC,EAAE;IAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,gBAAgB,CAAA;IAC1D,MAAM,YAAY,GAAG,GAAG,YAAY,wBAAwB,CAAA;IAC5D,MAAM,aAAa,GAAG,GAAG,YAAY,uBAAuB,CAAA;IAE5D,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAA;IACnD,MAAM,aAAa,GAAG,uBAAuB,CAAC,uBAAuB,CAAC,CAAA;IAEtE,oEAAoE;IACpE,0EAA0E;IAC1E,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;SACvC,MAAM,CAAC,aAAa,IAAI,CAAC,WAAW,IAAI,EAAE,GAAG,CAAC;SAC9C,MAAM,CAAC,GAAG,YAAY,OAAO,YAAY,OAAO,aAAa,OAAO,aAAa,EAAE,CAAC;SACpF,MAAM,CAAC,KAAK,CAAC,CAAA;IAEhB,OAAO;QACL,aAAa;QACb,WAAW,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;YAC1C,8DAA8D;YAC9D,+DAA+D;YAC/D,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YACzD,MAAM,KAAK,GAAqD;gBAC9D,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE;gBACnE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE;gBAC/C,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,2BAA2B,CAAC,aAAa,CAAC,EAAE;aAC7G,CAAA;YACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,WAAW,EAAE,CAAA"}

package/dist/headers.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Port of `intutic_headers()` from
+ * `packages/intutic-clawde/intutic_clawde/gate/framework.py`.
+ */
+export interface IntuticHeadersOptions {
+    sessionId?: string;
+    workspaceId?: string;
+    /** Attributes traces to this adapter. Defaults to `"generic"`. */
+    harness?: string;
+}
+/**
+ * Default headers for a client pointed at the Intutic proxy (an OpenAI-
+ * compatible chat client, a raw `fetch` call, etc.).
+ *
+ * `x-session-id` matters: the proxy defaults an unset one to the literal
+ * `"unknown"`, which merges every run into a single dashboard session.
+ * `x-intutic-harness` attributes traces to this adapter — the proxy honours
+ * it for trace attribution (unknown headers are ignored by older proxies, so
+ * it is always safe to send).
+ *
+ * Usage:
+ *
+ *     const client = new OpenAI({ baseURL: proxyUrl, defaultHeaders: intuticHeaders({ sessionId: runId }) })
+ */
+export declare function intuticHeaders(opts?: IntuticHeadersOptions): Record<string, string>;
+//# sourceMappingURL=headers.d.ts.map

package/dist/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWvF"}

package/dist/headers.js

@@ -0,0 +1,30 @@
+/**
+ * Port of `intutic_headers()` from
+ * `packages/intutic-clawde/intutic_clawde/gate/framework.py`.
+ */
+/**
+ * Default headers for a client pointed at the Intutic proxy (an OpenAI-
+ * compatible chat client, a raw `fetch` call, etc.).
+ *
+ * `x-session-id` matters: the proxy defaults an unset one to the literal
+ * `"unknown"`, which merges every run into a single dashboard session.
+ * `x-intutic-harness` attributes traces to this adapter — the proxy honours
+ * it for trace attribution (unknown headers are ignored by older proxies, so
+ * it is always safe to send).
+ *
+ * Usage:
+ *
+ *     const client = new OpenAI({ baseURL: proxyUrl, defaultHeaders: intuticHeaders({ sessionId: runId }) })
+ */
+export function intuticHeaders(opts = {}) {
+    const harness = opts.harness ?? 'generic';
+    const headers = { 'x-intutic-harness': harness };
+    const sess = opts.sessionId || process.env.INTUTIC_SESSION_ID || '';
+    if (sess)
+        headers['x-session-id'] = sess;
+    const ws = opts.workspaceId || process.env.INTUTIC_WORKSPACE_ID || '';
+    if (ws)
+        headers['x-workspace-id'] = ws;
+    return headers;
+}
+//# sourceMappingURL=headers.js.map

package/dist/headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B,EAAE;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAA;IACzC,MAAM,OAAO,GAA2B,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAA;IAExE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;IACnE,IAAI,IAAI;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAA;IAExC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAA;IACrE,IAAI,EAAE;QAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAA;IAEtC,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/imagecheck.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Container image integrity checking.
+ *
+ * Port of `packages/intutic-clawde/intutic_clawde/gate/imagecheck.py`.
+ *
+ * Given a deploy command, find the manifests it would apply, extract every
+ * container image reference, and check each against an allowlist of approved
+ * sha256 digests. Nothing else in Intutic does this — no cosign, no sigstore,
+ * no admission webhook — so this check is the argument-level enforcement
+ * point for "deploy only pinned, reviewed images".
+ *
+ * Fail-closed on anything it cannot read. That is a deliberate departure from
+ * Intutic's fail-open default (WASM rules, hook-gate, the MCP proxy all fail
+ * open). The reasoning: a gate that cannot parse what it is being asked to
+ * approve does not know what it is approving, and "I could not read it" is
+ * not evidence of safety.
+ */
+export declare const E_UNPINNED_LATEST = "E_UNPINNED_LATEST";
+export declare const E_UNPINNED_TAG = "E_UNPINNED_TAG";
+export declare const E_UNKNOWN_REGISTRY = "E_UNKNOWN_REGISTRY";
+export declare const E_UNKNOWN_IMAGE = "E_UNKNOWN_IMAGE";
+export declare const E_DIGEST_MISMATCH = "E_DIGEST_MISMATCH";
+export declare const E_MANIFEST_UNPARSEABLE = "E_MANIFEST_UNPARSEABLE";
+/** A parsed container image reference. */
+export interface ImageRef {
+    raw: string;
+    /** registry/namespace/name, no tag, no digest */
+    repository: string;
+    tag: string | null;
+    /** `sha256:...` or null */
+    digest: string | null;
+    /** which manifest file it came from */
+    source: string;
+}
+export declare function isPinned(img: ImageRef): boolean;
+export interface ImagePolicy {
+    require_digest?: boolean;
+    registries_allowed?: string[];
+    images?: Record<string, {
+        approved_digests?: string[];
+    }>;
+}
+export interface Verdict {
+    ok: boolean;
+    code: string;
+    detail: string;
+    images: ImageRef[];
+}
+/** The single line an operator sees on the dashboard. */
+export declare function verdictReason(v: Verdict): string;
+/**
+ * Parse `registry/repo:tag@sha256:...` into its parts.
+ *
+ * Docker's own rule for splitting registry from repository: the first path
+ * component is a registry host only if it contains a dot or a colon, or is
+ * exactly `localhost`. This function does not need to make that
+ * classification itself — it only needs to find the tag/digest boundary,
+ * which is a colon (or `@`) in the LAST path component; a colon earlier
+ * (a registry port, `localhost:5000/foo`) is left alone.
+ */
+export declare function parseImageRef(raw: string, source?: string): ImageRef;
+/**
+ * Extract the -f/-k targets from a kubectl/helm command.
+ *
+ * Returns `{paths, readable}`. `readable` is false when the command applies
+ * something we cannot inspect — stdin (`-f -`), a URL, or a command we could
+ * not tokenise. That drives the fail-closed path.
+ */
+export declare function manifestPathsFromCommand(command: string): {
+    paths: string[];
+    readable: boolean;
+};
+/**
+ * Catch images named directly on the command line.
+ *
+ * `kubectl set image deploy/catalogue catalogue=repo:latest` never touches a
+ * manifest, so the YAML path would miss it entirely.
+ */
+export declare function inlineImagesFromCommand(command: string): ImageRef[];
+/** Evaluate parsed references against the allowlist. First failure wins. */
+export declare function checkImages(images: readonly ImageRef[], policy: ImagePolicy): Verdict;
+/** Full check for a deploy command. The entry point the gate calls. */
+export declare function checkCommand(command: string, repoRoot: string, policy: ImagePolicy): Verdict;
+/**
+ * Check a manifest at authoring time, before it is ever applied.
+ *
+ * Lets the dashboard show the bad image being *written* a full turn before it
+ * is *applied* — the write is flagged, the apply is blocked.
+ */
+export declare function checkWrittenManifest(path: string, content: string, policy: ImagePolicy): Verdict;
+/** True when this call should be image-checked. */
+export declare function isDeployCommand(toolName: string, toolInput: unknown): boolean;
+//# sourceMappingURL=imagecheck.d.ts.map