@intutic/sync-daemon 1.10.0 → 1.10.1

package/dist/harness/gateBody.d.ts

@@ -0,0 +1,422 @@
+/**
+ * The gate evaluator, emitted once per language instead of written thirteen
+ * times.
+ *
+ * # Why this file exists
+ *
+ * Every harness writer used to hand-author its own copy of the decision logic
+ * inside a TypeScript template literal. Four production defects came directly
+ * out of that arrangement, and each one silently removed enforcement while every
+ * test stayed green:
+ *
+ * - `claudeCodeHooks` emitted `...UNIVERSAL_PROTECTED_PATHS,` as *literal source
+ *   text* into a script that never imported it. Node threw `ReferenceError`
+ *   before the gate decided anything — and a Claude Code PreToolUse hook exiting
+ *   1 is a hook *error*, not a block, so the call proceeded.
+ * - `INTUITIC_` for `INTUTIC_`: the gate died on an unbound variable under
+ *   `set -u`, exiting 1 rather than 2 — again, not a block.
+ * - Five bash writers wrote `\"` where `\\"` was needed. Bash ate the quotes,
+ *   the audit line stopped being parseable JSON, and `drainHookEvents` drops
+ *   malformed lines and then *wipes the log* on a successful drain. The record
+ *   of a block was destroyed rather than delayed.
+ * - `gooseHooks`/`openhandsHooks` never extracted a command at all, so neither
+ *   had a shell-bypass guard — for their entire life.
+ *
+ * The common cause is not carelessness. It is that shell and JavaScript embedded
+ * in a template literal have three levels of escaping and no compiler checking
+ * any of them. Emitting from one place does not make the escaping easier; it
+ * makes there be one of it, with one set of tests.
+ *
+ * # The contract with a writer
+ *
+ * # One editing hazard, since it bit four times
+ *
+ * A backtick inside a comment in an emitted body ends the TypeScript template
+ * literal it lives in, and the rest of the gate becomes TypeScript. `tsc` does
+ * catch it — but as a syntax error dozens of lines away, which reads as
+ * unrelated damage. Use plain quotes in comments inside the emitted strings.
+ *
+ * A lint for this was tried and removed: a line-based scan cannot cheaply tell
+ * a comment inside a template literal from one outside it, and it produced 26
+ * false positives on this file's own prose. The compiler is the right detector;
+ * this note is the right documentation.
+ *
+ * A writer supplies the harness-specific parts — how to read the tool call, how
+ * to record an event, how to refuse — and interpolates the bodies below. See
+ * {@link ShellGateOptions} and {@link JsGateOptions} for exactly what must be in
+ * scope.
+ *
+ * @module
+ */
+import { DESTRUCTIVE_COMMAND_PATTERNS, type GuardPattern } from './protectedPaths.js';
+/**
+ * Bumped when the emitted evaluator changes shape.
+ *
+ * Stamped into the header of every emitted gate and into the policy snapshot, so
+ * the version a machine is actually running can be read off the artifact rather
+ * than inferred. The previous docstring claimed it "rides on every audit line",
+ * which was simply untrue — nothing emitted it anywhere, and a constant whose
+ * comment describes behaviour it does not have is worse than no constant.
+ *
+ * v4: the `.rules` projection grew an `argPatternB64` column and every emitted
+ * evaluator learned to condition a matched rule on the serialized tool input
+ * (` WHERE ` SOP rules). Nothing *triggers* on this number: the daemon
+ * regenerates every gate unconditionally each sync cycle, the snapshot writer
+ * stamps it into `policy-snapshot.json` for support conversations, and
+ * `gateLivenessService` records it off events when a gate reports one. A v3
+ * gate reading a v4 snapshot and a v4 gate reading a v3 snapshot both degrade
+ * to v3 behaviour — see the encoding note on {@link RULES_COLUMNS}.
+ *
+ * v5: the residual fail-open edges were closed. Every bash gate now converts
+ * an accidental crash (exit != 0 and != 2 under `set -euo pipefail`) into
+ * exit 2 via {@link SHELL_FAIL_CLOSED}; every bash gate refuses a stdin
+ * payload from which neither a tool name nor a tool_input could be extracted
+ * (the envelope posture githubCopilotHooks established, now uniform); every
+ * JS gate installs `uncaughtException`/`unhandledRejection` handlers as its
+ * first statements ({@link emitJsFailClosedPrelude}) so a crash outside the
+ * stdin handler refuses through the harness's own contract instead of exiting
+ * 1 (which every exit-code harness reads as "hook errored — allow"); and the
+ * malformed-envelope refusal is shared across the JS writers via
+ * `intuticGuardEnvelope`. The `.rules` format is unchanged — v4 and v5 gates
+ * read each other's snapshots byte-identically.
+ *
+ * v6 (M3): `#mcpservers` header parsing + `mcp__<server>__*` allowlist
+ * refusal + Cline `use_mcp_tool` envelope normalization; rule-line format
+ * itself is unchanged. This IS a `.rules` shape change, unlike v5 (which only
+ * closed fail-open edges) — a new header line means:
+ *
+ * - a v5 gate reading a v6 snapshot ignores the unknown `#mcpservers` header
+ *   (every existing header-parsing loop already falls through unrecognised
+ *   `#`-prefixed lines to the comment case) and degrades to v5 behaviour: no
+ *   allowlist enforcement, but no crash and no false-block either;
+ * - a v6 gate reading a v5 snapshot (no `#mcpservers` header present) also
+ *   behaves as unrestricted — the empty-list default — because "header
+ *   absent" and "header present with an empty list" are deliberately the same
+ *   observable state (`writePolicySnapshot` omits the line rather than
+ *   emitting it empty, precisely so a v6 gate cannot tell "no snapshot
+ *   configured a list yet" from "this workspace wants zero servers", and
+ *   picks the fail-open reading of that ambiguity rather than blocking every
+ *   MCP call the first time a v6 gate meets an old snapshot).
+ *
+ * v8 (TD-474 item 4): the `hold` severity and the `action` subject. A hold
+ * rule — a `require_approval` SOP rule the control plane resolves, or a local
+ * `review_before:` token the daemon compiles as `sop.local.review_before.*` —
+ * refuses the call through the harness's own contract, appends the v1 hold
+ * record `drainReviewRequests` already reads, prints the `intutic decision
+ * approve <holdId>` hint, and lets the call through instead when the
+ * daemon's approved-bypass cache holds an exact, unexpired match for it. One
+ * mechanism in the shared bodies; the Claude Code writer's bespoke copy is
+ * gone. The `.rules` line format is unchanged — `hold` is just a new value in
+ * the severity column — so a v7 JS or bash gate reading a v8 snapshot falls
+ * through its severity switch to BLOCK (fail closed, no hold record, no
+ * bypass). The v7 Python filter is the one exception: its mapping sent every
+ * unrecognised severity to `flags`, i.e. ALLOWED, which is why the v8 filter
+ * maps unknown to block and why the daemon regenerates every gate each cycle —
+ * the skew window is one sync interval.
+ */
+export declare const GATE_VERSION = 8;
+/**
+ * The coarse command → action-token classification the hold tier keys on:
+ * `review_before: action:deploy` holds a shell command that contains any of
+ * the deploy needles. Deliberately minimal — a gate that tries to be clever
+ * about shell commands is a gate that blocks real work — and it mirrors the
+ * proxy's `actions.rs` in both directions: `hookActionParity.test.ts` reads
+ * THIS file as text and fails if either side knows a needle the other does
+ * not. Keep each entry on one line in this exact `['action:x', [...]]` shape;
+ * that is what the test's regex finds.
+ */
+export declare const ACTION_NEEDLES: ReadonlyArray<readonly [string, readonly string[]]>;
+/** The (lower-cased) tool names whose `command` the classifier reads. */
+export declare const ACTION_TOOL_NAMES: readonly ["bash", "shell", "run_command", "terminal", "execute"];
+/** Where a gate appends a hold, relative to the workspace root; the daemon's
+ *  `drainReviewRequests` reads the same file. */
+export declare const REVIEW_REQUESTS_BASENAME = "review-requests.jsonl";
+export declare const REVIEW_REQUESTS_LOG = ".intutic/events/review-requests.jsonl";
+/** Bumped when a hold record's shape changes; the control plane drops any
+ *  other version at ingest. */
+export declare const REVIEW_REQUEST_VERSION = 1;
+/**
+ * How old a snapshot may be before a gate reports it as stale.
+ *
+ * Alerting only — a stale snapshot is still enforced, deliberately. If rules
+ * expired into permissiveness, "stop the daemon and wait" would be a supported
+ * way to disarm governance. Seven days is far longer than the sync interval, so
+ * this fires on "the daemon has been dead for a week", not on "it is Sunday".
+ */
+export declare const SNAPSHOT_STALE_AFTER_DAYS = 7;
+/**
+ * How a gate refuses a call.
+ *
+ * The three values are not stylistic. Claude Code, Cursor and the bash
+ * harnesses read the **exit code** (2 = deny; 1 is an error and lets the call
+ * through). Cline and Roo Code ignore the exit code and read a `{"cancel":
+ * true}` object on stdout. Grok Build ALSO ignores the exit code, but its
+ * confirmed verdict shape is a *different* stdout object —
+ * `{"decision":"deny","reason":"..."}` — not `{"cancel":true}`. The two
+ * stdout contracts are kept as distinct union members rather than folded into
+ * one "stdout-cancel" bucket precisely because a gate that emits the wrong
+ * field name looks identical in a code review and enforces nothing: Grok
+ * Build does not recognise `cancel`, and Cline/Roo Code do not recognise
+ * `decision`. A gate that uses the wrong one is silently inert.
+ */
+/**
+ * `'throw'` is for a gate that runs INSIDE the harness process (OpenCode's
+ * plugin hook): the refusal is a thrown Error carrying the BLOCKED message,
+ * which the host turns into the tool-error the model reads. No exit code, no
+ * stdout — the same in-process posture the n8n workflow gate takes.
+ */
+export type BlockContract = 'exit2' | 'stdout-cancel' | 'stdout-decision-deny' | 'throw';
+/**
+ * The `.rules` snapshot record layout, defined once so the writer and every
+ * reader cannot disagree about column order.
+ *
+ * `source` may contain any punctuation EXCEPT a tab — `assertPortableEre`
+ * rejects literal tabs precisely because this projection is tab-separated —
+ * so it is safe mid-record.
+ *
+ * `argPatternB64` is the ` WHERE ` clause of a SOP rule, **base64-encoded**
+ * (standard alphabet, UTF-8 source), and the encoding is not a stylistic
+ * choice. An argPattern is an arbitrary JS regex: unlike `source` it is not
+ * run through `assertPortableEre`, so it may legally contain tabs, and any
+ * escaping convention would be a second dialect every one of the four readers
+ * (bash, JS, the Open WebUI filter, and the LangGraph port) had to get
+ * byte-identically right. Base64's alphabet ([A-Za-z0-9+/=]) cannot collide
+ * with the separator, full stop.
+ *
+ * The column is OMITTED (not emitted empty) when a rule has no argPattern, so
+ * every rule that exists today serialises byte-identically to the v3 layout.
+ * Compatibility in both directions:
+ *  - a v4 gate reading a v3 file sees six fields and treats every rule as
+ *    name-only — exactly v3 behaviour;
+ *  - a v3 gate reading a v4 file: the JS and Python readers index `f[5]` and
+ *    ignore the extra field; the bash reader's final `read` variable absorbs
+ *    `source<TAB>base64`, so that one rule matches nothing rather than
+ *    crashing the gate. That last degradation (a WHERE rule inert under a
+ *    stale bash gate for one sync cycle, until the daemon — which writes both
+ *    the snapshot and the gates — regenerates them) is the cost of never
+ *    shifting the six columns every deployed reader already indexes.
+ */
+export declare const RULES_COLUMNS: readonly ["id", "severity", "flags", "subject", "reason", "source", "argPatternB64"];
+/**
+ * Serialises one rule into a `.rules` line.
+ *
+ * The reason travels with the rule rather than being generated at block time.
+ * `hookEvents.resolveSeverity` classifies an incident by looking for the literal
+ * substrings "governance-protected" and "bypass pattern" in the reason text — so
+ * a gate that emits a generic message files a governance-config tamper as MEDIUM
+ * instead of CRITICAL, and whatever routes on CRITICAL never sees it. That
+ * coupling is asserted in `harnessProtectedPaths.test.ts`.
+ */
+export declare function toRulesLine(p: GuardPattern): string;
+/**
+ * The bash fail-closed prelude. Interpolated by every bash writer immediately
+ * after `set -euo pipefail`, before anything that can fail has run.
+ *
+ * The edge it closes: under `set -euo pipefail` any script bug — an unbound
+ * variable, a `read` that hits EOF outside its guard, a corrupted snapshot
+ * tripping an unguarded command — ends the script with the failing command's
+ * status, usually 1. Every harness that runs these gates treats a non-2
+ * non-zero exit as "the hook errored" and ALLOWS the call, so an accidental
+ * crash was an allow that looked like enforcement.
+ *
+ * An EXIT trap that inspects the final status, deliberately not `trap ... ERR`:
+ *
+ * - ERR does not fire on `set -u` unbound-variable deaths or on every `set -e`
+ *   exit path, and its firing rules differ between bash versions and whatever
+ *   /bin/sh a harness substitutes. EXIT always runs, in every POSIX shell.
+ * - An ERR trap also fires on every benign non-zero intermediate — a grep
+ *   no-match inside a condition, an arithmetic result of 0 — and turning those
+ *   into blocks would make the gate refuse every call, which is exactly as
+ *   broken as allowing every call. Inspecting only the FINAL exit status
+ *   sidesteps that class entirely: `set -e` semantics are untouched, and a
+ *   status the script deliberately produced (0 = allow, 2 = block, including
+ *   the python3-missing refusal in SHELL_EXTRACT) passes through unchanged.
+ *   Under `set -e` a script bug can never reach the final `exit 0`, so
+ *   "status not in {0, 2}" is exactly "the gate crashed".
+ *
+ * The trap body runs under the script's own `set -eu`, so it disarms both
+ * first — a trap that itself dies on an unset variable would exit with that
+ * failure's status and reopen the hole it exists to close. `log_event` is
+ * defined by the writer AFTER this prelude, so the trap probes for it before
+ * calling: a crash earlier than the definition still blocks, just without an
+ * audit line (stderr carries the reason either way).
+ */
+export declare const SHELL_FAIL_CLOSED = "\n# \u2500\u2500 Intutic fail-closed prelude v8 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Any exit status other than the two deliberate verdicts (0 = allow, 2 = block)\n# means this gate crashed rather than decided. The harness would read exit 1 as\n# \"hook errored\" and run the tool anyway, so a crash is converted into a block.\n# EXIT rather than ERR: ERR is unreliable across shells for set -u deaths, and\n# it fires on benign non-zero intermediates; the final status cannot lie.\nintutic_fail_closed() {\n  _intutic_exit_rc=$?\n  # The trap must not itself die on an unset variable or a failed command \u2014\n  # that would replace the exit status it exists to correct.\n  set +eu\n  trap - EXIT\n  if [ \"$_intutic_exit_rc\" = \"0\" ] || [ \"$_intutic_exit_rc\" = \"2\" ]; then\n    exit \"$_intutic_exit_rc\"\n  fi\n  echo \"[Intutic Governance] BLOCKED: gate crashed (exit ${_intutic_exit_rc}) \u2014 failing closed rather than allowing an unevaluated call.\" >&2\n  if command -v log_event >/dev/null 2>&1; then\n    log_event \"tool_blocked\" \"${TOOL:-unknown}\" \"gate crashed (exit ${_intutic_exit_rc}) \u2014 failing closed\" || true\n  fi\n  exit 2\n}\ntrap intutic_fail_closed EXIT\n";
+export interface ShellGateOptions {
+    /** Harness id, as it appears in audit lines. */
+    harness: string;
+    /**
+     * Name of the shell function the writer defined to record an event.
+     * Called as `<fn> <verdict> <tool> <reason>`.
+     */
+    logFn?: string;
+    /**
+     * Absolute path of the hold record file. Defaults to
+     * `<script dir>/../events/review-requests.jsonl`, which is the workspace's
+     * `.intutic/events/` for every gate that lives in `.intutic/hooks/`; a
+     * writer whose artifact lives elsewhere passes it.
+     */
+    reviewRequestFile?: string;
+}
+export declare function emitShellGate(opts: ShellGateOptions): string;
+export interface JsGateOptions {
+    harness: string;
+    /** How this harness refuses. */
+    contract: BlockContract;
+    /** See {@link ShellGateOptions.reviewRequestFile}. Writers whose artifact
+     *  does not live in `.intutic/hooks/` (cline, opencode) pass it. */
+    reviewRequestFile?: string;
+}
+/**
+ * The JavaScript gate body.
+ *
+ * Emits a self-contained `intuticGate()` that the writer calls. Refuses through
+ * whichever mechanism {@link JsGateOptions.contract} names, so a harness that
+ * reads stdout rather than the exit code cannot be given the wrong one by
+ * accident — it is a parameter, not a copy-paste.
+ */
+export declare function emitJsGate(opts: JsGateOptions): string;
+/**
+ * Pre-image capture — the storage half of the rollback enforcement rung (TD-328).
+ *
+ * ## Why this exists and why it is here
+ *
+ * The enforcement ladder jumps from Reask (weak) to Kill (destructive). The
+ * missing rung is **Revert**: undo a flagged action's effect instead of ending
+ * the session over it. Reverting needs a pre-image, and nothing in the system
+ * had one — `ChangeEntry` records `tool`, `op`, `target` and deliberately
+ * **never the content being written**, so a manifest can say *what* changed
+ * and not *to what*.
+ *
+ * It belongs in the PreToolUse gate and nowhere else. The proxy sees tool calls
+ * the model *proposed*, before the harness runs them; only the hook fires in
+ * the instant between "this call was flagged and allowed" and "the file
+ * changed". That instant is the only place the prior bytes still exist.
+ *
+ * ## What is captured, and what is refused
+ *
+ * Only the `warn` tier — a call a guard flagged and let proceed. Blocked calls
+ * changed nothing, so there is nothing to restore; clean calls were never
+ * interesting. That keeps the volume proportional to flags rather than to
+ * edits.
+ *
+ * **Off unless asked for, and that is not this codebase's usual default.**
+ * Every other guard here is on by default because being wrong costs a false
+ * positive. This one stores the *contents* of the user's files on their disk,
+ * so being wrong costs a copy of their work nobody consented to. It follows
+ * the `mirror_sample_rate: 0.0` precedent: a capability with a real external
+ * cost is opted into, not defaulted on. `.intutic/rollback/` is gitignored by
+ * the same writer that creates it.
+ *
+ * Three ceilings, each refusing rather than truncating — a partial pre-image
+ * restores a file to a state it was never in, which is worse than no rollback:
+ *   * `MAX_PREIMAGE_BYTES` per file
+ *   * `MAX_PREIMAGE_ENTRIES` retained, oldest evicted
+ *   * only paths inside the workspace root, resolved — a capture of
+ *     `../../.ssh/id_rsa` would be an exfiltration primitive wearing a
+ *     governance badge.
+ */
+export declare function emitPreImageCapture(): string;
+/**
+ * The JS fail-closed prelude — the FIRST statements of every emitted JS gate.
+ *
+ * The edge it closes: each writer's stdin handler wraps its work in a
+ * try/catch that fails closed, but a crash OUTSIDE that handler — a
+ * module-load failure, an unhandled promise rejection from an async path —
+ * ended the process with Node's default exit 1. Every exit-code harness reads
+ * a non-2 non-zero exit as "the hook errored" and ALLOWS the call, and the
+ * stdout-cancel harnesses saw no cancel object, which is also an allow. So a
+ * gate that crashed was indistinguishable from a gate that approved.
+ *
+ * Interpolated by the writer as the first executable code in the script —
+ * before any `require` (after `'use strict'` where the writer has one, since a
+ * directive must lead the file to take effect) — so everything that runs is
+ * covered. The one thing it cannot cover is a SyntaxError in the emitted file
+ * itself: Node rejects the whole module before any statement executes,
+ * handlers included. That residue is pinned by the behaviour tests running
+ * every emitted gate for real.
+ *
+ * Refuses through the harness's contract, like everything else: exit 2 means
+ * nothing to cline or roo-code, whose harnesses only read stdout — a crashed
+ * stdout-cancel gate must still print its cancel object.
+ */
+export declare function emitJsFailClosedPrelude(opts: JsGateOptions): string;
+/**
+ * The single `python3` invocation that replaces the three or four each bash gate
+ * used to spawn.
+ *
+ * Process startup dominated the old gates: three `python3` spawns is 75–200ms on
+ * the tool path, more than rule evaluation will ever cost. This does the whole
+ * extraction in one, and collapses whitespace while it is there — which also
+ * makes the three values safe to read back as three lines.
+ *
+ * **Fails closed if there is no parser.** Without one the gate cannot know what
+ * it is being asked to allow, and the old behaviour — empty tool, empty target,
+ * allow — was a silent hole. The message names the fix, because a developer who
+ * hits this needs to act on it rather than file a bug.
+ */
+export declare const SHELL_EXTRACT = "\nif ! command -v python3 >/dev/null 2>&1; then\n  echo \"[Intutic Governance] BLOCKED: python3 is required to evaluate tool calls and was not found on PATH.\" >&2\n  echo \"[Intutic Governance] Install python3, or unset the Intutic hooks to run ungoverned.\" >&2\n  exit 2\nfi\n\nINTUTIC_FIELDS=\"$(printf '%s' \"$INPUT\" | python3 -c '\nimport sys, json\ndef clean(v):\n    return \" \".join(str(v).split()) if isinstance(v, str) else \"\"\nstate = \"ok\"\ntry:\n    d = json.load(sys.stdin)\nexcept Exception:\n    d = {}\n    state = \"malformed\"\nif not isinstance(d, dict):\n    d = {}\n    state = \"malformed\"\n# The envelope check githubCopilotHooks established, applied to the bash\n# family: a payload carrying none of the tool fields in any known spelling is\n# one the gate cannot evaluate, and extracting empty fields from it would\n# match no rule \u2014 an allow. Reported as a STATE and decided in the gate body,\n# because log_event is not defined yet at extraction time.\nif state == \"ok\" and not any(\n    k in d for k in (\"tool_name\", \"toolName\", \"tool_input\", \"toolInput\")\n):\n    state = \"malformed\"\ni = d.get(\"tool_input\") or {}\nif not isinstance(i, dict):\n    i = {}\ndef first(*keys):\n    for k in keys:\n        v = i.get(k)\n        if isinstance(v, str) and v:\n            return clean(v)\n    return \"\"\n# The state line comes FIRST: the lines after it may legitimately be empty,\n# and command substitution strips trailing newlines, so the last line is the\n# only position an empty value cannot survive in.\nprint(state)\nprint(clean(d.get(\"tool_name\", \"\")))\nprint(first(\"path\", \"file_path\", \"notebook_path\", \"filePath\"))\nprint(first(\"command\", \"cmd\", \"script\", \"shell_command\"))\nprint(clean(d.get(\"session_id\", d.get(\"sessionId\", \"\"))))\n# The FULL tool_input, serialized to the exact shape argPattern rules are\n# matched against everywhere: JSON.stringify(tool_input) \u2014 compact separators,\n# insertion order, non-ASCII intact. The selected fields above are whitespace-\n# collapsed for token matching; this one must NOT be, or a WHERE clause that\n# spans a key/value boundary matches here and not in the JS gates. json.dumps\n# escapes every newline, so it is still exactly one line to read back.\nprint(json.dumps(i, separators=(\",\", \":\"), ensure_ascii=False))\n' 2>/dev/null || printf '\\n\\n\\n\\n\\n\\n')\"\n\n# Each read is `|| true` because command substitution strips trailing newlines:\n# a tool call with no command argument yields fewer lines than reads, so a late\n# read hits EOF and returns non-zero. Under `set -e` that killed the gate with\n# **exit 1** \u2014 which every harness reads as a hook error and lets the call\n# through. A guard that fails open on the most ordinary input there is (a Write\n# with no shell command) is worse than no guard, because it looks present.\n{ IFS= read -r INTUTIC_EXTRACT_STATE || true; IFS= read -r TOOL || true; IFS= read -r TARGET || true; IFS= read -r COMMAND || true; IFS= read -r SESSION_ID || true; IFS= read -r TOOL_INPUT_JSON || true; } <<EOF_INTUTIC_FIELDS\n$INTUTIC_FIELDS\nEOF_INTUTIC_FIELDS\nTOOL=\"${TOOL:-}\"; TARGET=\"${TARGET:-}\"; COMMAND=\"${COMMAND:-}\"; SESSION_ID=\"${SESSION_ID:-}\"\n# Empty means the extractor itself died (the fallback printf above): treat it\n# exactly like a payload the parser rejected. The gate body refuses on any\n# value other than \"ok\" \u2014 see the envelope refusal in emitShellGate.\nINTUTIC_EXTRACT_STATE=\"${INTUTIC_EXTRACT_STATE:-}\"\n[ -n \"$INTUTIC_EXTRACT_STATE\" ] || INTUTIC_EXTRACT_STATE=\"malformed\"\n# Empty only when the extractor failed wholesale (malformed stdin). Defaulting\n# to the empty OBJECT rather than the empty string keeps the argPattern match\n# well-defined either way.\nTOOL_INPUT_JSON=\"${TOOL_INPUT_JSON:-}\"\n[ -n \"$TOOL_INPUT_JSON\" ] || TOOL_INPUT_JSON=\"{}\"\n# Aliases for the names the older writers used. Kept so this extractor is a\n# drop-in for every bash gate; the canonical names are the unsuffixed ones.\nTOOL_NAME=\"$TOOL\"; TARGET_PATH=\"$TARGET\"\n";
+/**
+ * The Python gate, for Open WebUI.
+ *
+ * Open WebUI filters see a **prompt**, not a tool call — there is no tool name,
+ * no path argument and no shell command. So this deliberately does less than the
+ * other two emitters, and the difference is the point:
+ *
+ * - It **can** refuse. `inlet()` used to hardcode `"event": "tool_allowed"` and
+ *   return the body unconditionally; it was notification-only, and nothing said
+ *   so. Raising from `inlet()` is how an Open WebUI filter blocks, and that path
+ *   now exists.
+ * - It **does not** block on the compiled floor. A prompt that mentions
+ *   `.claude/settings.json` is someone asking about a file, not an agent writing
+ *   it, and refusing to discuss a path is the kind of false positive that gets a
+ *   governance tool switched off. Those rules flag instead.
+ * - It **does** refuse on a snapshot rule whose severity is `block`, so a
+ *   workspace that wants a hard stop here can have one without a release.
+ *
+ * A control that claims more than it delivers is worse than one that claims
+ * less, so `enforces` for this harness in `gateRegistry.ts` says exactly this.
+ */
+export declare function emitPythonGate(): string;
+/**
+ * The n8n workflow gate.
+ *
+ * A different unit of evaluation than every other JS gate, and the difference
+ * is the whole design. n8n's only blocking mechanism is deployment-level:
+ * `EXTERNAL_HOOK_FILES=/path/to/hook.js` names a module whose
+ * `workflow.preExecute` functions run once per WORKFLOW execution and receive
+ * the full Workflow object — every node with its parameters — not one tool
+ * call. A hook that throws aborts the execution; that throw is the refusal.
+ *
+ * So the emitted evaluator walks the workflow's nodes and maps each onto the
+ * shape the shared rules were written for:
+ *
+ * - the node's **type** (`n8n-nodes-base.executeCommand`, …) stands in for the
+ *   tool name — `subject: 'tool'` rules match it;
+ * - the node's **serialized parameters** (compact `JSON.stringify`, the same
+ *   shape `matchSopRule` pins) stand in for the command/target — `command`,
+ *   `target` and `any` rules match the normalised serialization, and a WHERE
+ *   rule's argPattern matches the raw serialization, exactly as it matches
+ *   `JSON.stringify(tool_input)` in the per-tool gates.
+ *
+ * Granularity is honest here: one refusal aborts the whole execution, not one
+ * node, because that is all preExecute can do. The BLOCKED message names the
+ * offending node and rule so the operator knows which node to fix.
+ *
+ * Refuses by THROWING — there is no exit code and no stdout contract in-process.
+ * An internal fault also throws, which n8n treats the same way: fail closed.
+ *
+ * Verified during the v5 fail-open audit and deliberately left alone: the
+ * writer's preExecute wrapper has no try/catch around this gate (see the
+ * comment at the module.exports site in n8nHooks.ts), so a fault inside the
+ * evaluator aborts the execution exactly as a BLOCKED throw does. This is the
+ * one family whose crash posture was already closed; installing process-level
+ * exit handlers here would be actively wrong, since the gate runs inside the
+ * n8n server process, not a per-call subprocess. Pinned by the "internal
+ * fault" case in the n8n block of generatedGateFailClosed.test.ts.
+ */
+export declare function emitN8nWorkflowGate(): string;
+/** The destructive tier, for the snapshot writer to ship. Not compiled into any
+ *  gate — see the note on {@link DESTRUCTIVE_COMMAND_PATTERNS}. */
+export { DESTRUCTIVE_COMMAND_PATTERNS };
+//# sourceMappingURL=gateBody.d.ts.map

package/dist/harness/gateBody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateBody.d.ts","sourceRoot":"","sources":["../../src/harness/gateBody.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EACL,4BAA4B,EAG5B,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,eAAO,MAAM,YAAY,IAAI,CAAA;AAE7B;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAK9E,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,kEAAmE,CAAA;AAEjG;iDACiD;AACjD,eAAO,MAAM,wBAAwB,0BAA0B,CAAA;AAC/D,eAAO,MAAM,mBAAmB,0CAAgD,CAAA;AAChF;+BAC+B;AAC/B,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAkBvC;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C;;;;;;;;;;;;;;GAcG;AACH;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,eAAe,GAAG,sBAAsB,GAAG,OAAO,CAAA;AAmCxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,aAAa,sFAAuF,CAAA;AAEjH;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAMnD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,iBAAiB,g0CAuB7B,CAAA;AAED,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AA6ID,wBAAgB,aAAa,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CA6Y5D;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,gCAAgC;IAChC,QAAQ,EAAE,aAAa,CAAA;IACvB;wEACoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAiGD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAmPtD;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CA8H5C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAgCnE;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,4gIA8EzB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAyHvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAuJ5C;AAED;mEACmE;AACnE,OAAO,EAAE,4BAA4B,EAAE,CAAA"}