@lannguyensi/harness 0.25.2 → 0.27.0

package/dist/schema/risk.js

@@ -0,0 +1,87 @@
+import { z } from "zod";
+// Risk Gate vocabulary — Phase 7 #1 anchor.
+//
+// STATUS: schema vocabulary only. `harness validate` parses and
+// validates a `risk:` block, but no runtime surface reads it yet. The
+// Risk Classifier that consumes `risk.classifiers[]` to assign an
+// Action Envelope a severity + categories lands in Phase 7 #3 (see
+// docs/ROADMAP.md and docs/risk-gate.md). Until then a `risk:` block is
+// inert, validated config.
+//
+// Design source: lava-ice-logs/2026-04-30/harness-risk-gate-extension.md.
+// Severity is an ordered scale: a future `when.risk.severity_at_least:
+// high` clause matches `high` and `critical`. The ordering is the enum
+// declaration order — the Phase 7 #5 evaluator derives the comparison
+// from `RiskSeveritySchema.options`. This anchor only fixes the set.
+export const RiskSeveritySchema = z.enum(["low", "medium", "high", "critical"]);
+// Closed category vocabulary. Phase 7 #1 deliberately ships a fixed set
+// rather than a free-form string: a typo (`data-loss` for `data_loss`)
+// is then a validate-time error instead of a clause that silently never
+// matches, and `when.risk.category_in` stays statically checkable. New
+// categories are a schema addition, not operator config — see
+// docs/risk-gate.md for the rationale and the v2 escape hatch.
+export const RiskCategorySchema = z.enum([
+    "destructive",
+    "data_loss",
+    "production_mutation",
+    "credential_access",
+    "secret_exfiltration",
+    "network_exfiltration",
+    "deployment_change",
+    "infrastructure_change",
+    "privilege_escalation",
+    "irreversible_action",
+    "mass_update",
+]);
+// One pattern → (categories, severity) assignment. `pattern` is a
+// regular expression matched against the classified tool's raw input
+// (the exact field and match semantics are the Phase 7 #3 classifier's
+// concern; the anchor only stores and regex-validates the string).
+const RiskPatternSchema = z
+    .object({
+    pattern: z.string().min(1),
+    categories: z.array(RiskCategorySchema).min(1),
+    severity: RiskSeveritySchema,
+})
+    .strict()
+    .superRefine((rule, ctx) => {
+    try {
+        new RegExp(rule.pattern);
+    }
+    catch (err) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["pattern"],
+            message: `invalid regex: ${err.message}`,
+        });
+    }
+});
+export const RiskClassifierSchema = z
+    .object({
+    name: z.string().min(1),
+    // The tool name whose input the classifier's patterns run against
+    // (e.g. `Bash`). The matcher that binds a classifier to a live tool
+    // event is Phase 7 #3; the anchor only records the binding.
+    tool: z.string().min(1),
+    patterns: z.array(RiskPatternSchema).min(1),
+})
+    .strict();
+export const RiskSchema = z
+    .object({
+    classifiers: z.array(RiskClassifierSchema).default([]),
+})
+    .strict()
+    .superRefine((risk, ctx) => {
+    const seen = new Set();
+    risk.classifiers.forEach((c, i) => {
+        if (seen.has(c.name)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["classifiers", i, "name"],
+                message: `duplicate risk classifier name: ${c.name}`,
+            });
+        }
+        seen.add(c.name);
+    });
+});
+//# sourceMappingURL=risk.js.map

package/dist/schema/risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.js","sourceRoot":"","sources":["../../src/schema/risk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4CAA4C;AAC5C,EAAE;AACF,gEAAgE;AAChE,sEAAsE;AACtE,kEAAkE;AAClE,mEAAmE;AACnE,wEAAwE;AACxE,2BAA2B;AAC3B,EAAE;AACF,0EAA0E;AAE1E,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhF,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,8DAA8D;AAC9D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACvC,aAAa;IACb,WAAW;IACX,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IACrB,sBAAsB;IACtB,mBAAmB;IACnB,uBAAuB;IACvB,sBAAsB;IACtB,qBAAqB;IACrB,aAAa;CACd,CAAC,CAAC;AAEH,kEAAkE;AAClE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,QAAQ,EAAE,kBAAkB;CAC7B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,kBAAmB,GAAa,CAAC,OAAO,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,kEAAkE;IAClE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,CAAC;gBAChC,OAAO,EAAE,mCAAmC,CAAC,CAAC,IAAI,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lannguyensi/harness",
-  "version": "0.25.2",
+  "version": "0.27.0",
   "description": "Declarative control plane for agent harnesses — one YAML for grounding, tools, memory, and hooks.",
   "license": "MIT",
   "homepage": "https://github.com/LanNguyenSi/harness",

package/dist/cli/pack/pause-check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pause-check.js","sourceRoot":"","sources":["../../../src/cli/pack/pause-check.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,sCAAsC;AACtC,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,2BAA2B;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAehE;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,IAAI,YAAoB,CAAC;IACzB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;YACrC,YAAY,GAAG,mBAAmB,CAAC;gBACjC,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,mEAAmE;YACnE,oCAAoC;YACpC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAA6C;QAC7D,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACjE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACxD,OAAO,kBAAkB,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC"}