@minionry/minion 0.7.36

package/dist/server/mcp/bouncer-integration.js

@@ -0,0 +1,744 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { existsSync } from 'node:fs';
+import { basename, isAbsolute, join, resolve } from 'node:path';
+import { AnalyticsEvents, trackEvent } from '../services/analytics.js';
+import { getBrowserDriverState, INPUT_MUTATING_BROWSER_TOOLS } from '../services/browser/driver-state.js';
+import { WORKSPACE_READ_TOOLS, WORKSPACE_SHELL_TOOLS, WORKSPACE_WRITE_TOOLS, } from '../services/sdk/run-profile.js';
+import { resolveWithinRoot } from '../services/sdk/sandbox.js';
+import { captureException } from '../services/sentry.js';
+import { getBrowserAllowlist } from '../services/settings.js';
+import { SPACE_DIRNAME, SPACE_LAYOUT, spacePath } from '../services/space-layout.js';
+import { redactBeforeReview, redactToolInput } from './browser-redaction.js';
+import { HAIKU_TIMEOUT_MS } from './classifier/ClaudeBouncerClassifier.js';
+import { getConfiguredClassifierIdentity, resolveClassifier, } from './classifier/factory.js';
+import { isCompanyMode } from './company-patterns.js';
+import { departmentAllows, departmentDenies, getActiveDepartmentProfile, } from './department-profiles.js';
+import { BROWSER_EVAL_THREATS, BROWSER_SAFE_TOOLS, CRITICAL_THREATS, classifyRisk, isDeployMode, isLocalhostUrl, isOriginAllowlisted, matchesPattern, normalizeOperation, requiresAIReview, SAFE_OPERATIONS, SENSITIVE_PATHS } from './security-patterns.js';
+function untrustedModeRequiresReview(isSafe) {
+    return !isSafe && (isDeployMode() || isCompanyMode());
+}
+export function mapBouncerDecisionToOutcome(decision) {
+    switch (decision.decision) {
+        case 'allow':
+            return 'autoAllow';
+        case 'deny':
+            return 'autoDeny';
+        default:
+            return 'greenlight';
+    }
+}
+const CACHE_TTL_MS = parseInt(process.env.BOUNCER_CACHE_TTL_MS || '300000', 10);
+const CACHE_MAX_SIZE = 200;
+const decisionCache = new Map();
+export function normalizeOperationForCacheKey(operation) {
+    const op = operation.replace(/\s+/g, ' ').trim();
+    const fileMatch = op.match(/^(Write|Edit|Read):\s*(\/\S+)$/i);
+    if (fileMatch && !matchesPattern(op, SENSITIVE_PATHS)) {
+        const [, tool, filePath] = fileMatch;
+        const slash = filePath.lastIndexOf('/');
+        const dir = slash > 0 ? filePath.slice(0, slash) : '';
+        return `${tool}: ${dir}/*`;
+    }
+    return op;
+}
+function buildCacheKey(operation, context) {
+    const sessionId = context?.sessionId ?? '_';
+    const sdkSalt = context?.source === 'sdk'
+        ? `|sdk:${String(context.appId ?? '')}:${Array.isArray(context.grantedScopes) ? [...context.grantedScopes].sort().join('+') : ''}`
+        : '';
+    return `${sessionId}${sdkSalt}:${normalizeOperationForCacheKey(operation)}`;
+}
+function getCachedDecision(operation, context) {
+    const key = buildCacheKey(operation, context);
+    const entry = decisionCache.get(key);
+    if (!entry)
+        return null;
+    if (Date.now() > entry.expiresAt) {
+        decisionCache.delete(key);
+        return null;
+    }
+    return entry.decision;
+}
+export function clearDecisionCache() {
+    decisionCache.clear();
+}
+const REMOTE_CACHE_TTL_MS = parseInt(process.env.BOUNCER_REMOTE_CACHE_TTL_MS || String(30 * 60 * 1000), 10);
+let remoteDecisionCache = null;
+export function setRemoteDecisionCache(store) {
+    remoteDecisionCache = store;
+}
+async function getRemoteCachedDecision(operation, context) {
+    if (!remoteDecisionCache)
+        return null;
+    const key = buildCacheKey(operation, context);
+    try {
+        const decision = await remoteDecisionCache.get(key);
+        if (!decision)
+            return null;
+        decisionCache.set(key, { decision, expiresAt: Date.now() + CACHE_TTL_MS });
+        return decision;
+    }
+    catch {
+        return null;
+    }
+}
+async function lookupCachedDecision(operation, context) {
+    const local = getCachedDecision(operation, context);
+    if (local) {
+        console.error(`[Bouncer] ⚡ Cache hit: ${local.decision} (${local.confidence}%)`);
+        return local;
+    }
+    const crossTurn = await getRemoteCachedDecision(operation, context);
+    if (crossTurn) {
+        console.error(`[Bouncer] ⚡ Cross-turn cache hit: ${crossTurn.decision} (${crossTurn.confidence}%)`);
+    }
+    return crossTurn;
+}
+function cacheDecision(operation, context, decision, layer) {
+    if (decision.confidence < 50)
+        return;
+    if (decisionCache.size >= CACHE_MAX_SIZE) {
+        const firstKey = decisionCache.keys().next().value;
+        if (firstKey !== undefined)
+            decisionCache.delete(firstKey);
+    }
+    const key = buildCacheKey(operation, context);
+    decisionCache.set(key, { decision, expiresAt: Date.now() + CACHE_TTL_MS });
+    if (remoteDecisionCache && layer === 'haiku-ai') {
+        remoteDecisionCache.set(key, decision, REMOTE_CACHE_TTL_MS).catch(() => {
+        });
+    }
+}
+function redactForSink(sink, operation, context) {
+    const toolName = context?.toolName;
+    const toolInput = context?.toolInput;
+    if (typeof toolName !== 'string' || typeof toolInput !== 'object' || toolInput === null) {
+        return { operation, context };
+    }
+    const redactedInput = redactToolInput(toolName, toolInput, sink);
+    if (redactedInput === toolInput)
+        return { operation, context };
+    return {
+        operation: formatOperationForReview(toolName, redactedInput),
+        context: sink === 'audit' ? { ...context, toolInput: redactedInput } : context,
+    };
+}
+function redactRequestBeforeReview(request) {
+    const toolName = request.context?.toolName;
+    const toolInput = request.context?.toolInput;
+    if (typeof toolName !== 'string' || typeof toolInput !== 'object' || toolInput === null) {
+        return request;
+    }
+    const redactedInput = redactBeforeReview(toolName, toolInput);
+    if (redactedInput === toolInput)
+        return request;
+    return {
+        ...request,
+        operation: formatOperationForReview(toolName, redactedInput),
+        context: { ...request.context, toolInput: redactedInput },
+    };
+}
+class DecisionFinalizer {
+    operation;
+    startTime;
+    context;
+    logFn;
+    constructor(operation, startTime, context, logFn) {
+        this.operation = operation;
+        this.startTime = startTime;
+        this.context = context;
+        this.logFn = logFn;
+    }
+    finalize(decision, layer, opts) {
+        const latencyMs = Math.round(performance.now() - this.startTime);
+        const needsClassifier = !opts?.skipLog || !opts?.skipAnalytics;
+        const classifier = needsClassifier
+            ? (opts?.classifier ?? { ...getConfiguredClassifierIdentity(), fallback: false })
+            : null;
+        if (!opts?.skipLog) {
+            const audit = redactForSink('audit', this.operation, this.context);
+            this.logFn(audit.operation, decision.decision, decision.confidence, decision.reasoning, {
+                context: audit.context,
+                threatLevel: decision.threatLevel,
+                layer,
+                latencyMs,
+                ...(classifier && {
+                    classifierEngine: classifier.engine,
+                    classifierModel: classifier.model,
+                    ...(classifier.fallback && { classifierFallback: true }),
+                }),
+                ...(opts?.error && { error: opts.error }),
+            });
+        }
+        if (!opts?.skipAnalytics) {
+            const event = decision.decision === 'deny' ? AnalyticsEvents.BOUNCER_TOOL_DENIED : AnalyticsEvents.BOUNCER_TOOL_ALLOWED;
+            trackEvent(event, {
+                layer,
+                operation_length: this.operation.length,
+                threat_level: decision.threatLevel,
+                confidence: decision.confidence,
+                latency_ms: latencyMs,
+                ...(classifier && {
+                    classifier_engine: classifier.engine,
+                    classifier_model: classifier.model,
+                    classifier_fallback: classifier.fallback,
+                }),
+            });
+        }
+        if (!opts?.skipCache)
+            cacheDecision(this.operation, this.context, decision, layer);
+        return decision;
+    }
+}
+export const LOW_CONFIDENCE_THRESHOLD = 50;
+export function isSensitiveOperation(operation) {
+    const risk = classifyRisk(operation);
+    return (risk.riskLevel === 'high' ||
+        risk.riskLevel === 'critical' ||
+        !!matchesPattern(operation, SENSITIVE_PATHS));
+}
+function applySensitiveVerdictFloor(operation, decision, classifier, fin) {
+    if (decision.decision === 'deny')
+        return null;
+    if (!isSensitiveOperation(operation))
+        return null;
+    const confidence = decision.confidence;
+    const malformed = typeof confidence !== 'number' ||
+        !Number.isFinite(confidence) ||
+        confidence < 0 ||
+        confidence > 100;
+    if (!malformed && confidence >= LOW_CONFIDENCE_THRESHOLD)
+        return null;
+    const cause = malformed
+        ? 'returned a malformed/unparseable verdict'
+        : `returned a low-confidence verdict (${confidence}% < ${LOW_CONFIDENCE_THRESHOLD}%)`;
+    console.error(`[Bouncer] 🚫 Classifier ${cause} on a sensitive/high-risk operation — DENYING for safety (fail-closed)`);
+    return fin.finalize({
+        decision: 'deny',
+        confidence: 0,
+        reasoning: `Security classifier ${cause} on a sensitive/high-risk operation. Denying for safety — the operation could not be verified with sufficient confidence.`,
+        threatLevel: 'high',
+    }, 'haiku-lowconf', { skipCache: true, classifier });
+}
+function resolveClassifierUnavailable(isTimeout, errorMessage, operation, maxAttempts, classifier, fin) {
+    const layer = isTimeout ? 'haiku-timeout' : 'ai-error';
+    const cause = isTimeout
+        ? `timed out after ${maxAttempts} attempts (${HAIKU_TIMEOUT_MS}ms each)`
+        : `failed: ${errorMessage}`;
+    const risk = classifyRisk(operation);
+    const failClosed = isSensitiveOperation(operation);
+    if (failClosed) {
+        console.error(`[Bouncer] 🚫 Classifier unavailable (${cause}) on a ${risk.riskLevel}-risk operation — DENYING for safety`);
+        return fin.finalize({ decision: 'deny', confidence: 0, reasoning: `Security analysis ${cause} on a sensitive/high-risk operation. Denying for safety — operation could not be verified.`, threatLevel: 'high' }, layer, { skipCache: true, classifier, ...(isTimeout ? {} : { skipAnalytics: true, error: errorMessage }) });
+    }
+    console.error(`[Bouncer] ⚠️  Classifier unavailable (${cause}) on a ${risk.riskLevel}-risk operation — allowing with caution (fail-open)`);
+    return fin.finalize({ decision: 'warn_allow', confidence: 50, reasoning: `Security classifier was unavailable (${cause}). The operation cleared Layer-1 pattern checks and is ${risk.riskLevel}-risk, so it is allowed with caution rather than blocked on classifier latency. Verify it matches your intent.`, threatLevel: 'medium' }, layer, { skipCache: true, classifier, ...(isTimeout ? {} : { skipAnalytics: true, error: errorMessage }) });
+}
+function handleHaikuError(error, operation, attempt, maxAttempts, classifier, fin) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    const isTimeout = errorMessage.includes('timed out');
+    if (isTimeout && attempt < maxAttempts) {
+        console.error(`[Bouncer] ⚠️  Haiku timed out (attempt ${attempt}/${maxAttempts}), retrying...`);
+        captureException(error, { context: 'bouncer.haiku_timeout_retry', operation, attempt });
+        return null;
+    }
+    captureException(error, { context: isTimeout ? 'bouncer.haiku_timeout' : 'bouncer.haiku_analysis', operation });
+    return resolveClassifierUnavailable(isTimeout, errorMessage, operation, maxAttempts, classifier, fin);
+}
+let defaultClassifier = null;
+function resolveActiveClassifier() {
+    if (defaultClassifier) {
+        return {
+            classifier: defaultClassifier,
+            identity: { engine: 'custom', model: 'custom', fallback: false },
+        };
+    }
+    const resolution = resolveClassifier();
+    return {
+        classifier: resolution.classifier,
+        identity: { engine: resolution.engine, model: resolution.model, fallback: resolution.didFallback },
+    };
+}
+export function setBouncerClassifier(classifier) {
+    defaultClassifier = classifier;
+}
+const inflightClassifications = new Map();
+function coalesceClassification(key, run) {
+    const joined = inflightClassifications.get(key);
+    if (joined) {
+        console.error('[Bouncer] ⏳ Identical classification already in flight — joining it');
+        return joined;
+    }
+    const started = run().finally(() => {
+        if (inflightClassifications.get(key) === started)
+            inflightClassifications.delete(key);
+    });
+    inflightClassifications.set(key, started);
+    return started;
+}
+async function runHaikuAnalysis(request, operation, startTime, fin) {
+    const aiDisabledByEnv = process.env.BOUNCER_USE_AI === 'false';
+    if (aiDisabledByEnv || request.context?._skipAI === true) {
+        console.error('[Bouncer] AI analysis disabled');
+        return fin.finalize({ decision: 'warn_allow', confidence: 60, reasoning: 'Operation requires review but AI analysis is disabled. Proceeding with caution.', threatLevel: 'medium' }, 'ai-disabled', { skipCache: true, skipAnalytics: true });
+    }
+    console.error('[Bouncer] 🤖 Invoking Haiku for AI analysis...');
+    trackEvent(AnalyticsEvents.BOUNCER_HAIKU_REVIEW, { operation_length: operation.length });
+    const { classifier, identity } = resolveActiveClassifier();
+    const MAX_ATTEMPTS = 2;
+    const classifierInput = redactForSink('classifier', request.operation, request.context);
+    const coalesceKey = buildCacheKey(operation, request.context);
+    for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+        try {
+            const decision = await coalesceClassification(coalesceKey, () => classifier.classify(classifierInput.operation, request.context));
+            console.error(`[Bouncer] ✓ Haiku decision: ${decision.decision} (${decision.confidence}% confidence) [${Math.round(performance.now() - startTime)}ms]`);
+            console.error(`[Bouncer] Reasoning: ${decision.reasoning}`);
+            const floored = applySensitiveVerdictFloor(operation, decision, identity, fin);
+            if (floored)
+                return floored;
+            return fin.finalize(decision, 'haiku-ai', { classifier: identity });
+        }
+        catch (error) {
+            const result = handleHaikuError(error, operation, attempt, MAX_ATTEMPTS, identity, fin);
+            if (result)
+                return result;
+        }
+    }
+    return fin.finalize({ decision: 'deny', confidence: 0, reasoning: 'Security analysis exhausted all attempts. Denying for safety.', threatLevel: 'critical' }, 'ai-error', { skipCache: true, classifier: identity });
+}
+const BROWSER_MCP_PREFIX_RE = /^mcp__minionry-browser__/i;
+function extractBrowserNavigateUrl(operation) {
+    const match = operation.match(/^browser_navigate:\s*(\{[\s\S]*\})\s*$/i);
+    if (!match)
+        return null;
+    try {
+        const parsed = JSON.parse(match[1]);
+        if (parsed && typeof parsed === 'object' && typeof parsed.url === 'string') {
+            return parsed.url;
+        }
+    }
+    catch {
+    }
+    return null;
+}
+function resolveBrowserAllowlist(context) {
+    const fromContext = context?.browserAllowlist;
+    if (Array.isArray(fromContext)) {
+        return fromContext.filter((e) => typeof e === 'string');
+    }
+    try {
+        return getBrowserAllowlist();
+    }
+    catch {
+        return [];
+    }
+}
+function browserTabOf(context) {
+    if (typeof context?.browserTabId === 'string' && context.browserTabId)
+        return context.browserTabId;
+    const input = context?.toolInput;
+    const named = typeof input === 'object' && input !== null ? input.tabId : undefined;
+    return typeof named === 'string' && named ? named : undefined;
+}
+function applyDriverStateGate(operation, context, fin) {
+    const bare = operation.replace(BROWSER_MCP_PREFIX_RE, '');
+    const toolName = bare.match(/^(browser_[a-z_]+)/i)?.[1] ?? '';
+    if (!INPUT_MUTATING_BROWSER_TOOLS.has(toolName))
+        return null;
+    const tabId = browserTabOf(context);
+    const driverState = getBrowserDriverState();
+    const gate = tabId ? driverState.gateSync(tabId, toolName) : driverState.anyTabBlocksAgent();
+    if (gate.allow)
+        return null;
+    console.error(`[Bouncer] ⚡ Driver-state gate: ${toolName} blocked (${gate.state}) on ${tabId ?? 'some tab'}`);
+    return fin.finalize({
+        decision: 'deny',
+        confidence: 95,
+        reasoning: `Driver arbitration: ${gate.hint}`,
+        threatLevel: 'low',
+        alternative: gate.state === 'automation'
+            ? 'Wait for the user to resume the tab from the browser view before retrying.'
+            : 'Re-check the page state after the user finishes their action; do not blindly retry.',
+        enforceable: true,
+    }, 'pattern-arbitration', { skipCache: true });
+}
+function reviewBrowserTool(operation, context, fin) {
+    if (!/^(mcp__minionry-browser__)?browser_/i.test(operation))
+        return null;
+    const bare = operation.replace(BROWSER_MCP_PREFIX_RE, '');
+    const arbitration = applyDriverStateGate(operation, context, fin);
+    if (arbitration)
+        return arbitration;
+    const safeBrowser = matchesPattern(bare, BROWSER_SAFE_TOOLS);
+    if (safeBrowser) {
+        console.error('[Bouncer] ⚡ Browser fast path: read-only tool approved');
+        return fin.finalize({
+            decision: 'allow',
+            confidence: 95,
+            reasoning: `Read-only browser tool: ${safeBrowser.reason ?? 'no side effects'}`,
+            threatLevel: 'low',
+        }, 'pattern-safe');
+    }
+    if (/^browser_(evaluate|run_code_unsafe):/i.test(bare)) {
+        const threat = matchesPattern(bare, BROWSER_EVAL_THREATS);
+        if (threat) {
+            console.error('[Bouncer] ⚡ Browser fast path: JS payload threat detected');
+            return fin.finalize({
+                decision: 'deny',
+                confidence: 99,
+                reasoning: `🚨 Browser JS payload threat: ${threat.reason}`,
+                threatLevel: 'critical',
+                alternative: 'Avoid reading cookies, storage, or sending credentials from injected JS. If you need this data, ask the user to provide it directly.',
+                enforceable: true,
+            }, 'pattern-critical');
+        }
+        console.error('[Bouncer] ⚡ Browser fast path: JS payload — no threat patterns matched');
+        return fin.finalize({
+            decision: 'warn_allow',
+            confidence: 65,
+            reasoning: 'Browser JS evaluation — no known exfiltration patterns matched, but executing arbitrary JS in a logged-in page is inherently risky. Verify the payload before approving.',
+            threatLevel: 'medium',
+        }, 'pattern-default', { skipCache: true });
+    }
+    if (/^browser_navigate:/i.test(bare)) {
+        const url = extractBrowserNavigateUrl(bare);
+        if (!url) {
+            return null;
+        }
+        if (isLocalhostUrl(url)) {
+            console.error(`[Bouncer] ⚡ Browser fast path: localhost navigation approved (${url})`);
+            return fin.finalize({
+                decision: 'allow',
+                confidence: 95,
+                reasoning: 'Localhost / loopback navigation — target is the user\'s own machine, not a third party.',
+                threatLevel: 'low',
+            }, 'pattern-safe');
+        }
+        const allowlist = resolveBrowserAllowlist(context);
+        if (isOriginAllowlisted(url, allowlist)) {
+            console.error(`[Bouncer] ⚡ Browser fast path: allowlisted origin approved (${url})`);
+            return fin.finalize({
+                decision: 'allow',
+                confidence: 95,
+                reasoning: 'Navigation target matches the per-orchestra origin allowlist.',
+                threatLevel: 'low',
+            }, 'pattern-safe');
+        }
+        return null;
+    }
+    return null;
+}
+export function sdkRunReviewContextFromEnv(env) {
+    const appId = env.BOUNCER_SDK_APP_ID;
+    if (!appId)
+        return null;
+    return {
+        source: 'sdk',
+        appId,
+        appOrigin: env.BOUNCER_SDK_APP_ORIGIN ?? '',
+        grantedScopes: (env.BOUNCER_SDK_SCOPES ?? '')
+            .split(',')
+            .map((scope) => scope.trim())
+            .filter((scope) => scope.length > 0),
+        sdkWorkspaceDir: env.BOUNCER_SDK_WORKSPACE_DIR ?? '',
+        sdkSandboxDir: env.BOUNCER_SDK_SANDBOX_DIR ?? '',
+    };
+}
+const SDK_READ_TOOL_SET = new Set(WORKSPACE_READ_TOOLS.map((tool) => tool.toLowerCase()));
+const SDK_WRITE_TOOL_SET = new Set(WORKSPACE_WRITE_TOOLS.map((tool) => tool.toLowerCase()));
+const SDK_SHELL_TOOL_SET = new Set(WORKSPACE_SHELL_TOOLS.map((tool) => tool.toLowerCase()));
+const SDK_SECRET_REFS = /\.minionry[\\/]+(credentials(?:-dev\.json|(?![-\w]))|(?:config[\\/]+)?settings\.json|session-token|e2ee-identity)/i;
+const SDK_APPS_AREA = /[\\/]\.minionry[. ]*(?::[^\\/]*)?[\\/]+apps[. ]*(?::[^\\/]*)?(?:[\\/]|$)/i;
+const SDK_APPS_ROSTER = /[\\/]\.minionry[. ]*(?::[^\\/]*)?[\\/]+apps\.json[. ]*(?::[^\\/]*)?$/i;
+function sdkForeignSandboxRef(text, appId) {
+    const safeAppId = appId.toLowerCase().replace(/[^a-z0-9-]/g, '');
+    if (!safeAppId)
+        return SDK_APPS_AREA.test(text);
+    const foreign = new RegExp(`\\.minionry[\\\\/]+apps(?![\\\\/]+${safeAppId}(?:[\\\\/]|['"\\s]|$))`, 'i');
+    return foreign.test(text);
+}
+function sdkTargetPath(input) {
+    for (const key of ['file_path', 'filePath', 'path', 'notebook_path']) {
+        const value = input[key];
+        if (typeof value === 'string' && value.length > 0)
+            return value;
+    }
+    return null;
+}
+function parseSdkCeiling(context) {
+    const scopes = Array.isArray(context.grantedScopes)
+        ? context.grantedScopes.filter((scope) => typeof scope === 'string')
+        : [];
+    const workspaceWrite = scopes.includes('files:workspace:write');
+    return {
+        appId: typeof context.appId === 'string' ? context.appId : '',
+        scopes,
+        workspaceWrite,
+        workspaceRead: workspaceWrite || scopes.includes('files:workspace:read'),
+        sandboxDir: typeof context.sdkSandboxDir === 'string' && context.sdkSandboxDir ? context.sdkSandboxDir : null,
+        workspaceDir: typeof context.sdkWorkspaceDir === 'string' && context.sdkWorkspaceDir ? context.sdkWorkspaceDir : null,
+    };
+}
+function confineSdkShell(toolName, command, ceiling) {
+    if (!ceiling.workspaceWrite) {
+        return {
+            reasoning: `shell tool '${toolName}' exceeds the granted scopes [${ceiling.scopes.join(', ') || 'none'}] — shell requires files:workspace:write at minimum`,
+            alternative: 'The app must request the files:workspace:write scope (re-consent) for shell access.',
+        };
+    }
+    if (SDK_SECRET_REFS.test(command)) {
+        return { reasoning: 'shell command references the Minionry credential/settings store — off-limits to app runs regardless of scopes' };
+    }
+    if (sdkForeignSandboxRef(command, ceiling.appId)) {
+        return { reasoning: "shell command references the app-sandbox area outside this app's own sandbox — other apps' sandboxes are excluded from workspace scopes" };
+    }
+    return null;
+}
+function sdkWithin(root, path) {
+    return root !== null && resolveWithinRoot(root, path, { quiet: true }).valid;
+}
+function sdkResolveTarget(rawPath, sandboxDir) {
+    if (isAbsolute(rawPath))
+        return resolve(rawPath);
+    return sandboxDir ? resolve(sandboxDir, rawPath) : null;
+}
+function sdkNamesAppsArea(path) {
+    return SDK_APPS_AREA.test(path) || SDK_APPS_ROSTER.test(path);
+}
+function sdkInAppsArea(resolved, workspaceDir) {
+    if (sdkNamesAppsArea(resolved))
+        return true;
+    const real = workspaceDir ? resolveWithinRoot(workspaceDir, resolved, { quiet: true }) : null;
+    if (real?.valid && sdkNamesAppsArea(real.resolvedPath))
+        return true;
+    return sdkWithin(workspaceDir ? spacePath(workspaceDir, 'apps') : null, resolved);
+}
+function sdkHoldsAppsArea(resolved, workspaceDir) {
+    const real = workspaceDir ? resolveWithinRoot(workspaceDir, resolved, { quiet: true }) : null;
+    if (!real?.valid)
+        return false;
+    const name = basename(real.resolvedPath).split(':')[0].replace(/[. ]+$/, '').toLowerCase();
+    if (name !== SPACE_DIRNAME)
+        return false;
+    return (existsSync(join(real.resolvedPath, SPACE_LAYOUT.apps)) || existsSync(join(real.resolvedPath, SPACE_LAYOUT.appsRoster)));
+}
+function confineSdkWorkspaceScope(toolName, kind, ceiling) {
+    const allowed = kind === 'write' ? ceiling.workspaceWrite : ceiling.workspaceRead;
+    if (allowed)
+        return null;
+    const needed = kind === 'write' ? 'files:workspace:write' : 'files:workspace:read';
+    return {
+        reasoning: `workspace ${kind} via '${toolName}' exceeds the granted scopes [${ceiling.scopes.join(', ') || 'none'}] — requires ${needed}`,
+    };
+}
+function confineSdkFileTarget(toolName, kind, rawPath, ceiling) {
+    const resolved = sdkResolveTarget(rawPath, ceiling.sandboxDir);
+    if (resolved === null) {
+        return { reasoning: `relative path '${rawPath}' cannot be confined without the run's sandbox root (fail closed)` };
+    }
+    if (SDK_SECRET_REFS.test(resolved)) {
+        return { reasoning: `'${rawPath}' targets the Minionry credential/settings store — off-limits to app runs regardless of scopes` };
+    }
+    if (sdkWithin(ceiling.sandboxDir, resolved))
+        return null;
+    if (sdkInAppsArea(resolved, ceiling.workspaceDir)) {
+        return { reasoning: `'${rawPath}' is inside the app-sandbox area but outside this app's own sandbox — denied even with workspace scopes` };
+    }
+    if (sdkHoldsAppsArea(resolved, ceiling.workspaceDir)) {
+        return {
+            reasoning: `'${rawPath}' is a Space's state directory holding the app-sandbox area — a search or listing rooted there reaches other apps' sandboxes, so it is denied even with workspace scopes`,
+            alternative: "Target a subdirectory of .minionry (e.g. its specs) instead of .minionry itself.",
+        };
+    }
+    if (!sdkWithin(ceiling.workspaceDir, resolved)) {
+        return {
+            reasoning: `'${rawPath}' is outside the workspace and outside the app sandbox — no grantable scope reaches it`,
+            alternative: 'App runs may touch their own sandbox, and the workspace when files:workspace:* scopes are granted.',
+        };
+    }
+    return confineSdkWorkspaceScope(toolName, kind, ceiling);
+}
+function classifySdkTool(operation, context) {
+    const name = (typeof context.toolName === 'string' && context.toolName
+        ? context.toolName
+        : (operation.split(':')[0] ?? ''))
+        .trim()
+        .toLowerCase();
+    if (SDK_SHELL_TOOL_SET.has(name))
+        return { name, kind: 'shell' };
+    if (SDK_WRITE_TOOL_SET.has(name))
+        return { name, kind: 'write' };
+    if (SDK_READ_TOOL_SET.has(name))
+        return { name, kind: 'read' };
+    return null;
+}
+function applySdkScopeCeiling(operation, context, fin) {
+    if (context?.source !== 'sdk')
+        return null;
+    const tool = classifySdkTool(operation, context);
+    if (!tool)
+        return null;
+    const ceiling = parseSdkCeiling(context);
+    const input = typeof context.toolInput === 'object' && context.toolInput !== null
+        ? context.toolInput
+        : {};
+    let violation;
+    if (tool.kind === 'shell') {
+        violation = confineSdkShell(tool.name, typeof input.command === 'string' ? input.command : operation, ceiling);
+    }
+    else {
+        const rawPath = sdkTargetPath(input);
+        violation = rawPath ? confineSdkFileTarget(tool.name, tool.kind, rawPath, ceiling) : null;
+    }
+    if (!violation)
+        return null;
+    console.error(`[Bouncer] 🚫 SDK scope ceiling: ${violation.reasoning}`);
+    return fin.finalize({
+        decision: 'deny',
+        confidence: 98,
+        reasoning: `App-run scope ceiling (app '${ceiling.appId}'): ${violation.reasoning}`,
+        threatLevel: 'high',
+        ...(violation.alternative ? { alternative: violation.alternative } : {}),
+        enforceable: true,
+    }, 'sdk-scope-ceiling', 
+    { skipCache: true });
+}
+const NOOP_FASTPATH_EXEMPT_PATTERNS = [/^git_/i, /^(mcp__minionry-browser__)?browser_/i];
+function isEmptyParamNoop(operation, toolInput) {
+    if (!toolInput || typeof toolInput !== 'object' || Object.keys(toolInput).length > 0)
+        return false;
+    return !NOOP_FASTPATH_EXEMPT_PATTERNS.some((pattern) => pattern.test(operation));
+}
+export async function reviewOperation(incoming) {
+    const { logBouncerDecision } = await import('./security-audit.js');
+    const startTime = performance.now();
+    const request = redactRequestBeforeReview(incoming);
+    const { operation: rawOperation } = request;
+    const operation = normalizeOperation(rawOperation);
+    const fin = new DecisionFinalizer(operation, startTime, request.context, logBouncerDecision);
+    const ceilingDenial = applySdkScopeCeiling(operation, request.context, fin);
+    if (ceilingDenial)
+        return ceilingDenial;
+    const cached = await lookupCachedDecision(operation, request.context);
+    if (cached)
+        return cached;
+    console.error('[Bouncer] Analyzing operation...');
+    console.error(`[Bouncer] Operation: ${operation}`);
+    if (request.context?.userRequest) {
+        console.error(`[Bouncer] User request: ${request.context.userRequest}`);
+    }
+    const stages = [
+        () => {
+            if (isEmptyParamNoop(operation, request.context?.toolInput)) {
+                console.error('[Bouncer] ⚡ Fast path: Empty tool parameters (no-op)');
+                return fin.finalize({ decision: 'allow', confidence: 95, reasoning: 'Empty tool parameters - operation is a no-op with no side effects.', threatLevel: 'low' }, 'pattern-noop', { skipAnalytics: true, skipLog: true });
+            }
+            return null;
+        },
+        () => reviewBrowserTool(operation, request.context, fin),
+        () => {
+            if (/^(mcp__minionry-browser__)?browser_navigate:/i.test(operation)) {
+                const enriched = enrichBrowserContext(request, operation);
+                return runHaikuAnalysis(enriched, operation, startTime, fin);
+            }
+            return null;
+        },
+        () => {
+            const criticalThreat = matchesPattern(operation, CRITICAL_THREATS);
+            if (criticalThreat) {
+                console.error('[Bouncer] ⚡ Fast path: CRITICAL THREAT detected');
+                return fin.finalize({
+                    decision: 'deny', confidence: 99, reasoning: `🚨 CRITICAL THREAT: ${criticalThreat.reason}`, threatLevel: 'critical',
+                    alternative: 'This operation should never be performed. If you need to accomplish a specific task, please describe your goal and I can suggest safe alternatives.',
+                    enforceable: true,
+                }, 'pattern-critical');
+            }
+            return null;
+        },
+        () => {
+            const activeProfile = getActiveDepartmentProfile();
+            const profileDenied = departmentDenies(operation, activeProfile);
+            const needsReview = requiresAIReview(operation) || !!profileDenied;
+            if (needsReview)
+                return null;
+            const profileAllowed = departmentAllows(operation, activeProfile);
+            if (profileAllowed && activeProfile) {
+                console.error(`[Bouncer] ⚡ Fast path: ${activeProfile.label} department profile approved`);
+                return fin.finalize({
+                    decision: 'allow',
+                    confidence: 90,
+                    reasoning: `Allowed by ${activeProfile.label} department profile: ${profileAllowed.reason}`,
+                    threatLevel: 'low',
+                }, 'pattern-department');
+            }
+            const isSafe = matchesPattern(operation, SAFE_OPERATIONS);
+            if (untrustedModeRequiresReview(!!isSafe)) {
+                console.error('[Bouncer] ⚡ Untrusted-prompt mode: no safe-pattern match — escalating to AI review instead of pattern-default allow');
+                return null;
+            }
+            console.error(`[Bouncer] ⚡ Fast path: ${isSafe ? 'Safe operation approved' : 'No concerning patterns, allowing'}`);
+            return fin.finalize({
+                decision: 'allow',
+                confidence: isSafe ? 95 : 80,
+                reasoning: isSafe
+                    ? 'Operation matches known-safe patterns. No security concerns detected.'
+                    : 'Operation appears safe based on pattern analysis. No obvious threats detected.',
+                threatLevel: 'low'
+            }, isSafe ? 'pattern-safe' : 'pattern-default');
+        },
+    ];
+    for (const stage of stages) {
+        const decision = stage();
+        if (decision)
+            return decision;
+    }
+    const enrichedRequest = enrichBrowserContext(request, operation);
+    return runHaikuAnalysis(enrichedRequest, operation, startTime, fin);
+}
+function enrichBrowserContext(request, operation) {
+    const bare = operation.replace(BROWSER_MCP_PREFIX_RE, '');
+    if (!/^browser_/i.test(bare))
+        return request;
+    if (/^browser_(evaluate|run_code_unsafe):/i.test(bare))
+        return request;
+    const navUrl = extractBrowserNavigateUrl(bare);
+    const allowlist = resolveBrowserAllowlist(request.context);
+    return {
+        ...request,
+        context: {
+            ...request.context,
+            browserAllowlist: allowlist,
+            ...(navUrl ? { browserNavigateUrl: navUrl } : {}),
+        },
+    };
+}
+export { classifyRisk as classifyOperationRisk } from './security-patterns.js';
+export function formatOperationForReview(toolName, input) {
+    const getFilePath = (inp) => inp.file_path ?? inp.filePath ?? inp.path;
+    const lowered = toolName.toLowerCase();
+    if (lowered === 'bash' && typeof input.command === 'string' && input.command) {
+        return `${toolName}: ${input.command}`;
+    }
+    if (['write', 'edit', 'read'].includes(lowered)) {
+        const filePath = getFilePath(input);
+        return typeof filePath === 'string' && filePath
+            ? `${toolName}: ${filePath}`
+            : `${toolName}: ${JSON.stringify(input)}`;
+    }
+    return `${toolName}: ${JSON.stringify(input)}`;
+}
+export async function reviewEnginePermission(request) {
+    const operation = formatOperationForReview(request.toolName, request.input);
+    return reviewOperation({
+        operation,
+        context: {
+            ...request.context,
+            toolName: request.toolName,
+            toolInput: request.input,
+        },
+    });
+}
+export function formatDenialMessage(decision) {
+    return `🚫 ${decision.reasoning}${decision.alternative ? `\n\nAlternative: ${decision.alternative}` : ''}`;
+}