@muxoai/platform 1.4.1 → 1.4.2

package/dist/config.d.ts

@@ -5,7 +5,13 @@ export interface MuxoConfig {
     baseUrl: string;
     dbPath: string;
     composioApiKey: string;
+    composioInstantApiKey: string;
     composioBaseUrl: string;
+    composioWebhookSecret: string;
+    composioWebhookSubscriptionId: string;
+    composioProjectId: string;
+    composioOrgId: string;
+    composioUserId: string;
     stripeSecretKey: string;
     stripePublishableKey: string;
     stripeApiBaseUrl: string;

package/dist/config.js

@@ -65,8 +65,18 @@ export function getConfig() {
         dbPath: process.env.MUXO_DB_PATH || path.join(dataDir, "muxo.db"),
         composioApiKey: process.env.MUXO_EXTERNAL_MODE === "1"
             ? ""
-            : process.env.COMPOSIO_API_KEY || "",
+            : process.env.COMPOSIO_API_KEY || process.env.COMPOSIO_INSTANT_API_KEY || "",
+        composioInstantApiKey: process.env.MUXO_EXTERNAL_MODE === "1"
+            ? ""
+            : process.env.COMPOSIO_INSTANT_API_KEY || process.env.COMPOSIO_API_KEY || "",
         composioBaseUrl: process.env.COMPOSIO_BASE_URL || "https://backend.composio.dev/api/v3",
+        composioWebhookSecret: process.env.MUXO_EXTERNAL_MODE === "1"
+            ? ""
+            : process.env.COMPOSIO_WEBHOOK_SECRET || "",
+        composioWebhookSubscriptionId: process.env.COMPOSIO_WEBHOOK_SUBSCRIPTION_ID || "",
+        composioProjectId: process.env.COMPOSIO_PROJECT_ID || "",
+        composioOrgId: process.env.COMPOSIO_ORG_ID || "",
+        composioUserId: process.env.COMPOSIO_USER_ID || "",
         stripeSecretKey: process.env.MUXO_EXTERNAL_MODE === "1"
             ? ""
             : process.env.STRIPE_SECRET_KEY || "",

package/dist/engine.d.ts

@@ -1,7 +1,7 @@
 import type { MuxoConfig } from "./config.js";
 import { type DurableWorkflow } from "./durable-workflow.js";
 import { type NaturalLanguageResolution } from "./nl.js";
-import { describePolicyInPlainEnglish, type GuardrailCompileOptions, type ParsedNaturalLanguageGuardrail } from "./policy.js";
+import { describePolicyInPlainEnglish, type GuardrailCompileOptions, type LlmPolicyAndGovernanceBrief, type ParsedNaturalLanguageGuardrail, type PolicySimulationResult } from "./policy.js";
 import { ComposioInstantAdapter } from "./providers/composio-instant.js";
 import { ComposioSdkAdapter } from "./providers/composio-sdk.js";
 import { MicrosoftGovernanceAdapter } from "./providers/microsoft-governance.js";
@@ -66,6 +66,7 @@ export declare class MuxoEngine {
         provider?: string;
         syncLive?: boolean;
     }): Promise<Record<string, unknown>>;
+    getHostedSiteHtml(slug: string, filePath?: string): string | null;
     startConnection(ctx: ExecutionContext, params: {
         provider: string;
         lane?: ProviderLane;
@@ -287,8 +288,22 @@ export declare class MuxoEngine {
         trustScore: ReturnType<MicrosoftGovernanceAdapter["getWorkspaceTrustScore"]>;
         policy: Workspace["policy"];
         plainEnglish: ReturnType<typeof describePolicyInPlainEnglish>;
+        llmPolicyBrief: LlmPolicyAndGovernanceBrief;
         explanation: HumanFriendlyExplanation;
     };
+    resetWorkspaceGuardrails(ctx: ExecutionContext): {
+        ok: true;
+        action: "reset_guardrails";
+        workspace: Workspace;
+        policy: Workspace["policy"];
+        plainEnglish: ReturnType<typeof describePolicyInPlainEnglish>;
+        llmPolicyBrief: LlmPolicyAndGovernanceBrief;
+        explanation: HumanFriendlyExplanation;
+    };
+    checkToolPolicy(ctx: ExecutionContext, params: {
+        toolSlug: string;
+        input?: Record<string, unknown>;
+    }): Promise<PolicySimulationResult>;
     setKillSwitch(ctx: ExecutionContext, active: boolean, reason?: string): Workspace;
     scanForContextPoisoning(workspaceId: string, text: string): {
         poisoned: boolean;
@@ -301,6 +316,7 @@ export declare class MuxoEngine {
         workspaceId: string;
         policy: Workspace["policy"];
         plainEnglish: ReturnType<typeof describePolicyInPlainEnglish>;
+        llmPolicyBrief: LlmPolicyAndGovernanceBrief;
         activeDefaults: ActiveMemoryDefaults;
         activeGuardrails: string[];
     };
@@ -309,6 +325,7 @@ export declare class MuxoEngine {
         workspace: Workspace;
         guardrail: ParsedNaturalLanguageGuardrail;
         plainEnglish: ReturnType<typeof describePolicyInPlainEnglish>;
+        llmPolicyBrief: LlmPolicyAndGovernanceBrief;
         memoryRecord?: WorkspaceMemoryRecord;
     }>;
     doNaturalLanguage(ctx: ExecutionContext, params: {

package/dist/engine.js

@@ -1,9 +1,10 @@
 import crypto from "node:crypto";
-import { APPROVED_PLAN_STATUSES, approvalRequiredError, buildApprovalUrl, clampWaitSeconds, looksLikeToolSlug, unknownToolError, } from "./mcp-schema.js";
+import { isStripeProjectsExclusiveProvider, normalizeStripeProjectsProviderSlug, wrapMuxoConnectUrl, } from "./composio-catalog.js";
+import { APPROVED_PLAN_STATUSES, approvalRequiredError, buildApprovalHumanHandoff, buildApprovalUrl, buildOAuthHumanHandoff, clampWaitSeconds, looksLikeToolSlug, unknownToolError, } from "./mcp-schema.js";
 import { completeCloudProvisioningWorkflow, createCloudProvisioningWorkflow, normalizeWorkflowTarget, workflowNotFoundError, } from "./durable-workflow.js";
 import { buildMemoryKnowledgeGraph } from "./memory-graph.js";
 import { resolveNaturalLanguageIntent, } from "./nl.js";
-import { compileNaturalLanguageGuardrailWithLlm, describePolicyInPlainEnglish, formatHumanFriendlyExplanation, parseNaturalLanguageGuardrail, } from "./policy.js";
+import { DEFAULT_WORKSPACE_POLICY, buildLlmPolicyAndGovernanceBrief, compileNaturalLanguageGuardrailWithLlm, describePolicyInPlainEnglish, formatHumanFriendlyExplanation, parseNaturalLanguageGuardrail, simulatePolicyEvaluation, } from "./policy.js";
 import { ComposioInstantAdapter } from "./providers/composio-instant.js";
 import { ComposioSdkAdapter } from "./providers/composio-sdk.js";
 import { MicrosoftGovernanceAdapter } from "./providers/microsoft-governance.js";
@@ -73,6 +74,24 @@ export class MuxoEngine {
         const connections = this.store.listConnections(ws.id);
         const supplierSettlementSummary = this.store.getSupplierSettlementSummary(ws.id);
         const plainEnglishPolicy = describePolicyInPlainEnglish(ws.policy);
+        const localMemories = this.store.listMemoryRecords(ws.id, 25);
+        const activeFacts = this.store.listTemporalFacts(ws.id, {
+            includeHistorical: false,
+            limit: 30,
+        });
+        const inferred = extractActiveMemoryDefaults({
+            memories: localMemories,
+            temporalFacts: activeFacts,
+        });
+        const trustScore = this.governance.getWorkspaceTrustScore(ws.id);
+        const govStatus = this.governance.getStatus(ws);
+        const llmPolicyBrief = buildLlmPolicyAndGovernanceBrief(ws.policy, {
+            workspaceName: ws.name,
+            workspaceSlug: ws.slug,
+            activeDefaults: inferred.activeDefaults,
+            trustScore: { overall: trustScore.overall, tier: trustScore.tier },
+            agentDid: govStatus.agentDid,
+        });
         return {
             organization: {
                 id: ws.id,
@@ -88,12 +107,16 @@ export class MuxoEngine {
                 supplierSettlementSummary,
                 policy: ws.policy,
                 plainEnglishPolicy,
+                llmPolicyBrief,
+                activeDefaults: inferred.activeDefaults,
                 explanation: plainEnglishPolicy.explanation,
                 activeConnectionsCount: connections.filter((c) => c.status === "active").length,
                 provisionedResourcesCount: resources.filter((r) => r.status === "active").length,
                 projectsEnvironment: ws.projectsEnvName,
                 createdAt: ws.createdAt,
             },
+            llmPolicyBrief,
+            activeDefaults: inferred.activeDefaults,
         };
     }
     // 3. search_tools
@@ -101,7 +124,16 @@ export class MuxoEngine {
         const limit = Math.min(100, Math.max(1, Number(params.limit || 25)));
         const lane = params.lane || "all";
         const query = params.query?.trim();
+        const queryTokens = (query || "")
+            .toLowerCase()
+            .split(/[\s,._/-]+/)
+            .filter(Boolean);
+        const prefersStripeProjects = queryTokens.some((tok) => isStripeProjectsExclusiveProvider(tok) ||
+            /^(provision|deploy|deployment|publish|host|hosting|static|landing|database|postgres|sqlite|redis)$/.test(tok));
         const results = [];
+        if (lane === "all" && prefersStripeProjects) {
+            results.push(...this.stripeProjects.searchTools(query, limit));
+        }
         if (lane === "all" || lane === "composio_instant") {
             results.push(...this.composioInstant.searchTools(query, limit));
         }
@@ -109,8 +141,10 @@ export class MuxoEngine {
             const sdkTools = await this.composioSdk.searchTools(query, limit);
             results.push(...sdkTools);
         }
-        if (lane === "all" || lane === "stripe_projects") {
+        if (lane === "stripe_projects" || (lane === "all" && !prefersStripeProjects)) {
             results.push(...this.stripeProjects.searchTools(query, limit));
+        }
+        if (lane === "all" || lane === "stripe_projects") {
             const billingTools = this.stripeBilling.listTools().filter((t) => {
                 if (!query)
                     return true;
@@ -131,7 +165,7 @@ export class MuxoEngine {
     async listAllCatalogTools() {
         const instant = this.composioInstant.searchTools(undefined, 100);
         const sdk = await this.composioSdk.searchTools(undefined, 100);
-        const proj = this.stripeProjects.searchTools(undefined, 100);
+        const proj = this.stripeProjects.getTools();
         const billing = this.stripeBilling.listTools();
         return [...instant, ...billing, ...sdk, ...proj];
     }
@@ -162,6 +196,9 @@ export class MuxoEngine {
             const composioByok = this.store.getByokKey(ctx.workspace.id, "composio");
             const liveComposio = await this.composioSdk.listLiveConnections(ctx.workspace.id, composioByok);
             for (const c of liveComposio) {
+                if (isStripeProjectsExclusiveProvider(c.providerSlug)) {
+                    continue;
+                }
                 this.store.upsertConnection({
                     workspaceId: ctx.workspace.id,
                     lane: "composio_sdk",
@@ -191,15 +228,63 @@ export class MuxoEngine {
                 // Keep cached connections if CLI is busy
             }
         }
-        let connections = this.store.listConnections(ctx.workspace.id);
+        let connections = this.store.listConnections(ctx.workspace.id).map((c) => {
+            if (isStripeProjectsExclusiveProvider(c.providerSlug)) {
+                return {
+                    ...c,
+                    lane: "stripe_projects",
+                    status: "active",
+                    redirectUrl: null,
+                };
+            }
+            return c.lane === "composio_sdk" && c.redirectUrl
+                ? {
+                    ...c,
+                    redirectUrl: wrapMuxoConnectUrl(c.redirectUrl, this.config.baseUrl, {
+                        workspaceId: c.workspaceId,
+                        providerSlug: c.providerSlug,
+                        externalAccountId: c.externalAccountId,
+                    }),
+                }
+                : c;
+        });
         if (params?.provider) {
-            const target = params.provider.toLowerCase();
-            connections = connections.filter((c) => c.providerSlug.toLowerCase() === target ||
-                c.providerName.toLowerCase().includes(target));
+            const target = normalizeStripeProjectsProviderSlug(params.provider) || params.provider.toLowerCase();
+            if (isStripeProjectsExclusiveProvider(target)) {
+                const activeRecord = this.store.upsertConnection({
+                    workspaceId: ctx.workspace.id,
+                    lane: "stripe_projects",
+                    providerSlug: target,
+                    providerName: target.charAt(0).toUpperCase() + target.slice(1),
+                    status: "active",
+                    externalAccountId: `sp_conn_${target}`,
+                    redirectUrl: null,
+                    metadata: {
+                        managedBy: "stripe_projects",
+                        requiresOAuth: false,
+                    },
+                });
+                connections = [activeRecord];
+            }
+            else {
+                connections = connections.filter((c) => c.providerSlug.toLowerCase() === target ||
+                    c.providerName.toLowerCase().includes(target));
+            }
         }
+        const targetConn = connections[0] || null;
+        const isActive = targetConn
+            ? targetConn.status === "active"
+            : connections.some((c) => c.status === "active");
         return {
+            ok: true,
             workspaceId: ctx.workspace.id,
             instantWalletStatus: "active",
+            connected: isActive,
+            ready: isActive,
+            timedOut: false,
+            status: targetConn?.status || "not_connected",
+            redirectUrl: isActive ? null : targetConn?.redirectUrl || null,
+            connection: targetConn,
             connections,
             summary: {
                 total: connections.length,
@@ -209,11 +294,18 @@ export class MuxoEngine {
             },
         };
     }
+    getHostedSiteHtml(slug, filePath) {
+        return this.stripeProjects.getHostedSiteHtml(slug, filePath);
+    }
     // 6. start_connection
     async startConnection(ctx, params) {
         const rawProvider = params.provider.trim().toLowerCase();
-        const isProjectsLane = params.lane === "stripe_projects" || rawProvider.startsWith("resource.");
-        const cleanSlug = rawProvider.replace(/^(app\.|resource\.)/, "");
+        const cleanSlug = normalizeStripeProjectsProviderSlug(rawProvider) ||
+            rawProvider.replace(/^(app\.|resource\.|projects\.)/, "");
+        const isProjectsLane = params.lane === "stripe_projects" ||
+            rawProvider.startsWith("resource.") ||
+            rawProvider.startsWith("projects.") ||
+            isStripeProjectsExclusiveProvider(cleanSlug);
         if (isProjectsLane) {
             const stripeByok = this.store.getByokKey(ctx.workspace.id, "stripe");
             const linked = await this.stripeProjects.linkProvider(cleanSlug, stripeByok);
@@ -258,10 +350,9 @@ export class MuxoEngine {
     }
     // 6b. wait_for_connection (OAuth handoff polling & recovery, like COMPOSIO_WAIT_FOR_CONNECTIONS)
     async waitForConnection(ctx, params) {
-        const cleanSlug = params.provider
-            .trim()
-            .toLowerCase()
-            .replace(/^(app\.|resource\.)/, "");
+        const rawProvider = params.provider.trim().toLowerCase();
+        const cleanSlug = normalizeStripeProjectsProviderSlug(rawProvider) ||
+            rawProvider.replace(/^(app\.|resource\.|projects\.)/, "");
         if (!cleanSlug) {
             throw new Error("provider is required to wait for a connection (e.g. 'github').");
         }
@@ -283,6 +374,22 @@ export class MuxoEngine {
             elapsedMs: Date.now() - startedAt,
             message,
         });
+        if (isStripeProjectsExclusiveProvider(cleanSlug)) {
+            const activeRecord = this.store.upsertConnection({
+                workspaceId: ctx.workspace.id,
+                lane: "stripe_projects",
+                providerSlug: cleanSlug,
+                providerName: cleanSlug.charAt(0).toUpperCase() + cleanSlug.slice(1),
+                status: "active",
+                externalAccountId: `sp_conn_${cleanSlug}`,
+                redirectUrl: null,
+                metadata: {
+                    managedBy: "stripe_projects",
+                    requiresOAuth: false,
+                },
+            });
+            return connectedResult(activeRecord, `${activeRecord.providerName} is managed via Stripe Projects Cloud Infrastructure and is active immediately (no OAuth required).`);
+        }
         let current = this.store
             .listConnections(ctx.workspace.id)
             .find((c) => c.providerSlug.toLowerCase() === cleanSlug);
@@ -341,6 +448,16 @@ export class MuxoEngine {
         if (!current) {
             current = await this.startConnection(ctx, { provider: cleanSlug });
         }
+        else if (current.redirectUrl) {
+            current = {
+                ...current,
+                redirectUrl: wrapMuxoConnectUrl(current.redirectUrl, this.config.baseUrl, {
+                    workspaceId: ctx.workspace.id,
+                    providerSlug: cleanSlug,
+                    externalAccountId: current.externalAccountId,
+                }),
+            };
+        }
         return {
             ok: true,
             connected: false,
@@ -527,14 +644,21 @@ export class MuxoEngine {
                     // Keep existing connection state if offline
                 }
                 if (!existingConn || existingConn.status !== "active") {
+                    const wrappedRedirectUrl = existingConn?.redirectUrl
+                        ? wrapMuxoConnectUrl(existingConn.redirectUrl, this.config.baseUrl, {
+                            workspaceId: ws.id,
+                            providerSlug: tool.providerSlug,
+                            externalAccountId: existingConn.externalAccountId,
+                        })
+                        : null;
                     authHandoff = {
                         required: true,
                         provider: tool.providerSlug,
                         status: existingConn?.status || "pending",
-                        redirectUrl: existingConn?.redirectUrl || null,
+                        redirectUrl: wrappedRedirectUrl,
                         externalAccountId: existingConn?.externalAccountId || null,
-                        instructions: existingConn?.redirectUrl
-                            ? `Ask the user to authorize ${tool.providerName} at ${existingConn.redirectUrl}, then call wait_for_connection({ provider: "${tool.providerSlug}" }) before executing ${plan.id}.`
+                        instructions: wrappedRedirectUrl
+                            ? `Ask the user to authorize ${tool.providerName} at ${wrappedRedirectUrl}, then call wait_for_connection({ provider: "${tool.providerSlug}" }) before executing ${plan.id}.`
                             : `Call start_connection({ provider: "${tool.providerSlug}" }) to authorize ${tool.providerName} before executing ${plan.id}.`,
                     };
                 }
@@ -606,25 +730,15 @@ export class MuxoEngine {
         });
     }
     buildApprovalHandoff(plan) {
-        const url = `${this.config.baseUrl}/approve/${encodeURIComponent(plan.id)}`;
-        return {
-            kind: "approval",
-            url,
-            ctaLabel: "Review & approve",
-            headline: `Muxo needs your approval to run ${plan.toolSlug}`,
-            instructions: `Open ${url} to review and approve this ${plan.riskLevel}-risk action with one click (or run \`muxo approve ${plan.id}\`). Nothing runs until you approve.`,
-            planId: plan.id,
-        };
+        return buildApprovalHumanHandoff(this.config.baseUrl, plan);
     }
     buildOAuthHandoff(handoff, providerName) {
-        return {
-            kind: "oauth",
-            url: handoff.redirectUrl,
-            ctaLabel: `Connect ${providerName}`,
-            headline: `Connect ${providerName} to continue`,
+        return buildOAuthHumanHandoff({
+            providerSlug: handoff.provider,
+            providerName,
+            redirectUrl: handoff.redirectUrl,
             instructions: handoff.instructions,
-            provider: handoff.provider,
-        };
+        });
     }
     buildPlanLlmGuidance(plan, authHandoff) {
         const executeTool = `execute_${plan.riskLevel}`;
@@ -767,6 +881,7 @@ export class MuxoEngine {
         }
         const enriched = {
             ...ctx,
+            enabled: true,
             staticFacts,
             dynamicContext,
             recalledMemories: recalled,
@@ -833,6 +948,13 @@ export class MuxoEngine {
             technical: contextTechnical,
             policy: ws.policy,
         });
+        const llmPolicyBrief = buildLlmPolicyAndGovernanceBrief(ws.policy, {
+            workspaceName: ws.name,
+            workspaceSlug: ws.slug,
+            activeDefaults: memoryContext.activeDefaults || {},
+            trustScore: { overall: trustScore.overall, tier: trustScore.tier },
+            agentDid: governanceStatus.agentDid,
+        });
         const llmSystemPrompt = [
             `# Muxo Governed Workspace Context (${ws.name} / ${ws.slug})`,
             `- **Language Preference**: ${ws.policy.languageMode || "hybrid"}${ws.policy.customInstructions?.length ? ` (Custom Instructions: ${ws.policy.customInstructions.join("; ")})` : ""}`,
@@ -840,6 +962,7 @@ export class MuxoEngine {
             `- **Learned Memory Defaults (Auto-Fill)**: ${defaultsList.length > 0 ? defaultsList.join(", ") : "none"}`,
             `- **Credits & Quota**: ${ws.creditsBalance} credits ($${(ws.creditsBalance * 0.01).toFixed(2)}) available, ${actionsRemaining} monthly actions remaining`,
             `- **Active Cloud Resources**: ${activeResources.length > 0 ? activeResources.map((r) => `${r.resourceName} (${r.serviceSlug})`).join(", ") : "none"}`,
+            llmPolicyBrief.llmSystemDirective,
             memoryContext.formattedPromptContext,
         ].join("\n");
         return {
@@ -848,6 +971,7 @@ export class MuxoEngine {
             projectsEnvironment: ws.projectsEnvName,
             policy: ws.policy,
             plainEnglishPolicy,
+            llmPolicyBrief,
             languageMode: ws.policy.languageMode || "hybrid",
             customInstructions: ws.policy.customInstructions || [],
             activeDefaults: (memoryContext.activeDefaults ||
@@ -1060,7 +1184,10 @@ export class MuxoEngine {
     // 10-15. execute_<risk_level>
     async executePlanForRisk(ctx, planId, expectedRisk) {
         const plan = this.getPlan(ctx, planId);
-        if (plan.riskLevel !== expectedRisk) {
+        const isProjectsWriteCompatible = plan.lane === "stripe_projects" &&
+            plan.riskLevel === "provisioning" &&
+            expectedRisk === "write";
+        if (plan.riskLevel !== expectedRisk && !isProjectsWriteCompatible) {
             throw new Error(`Risk lane mismatch: Plan '${plan.id}' has risk level '${plan.riskLevel}', so it must be executed with 'execute_${plan.riskLevel}' instead of 'execute_${expectedRisk}'.`);
         }
         if (plan.runId) {
@@ -1107,7 +1234,16 @@ export class MuxoEngine {
         }
         let activeConnId = null;
         if (plan.lane === "composio_sdk" && tool.requiresAuth) {
-            let connections = this.store.listConnections(ctx.workspace.id);
+            let connections = this.store.listConnections(ctx.workspace.id).map((c) => c.lane === "composio_sdk" && c.redirectUrl
+                ? {
+                    ...c,
+                    redirectUrl: wrapMuxoConnectUrl(c.redirectUrl, this.config.baseUrl, {
+                        workspaceId: c.workspaceId,
+                        providerSlug: c.providerSlug,
+                        externalAccountId: c.externalAccountId,
+                    }),
+                }
+                : c);
             let activeConn = connections.find((c) => c.lane === "composio_sdk" &&
                 c.providerSlug === tool.providerSlug &&
                 c.status === "active");
@@ -1581,6 +1717,22 @@ export class MuxoEngine {
         const governance = this.governance.getStatus(ws);
         const trustScore = this.governance.getWorkspaceTrustScore(ws.id);
         const plainEnglish = describePolicyInPlainEnglish(ws.policy);
+        const localMemories = this.store.listMemoryRecords(ws.id, 25);
+        const activeFacts = this.store.listTemporalFacts(ws.id, {
+            includeHistorical: false,
+            limit: 30,
+        });
+        const inferred = extractActiveMemoryDefaults({
+            memories: localMemories,
+            temporalFacts: activeFacts,
+        });
+        const llmPolicyBrief = buildLlmPolicyAndGovernanceBrief(ws.policy, {
+            workspaceName: ws.name,
+            workspaceSlug: ws.slug,
+            activeDefaults: inferred.activeDefaults,
+            trustScore: { overall: trustScore.overall, tier: trustScore.tier },
+            agentDid: governance.agentDid,
+        });
         const killSwitch = {
             active: Boolean(ws.policy.killSwitchActive),
             reason: ws.policy.killSwitchReason || null,
@@ -1603,9 +1755,70 @@ export class MuxoEngine {
             trustScore,
             policy: ws.policy,
             plainEnglish,
+            llmPolicyBrief,
             explanation,
         };
     }
+    resetWorkspaceGuardrails(ctx) {
+        const ws = this.store.getWorkspace(ctx.workspace.id);
+        const updated = this.store.updateWorkspacePolicy(ws.id, {
+            ...DEFAULT_WORKSPACE_POLICY,
+            parameterRules: [],
+            customInstructions: [],
+            naturalLanguageRules: [],
+            blockedToolSlugs: [],
+        });
+        this.governance.resumeKillSwitch(ws.id);
+        const plainEnglish = describePolicyInPlainEnglish(updated.policy);
+        const llmPolicyBrief = buildLlmPolicyAndGovernanceBrief(updated.policy, {
+            workspaceName: updated.name,
+            workspaceSlug: updated.slug,
+        });
+        return {
+            ok: true,
+            action: "reset_guardrails",
+            workspace: updated,
+            policy: updated.policy,
+            plainEnglish,
+            llmPolicyBrief,
+            explanation: plainEnglish.explanation,
+        };
+    }
+    async checkToolPolicy(ctx, params) {
+        const ws = this.store.getWorkspace(ctx.workspace.id);
+        const localMemories = this.store.listMemoryRecords(ws.id, 25);
+        const activeFacts = this.store.listTemporalFacts(ws.id, {
+            includeHistorical: false,
+            limit: 30,
+        });
+        const inferred = extractActiveMemoryDefaults({
+            memories: localMemories,
+            temporalFacts: activeFacts,
+        });
+        let riskLevel;
+        let creditCost;
+        let lane;
+        let resolvedSlug = String(params.toolSlug || "instant.web.search").trim();
+        try {
+            const tool = await this.inspectTool(resolvedSlug);
+            resolvedSlug = tool.slug;
+            riskLevel = tool.riskLevel;
+            creditCost = tool.creditCost;
+            lane = tool.lane;
+        }
+        catch {
+            // Fallback to slug prefix heuristics in simulatePolicyEvaluation
+        }
+        return simulatePolicyEvaluation({
+            policy: ws.policy,
+            toolSlug: resolvedSlug,
+            riskLevel,
+            creditCost,
+            lane,
+            input: params.input || {},
+            activeDefaults: inferred.activeDefaults,
+        });
+    }
     setKillSwitch(ctx, active, reason) {
         const ws = this.store.getWorkspace(ctx.workspace.id);
         const updated = this.store.updateWorkspacePolicy(ws.id, {
@@ -1656,10 +1869,16 @@ export class MuxoEngine {
             memories: localMemories,
             temporalFacts: activeFacts,
         });
+        const llmPolicyBrief = buildLlmPolicyAndGovernanceBrief(ws.policy, {
+            workspaceName: ws.name,
+            workspaceSlug: ws.slug,
+            activeDefaults: inferred.activeDefaults,
+        });
         return {
             workspaceId: ws.id,
             policy: ws.policy,
             plainEnglish,
+            llmPolicyBrief,
             activeDefaults: inferred.activeDefaults,
             activeGuardrails: Array.from(new Set([
                 ...(ws.policy.naturalLanguageRules || []),
@@ -1701,11 +1920,16 @@ export class MuxoEngine {
             // Non-blocking if memory scan/storage fails
         }
         const plainEnglish = describePolicyInPlainEnglish(updated.policy);
+        const llmPolicyBrief = buildLlmPolicyAndGovernanceBrief(updated.policy, {
+            workspaceName: updated.name,
+            workspaceSlug: updated.slug,
+        });
         return {
             ok: true,
             workspace: updated,
             guardrail: parsed,
             plainEnglish,
+            llmPolicyBrief,
             memoryRecord,
         };
     }