@muxoai/platform 1.4.1 → 1.4.3

package/dist/policy.d.ts

@@ -1,4 +1,4 @@
-import type { GovernancePolicy, HumanFriendlyExplanation, LanguageMode, ParameterPolicyRule } from "./types.js";
+import type { GovernancePolicy, HumanFriendlyExplanation, LanguageMode, ParameterPolicyRule, RiskLevel } from "./types.js";
 export declare function sanitizeParameterPolicyRule(r: Record<string, unknown>, idx?: number): ParameterPolicyRule;
 export declare class PolicyValidationError extends Error {
 }
@@ -81,3 +81,110 @@ export declare function evaluateParameterPolicyRules(paramsOrToolSlug: {
     violatedRule: ParameterPolicyRule | null;
     reason: string | null;
 };
+export declare function describeParameterRuleCompliance(rule: ParameterPolicyRule): string;
+export interface LlmRiskLaneRule {
+    riskLevel: RiskLevel;
+    status: "auto_approved" | "requires_approval" | "blocked";
+    executeTool: string;
+    reason: string;
+}
+export interface LlmPolicyAndGovernanceBrief {
+    workspaceId?: string;
+    posture: "paused" | "read_only_sandbox" | "ask_every_time" | "safe_default" | "hands_off" | "monitor";
+    mode: "enforce" | "monitor";
+    executionRing: 0 | 1 | 2 | 3;
+    headline: string;
+    preferredExplanation: string;
+    plainEnglish: ReturnType<typeof describePolicyInPlainEnglish>;
+    languageMode: LanguageMode;
+    customInstructions: string[];
+    killSwitch: {
+        active: boolean;
+        reason: string | null;
+        howToToggleMcp: {
+            pause: {
+                tool: "get_run_context";
+                arguments: Record<string, unknown>;
+            };
+            resume: {
+                tool: "get_run_context";
+                arguments: Record<string, unknown>;
+            };
+        };
+    };
+    budgetGuardrail: {
+        maxCreditsPerRun: number;
+        maxUsdPerRun: number;
+        allowInstantWallet: boolean;
+        allowProvisioning: boolean;
+        blockDestructiveSql: boolean;
+    };
+    riskLaneMatrix: Record<RiskLevel, LlmRiskLaneRule>;
+    autoApproveRiskLevels: RiskLevel[];
+    requireApprovalRiskLevels: RiskLevel[];
+    blockedRiskLevels: RiskLevel[];
+    blockedToolSlugs: string[];
+    parameterRules: Array<ParameterPolicyRule & {
+        howToComply: string;
+    }>;
+    naturalLanguageRules: string[];
+    activeDefaults: Record<string, unknown>;
+    trustScore?: {
+        overall: number;
+        tier: string;
+    };
+    agentDid?: string;
+    llmSystemDirective: string;
+    agentControlCheatsheet: Array<{
+        intent: string;
+        mcpTool: string;
+        arguments: Record<string, unknown>;
+    }>;
+}
+export declare function buildLlmPolicyAndGovernanceBrief(policy?: GovernancePolicy, options?: {
+    workspaceId?: string;
+    workspaceName?: string;
+    workspaceSlug?: string;
+    activeDefaults?: Record<string, unknown>;
+    trustScore?: {
+        overall: number;
+        tier: string;
+    };
+    agentDid?: string;
+}): LlmPolicyAndGovernanceBrief;
+export interface PolicySimulationResult {
+    ok: true;
+    action: "check_policy";
+    toolSlug: string;
+    toolName?: string;
+    riskLevel: RiskLevel;
+    creditCost: number;
+    decision: "auto_approved" | "pending_approval" | "blocked";
+    approvalStatus: "auto_approved" | "pending_approval" | "blocked";
+    allowed: boolean;
+    requiresApproval: boolean;
+    blocked: boolean;
+    executeTool: string;
+    effectiveInput: Record<string, unknown>;
+    autoFilledInput: Record<string, unknown>;
+    reasons: string[];
+    matchedParameterRule: ParameterPolicyRule | null;
+    violatedParameterRule: ParameterPolicyRule | null;
+    remediationForLlm: string;
+    nextToolCalls: Array<{
+        tool: string;
+        input: Record<string, unknown>;
+        when: string;
+    }>;
+}
+export declare function simulatePolicyEvaluation(params: {
+    policy?: GovernancePolicy | null;
+    toolSlug: string;
+    toolName?: string;
+    riskLevel?: RiskLevel;
+    creditCost?: number;
+    creditsBalance?: number;
+    lane?: string;
+    input?: Record<string, unknown>;
+    activeDefaults?: Record<string, unknown>;
+}): PolicySimulationResult;

package/dist/policy.js

@@ -239,6 +239,7 @@ export const DEFAULT_WORKSPACE_POLICY = {
     killSwitchReason: null,
     blockDestructiveSql: true,
     naturalLanguageRules: [],
+    parameterRules: [],
     languageMode: "hybrid",
     customInstructions: [],
 };
@@ -267,7 +268,22 @@ export function parseNaturalLanguageGuardrail(prompt, currentPolicy = DEFAULT_WO
             // Ignore invalid partial fields in optional patch
         }
     }
-    const hasGuardrailIntent = /\b(don'?t\s+(?:go\s+over|spend|exceed|use|run|call|allow|provision|delete|drop|send|post)|never\s+(?:go\s+over|spend|exceed|use|run|call|allow|provision|delete|drop|send|post)|do\s+not\s+(?:go\s+over|spend|exceed|use|run|call|allow|provision|delete|drop|send|post)|cap\s+(?:budget|spend|credits)|budget\s+(?:cap|limit|under|below)|max(?:imum)?\s+\d+\s*credits|limit\s+(?:spend|budget|credits)|block\s+(?:tool|destructive|sql|provisioning|app\.|resource\.|instant\.|billing\.|refunds?|payments?|transfers?|emails?|messages?)|unblock\s+(?:all\s+)?tools|disable\s+(?:tool|provisioning|instant)|enable\s+provisioning|ask\s+(?:me\s+)?before|require\s+approval|auto[- ]?approve|only\s+(?:allow|send|post|permit)|restrict\s+(?:emails?|messages?|slack|github|refunds?)|read[- ]only\s+mode|sandbox\s+mode|strict\s+manual|hands[- ]off\s+mode|safe\s+default|monitor\s+mode|observation\s+mode|enforce\s+mode|execution\s+ring|ring\s+[0123]|non[- ]technical\s+(?:mode|language|explanations?)|technical\s+(?:mode|language|explanations?|detail)|plain\s+english|hybrid\s+(?:mode|language)|custom\s+instruction\s*:|always\s+(?:explain|show|include|format)|guardrail\s*:|rule\s*:|policy\s*:)/i.test(cleanPrompt);
+    const hasGuardrailIntent = /\b(don'?t\s+(?:go\s+over|spend|exceed|use|run|call|allow|provision|delete|drop|send|post)|never\s+(?:go\s+over|spend|exceed|use|run|call|allow|provision|delete|drop|send|post)|do\s+not\s+(?:go\s+over|spend|exceed|use|run|call|allow|provision|delete|drop|send|post)|cap\s+(?:budget|spend|credits)|budget\s+(?:cap|limit|under|below)|max(?:imum)?\s+\d+\s*credits|limit\s+(?:spend|budget|credits)|block\s+(?:tool|destructive|sql|provisioning|app\.|resource\.|instant\.|billing\.|refunds?|payments?|transfers?|emails?|messages?)|unblock\s+(?:all\s+)?tools|disable\s+(?:tool|provisioning|instant)|enable\s+provisioning|ask\s+(?:me\s+)?before|require\s+approval|auto[- ]?approve|only\s+(?:allow|send|post|permit)|restrict\s+(?:emails?|messages?|slack|github|refunds?)|read[- ]only\s+mode|sandbox\s+mode|strict\s+manual|hands[- ]off\s+mode|safe\s+default|monitor\s+mode|observation\s+mode|enforce\s+mode|execution\s+ring|ring\s+[0123]|non[- ]technical\s+(?:mode|language|explanations?)|technical\s+(?:mode|language|explanations?|detail)|plain\s+english|hybrid\s+(?:mode|language)|custom\s+instruction\s*:|always\s+(?:explain|show|include|format)|guardrail\s*:|rule\s*:|policy\s*:|(?:reset|clear|restore)\s+(?:all\s+)?(?:guardrails?|policy|safety\s+rules?))/i.test(cleanPrompt);
+    // 0. Full policy / guardrail reset ("reset guardrails", "clear all guardrails", "restore default policy")
+    if (/\b(reset|clear|restore)\s+(?:all\s+)?(?:custom\s+)?(?:guardrails?|policy|safety\s+rules?)(?:\s+to\s+defaults?)?\b/i.test(lower) &&
+        !/\bparameter\s+rules\b/i.test(lower)) {
+        patch.mode = DEFAULT_WORKSPACE_POLICY.mode;
+        patch.requireApprovalFor = [...DEFAULT_WORKSPACE_POLICY.requireApprovalFor];
+        patch.allowInstantWallet = DEFAULT_WORKSPACE_POLICY.allowInstantWallet;
+        patch.allowProvisioning = DEFAULT_WORKSPACE_POLICY.allowProvisioning;
+        patch.maxCreditsPerRun = DEFAULT_WORKSPACE_POLICY.maxCreditsPerRun;
+        patch.blockedToolSlugs = [];
+        patch.parameterRules = [];
+        patch.executionRing = DEFAULT_WORKSPACE_POLICY.executionRing;
+        patch.blockDestructiveSql = DEFAULT_WORKSPACE_POLICY.blockDestructiveSql;
+        patch.naturalLanguageRules = [];
+        appliedSummaries.push("Reset all workspace guardrails, parameter rules, and approval thresholds to Safe Default");
+    }
     // Detect whether a dollar amount in the sentence refers to a tool-specific transaction
     // (e.g. "Stripe refunds over $50", "payments over $100", "transfers above $250")
     // rather than the workspace's Muxo credit budget per run.
@@ -1190,3 +1206,392 @@ export function evaluateParameterPolicyRules(paramsOrToolSlug, maybeInput, maybe
             : null,
     };
 }
+export function describeParameterRuleCompliance(rule) {
+    const paramLabel = rule.parameter.split(",")[0] || rule.parameter;
+    const valStr = Array.isArray(rule.value)
+        ? rule.value.join(", ")
+        : String(rule.value);
+    const unitSuffix = rule.unit && rule.unit !== "raw" ? ` ${rule.unit.toUpperCase()}` : "";
+    const elseNote = rule.elseAction
+        ? `; otherwise action is '${rule.elseAction}'`
+        : "";
+    switch (rule.operator) {
+        case "must_end_with":
+        case "ends_with":
+            return `For tools matching '${rule.toolPattern}', parameter '${paramLabel}' must end with '${valStr}' (violation -> ${rule.action}${elseNote}).`;
+        case "domain_in":
+            return `For tools matching '${rule.toolPattern}', recipient domain in '${paramLabel}' must be in [${valStr}] (violation -> ${rule.action}${elseNote}).`;
+        case "domain_not_in":
+            return `For tools matching '${rule.toolPattern}', recipient domain in '${paramLabel}' must NOT be in [${valStr}] (violation -> ${rule.action}${elseNote}).`;
+        case "max_number":
+        case "gt":
+        case "gte":
+            return `For tools matching '${rule.toolPattern}', keep '${paramLabel}' <= ${valStr}${unitSuffix} (exceeding ${valStr}${unitSuffix} triggers '${rule.action}'${elseNote}).`;
+        case "min_number":
+        case "lt":
+        case "lte":
+            return `For tools matching '${rule.toolPattern}', keep '${paramLabel}' >= ${valStr}${unitSuffix} (below ${valStr}${unitSuffix} triggers '${rule.action}'${elseNote}).`;
+        case "must_equal":
+        case "equals":
+            return `For tools matching '${rule.toolPattern}', parameter '${paramLabel}' must equal '${valStr}' (violation -> ${rule.action}${elseNote}).`;
+        case "not_equals":
+            return `For tools matching '${rule.toolPattern}', parameter '${paramLabel}' must NOT equal '${valStr}' (violation -> ${rule.action}${elseNote}).`;
+        case "in":
+            return `For tools matching '${rule.toolPattern}', parameter '${paramLabel}' must be one of [${valStr}] (violation -> ${rule.action}${elseNote}).`;
+        case "not_in":
+            return `For tools matching '${rule.toolPattern}', parameter '${paramLabel}' must NOT be in [${valStr}] (violation -> ${rule.action}${elseNote}).`;
+        default:
+            return `${rule.description} (toolPattern='${rule.toolPattern}', parameter='${rule.parameter}', operator='${rule.operator}', value=${JSON.stringify(rule.value)}, action='${rule.action}'${elseNote}).`;
+    }
+}
+export function buildLlmPolicyAndGovernanceBrief(policy = DEFAULT_WORKSPACE_POLICY, options) {
+    const plain = describePolicyInPlainEnglish(policy);
+    const reqSet = new Set(policy.requireApprovalFor || []);
+    const ring = (policy.executionRing ?? 1);
+    const isPaused = Boolean(policy.killSwitchActive);
+    const isReadOnly = ring === 3;
+    const isMonitor = policy.mode === "monitor";
+    const posture = isPaused
+        ? "paused"
+        : isReadOnly
+            ? "read_only_sandbox"
+            : isMonitor
+                ? "monitor"
+                : reqSet.has("read")
+                    ? "ask_every_time"
+                    : !reqSet.has("write")
+                        ? "hands_off"
+                        : "safe_default";
+    const riskLaneMatrix = {};
+    for (const risk of RISK_LEVELS) {
+        const executeTool = `execute_${risk}`;
+        if (isPaused && !isMonitor) {
+            riskLaneMatrix[risk] = {
+                riskLevel: risk,
+                status: "blocked",
+                executeTool,
+                reason: `Blocked while workspace kill switch is active (${policy.killSwitchReason || "emergency pause"}).`,
+            };
+        }
+        else if (isReadOnly && risk !== "read" && !isMonitor) {
+            riskLaneMatrix[risk] = {
+                riskLevel: risk,
+                status: "blocked",
+                executeTool,
+                reason: "Blocked by Ring 3 Read-Only Sandbox mode (only 'read' tools are permitted).",
+            };
+        }
+        else if (risk === "provisioning" && policy.allowProvisioning === false && !isMonitor) {
+            riskLaneMatrix[risk] = {
+                riskLevel: risk,
+                status: "blocked",
+                executeTool,
+                reason: "Blocked because cloud infrastructure provisioning (allowProvisioning=false) is disabled.",
+            };
+        }
+        else if (reqSet.has(risk) && !isMonitor) {
+            riskLaneMatrix[risk] = {
+                riskLevel: risk,
+                status: "requires_approval",
+                executeTool,
+                reason: `Requires human owner approval before ${executeTool} can run (unless a conditional parameterRule explicitly sets elseAction='auto_approve').`,
+            };
+        }
+        else {
+            riskLaneMatrix[risk] = {
+                riskLevel: risk,
+                status: "auto_approved",
+                executeTool,
+                reason: isMonitor
+                    ? `Auto-approved in monitor mode; call ${executeTool} immediately after plan_action.`
+                    : `Auto-approved by workspace policy; call ${executeTool} immediately after plan_action.`,
+            };
+        }
+    }
+    const parameterRules = (policy.parameterRules || []).map((r) => ({
+        ...r,
+        howToComply: describeParameterRuleCompliance(r),
+    }));
+    const maxCredits = Number(policy.maxCreditsPerRun ?? 50);
+    const maxUsd = Number((maxCredits * 0.01).toFixed(2));
+    const activeDefaults = options?.activeDefaults || {};
+    const defaultsPairs = Object.entries(activeDefaults).map(([k, v]) => `${k}=${JSON.stringify(v)}`);
+    const autoApproveRiskLevels = RISK_LEVELS.filter((r) => riskLaneMatrix[r].status === "auto_approved");
+    const requireApprovalRiskLevels = RISK_LEVELS.filter((r) => riskLaneMatrix[r].status === "requires_approval");
+    const blockedLanes = RISK_LEVELS.filter((r) => riskLaneMatrix[r].status === "blocked");
+    const directiveLines = [
+        `## Muxo Policy & Governance Contract${options?.workspaceName ? ` (${options.workspaceName})` : ""}`,
+        `- **Posture**: \`${posture}\` (mode=\`${policy.mode || "enforce"}\`, ring=\`Ring ${ring}\`, languageMode=\`${plain.languageMode}\`)`,
+        `- **Summary**: ${plain.preferred}`,
+        `- **Per-Run Budget Cap**: ${maxCredits} credits ($${maxUsd.toFixed(2)}) max per run`,
+        `- **Auto-Approved Risk Lanes**: ${autoApproveRiskLevels.join(", ") || "none"}`,
+        `- **Human-Approval Risk Lanes**: ${requireApprovalRiskLevels.join(", ") || "none"}`,
+    ];
+    if (blockedLanes.length > 0) {
+        directiveLines.push(`- **Blocked Risk Lanes**: ${blockedLanes.join(", ")}`);
+    }
+    if (policy.blockedToolSlugs && policy.blockedToolSlugs.length > 0) {
+        directiveLines.push(`- **Blocked Tools (Never Call)**: ${policy.blockedToolSlugs.join(", ")}`);
+    }
+    if (parameterRules.length > 0) {
+        directiveLines.push(`- **Conditional Parameter Guardrails (${parameterRules.length})**:`);
+        for (const pr of parameterRules) {
+            directiveLines.push(`  - \`${pr.id}\`: ${pr.howToComply}`);
+        }
+    }
+    if (defaultsPairs.length > 0) {
+        directiveLines.push(`- **Learned Memory Defaults (Auto-Filled on plan_action)**: ${defaultsPairs.join(", ")}`);
+    }
+    if (plain.customInstructions.length > 0) {
+        directiveLines.push(`- **Operator Custom Instructions**: ${plain.customInstructions.join(" | ")}`);
+    }
+    return {
+        ...(options?.workspaceId ? { workspaceId: options.workspaceId } : {}),
+        posture,
+        mode: (policy.mode || "enforce"),
+        executionRing: ring,
+        headline: plain.headline,
+        preferredExplanation: plain.preferred,
+        plainEnglish: plain,
+        languageMode: plain.languageMode,
+        customInstructions: plain.customInstructions,
+        killSwitch: {
+            active: isPaused,
+            reason: policy.killSwitchReason || null,
+            howToToggleMcp: {
+                pause: {
+                    tool: "get_run_context",
+                    arguments: {
+                        action: "kill_switch",
+                        enabled: true,
+                        prompt: "Pause all agent executions",
+                    },
+                },
+                resume: {
+                    tool: "get_run_context",
+                    arguments: {
+                        action: "kill_switch",
+                        enabled: false,
+                        prompt: "Resume agent executions",
+                    },
+                },
+            },
+        },
+        budgetGuardrail: {
+            maxCreditsPerRun: maxCredits,
+            maxUsdPerRun: maxUsd,
+            allowInstantWallet: policy.allowInstantWallet !== false,
+            allowProvisioning: policy.allowProvisioning !== false,
+            blockDestructiveSql: policy.blockDestructiveSql !== false,
+        },
+        riskLaneMatrix,
+        autoApproveRiskLevels,
+        requireApprovalRiskLevels,
+        blockedRiskLevels: blockedLanes,
+        blockedToolSlugs: policy.blockedToolSlugs || [],
+        parameterRules,
+        naturalLanguageRules: policy.naturalLanguageRules || [],
+        activeDefaults,
+        ...(options?.trustScore ? { trustScore: options.trustScore } : {}),
+        ...(options?.agentDid ? { agentDid: options.agentDid } : {}),
+        llmSystemDirective: directiveLines.join("\n"),
+        agentControlCheatsheet: [
+            {
+                intent: "Inspect active policy, guardrails, and learned memory defaults",
+                mcpTool: "get_run_context",
+                arguments: { action: "governance_status" },
+            },
+            {
+                intent: "Add or update a guardrail in plain English or structured parameter_rules",
+                mcpTool: "get_run_context",
+                arguments: {
+                    action: "set_guardrail",
+                    prompt: "Require approval for Stripe refunds over $50, auto-approve under $50",
+                },
+            },
+            {
+                intent: "Dry-run test if a tool + input will pass policy before creating a plan",
+                mcpTool: "get_run_context",
+                arguments: {
+                    action: "check_policy",
+                    tool_slug: "app.gmail.send_email",
+                    input: { to: "team@muxo.ai", subject: "Status" },
+                },
+            },
+            {
+                intent: "Reset custom guardrails and parameter rules back to Safe Default",
+                mcpTool: "get_run_context",
+                arguments: { action: "reset_guardrails" },
+            },
+            {
+                intent: "Pause or resume workspace execution via the emergency kill switch",
+                mcpTool: "get_run_context",
+                arguments: { action: "kill_switch", enabled: false },
+            },
+            {
+                intent: "Save a workspace fact or default parameter for automatic recall",
+                mcpTool: "get_run_context",
+                arguments: {
+                    action: "remember",
+                    prompt: "Remember our default GitHub repo is muxo-ai/muxo",
+                },
+            },
+        ],
+    };
+}
+export function simulatePolicyEvaluation(params) {
+    const policy = {
+        ...DEFAULT_WORKSPACE_POLICY,
+        ...(params.policy || {}),
+    };
+    const toolSlug = String(params.toolSlug || "instant.web.search").trim();
+    const riskLevel = params.riskLevel ||
+        (toolSlug.startsWith("instant.")
+            ? "read"
+            : toolSlug.startsWith("resource.")
+                ? "provisioning"
+                : toolSlug.startsWith("billing.")
+                    ? "financial"
+                    : "write");
+    const creditCost = Number(params.creditCost ?? (riskLevel === "read" ? 2 : 5));
+    const rawInput = { ...(params.input || {}) };
+    const defaults = params.activeDefaults || {};
+    const effectiveInput = { ...rawInput };
+    const autoFilledInput = {};
+    for (const [k, v] of Object.entries(defaults)) {
+        if (effectiveInput[k] === undefined && v !== undefined) {
+            effectiveInput[k] = v;
+            autoFilledInput[k] = v;
+        }
+    }
+    const reasons = [];
+    let decision = "auto_approved";
+    const isMonitor = policy.mode === "monitor";
+    if (policy.killSwitchActive && !isMonitor) {
+        decision = "blocked";
+        reasons.push(`Workspace kill switch is active (${policy.killSwitchReason || "emergency pause"}).`);
+    }
+    if (decision !== "blocked" &&
+        (policy.blockedToolSlugs || []).some((s) => s.toLowerCase() === toolSlug.toLowerCase()) &&
+        !isMonitor) {
+        decision = "blocked";
+        reasons.push(`Tool '${toolSlug}' is on the workspace blockedToolSlugs list.`);
+    }
+    if (decision !== "blocked" &&
+        policy.executionRing === 3 &&
+        riskLevel !== "read" &&
+        !isMonitor) {
+        decision = "blocked";
+        reasons.push(`Workspace is in Ring 3 (Read-Only Sandbox mode), which blocks '${riskLevel}' tools.`);
+    }
+    if (decision !== "blocked" &&
+        riskLevel === "provisioning" &&
+        policy.allowProvisioning === false &&
+        !isMonitor) {
+        decision = "blocked";
+        reasons.push("Cloud infrastructure provisioning is disabled (allowProvisioning=false).");
+    }
+    const maxCredits = Number(policy.maxCreditsPerRun ?? 50);
+    if (decision !== "blocked" && creditCost > maxCredits && !isMonitor) {
+        decision = "blocked";
+        reasons.push(`Tool credit cost (${creditCost} cr) exceeds policy maxCreditsPerRun (${maxCredits} cr).`);
+    }
+    if (decision !== "blocked" &&
+        typeof params.creditsBalance === "number" &&
+        creditCost > params.creditsBalance) {
+        decision = "blocked";
+        reasons.push(`Insufficient workspace credits: tool requires ${creditCost} cr, balance is ${params.creditsBalance} cr.`);
+    }
+    const paramEval = evaluateParameterPolicyRules({
+        policy,
+        toolSlug,
+        input: effectiveInput,
+    });
+    if (decision !== "blocked") {
+        if (paramEval.violated && paramEval.action === "block" && !isMonitor) {
+            decision = "blocked";
+            reasons.push(paramEval.reason || "Blocked by conditional parameter guardrail.");
+        }
+        else if (paramEval.violated &&
+            paramEval.action === "require_approval" &&
+            !isMonitor) {
+            decision = "pending_approval";
+            reasons.push(paramEval.reason || "Parameter guardrail requires human owner approval.");
+        }
+        else if (paramEval.explicitAllow && paramEval.action === "auto_approve") {
+            decision = "auto_approved";
+            reasons.push(paramEval.reason ||
+                "Auto-approved by conditional parameter guardrail (elseAction='auto_approve').");
+        }
+        else if ((policy.requireApprovalFor || []).includes(riskLevel) &&
+            !isMonitor) {
+            decision = "pending_approval";
+            reasons.push(`Risk level '${riskLevel}' requires human owner approval under active workspace policy.`);
+        }
+        else {
+            decision = "auto_approved";
+            reasons.push(`Allowed and auto-approved under workspace policy (riskLevel='${riskLevel}', cost=${creditCost} cr <= ${maxCredits} cr).`);
+        }
+    }
+    const executeTool = `execute_${riskLevel}`;
+    let remediationForLlm = "";
+    const nextToolCalls = [];
+    if (decision === "auto_approved") {
+        remediationForLlm = `Action will be auto_approved. Call plan_action({ tool_slug: '${toolSlug}', input: ${JSON.stringify(effectiveInput)} }) and then ${executeTool}.`;
+        nextToolCalls.push({
+            tool: "plan_action",
+            input: {
+                tool_slug: toolSlug,
+                input: effectiveInput,
+                reason: `Execute ${toolSlug}`,
+            },
+            when: "Ready to create an auto-approved plan",
+        });
+    }
+    else if (decision === "pending_approval") {
+        remediationForLlm = `Action is allowed to be planned but will enter 'pending_approval' (${reasons.join("; ")}). Call plan_action, share humanHandoff.url with the user, and call get_plan({ plan_id, wait_for_approval: true }).`;
+        nextToolCalls.push({
+            tool: "plan_action",
+            input: {
+                tool_slug: toolSlug,
+                input: effectiveInput,
+                reason: `Request approval for ${toolSlug}`,
+            },
+            when: "To generate the plan and human approval URL",
+        });
+    }
+    else {
+        const ruleHint = paramEval.violatedRule
+            ? ` Adjust arguments to satisfy: ${describeParameterRuleCompliance(paramEval.violatedRule)}`
+            : "";
+        remediationForLlm = `Action is currently BLOCKED (${reasons.join("; ")}).${ruleHint} Or ask the user if they want to update the guardrail via get_run_context({ action: 'set_guardrail', prompt: '...' }).`;
+        nextToolCalls.push({
+            tool: "get_run_context",
+            input: {
+                action: "governance_status",
+            },
+            when: "To inspect active guardrails or adjust workspace policy with the user's permission",
+        });
+    }
+    return {
+        ok: true,
+        action: "check_policy",
+        toolSlug,
+        ...(params.toolName ? { toolName: params.toolName } : {}),
+        riskLevel,
+        creditCost,
+        decision,
+        approvalStatus: decision,
+        allowed: decision !== "blocked",
+        requiresApproval: decision === "pending_approval",
+        blocked: decision === "blocked",
+        executeTool,
+        effectiveInput,
+        autoFilledInput,
+        reasons,
+        matchedParameterRule: paramEval.matchedRule,
+        violatedParameterRule: paramEval.violatedRule,
+        remediationForLlm,
+        nextToolCalls,
+    };
+}

package/dist/providers/composio-instant.js

@@ -265,7 +265,8 @@ export class ComposioInstantAdapter {
         const hasCustomerByok = Boolean((params.composioApiKey && params.composioApiKey.trim()) ||
             (params.exaApiKey && params.exaApiKey.trim()) ||
             (params.firecrawlApiKey && params.firecrawlApiKey.trim()));
-        const activeComposioKey = params.composioApiKey || (isMasterWalletEmpty ? null : this.config.composioApiKey);
+        const activeComposioKey = params.composioApiKey ||
+            (isMasterWalletEmpty ? null : this.config.composioInstantApiKey || this.config.composioApiKey);
         const finalizeInstantResult = (res) => {
             if (isMasterWalletEmpty && !hasCustomerByok) {
                 return {
@@ -377,12 +378,29 @@ export class ComposioInstantAdapter {
                     new Promise((_, reject) => setTimeout(() => reject(new Error("Composio SDK instant timeout")), 8000)),
                 ]);
                 if (sdkRes && !sdkRes.error && sdkRes.successful !== false) {
+                    const rawData = (sdkRes.data ?? sdkRes);
+                    const citations = Array.isArray(rawData?.citations)
+                        ? rawData.citations
+                        : null;
+                    const mappedResults = Array.isArray(rawData?.results)
+                        ? rawData.results
+                        : citations
+                            ? citations.map((c) => ({
+                                title: String(c.title || c.url || c.id || ""),
+                                url: String(c.url || c.id || ""),
+                                snippet: String(c.author || rawData.answer || ""),
+                                source: "composio_instant",
+                            }))
+                            : undefined;
                     return finalizeInstantResult({
                         provider: "composio_instant",
                         sdk: "@composio/core",
                         billingMode: "provider_wallet",
                         tool: tool.slug,
-                        data: sdkRes.data ?? sdkRes,
+                        ...(input.query ? { query: String(input.query) } : {}),
+                        ...(typeof rawData?.answer === "string" ? { answer: rawData.answer } : {}),
+                        ...(mappedResults ? { results: mappedResults } : {}),
+                        data: rawData,
                     });
                 }
             }
@@ -405,11 +423,28 @@ export class ComposioInstantAdapter {
                 if (res.ok) {
                     const payload = (await res.json());
                     if (!payload.error) {
+                        const rawData = (payload.data ?? payload);
+                        const citations = Array.isArray(rawData?.citations)
+                            ? rawData.citations
+                            : null;
+                        const mappedResults = Array.isArray(rawData?.results)
+                            ? rawData.results
+                            : citations
+                                ? citations.map((c) => ({
+                                    title: String(c.title || c.url || c.id || ""),
+                                    url: String(c.url || c.id || ""),
+                                    snippet: String(c.author || rawData.answer || ""),
+                                    source: "composio_instant",
+                                }))
+                                : undefined;
                         return finalizeInstantResult({
                             provider: "composio_instant",
                             billingMode: "provider_wallet",
                             tool: tool.slug,
-                            data: payload.data ?? payload,
+                            ...(input.query ? { query: String(input.query) } : {}),
+                            ...(typeof rawData?.answer === "string" ? { answer: rawData.answer } : {}),
+                            ...(mappedResults ? { results: mappedResults } : {}),
+                            data: rawData,
                         });
                     }
                 }