@muxoai/sdk 1.2.3 → 1.4.2

package/dist/policy.js

@@ -0,0 +1,1597 @@
+const RISK_LEVELS = [
+    "read",
+    "write",
+    "admin",
+    "financial",
+    "provisioning",
+    "destructive",
+];
+const LANGUAGE_MODES = [
+    "non_technical",
+    "technical",
+    "hybrid",
+];
+const PARAMETER_RULE_OPERATORS = [
+    "equals",
+    "must_equal",
+    "not_equals",
+    "contains",
+    "not_contains",
+    "starts_with",
+    "must_start_with",
+    "ends_with",
+    "must_end_with",
+    "domain_in",
+    "domain_not_in",
+    "max_number",
+    "min_number",
+    "gt",
+    "gte",
+    "lt",
+    "lte",
+    "in",
+    "not_in",
+    "regex",
+];
+export function sanitizeParameterPolicyRule(r, idx = 0) {
+    const rawAction = String(r.action || "block").toLowerCase();
+    const action = rawAction === "require_approval" || rawAction === "escalate"
+        ? "require_approval"
+        : rawAction === "auto_approve"
+            ? "auto_approve"
+            : rawAction === "allow"
+                ? "allow"
+                : "block";
+    const rawElse = r.elseAction ? String(r.elseAction).toLowerCase() : "";
+    const elseAction = rawElse === "allow"
+        ? "allow"
+        : rawElse === "auto_approve"
+            ? "auto_approve"
+            : rawElse === "require_approval" || rawElse === "escalate"
+                ? "require_approval"
+                : rawElse === "block"
+                    ? "block"
+                    : undefined;
+    const rawOp = String(r.operator || "equals").toLowerCase();
+    const operator = PARAMETER_RULE_OPERATORS.includes(rawOp)
+        ? rawOp
+        : "equals";
+    const rawUnit = r.unit ? String(r.unit).toLowerCase() : undefined;
+    const unit = rawUnit === "usd" || rawUnit === "cents" || rawUnit === "credits" || rawUnit === "raw"
+        ? rawUnit
+        : undefined;
+    const rawSource = r.source ? String(r.source).toLowerCase() : undefined;
+    const source = rawSource === "deterministic" ||
+        rawSource === "llm" ||
+        rawSource === "mcp_harness" ||
+        rawSource === "user"
+        ? rawSource
+        : undefined;
+    const parameter = String(r.parameter || "").trim();
+    return {
+        id: String(r.id || `prule_${idx + 1}`),
+        toolPattern: String(r.toolPattern || "*"),
+        parameter,
+        operator,
+        value: r.value ?? "",
+        ...(unit ? { unit } : {}),
+        action,
+        ...(elseAction ? { elseAction } : {}),
+        description: String(r.description ||
+            `Parameter rule on ${parameter}: ${operator} ${JSON.stringify(r.value)}${elseAction ? ` (else ${elseAction})` : ""}`),
+        ...(source ? { source } : {}),
+    };
+}
+export class PolicyValidationError extends Error {
+}
+export function formatHumanFriendlyExplanation(params) {
+    const mode = params.languageMode ||
+        params.policy?.languageMode ||
+        "hybrid";
+    const customInstructions = Array.isArray(params.policy?.customInstructions)
+        ? params.policy.customInstructions.filter(Boolean)
+        : [];
+    const customNote = customInstructions.length > 0
+        ? ` [Custom instructions active: ${customInstructions.join("; ")}]`
+        : "";
+    const preferred = mode === "non_technical"
+        ? `${params.nonTechnical}${customNote}`
+        : mode === "technical"
+            ? `${params.technical}${customNote}`
+            : `${params.nonTechnical}\n\nTechnical detail: ${params.technical}${customNote}`;
+    return {
+        headline: params.headline,
+        preferred,
+        nonTechnical: params.nonTechnical,
+        technical: params.technical,
+        languageMode: mode,
+        ...(customInstructions.length > 0 ? { customInstructions } : {}),
+    };
+}
+/**
+ * Validates a client-supplied policy patch. Kill-switch fields are rejected so
+ * that pausing and resuming always goes through /api/v1/governance/kill-switch,
+ * which records the trust-score penalty and audit entry.
+ */
+export function sanitizePolicyPatch(body) {
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+        throw new PolicyValidationError("Policy update must be a JSON object");
+    }
+    const input = body;
+    if ("killSwitchActive" in input || "killSwitchReason" in input) {
+        throw new PolicyValidationError("Use POST /api/v1/governance/kill-switch to pause or resume agents");
+    }
+    const patch = {};
+    if (input.mode !== undefined) {
+        if (input.mode !== "monitor" && input.mode !== "enforce") {
+            throw new PolicyValidationError('mode must be "monitor" or "enforce"');
+        }
+        patch.mode = input.mode;
+    }
+    if (input.requireApprovalFor !== undefined) {
+        if (!Array.isArray(input.requireApprovalFor) ||
+            !input.requireApprovalFor.every((r) => RISK_LEVELS.includes(r))) {
+            throw new PolicyValidationError(`requireApprovalFor must be a list of: ${RISK_LEVELS.join(", ")}`);
+        }
+        patch.requireApprovalFor = [...new Set(input.requireApprovalFor)];
+    }
+    if (input.executionRing !== undefined) {
+        const ring = Number(input.executionRing);
+        if (![0, 1, 2, 3].includes(ring)) {
+            throw new PolicyValidationError("executionRing must be 0, 1, 2, or 3");
+        }
+        patch.executionRing = ring;
+    }
+    if (input.maxCreditsPerRun !== undefined) {
+        const max = Number(input.maxCreditsPerRun);
+        if (!Number.isFinite(max) || max < 0) {
+            throw new PolicyValidationError("maxCreditsPerRun must be a non-negative number");
+        }
+        patch.maxCreditsPerRun = max;
+    }
+    for (const key of ["allowInstantWallet", "allowProvisioning", "blockDestructiveSql"]) {
+        if (input[key] !== undefined) {
+            if (typeof input[key] !== "boolean") {
+                throw new PolicyValidationError(`${key} must be true or false`);
+            }
+            patch[key] = input[key];
+        }
+    }
+    if (input.blockedToolSlugs !== undefined) {
+        if (!Array.isArray(input.blockedToolSlugs) ||
+            !input.blockedToolSlugs.every((s) => typeof s === "string" && s.trim())) {
+            throw new PolicyValidationError("blockedToolSlugs must be a list of tool slugs");
+        }
+        patch.blockedToolSlugs = [
+            ...new Set(input.blockedToolSlugs.map((s) => s.trim())),
+        ];
+    }
+    if (input.parameterRules !== undefined) {
+        if (!Array.isArray(input.parameterRules)) {
+            throw new PolicyValidationError("parameterRules must be an array of parameter policy rules");
+        }
+        patch.parameterRules = input.parameterRules
+            .filter((r) => r && typeof r === "object" && typeof r.parameter === "string")
+            .map((r, idx) => sanitizeParameterPolicyRule(r, idx))
+            .slice(0, 50);
+    }
+    if (input.naturalLanguageRules !== undefined) {
+        if (!Array.isArray(input.naturalLanguageRules) ||
+            !input.naturalLanguageRules.every((r) => typeof r === "string")) {
+            throw new PolicyValidationError("naturalLanguageRules must be a list of rule strings");
+        }
+        patch.naturalLanguageRules = [
+            ...new Set(input.naturalLanguageRules
+                .map((r) => r.trim())
+                .filter((r) => r.length > 0 && r.length <= 280)),
+        ].slice(0, 50);
+    }
+    if (input.languageMode !== undefined) {
+        if (!LANGUAGE_MODES.includes(input.languageMode)) {
+            throw new PolicyValidationError(`languageMode must be one of: ${LANGUAGE_MODES.join(", ")}`);
+        }
+        patch.languageMode = input.languageMode;
+    }
+    if (input.customInstructions !== undefined) {
+        if (!Array.isArray(input.customInstructions) ||
+            !input.customInstructions.every((r) => typeof r === "string")) {
+            throw new PolicyValidationError("customInstructions must be a list of instruction strings");
+        }
+        patch.customInstructions = [
+            ...new Set(input.customInstructions
+                .map((r) => r.trim())
+                .filter((r) => r.length > 0 && r.length <= 280)),
+        ].slice(0, 25);
+    }
+    const inlineRule = typeof input.naturalLanguageRule === "string"
+        ? input.naturalLanguageRule.trim()
+        : typeof input.rule === "string"
+            ? input.rule.trim()
+            : typeof input.prompt === "string"
+                ? input.prompt.trim()
+                : typeof input.instruction === "string"
+                    ? input.instruction.trim()
+                    : "";
+    if (inlineRule) {
+        const parsed = parseNaturalLanguageGuardrail(inlineRule);
+        Object.assign(patch, parsed.patch);
+    }
+    if (Object.keys(patch).length === 0) {
+        throw new PolicyValidationError("No supported policy fields in request");
+    }
+    return patch;
+}
+export const DEFAULT_WORKSPACE_POLICY = {
+    mode: "enforce",
+    requireApprovalFor: [
+        "write",
+        "admin",
+        "financial",
+        "provisioning",
+        "destructive",
+    ],
+    allowInstantWallet: true,
+    allowProvisioning: true,
+    maxCreditsPerRun: 50,
+    blockedToolSlugs: [],
+    executionRing: 1,
+    killSwitchActive: false,
+    killSwitchReason: null,
+    blockDestructiveSql: true,
+    naturalLanguageRules: [],
+    parameterRules: [],
+    languageMode: "hybrid",
+    customInstructions: [],
+};
+/**
+ * Compiles plain-English user guardrails (e.g. "Hey Muxo, don't go over 25 credits",
+ * "Only allow sending emails to @muxo.ai", or "Require approval for Stripe refunds over $50,
+ * auto-approve under $50") and/or structured MCP harness parameter rules into enforced
+ * GovernancePolicy fields while keeping human-readable rule descriptions.
+ */
+export function parseNaturalLanguageGuardrail(prompt, currentPolicy = DEFAULT_WORKSPACE_POLICY, options) {
+    const cleanPrompt = String(prompt || "").trim();
+    const lower = cleanPrompt.toLowerCase();
+    const patch = {};
+    const appliedSummaries = [];
+    let compiledBy = options?.source === "mcp_harness"
+        ? "mcp_harness"
+        : options?.source === "llm"
+            ? "llm"
+            : "deterministic";
+    if (options?.policyPatch && typeof options.policyPatch === "object") {
+        try {
+            const sanitized = sanitizePolicyPatch(options.policyPatch);
+            Object.assign(patch, sanitized);
+        }
+        catch {
+            // Ignore invalid partial fields in optional patch
+        }
+    }
+    const hasGuardrailIntent = /\b(don'?t\s+(?:go\s+over|spend|exceed|use|run|call|allow|provision|delete|drop|send|post)|never\s+(?:go\s+over|spend|exceed|use|run|call|allow|provision|delete|drop|send|post)|do\s+not\s+(?:go\s+over|spend|exceed|use|run|call|allow|provision|delete|drop|send|post)|cap\s+(?:budget|spend|credits)|budget\s+(?:cap|limit|under|below)|max(?:imum)?\s+\d+\s*credits|limit\s+(?:spend|budget|credits)|block\s+(?:tool|destructive|sql|provisioning|app\.|resource\.|instant\.|billing\.|refunds?|payments?|transfers?|emails?|messages?)|unblock\s+(?:all\s+)?tools|disable\s+(?:tool|provisioning|instant)|enable\s+provisioning|ask\s+(?:me\s+)?before|require\s+approval|auto[- ]?approve|only\s+(?:allow|send|post|permit)|restrict\s+(?:emails?|messages?|slack|github|refunds?)|read[- ]only\s+mode|sandbox\s+mode|strict\s+manual|hands[- ]off\s+mode|safe\s+default|monitor\s+mode|observation\s+mode|enforce\s+mode|execution\s+ring|ring\s+[0123]|non[- ]technical\s+(?:mode|language|explanations?)|technical\s+(?:mode|language|explanations?|detail)|plain\s+english|hybrid\s+(?:mode|language)|custom\s+instruction\s*:|always\s+(?:explain|show|include|format)|guardrail\s*:|rule\s*:|policy\s*:|(?:reset|clear|restore)\s+(?:all\s+)?(?:guardrails?|policy|safety\s+rules?))/i.test(cleanPrompt);
+    // 0. Full policy / guardrail reset ("reset guardrails", "clear all guardrails", "restore default policy")
+    if (/\b(reset|clear|restore)\s+(?:all\s+)?(?:custom\s+)?(?:guardrails?|policy|safety\s+rules?)(?:\s+to\s+defaults?)?\b/i.test(lower) &&
+        !/\bparameter\s+rules\b/i.test(lower)) {
+        patch.mode = DEFAULT_WORKSPACE_POLICY.mode;
+        patch.requireApprovalFor = [...DEFAULT_WORKSPACE_POLICY.requireApprovalFor];
+        patch.allowInstantWallet = DEFAULT_WORKSPACE_POLICY.allowInstantWallet;
+        patch.allowProvisioning = DEFAULT_WORKSPACE_POLICY.allowProvisioning;
+        patch.maxCreditsPerRun = DEFAULT_WORKSPACE_POLICY.maxCreditsPerRun;
+        patch.blockedToolSlugs = [];
+        patch.parameterRules = [];
+        patch.executionRing = DEFAULT_WORKSPACE_POLICY.executionRing;
+        patch.blockDestructiveSql = DEFAULT_WORKSPACE_POLICY.blockDestructiveSql;
+        patch.naturalLanguageRules = [];
+        appliedSummaries.push("Reset all workspace guardrails, parameter rules, and approval thresholds to Safe Default");
+    }
+    // Detect whether a dollar amount in the sentence refers to a tool-specific transaction
+    // (e.g. "Stripe refunds over $50", "payments over $100", "transfers above $250")
+    // rather than the workspace's Muxo credit budget per run.
+    const isTransactionalThresholdPrompt = /\b(refunds?|payments?|charges?|transfers?|payouts?|invoices?|transactions?|wire|ach|send(?:ing)?\s+money)\b/i.test(lower) && !/\b(per\s+run|credits?\s+per\s+run|run\s+budget|muxo\s+credits?)\b/i.test(lower);
+    // 1. Budget / Credit / Dollar limits ("don't go over 25 credits", "max $0.50", "under 100 credits")
+    const creditMatch = cleanPrompt.match(/(?:over|above|exceed|max(?:imum)?|limit(?:\s+of|\s+to)?|cap(?:\s+at|\s+of)?|under|below|up\s+to|more\s+than|budget(?:\s+of|\s+is|\s+to)?)\s*(\d+(?:\.\d+)?)\s*credits?\b/i) ||
+        cleanPrompt.match(/\b(\d+)\s*credits?\s*(?:max|limit|cap|budget|per\s+run)\b/i);
+    const dollarMatch = !isTransactionalThresholdPrompt
+        ? cleanPrompt.match(/(?:over|above|exceed|max(?:imum)?|limit(?:\s+of|\s+to)?|cap(?:\s+at|\s+of)?|under|below|up\s+to|more\s+than|budget(?:\s+of|\s+is|\s+to)?)\s*\$\s*(\d+(?:\.\d+)?)/i) ||
+            cleanPrompt.match(/\$\s*(\d+(?:\.\d+)?)\s*(?:max|limit|cap|budget|per\s+run)\b/i) ||
+            cleanPrompt.match(/(?:over|above|exceed|max(?:imum)?|limit(?:\s+of|\s+to)?|cap(?:\s+at|\s+of)?|under|below|up\s+to|more\s+than|budget(?:\s+of|\s+is|\s+to)?)\s*(\d+(?:\.\d+)?)\s*(?:dollars?|usd)\b/i)
+        : null;
+    if (creditMatch) {
+        const credits = Math.max(0, Math.min(100_000, Math.round(Number(creditMatch[1]))));
+        patch.maxCreditsPerRun = credits;
+        appliedSummaries.push(`Budget cap set to ${credits} credits ($${(credits * 0.01).toFixed(2)}) per run`);
+    }
+    else if (dollarMatch) {
+        const dollars = Number(dollarMatch[1]);
+        const credits = Math.max(0, Math.min(100_000, Math.round(dollars * 100)));
+        patch.maxCreditsPerRun = credits;
+        appliedSummaries.push(`Budget cap set to $${dollars.toFixed(2)} (${credits} credits) per run`);
+    }
+    else if (/\b(free\s+tools?\s+only|zero\s+budget|no\s+paid\s+tools?|don'?t\s+spend\s+any\s+(?:money|credits))\b/i.test(lower)) {
+        patch.maxCreditsPerRun = 0;
+        patch.allowInstantWallet = false;
+        appliedSummaries.push("Paid tools disabled (0 credits per run)");
+    }
+    // 2. Tool / Slug blocking ("don't use resource.projects.deprovision", "block app.gmail.send_email")
+    const existingBlocked = new Set(currentPolicy.blockedToolSlugs || []);
+    let blockedChanged = false;
+    if (/\b(unblock\s+all|allow\s+all\s+tools|clear\s+blocked\s+tools|reset\s+blocked)\b/i.test(lower)) {
+        existingBlocked.clear();
+        blockedChanged = true;
+        appliedSummaries.push("Cleared all blocked tools");
+    }
+    const slugMatches = cleanPrompt.match(/\b(?:instant|app|resource|billing)\.[a-z0-9_]+(?:\.[a-z0-9_]+)+\b/gi);
+    if (slugMatches && slugMatches.length > 0) {
+        const isUnblock = /\b(unblock|allow|enable|permit)\b/i.test(lower) &&
+            !/\b(don'?t|never|do\s+not|block|disable)\b/i.test(lower);
+        for (const rawSlug of slugMatches) {
+            const slug = rawSlug.toLowerCase();
+            if (isUnblock) {
+                existingBlocked.delete(slug);
+                blockedChanged = true;
+                appliedSummaries.push(`Allowed tool ${slug}`);
+            }
+            else if (hasGuardrailIntent ||
+                /\b(don'?t|never|do\s+not|block|disable|forbid|stop)\b/i.test(lower)) {
+                existingBlocked.add(slug);
+                blockedChanged = true;
+                appliedSummaries.push(`Blocked tool ${slug}`);
+            }
+        }
+    }
+    // Friendly unconditional tool blocks ("don't send emails", "don't post to slack", "never deprovision")
+    // Do NOT unconditionally block the entire tool when the prompt is a conditional rule
+    // like "Only allow sending emails to @muxo.ai" or "Never post to #general" or "refunds over $50".
+    const isConditionalScope = /\b(only\s+(?:allow|send|post|permit)|restrict\s+to|must\s+end\s+with|over\s+\$?\d|above\s+\$?\d|under\s+\$?\d|below\s+\$?\d|exceeds?\s+\$?\d|more\s+than\s+\$?\d|to\s+@[a-z0-9.-]+|to\s+#[a-z0-9_-]+|in\s+[a-z0-9_.-]+\/[a-z0-9_.-]+)\b/i.test(lower);
+    if (!isConditionalScope &&
+        /\b(don'?t|never|do\s+not|block|disable|stop)\b[\s\S]*\b(send(?:ing)?\s+emails?|gmail\s+send)\b/i.test(lower)) {
+        existingBlocked.add("app.gmail.send_email");
+        blockedChanged = true;
+        appliedSummaries.push("Blocked sending emails (app.gmail.send_email)");
+    }
+    if (!isConditionalScope &&
+        /\b(don'?t|never|do\s+not|block|disable|stop)\b[\s\S]*\b(post(?:ing)?\s+to\s+slack|send(?:ing)?\s+slack|slack\s+messages?)\b/i.test(lower)) {
+        existingBlocked.add("app.slack.send_message");
+        blockedChanged = true;
+        appliedSummaries.push("Blocked sending Slack messages (app.slack.send_message)");
+    }
+    if (/\b(don'?t|never|do\s+not|block|disable|stop)\b[\s\S]*\b(deprovision|delete\s+databases?|destroy\s+projects?|teardown|destructive\s+tools?)\b/i.test(lower)) {
+        existingBlocked.add("resource.projects.deprovision");
+        blockedChanged = true;
+        appliedSummaries.push("Blocked cloud deprovisioning (resource.projects.deprovision)");
+    }
+    if (!isConditionalScope &&
+        /\b(don'?t|never|do\s+not|block|disable|stop)\b[\s\S]*\b(refunds?|issue\s+refund)\b/i.test(lower)) {
+        existingBlocked.add("billing.stripe.create_refund");
+        blockedChanged = true;
+        appliedSummaries.push("Blocked issuing Stripe refunds (billing.stripe.create_refund)");
+    }
+    if (blockedChanged) {
+        patch.blockedToolSlugs = Array.from(existingBlocked);
+    }
+    // 3. Provisioning & Instant Wallet toggles
+    if (/\b(don'?t|never|do\s+not|disable|block|stop|no)\b[\s\S]*\b(provision(?:ing)?|cloud\s+infrastructure|new\s+databases?)\b/i.test(lower) &&
+        !/\bask\s+(?:me\s+)?before\b/i.test(lower)) {
+        patch.allowProvisioning = false;
+        appliedSummaries.push("Disabled cloud infrastructure provisioning");
+    }
+    else if (/\b(enable|allow|turn\s+on)\s+(?:cloud\s+)?provisioning\b/i.test(lower)) {
+        patch.allowProvisioning = true;
+        appliedSummaries.push("Enabled cloud infrastructure provisioning");
+    }
+    // 4. Destructive SQL protection
+    if (/\b(block|prevent|disable|no|don'?t\s+(?:allow|run|use)|never\s+(?:allow|run|use))\b[\s\S]*\b(destructive\s+sql|drop\s+table|truncate|sql\s+delete|destructive\s+tools?)\b/i.test(lower)) {
+        patch.blockDestructiveSql = true;
+        appliedSummaries.push("Enabled destructive SQL protection (DROP/TRUNCATE blocked)");
+    }
+    // 5. Execution & Approval postures ("ask me before...", "read-only mode", "strict manual", "autonomous")
+    if (/\b(read[- ]only(\s+mode|\s+sandbox)?|sandbox\s+mode|only\s+allow\s+read(?:ing|s)?|don'?t\s+change\s+anything)\b/i.test(lower)) {
+        patch.executionRing = 3;
+        patch.mode = "enforce";
+        patch.allowProvisioning = false;
+        patch.requireApprovalFor = [
+            "write",
+            "admin",
+            "financial",
+            "provisioning",
+            "destructive",
+        ];
+        appliedSummaries.push("Switched to Read-Only Sandbox mode (only read/search tools can run)");
+    }
+    else if (/\b(ask\s+(?:me\s+)?(?:before\s+)?(?:every\s*time|everything|all\s+actions|all\s+tools)|strict\s+manual|require\s+approval\s+for\s+everything)\b/i.test(lower)) {
+        patch.mode = "enforce";
+        patch.executionRing = 1;
+        patch.requireApprovalFor = [
+            "read",
+            "write",
+            "admin",
+            "financial",
+            "provisioning",
+            "destructive",
+        ];
+        appliedSummaries.push("Set to Ask Every Time (manual approval required before any tool runs)");
+    }
+    else if (/\b(safe\s+default|ask\s+(?:me\s+)?before\s+(?:writing|changing|modifying|sending|provisioning|spending|destructive)|auto\s+read\s+approve\s+writes)\b/i.test(lower)) {
+        patch.mode = "enforce";
+        patch.executionRing = 1;
+        patch.requireApprovalFor = [
+            "write",
+            "admin",
+            "financial",
+            "provisioning",
+            "destructive",
+        ];
+        appliedSummaries.push("Set to Safe Default (reads run automatically; writes, billing, provisioning, and destructive actions ask first)");
+    }
+    else if (/\b(autonomous(\s+mode)?|hands[- ]off(\s+mode)?|auto[- ]approve\s+writes)\b/i.test(lower)) {
+        patch.mode = "enforce";
+        patch.executionRing = 0;
+        patch.requireApprovalFor = ["financial", "provisioning", "destructive"];
+        appliedSummaries.push("Set to Hands-Off mode (reads and writes run automatically; financial, provisioning, and destructive actions still ask)");
+    }
+    else if (/\b(monitor\s+mode|observation\s+mode|log\s+only|observe\s+without\s+blocking)\b/i.test(lower)) {
+        patch.mode = "monitor";
+        appliedSummaries.push("Switched to Monitor (Observation) mode (Muxo logs safety checks without blocking actions)");
+    }
+    else if (/\b(enforce\s+mode|strict\s+enforcement)\b/i.test(lower)) {
+        patch.mode = "enforce";
+        appliedSummaries.push("Switched to Enforce mode (safety guardrails actively block violations)");
+    }
+    // 6. Explicit execution ring (technical customization: "set execution ring to 2", "ring 0")
+    const ringMatch = cleanPrompt.match(/\b(?:execution\s+)?ring\s*([0123])\b/i);
+    if (ringMatch && patch.executionRing === undefined) {
+        const ring = Number(ringMatch[1]);
+        patch.executionRing = ring;
+        appliedSummaries.push(`Set execution ring to Ring ${ring}`);
+    }
+    // 7. Customizable language mode ("use non-technical language", "explain in technical detail", "hybrid language")
+    if (/\b(non[- ]technical(?:\s+language|\s+mode|\s+explanations?)?|plain[- ]english(?:\s+mode|\s+only)?|simple\s+language|explain\s+simply|no\s+jargon)\b/i.test(lower) &&
+        !/\b(both|hybrid)\b/i.test(lower)) {
+        patch.languageMode = "non_technical";
+        appliedSummaries.push("Set language mode to Non-Technical (plain English explanations without jargon)");
+    }
+    else if (/\b(technical\s+(?:language|mode|detail|explanations?)|developer\s+mode|engineering\s+detail)\b/i.test(lower) &&
+        !/\b(non[- ]technical|both|hybrid)\b/i.test(lower)) {
+        patch.languageMode = "technical";
+        appliedSummaries.push("Set language mode to Technical (cryptographic hashes, rings, and protocol facets included)");
+    }
+    else if (/\b(hybrid\s+(?:language|mode)|both\s+technical\s+and\s+non[- ]technical|both\s+plain\s+english\s+and\s+technical)\b/i.test(lower)) {
+        patch.languageMode = "hybrid";
+        appliedSummaries.push("Set language mode to Hybrid (both plain-English summary and technical detail)");
+    }
+    // 8. Custom communication / operator instructions ("custom instruction: ...", "always explain ...")
+    const customInstructionMatch = cleanPrompt.match(/(?:custom\s+instruction|communication\s+style|explanation\s+style)\s*[:=-]\s*(.+)$/i) ||
+        cleanPrompt.match(/^((?:always|whenever\s+you\s+explain|in\s+all\s+explanations)\s+(?:show|include|explain|format|mention|use)\b.+)$/i);
+    if (customInstructionMatch) {
+        const instruction = customInstructionMatch[1].trim().replace(/[.]+$/, "");
+        if (instruction) {
+            const existingInstructions = Array.isArray(currentPolicy.customInstructions)
+                ? [...currentPolicy.customInstructions]
+                : [];
+            if (!existingInstructions.includes(instruction)) {
+                existingInstructions.unshift(instruction);
+            }
+            patch.customInstructions = existingInstructions.slice(0, 25);
+            appliedSummaries.push(`Added custom instruction: "${instruction}"`);
+        }
+    }
+    // 9. Conditional & Parameter-level policy rules
+    // ("Only allow sending emails to @muxo.ai", "Require approval for Stripe refunds over $50, auto-approve under $50",
+    //  "Never post to #general", "Only allow GitHub writes in muxo/platform", plus structured MCP harness rules)
+    const existingParamRules = Array.isArray(currentPolicy.parameterRules)
+        ? [...currentPolicy.parameterRules]
+        : [];
+    let paramRulesChanged = false;
+    const upsertParamRule = (rule) => {
+        const filtered = existingParamRules.filter((r) => r.id !== rule.id);
+        filtered.unshift(rule);
+        existingParamRules.splice(0, existingParamRules.length, ...filtered);
+        paramRulesChanged = true;
+        appliedSummaries.push(rule.description);
+    };
+    if (/\b(clear|reset|remove)\s+(?:all\s+)?parameter\s+rules\b/i.test(lower)) {
+        existingParamRules.length = 0;
+        paramRulesChanged = true;
+        appliedSummaries.push("Cleared all parameter-level policy rules");
+    }
+    // 9a. Pre-compiled structured rules supplied by an MCP LLM harness or API caller
+    if (Array.isArray(options?.parameterRules) && options.parameterRules.length > 0) {
+        for (let i = 0; i < options.parameterRules.length; i++) {
+            const raw = options.parameterRules[i];
+            if (raw && typeof raw === "object" && typeof raw.parameter === "string") {
+                const sanitized = sanitizeParameterPolicyRule({ ...raw, source: raw.source || options?.source || "mcp_harness" }, i);
+                upsertParamRule(sanitized);
+            }
+        }
+        compiledBy = options?.source === "llm" ? "llm" : "mcp_harness";
+    }
+    // 9b. Email domain allowlist / blocklist ("only allow sending emails to @muxo.ai", "never email @competitor.com")
+    const emailDomains = cleanPrompt.match(/@[a-z0-9.-]+\.[a-z]{2,}/gi);
+    if (emailDomains &&
+        emailDomains.length > 0 &&
+        /\b(emails?|gmail|outlook|resend|sendgrid|recipients?|mail)\b/i.test(lower)) {
+        const normalizedDomains = [
+            ...new Set(emailDomains.map((d) => d.toLowerCase())),
+        ];
+        const isBlocklist = /\b(don'?t|never|do\s+not|block|forbid)\b/i.test(lower) &&
+            !/\b(only|must|restrict)\b/i.test(lower);
+        const action = /\b(ask|require\s+approval)\b/i.test(lower)
+            ? "require_approval"
+            : "block";
+        if (isBlocklist) {
+            upsertParamRule({
+                id: `prule_email_block_${normalizedDomains.join("_").replace(/[^a-z0-9]/g, "_")}`,
+                toolPattern: "*email*,*gmail*,*outlook*,*resend*,*sendgrid*",
+                parameter: "to,recipient,email,recipients,cc,bcc",
+                operator: "domain_not_in",
+                value: normalizedDomains,
+                action,
+                description: `Block sending emails to ${normalizedDomains.join(", ")}`,
+                source: "deterministic",
+            });
+        }
+        else if (normalizedDomains.length === 1) {
+            const domain = normalizedDomains[0];
+            upsertParamRule({
+                id: `prule_email_${domain.replace(/[^a-z0-9]/g, "_")}`,
+                toolPattern: "*email*,*gmail*,*outlook*,*resend*,*sendgrid*",
+                parameter: "to,recipient,email,recipients,cc,bcc",
+                operator: "must_end_with",
+                value: domain,
+                action,
+                description: `Email recipient (to) must end with ${domain}`,
+                source: "deterministic",
+            });
+        }
+        else {
+            upsertParamRule({
+                id: `prule_email_domains_${normalizedDomains.join("_").replace(/[^a-z0-9]/g, "_")}`,
+                toolPattern: "*email*,*gmail*,*outlook*,*resend*,*sendgrid*",
+                parameter: "to,recipient,email,recipients,cc,bcc",
+                operator: "domain_in",
+                value: normalizedDomains,
+                action,
+                description: `Only allow sending emails to ${normalizedDomains.join(", ")}`,
+                source: "deterministic",
+            });
+        }
+    }
+    // 9c. Transactional / Financial conditional thresholds
+    // e.g. "Require approval for Stripe refunds over $50, auto-approve under $50"
+    // or "Block refunds over $200" or "Auto-approve refunds under $50"
+    if (isTransactionalThresholdPrompt) {
+        const overMatch = cleanPrompt.match(/(?:(block|deny|forbid|require\s+approval|ask(?:\s+me)?)\s+(?:for\s+)?[\w\s]*?)?(?:over|above|exceed(?:s|ing)?|more\s+than|greater\s+than|>\s*)\$?\s*(\d+(?:\.\d+)?)/i);
+        const underAutoMatch = cleanPrompt.match(/(?:auto[- ]?approve|allow(?:\s+automatically)?|no\s+approval(?:\s+needed)?(?:\s+for)?)\s+[\w\s]*?(?:under|below|less\s+than|up\s+to|<=\s*|<\s*)\$?\s*(\d+(?:\.\d+)?)/i);
+        const targetNoun = /\brefunds?\b/i.test(lower)
+            ? { slug: "refund", pattern: "*refund*", label: "Stripe refunds" }
+            : /\b(transfers?|payouts?)\b/i.test(lower)
+                ? { slug: "transfer", pattern: "*transfer*,*payout*", label: "transfers/payouts" }
+                : /\binvoices?\b/i.test(lower)
+                    ? { slug: "invoice", pattern: "*invoice*", label: "invoices" }
+                    : {
+                        slug: "payment",
+                        pattern: "*refund*,*stripe*,*payment*,*charge*",
+                        label: "Stripe transactions",
+                    };
+        if (overMatch || underAutoMatch) {
+            const thresholdVal = overMatch
+                ? Number(overMatch[2])
+                : Number(underAutoMatch[1]);
+            const isBlockOver = Boolean(overMatch?.[1] && /\b(block|deny|forbid)\b/i.test(overMatch[1])) ||
+                (/\b(block|deny|forbid|never\s+allow)\b/i.test(lower) &&
+                    !/\b(require\s+approval|ask)\b/i.test(lower));
+            const hasAutoApproveUnder = Boolean(underAutoMatch) || /\bauto[- ]?approve\b/i.test(lower);
+            const action = isBlockOver ? "block" : "require_approval";
+            const elseAction = hasAutoApproveUnder
+                ? "auto_approve"
+                : undefined;
+            upsertParamRule({
+                id: `prule_${targetNoun.slug}_usd_${thresholdVal}`,
+                toolPattern: targetNoun.pattern,
+                parameter: "amount,amount_usd,amount_cents,refund_amount,total,value",
+                operator: "max_number",
+                value: thresholdVal,
+                unit: "usd",
+                action,
+                ...(elseAction ? { elseAction } : {}),
+                description: `${action === "block" ? "Block" : "Require approval for"} ${targetNoun.label} over $${thresholdVal}${elseAction ? `, auto-approve $${thresholdVal} and under` : ""}`,
+                source: "deterministic",
+            });
+        }
+    }
+    // 9d. Slack channel allowlist / blocklist ("never post to #general", "only allow Slack messages to #deployments")
+    const slackChannels = cleanPrompt.match(/#[a-z0-9_-]+/gi);
+    if (slackChannels && slackChannels.length > 0) {
+        const normalizedChannels = [
+            ...new Set(slackChannels.map((c) => c.toLowerCase())),
+        ];
+        const isOnlyAllow = /\b(only\s+(?:allow|post|send)|restrict\s+(?:slack|messages?)\s+to)\b/i.test(lower);
+        if (isOnlyAllow) {
+            upsertParamRule({
+                id: `prule_slack_allow_${normalizedChannels.join("_").replace(/[^a-z0-9]/g, "_")}`,
+                toolPattern: "*slack*",
+                parameter: "channel,channel_name",
+                operator: normalizedChannels.length === 1 ? "must_equal" : "in",
+                value: normalizedChannels.length === 1
+                    ? normalizedChannels[0]
+                    : normalizedChannels,
+                action: "block",
+                description: `Only allow Slack messages to ${normalizedChannels.join(", ")}`,
+                source: "deterministic",
+            });
+        }
+        else if (/\b(don'?t|never|do\s+not|block)\b/i.test(lower)) {
+            upsertParamRule({
+                id: `prule_slack_${normalizedChannels.join("_").replace(/[^a-z0-9]/g, "_")}`,
+                toolPattern: "*slack*",
+                parameter: "channel,channel_name",
+                operator: normalizedChannels.length === 1 ? "not_equals" : "not_in",
+                value: normalizedChannels.length === 1
+                    ? normalizedChannels[0]
+                    : normalizedChannels,
+                action: "block",
+                description: `Block Slack messages to ${normalizedChannels.join(", ")}`,
+                source: "deterministic",
+            });
+        }
+    }
+    // 9e. GitHub repository restriction ("only allow GitHub writes in muxo/platform")
+    const githubRepoMatch = cleanPrompt.match(/\b(?:only\s+(?:allow|permit|use)|restrict)\s+(?:github[\w\s]*?|issues?[\w\s]*?|prs?[\w\s]*?|pull\s+requests?[\w\s]*?|repos?(?:itory)?[\w\s]*?)(?:in|to|on)\s+([a-z0-9_.-]+\/[a-z0-9_.-]+)\b/i);
+    if (githubRepoMatch) {
+        const repo = githubRepoMatch[1].toLowerCase();
+        upsertParamRule({
+            id: `prule_github_repo_${repo.replace(/[^a-z0-9]/g, "_")}`,
+            toolPattern: "*github*",
+            parameter: "repo,repository,full_name",
+            operator: "must_equal",
+            value: repo,
+            action: "block",
+            description: `Only allow GitHub operations on repository ${repo}`,
+            source: "deterministic",
+        });
+    }
+    // 9f. Generic parameter numeric threshold ("block when amount exceeds 500", "require approval when parameter count > 10, auto-approve under 10")
+    const paramCapMatch = !isTransactionalThresholdPrompt
+        ? cleanPrompt.match(/\b(block|require\s+approval|ask(?:\s+me)?)\s+(?:when|if)\s+(?:parameter\s+)?([a-zA-Z0-9_]+)\s+(?:is\s+over|exceeds|>\s*|is\s+greater\s+than|more\s+than)\s*\$?\s*(\d+(?:\.\d+)?)\b/i)
+        : null;
+    if (paramCapMatch) {
+        const actionVerb = paramCapMatch[1].toLowerCase();
+        const paramName = paramCapMatch[2];
+        const maxVal = Number(paramCapMatch[3]);
+        const action = actionVerb.startsWith("block")
+            ? "block"
+            : "require_approval";
+        const hasAutoApprove = /\bauto[- ]?approve\b/i.test(lower);
+        upsertParamRule({
+            id: `prule_max_${paramName.toLowerCase()}`,
+            toolPattern: "*",
+            parameter: paramName,
+            operator: "max_number",
+            value: maxVal,
+            action,
+            ...(hasAutoApprove ? { elseAction: "auto_approve" } : {}),
+            description: `${action === "block" ? "Block" : "Require approval"} when parameter '${paramName}' exceeds ${maxVal}${hasAutoApprove ? ` (auto-approve ${maxVal} and under)` : ""}`,
+            source: "deterministic",
+        });
+    }
+    if (paramRulesChanged) {
+        patch.parameterRules = existingParamRules.slice(0, 50);
+    }
+    const isGuardrail = Boolean(cleanPrompt || paramRulesChanged) &&
+        (hasGuardrailIntent || appliedSummaries.length > 0);
+    if (isGuardrail && cleanPrompt) {
+        const existingRules = Array.isArray(currentPolicy.naturalLanguageRules)
+            ? [...currentPolicy.naturalLanguageRules]
+            : [];
+        const normalizedRule = cleanPrompt.replace(/^hey\s+muxo[,:\s]*/i, "").trim();
+        const displayRule = normalizedRule.charAt(0).toUpperCase() + normalizedRule.slice(1);
+        if (displayRule && !existingRules.includes(displayRule)) {
+            existingRules.unshift(displayRule);
+        }
+        patch.naturalLanguageRules = existingRules.slice(0, 25);
+        if (!patch.mode && !currentPolicy.mode) {
+            patch.mode = "enforce";
+        }
+    }
+    const nextPolicy = {
+        ...DEFAULT_WORKSPACE_POLICY,
+        ...currentPolicy,
+        ...patch,
+    };
+    const plain = describePolicyInPlainEnglish(nextPolicy);
+    const summary = appliedSummaries.length > 0
+        ? appliedSummaries.join(" · ")
+        : `Saved workspace guardrail: "${cleanPrompt}"`;
+    return {
+        isGuardrail,
+        patch,
+        ruleText: cleanPrompt,
+        summary,
+        humanRules: plain.rules,
+        compiledBy,
+        memoryFact: {
+            title: `Workspace Guardrail: ${summary.slice(0, 80)}`,
+            content: `User instructed Muxo guardrail: "${cleanPrompt}". Enforced effect: ${summary}.`,
+            subject: "workspace_guardrail",
+            predicate: "enforces_rule",
+            object: summary,
+            tags: ["guardrail", "safety", "user_rule"],
+        },
+    };
+}
+/**
+ * Async LLM-assisted policy compiler: first runs deterministic semantic compilation
+ * (plus any structured `parameterRules` supplied by an MCP LLM harness), and when an
+ * OpenAI or Anthropic key is available and a complex natural-language rule produced no
+ * structured patch fields, invokes the LLM to synthesize validated `ParameterPolicyRule[]`.
+ */
+export async function compileNaturalLanguageGuardrailWithLlm(prompt, currentPolicy = DEFAULT_WORKSPACE_POLICY, options) {
+    const deterministic = parseNaturalLanguageGuardrail(prompt, currentPolicy, options);
+    const hasCompiledEffect = Object.keys(deterministic.patch).some((k) => k !== "naturalLanguageRules" && k !== "mode") || Boolean(options?.parameterRules?.length);
+    const apiKey = options?.llmApiKey ||
+        (typeof process !== "undefined"
+            ? process.env.OPENAI_API_KEY || process.env.ANTHROPIC_API_KEY
+            : undefined);
+    if (hasCompiledEffect || !apiKey || !prompt.trim()) {
+        return deterministic;
+    }
+    const systemPrompt = [
+        "You compile plain-English AI agent safety guardrails into JSON policy rules for Muxo.",
+        "Return ONLY a JSON object with optional fields:",
+        "- parameterRules: array of { id, toolPattern, parameter, operator, value, unit, action, elseAction, description }",
+        "  where operator is one of: equals, must_equal, not_equals, contains, not_contains, starts_with, must_start_with, ends_with, must_end_with, domain_in, domain_not_in, max_number, min_number, gt, gte, lt, lte, in, not_in, regex",
+        "  and action / elseAction are one of: block, require_approval, auto_approve, allow",
+        "  and unit is optional: usd, cents, credits, raw.",
+        "- maxCreditsPerRun: optional number (100 credits = $1.00)",
+        "- blockedToolSlugs: optional string[]",
+    ].join("\n");
+    try {
+        const isAnthropic = options?.llmProvider === "anthropic" || apiKey.startsWith("sk-ant-");
+        let rawJsonText = "";
+        if (isAnthropic) {
+            const res = await fetch("https://api.anthropic.com/v1/messages", {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "x-api-key": apiKey,
+                    "anthropic-version": "2023-06-01",
+                },
+                body: JSON.stringify({
+                    model: "claude-3-5-haiku-latest",
+                    max_tokens: 512,
+                    system: systemPrompt,
+                    messages: [{ role: "user", content: prompt }],
+                }),
+            });
+            if (res.ok) {
+                const data = (await res.json());
+                rawJsonText = String(data?.content?.[0]?.text || "");
+            }
+        }
+        else {
+            const res = await fetch("https://api.openai.com/v1/chat/completions", {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${apiKey}`,
+                },
+                body: JSON.stringify({
+                    model: "gpt-4o-mini",
+                    temperature: 0,
+                    response_format: { type: "json_object" },
+                    messages: [
+                        { role: "system", content: systemPrompt },
+                        { role: "user", content: prompt },
+                    ],
+                }),
+            });
+            if (res.ok) {
+                const data = (await res.json());
+                rawJsonText = String(data?.choices?.[0]?.message?.content || "");
+            }
+        }
+        const jsonMatch = rawJsonText.match(/\{[\s\S]*\}/);
+        if (jsonMatch) {
+            const parsedLlm = JSON.parse(jsonMatch[0]);
+            return parseNaturalLanguageGuardrail(prompt, currentPolicy, {
+                ...options,
+                parameterRules: Array.isArray(parsedLlm.parameterRules)
+                    ? parsedLlm.parameterRules
+                    : undefined,
+                policyPatch: parsedLlm,
+                source: "llm",
+            });
+        }
+    }
+    catch {
+        // Fall back to deterministic compilation if LLM call fails or times out
+    }
+    return deterministic;
+}
+export function describePolicyInPlainEnglish(policy = DEFAULT_WORKSPACE_POLICY) {
+    const rules = [];
+    const badges = [];
+    const reqSet = new Set(policy.requireApprovalFor || []);
+    if (policy.killSwitchActive) {
+        rules.push(`All actions paused: ${policy.killSwitchReason || "Workspace pause is active."}`);
+        badges.push({ label: "Paused", tone: "strict" });
+    }
+    else if (policy.executionRing === 3) {
+        rules.push("Read-only mode: Muxo can search and read data, but cannot modify apps, spend money, or provision infrastructure.");
+        badges.push({ label: "Read-only sandbox", tone: "strict" });
+    }
+    else if (reqSet.has("read")) {
+        rules.push("Ask every time: Muxo will ask for your approval before running any tool.");
+        badges.push({ label: "Ask every time", tone: "strict" });
+    }
+    else if (!reqSet.has("write") && policy.mode === "enforce") {
+        rules.push("Hands-off mode: Muxo runs read and write tasks automatically, and asks before financial, cloud provisioning, or destructive actions.");
+        badges.push({ label: "Hands-off mode", tone: "warn" });
+    }
+    else if (policy.mode === "monitor") {
+        rules.push("Observation mode: Muxo logs safety checks without blocking actions.");
+        badges.push({ label: "Monitor mode", tone: "warn" });
+    }
+    else {
+        rules.push("Safe default: Searches and reads run automatically; Muxo asks before changing data, spending money, or provisioning cloud services.");
+        badges.push({ label: "Safe default", tone: "safe" });
+    }
+    const maxCredits = Number(policy.maxCreditsPerRun ?? 50);
+    const dollars = (maxCredits * 0.01).toFixed(2);
+    rules.push(`Budget limit: Don't spend more than ${maxCredits} credits ($${dollars}) on a single run.`);
+    badges.push({
+        label: `Max ${maxCredits} cr ($${dollars})/run`,
+        tone: "safe",
+    });
+    if (policy.allowProvisioning === false) {
+        rules.push("Cloud infrastructure: Provisioning new databases or cloud services is turned off.");
+        badges.push({ label: "No cloud provisioning", tone: "strict" });
+    }
+    if (policy.allowInstantWallet === false) {
+        rules.push("Paid instant tools: Turned off (only free and connected OAuth tools are allowed).");
+    }
+    if (policy.blockDestructiveSql !== false) {
+        rules.push("Database safety: Destructive SQL statements (DROP, TRUNCATE, DELETE without WHERE) are blocked.");
+        badges.push({ label: "SQL protected", tone: "safe" });
+    }
+    if (policy.blockedToolSlugs && policy.blockedToolSlugs.length > 0) {
+        rules.push(`Off-limits tools: Never use ${policy.blockedToolSlugs.join(", ")}.`);
+        badges.push({
+            label: `${policy.blockedToolSlugs.length} blocked tool${policy.blockedToolSlugs.length === 1 ? "" : "s"}`,
+            tone: "strict",
+        });
+    }
+    if (policy.parameterRules && policy.parameterRules.length > 0) {
+        for (const pr of policy.parameterRules) {
+            rules.push(`Parameter guardrail: ${pr.description}.`);
+        }
+        badges.push({
+            label: `${policy.parameterRules.length} param rule${policy.parameterRules.length === 1 ? "" : "s"}`,
+            tone: "strict",
+        });
+    }
+    const languageMode = policy.languageMode || "hybrid";
+    const customInstructions = Array.isArray(policy.customInstructions)
+        ? policy.customInstructions
+        : [];
+    if (languageMode === "non_technical") {
+        badges.push({ label: "Plain-English mode", tone: "safe" });
+    }
+    else if (languageMode === "technical") {
+        badges.push({ label: "Technical mode", tone: "safe" });
+    }
+    const activeCustomRules = Array.isArray(policy.naturalLanguageRules)
+        ? policy.naturalLanguageRules
+        : [];
+    const headline = rules[0] || "Safe default guardrails active.";
+    const nonTechnical = [
+        ...rules,
+        ...(activeCustomRules.length > 0
+            ? [`Custom rules: ${activeCustomRules.join(" · ")}`]
+            : []),
+    ].join(" ");
+    const ringNum = policy.executionRing ?? 1;
+    const ringNames = {
+        0: "Ring 0 (Root/Admin)",
+        1: "Ring 1 (Privileged Specialist)",
+        2: "Ring 2 (Standard Read/Write)",
+        3: "Ring 3 (Sandboxed Read-Only)",
+    };
+    const technical = `mode=${policy.mode || "enforce"} | executionRing=${ringNames[ringNum] || `Ring ${ringNum}`} | requireApprovalFor=[${(policy.requireApprovalFor || []).join(", ")}] | maxCreditsPerRun=${maxCredits} ($${dollars}) | allowInstantWallet=${policy.allowInstantWallet !== false} | allowProvisioning=${policy.allowProvisioning !== false} | blockDestructiveSql=${policy.blockDestructiveSql !== false} | blockedToolSlugs=[${(policy.blockedToolSlugs || []).join(", ")}] | killSwitchActive=${Boolean(policy.killSwitchActive)} | languageMode=${languageMode}`;
+    const explanation = formatHumanFriendlyExplanation({
+        headline,
+        nonTechnical,
+        technical,
+        policy,
+        languageMode,
+    });
+    return {
+        headline,
+        rules,
+        activeCustomRules,
+        badges,
+        languageMode,
+        customInstructions,
+        nonTechnical: explanation.nonTechnical,
+        technical: explanation.technical,
+        preferred: explanation.preferred,
+        explanation,
+    };
+}
+function matchesSingleToolPattern(toolSlug, pattern = "*") {
+    const slug = toolSlug.toLowerCase();
+    const pat = (pattern || "*").toLowerCase().trim();
+    if (!pat || pat === "*")
+        return true;
+    if (pat.startsWith("*") && pat.endsWith("*")) {
+        return slug.includes(pat.slice(1, -1));
+    }
+    if (pat.startsWith("*")) {
+        return slug.endsWith(pat.slice(1));
+    }
+    if (pat.endsWith("*")) {
+        return slug.startsWith(pat.slice(0, -1));
+    }
+    return slug === pat || slug.includes(pat);
+}
+function matchesToolPattern(toolSlug, pattern = "*") {
+    const raw = (pattern || "*").trim();
+    if (!raw || raw === "*")
+        return true;
+    const subpatterns = raw
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (subpatterns.length === 0)
+        return true;
+    return subpatterns.some((sub) => matchesSingleToolPattern(toolSlug, sub));
+}
+export function evaluateParameterPolicyRules(paramsOrToolSlug, maybeInput, maybePolicy) {
+    const params = typeof paramsOrToolSlug === "string"
+        ? {
+            toolSlug: paramsOrToolSlug,
+            input: maybeInput || {},
+            policy: maybePolicy,
+        }
+        : paramsOrToolSlug;
+    const rules = params.policy?.parameterRules;
+    if (!Array.isArray(rules) || rules.length === 0) {
+        return {
+            violated: false,
+            allowed: true,
+            explicitAllow: false,
+            action: "allow",
+            matchedRule: null,
+            violatedRule: null,
+            reason: null,
+        };
+    }
+    const input = params.input || {};
+    let explicitAllowRule = null;
+    let explicitAllowAction = "allow";
+    for (const rule of rules) {
+        if (!matchesToolPattern(params.toolSlug, rule.toolPattern))
+            continue;
+        const baseCandidates = String(rule.parameter || "")
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean);
+        const candidateSet = new Set(baseCandidates);
+        if (candidateSet.has("to")) {
+            for (const alias of [
+                "to",
+                "recipient",
+                "email",
+                "recipient_email",
+                "recipients",
+                "cc",
+                "bcc",
+            ]) {
+                candidateSet.add(alias);
+            }
+        }
+        if (candidateSet.has("amount")) {
+            for (const alias of [
+                "amount",
+                "amount_usd",
+                "amount_cents",
+                "total",
+                "value",
+            ]) {
+                candidateSet.add(alias);
+            }
+        }
+        const paramCandidates = Array.from(candidateSet);
+        const isRecipientRule = candidateSet.has("to");
+        const matchedEntries = [];
+        for (const key of paramCandidates) {
+            if (input[key] !== undefined && input[key] !== null) {
+                const val = input[key];
+                if (isRecipientRule && Array.isArray(val)) {
+                    for (const item of val) {
+                        matchedEntries.push({ key, value: item });
+                    }
+                }
+                else if (isRecipientRule &&
+                    typeof val === "string" &&
+                    val.includes(",")) {
+                    for (const part of val
+                        .split(",")
+                        .map((s) => s.trim())
+                        .filter(Boolean)) {
+                        matchedEntries.push({ key, value: part });
+                    }
+                }
+                else {
+                    matchedEntries.push({ key, value: val });
+                }
+                if (!isRecipientRule)
+                    break;
+            }
+        }
+        if (matchedEntries.length === 0)
+            continue;
+        for (const entry of matchedEntries) {
+            const rawVal = entry.value;
+            const matchedKey = entry.key;
+            const strVal = String(rawVal).trim().toLowerCase();
+            const targetStr = String(rule.value ?? "").trim().toLowerCase();
+            let rawNum = Number(rawVal);
+            if (Number.isFinite(rawNum)) {
+                if (rule.unit === "usd" && matchedKey === "amount_cents") {
+                    rawNum = rawNum / 100;
+                }
+                else if (rule.unit === "cents" && matchedKey === "amount_usd") {
+                    rawNum = rawNum * 100;
+                }
+            }
+            const thresholdNum = Number(rule.value);
+            const hasValidNumbers = Number.isFinite(rawNum) && Number.isFinite(thresholdNum);
+            let conditionTriggered = false;
+            switch (rule.operator) {
+                case "ends_with":
+                case "must_end_with":
+                    conditionTriggered =
+                        rule.action === "allow" || rule.action === "auto_approve"
+                            ? strVal.endsWith(targetStr)
+                            : !strVal.endsWith(targetStr);
+                    break;
+                case "starts_with":
+                case "must_start_with":
+                    conditionTriggered =
+                        rule.action === "allow" || rule.action === "auto_approve"
+                            ? strVal.startsWith(targetStr)
+                            : !strVal.startsWith(targetStr);
+                    break;
+                case "equals":
+                case "must_equal":
+                    conditionTriggered =
+                        rule.action === "allow" || rule.action === "auto_approve"
+                            ? strVal === targetStr
+                            : strVal !== targetStr;
+                    break;
+                case "not_equals":
+                    conditionTriggered = strVal === targetStr;
+                    break;
+                case "contains":
+                    conditionTriggered =
+                        rule.action === "allow" || rule.action === "auto_approve"
+                            ? strVal.includes(targetStr)
+                            : !strVal.includes(targetStr);
+                    break;
+                case "not_contains":
+                    conditionTriggered = strVal.includes(targetStr);
+                    break;
+                case "domain_in": {
+                    const allowedDomains = (Array.isArray(rule.value)
+                        ? rule.value
+                        : String(rule.value).split(","))
+                        .map((v) => String(v).trim().toLowerCase().replace(/^@/, ""))
+                        .filter(Boolean);
+                    const inDomain = allowedDomains.some((d) => strVal.endsWith(`@${d}`) || strVal === d);
+                    conditionTriggered =
+                        rule.action === "allow" || rule.action === "auto_approve"
+                            ? inDomain
+                            : !inDomain;
+                    break;
+                }
+                case "domain_not_in": {
+                    const blockedDomains = (Array.isArray(rule.value)
+                        ? rule.value
+                        : String(rule.value).split(","))
+                        .map((v) => String(v).trim().toLowerCase().replace(/^@/, ""))
+                        .filter(Boolean);
+                    conditionTriggered = blockedDomains.some((d) => strVal.endsWith(`@${d}`) || strVal === d);
+                    break;
+                }
+                case "max_number":
+                    if (hasValidNumbers) {
+                        conditionTriggered = rawNum > thresholdNum;
+                    }
+                    break;
+                case "min_number":
+                    if (hasValidNumbers) {
+                        conditionTriggered = rawNum < thresholdNum;
+                    }
+                    break;
+                case "gt":
+                    if (hasValidNumbers) {
+                        conditionTriggered = rawNum > thresholdNum;
+                    }
+                    break;
+                case "gte":
+                    if (hasValidNumbers) {
+                        conditionTriggered = rawNum >= thresholdNum;
+                    }
+                    break;
+                case "lt":
+                    if (hasValidNumbers) {
+                        conditionTriggered = rawNum < thresholdNum;
+                    }
+                    break;
+                case "lte":
+                    if (hasValidNumbers) {
+                        conditionTriggered = rawNum <= thresholdNum;
+                    }
+                    break;
+                case "in": {
+                    const allowed = (Array.isArray(rule.value)
+                        ? rule.value
+                        : String(rule.value).split(","))
+                        .map((v) => String(v).trim().toLowerCase())
+                        .filter(Boolean);
+                    const isMember = allowed.includes(strVal);
+                    conditionTriggered =
+                        rule.action === "allow" || rule.action === "auto_approve"
+                            ? isMember
+                            : !isMember;
+                    break;
+                }
+                case "not_in": {
+                    const blocked = (Array.isArray(rule.value)
+                        ? rule.value
+                        : String(rule.value).split(","))
+                        .map((v) => String(v).trim().toLowerCase())
+                        .filter(Boolean);
+                    conditionTriggered = blocked.includes(strVal);
+                    break;
+                }
+                case "regex": {
+                    try {
+                        const matches = new RegExp(String(rule.value), "i").test(String(rawVal));
+                        conditionTriggered =
+                            rule.action === "allow" || rule.action === "auto_approve"
+                                ? matches
+                                : !matches;
+                    }
+                    catch {
+                        conditionTriggered = false;
+                    }
+                    break;
+                }
+            }
+            const effectiveAction = conditionTriggered
+                ? rule.action
+                : rule.elseAction;
+            if (effectiveAction === "block" ||
+                effectiveAction === "require_approval") {
+                return {
+                    violated: true,
+                    allowed: false,
+                    explicitAllow: false,
+                    action: effectiveAction,
+                    matchedRule: rule,
+                    violatedRule: rule,
+                    reason: `Parameter policy rule triggered (${rule.description}): ${matchedKey}=${JSON.stringify(rawVal)}`,
+                };
+            }
+            if (effectiveAction === "auto_approve" ||
+                effectiveAction === "allow") {
+                explicitAllowRule = rule;
+                if (effectiveAction === "auto_approve") {
+                    explicitAllowAction = "auto_approve";
+                }
+            }
+        }
+    }
+    return {
+        violated: false,
+        allowed: true,
+        explicitAllow: Boolean(explicitAllowRule),
+        action: explicitAllowRule ? explicitAllowAction : "allow",
+        matchedRule: explicitAllowRule,
+        violatedRule: null,
+        reason: explicitAllowRule
+            ? `Parameter policy rule satisfied (${explicitAllowRule.description})`
+            : null,
+    };
+}
+export function describeParameterRuleCompliance(rule) {
+    const paramLabel = rule.parameter.split(",")[0] || rule.parameter;
+    const valStr = Array.isArray(rule.value)
+        ? rule.value.join(", ")
+        : String(rule.value);
+    const unitSuffix = rule.unit && rule.unit !== "raw" ? ` ${rule.unit.toUpperCase()}` : "";
+    const elseNote = rule.elseAction
+        ? `; otherwise action is '${rule.elseAction}'`
+        : "";
+    switch (rule.operator) {
+        case "must_end_with":
+        case "ends_with":
+            return `For tools matching '${rule.toolPattern}', parameter '${paramLabel}' must end with '${valStr}' (violation -> ${rule.action}${elseNote}).`;
+        case "domain_in":
+            return `For tools matching '${rule.toolPattern}', recipient domain in '${paramLabel}' must be in [${valStr}] (violation -> ${rule.action}${elseNote}).`;
+        case "domain_not_in":
+            return `For tools matching '${rule.toolPattern}', recipient domain in '${paramLabel}' must NOT be in [${valStr}] (violation -> ${rule.action}${elseNote}).`;
+        case "max_number":
+        case "gt":
+        case "gte":
+            return `For tools matching '${rule.toolPattern}', keep '${paramLabel}' <= ${valStr}${unitSuffix} (exceeding ${valStr}${unitSuffix} triggers '${rule.action}'${elseNote}).`;
+        case "min_number":
+        case "lt":
+        case "lte":
+            return `For tools matching '${rule.toolPattern}', keep '${paramLabel}' >= ${valStr}${unitSuffix} (below ${valStr}${unitSuffix} triggers '${rule.action}'${elseNote}).`;
+        case "must_equal":
+        case "equals":
+            return `For tools matching '${rule.toolPattern}', parameter '${paramLabel}' must equal '${valStr}' (violation -> ${rule.action}${elseNote}).`;
+        case "not_equals":
+            return `For tools matching '${rule.toolPattern}', parameter '${paramLabel}' must NOT equal '${valStr}' (violation -> ${rule.action}${elseNote}).`;
+        case "in":
+            return `For tools matching '${rule.toolPattern}', parameter '${paramLabel}' must be one of [${valStr}] (violation -> ${rule.action}${elseNote}).`;
+        case "not_in":
+            return `For tools matching '${rule.toolPattern}', parameter '${paramLabel}' must NOT be in [${valStr}] (violation -> ${rule.action}${elseNote}).`;
+        default:
+            return `${rule.description} (toolPattern='${rule.toolPattern}', parameter='${rule.parameter}', operator='${rule.operator}', value=${JSON.stringify(rule.value)}, action='${rule.action}'${elseNote}).`;
+    }
+}
+export function buildLlmPolicyAndGovernanceBrief(policy = DEFAULT_WORKSPACE_POLICY, options) {
+    const plain = describePolicyInPlainEnglish(policy);
+    const reqSet = new Set(policy.requireApprovalFor || []);
+    const ring = (policy.executionRing ?? 1);
+    const isPaused = Boolean(policy.killSwitchActive);
+    const isReadOnly = ring === 3;
+    const isMonitor = policy.mode === "monitor";
+    const posture = isPaused
+        ? "paused"
+        : isReadOnly
+            ? "read_only_sandbox"
+            : isMonitor
+                ? "monitor"
+                : reqSet.has("read")
+                    ? "ask_every_time"
+                    : !reqSet.has("write")
+                        ? "hands_off"
+                        : "safe_default";
+    const riskLaneMatrix = {};
+    for (const risk of RISK_LEVELS) {
+        const executeTool = `execute_${risk}`;
+        if (isPaused && !isMonitor) {
+            riskLaneMatrix[risk] = {
+                riskLevel: risk,
+                status: "blocked",
+                executeTool,
+                reason: `Blocked while workspace kill switch is active (${policy.killSwitchReason || "emergency pause"}).`,
+            };
+        }
+        else if (isReadOnly && risk !== "read" && !isMonitor) {
+            riskLaneMatrix[risk] = {
+                riskLevel: risk,
+                status: "blocked",
+                executeTool,
+                reason: "Blocked by Ring 3 Read-Only Sandbox mode (only 'read' tools are permitted).",
+            };
+        }
+        else if (risk === "provisioning" && policy.allowProvisioning === false && !isMonitor) {
+            riskLaneMatrix[risk] = {
+                riskLevel: risk,
+                status: "blocked",
+                executeTool,
+                reason: "Blocked because cloud infrastructure provisioning (allowProvisioning=false) is disabled.",
+            };
+        }
+        else if (reqSet.has(risk) && !isMonitor) {
+            riskLaneMatrix[risk] = {
+                riskLevel: risk,
+                status: "requires_approval",
+                executeTool,
+                reason: `Requires human owner approval before ${executeTool} can run (unless a conditional parameterRule explicitly sets elseAction='auto_approve').`,
+            };
+        }
+        else {
+            riskLaneMatrix[risk] = {
+                riskLevel: risk,
+                status: "auto_approved",
+                executeTool,
+                reason: isMonitor
+                    ? `Auto-approved in monitor mode; call ${executeTool} immediately after plan_action.`
+                    : `Auto-approved by workspace policy; call ${executeTool} immediately after plan_action.`,
+            };
+        }
+    }
+    const parameterRules = (policy.parameterRules || []).map((r) => ({
+        ...r,
+        howToComply: describeParameterRuleCompliance(r),
+    }));
+    const maxCredits = Number(policy.maxCreditsPerRun ?? 50);
+    const maxUsd = Number((maxCredits * 0.01).toFixed(2));
+    const activeDefaults = options?.activeDefaults || {};
+    const defaultsPairs = Object.entries(activeDefaults).map(([k, v]) => `${k}=${JSON.stringify(v)}`);
+    const autoApproveRiskLevels = RISK_LEVELS.filter((r) => riskLaneMatrix[r].status === "auto_approved");
+    const requireApprovalRiskLevels = RISK_LEVELS.filter((r) => riskLaneMatrix[r].status === "requires_approval");
+    const blockedLanes = RISK_LEVELS.filter((r) => riskLaneMatrix[r].status === "blocked");
+    const directiveLines = [
+        `## Muxo Policy & Governance Contract${options?.workspaceName ? ` (${options.workspaceName})` : ""}`,
+        `- **Posture**: \`${posture}\` (mode=\`${policy.mode || "enforce"}\`, ring=\`Ring ${ring}\`, languageMode=\`${plain.languageMode}\`)`,
+        `- **Summary**: ${plain.preferred}`,
+        `- **Per-Run Budget Cap**: ${maxCredits} credits ($${maxUsd.toFixed(2)}) max per run`,
+        `- **Auto-Approved Risk Lanes**: ${autoApproveRiskLevels.join(", ") || "none"}`,
+        `- **Human-Approval Risk Lanes**: ${requireApprovalRiskLevels.join(", ") || "none"}`,
+    ];
+    if (blockedLanes.length > 0) {
+        directiveLines.push(`- **Blocked Risk Lanes**: ${blockedLanes.join(", ")}`);
+    }
+    if (policy.blockedToolSlugs && policy.blockedToolSlugs.length > 0) {
+        directiveLines.push(`- **Blocked Tools (Never Call)**: ${policy.blockedToolSlugs.join(", ")}`);
+    }
+    if (parameterRules.length > 0) {
+        directiveLines.push(`- **Conditional Parameter Guardrails (${parameterRules.length})**:`);
+        for (const pr of parameterRules) {
+            directiveLines.push(`  - \`${pr.id}\`: ${pr.howToComply}`);
+        }
+    }
+    if (defaultsPairs.length > 0) {
+        directiveLines.push(`- **Learned Memory Defaults (Auto-Filled on plan_action)**: ${defaultsPairs.join(", ")}`);
+    }
+    if (plain.customInstructions.length > 0) {
+        directiveLines.push(`- **Operator Custom Instructions**: ${plain.customInstructions.join(" | ")}`);
+    }
+    return {
+        ...(options?.workspaceId ? { workspaceId: options.workspaceId } : {}),
+        posture,
+        mode: (policy.mode || "enforce"),
+        executionRing: ring,
+        headline: plain.headline,
+        preferredExplanation: plain.preferred,
+        plainEnglish: plain,
+        languageMode: plain.languageMode,
+        customInstructions: plain.customInstructions,
+        killSwitch: {
+            active: isPaused,
+            reason: policy.killSwitchReason || null,
+            howToToggleMcp: {
+                pause: {
+                    tool: "get_run_context",
+                    arguments: {
+                        action: "kill_switch",
+                        enabled: true,
+                        prompt: "Pause all agent executions",
+                    },
+                },
+                resume: {
+                    tool: "get_run_context",
+                    arguments: {
+                        action: "kill_switch",
+                        enabled: false,
+                        prompt: "Resume agent executions",
+                    },
+                },
+            },
+        },
+        budgetGuardrail: {
+            maxCreditsPerRun: maxCredits,
+            maxUsdPerRun: maxUsd,
+            allowInstantWallet: policy.allowInstantWallet !== false,
+            allowProvisioning: policy.allowProvisioning !== false,
+            blockDestructiveSql: policy.blockDestructiveSql !== false,
+        },
+        riskLaneMatrix,
+        autoApproveRiskLevels,
+        requireApprovalRiskLevels,
+        blockedRiskLevels: blockedLanes,
+        blockedToolSlugs: policy.blockedToolSlugs || [],
+        parameterRules,
+        naturalLanguageRules: policy.naturalLanguageRules || [],
+        activeDefaults,
+        ...(options?.trustScore ? { trustScore: options.trustScore } : {}),
+        ...(options?.agentDid ? { agentDid: options.agentDid } : {}),
+        llmSystemDirective: directiveLines.join("\n"),
+        agentControlCheatsheet: [
+            {
+                intent: "Inspect active policy, guardrails, and learned memory defaults",
+                mcpTool: "get_run_context",
+                arguments: { action: "governance_status" },
+            },
+            {
+                intent: "Add or update a guardrail in plain English or structured parameter_rules",
+                mcpTool: "get_run_context",
+                arguments: {
+                    action: "set_guardrail",
+                    prompt: "Require approval for Stripe refunds over $50, auto-approve under $50",
+                },
+            },
+            {
+                intent: "Dry-run test if a tool + input will pass policy before creating a plan",
+                mcpTool: "get_run_context",
+                arguments: {
+                    action: "check_policy",
+                    tool_slug: "app.gmail.send_email",
+                    input: { to: "team@muxo.ai", subject: "Status" },
+                },
+            },
+            {
+                intent: "Reset custom guardrails and parameter rules back to Safe Default",
+                mcpTool: "get_run_context",
+                arguments: { action: "reset_guardrails" },
+            },
+            {
+                intent: "Pause or resume workspace execution via the emergency kill switch",
+                mcpTool: "get_run_context",
+                arguments: { action: "kill_switch", enabled: false },
+            },
+            {
+                intent: "Save a workspace fact or default parameter for automatic recall",
+                mcpTool: "get_run_context",
+                arguments: {
+                    action: "remember",
+                    prompt: "Remember our default GitHub repo is muxo-ai/muxo",
+                },
+            },
+        ],
+    };
+}
+export function simulatePolicyEvaluation(params) {
+    const policy = {
+        ...DEFAULT_WORKSPACE_POLICY,
+        ...(params.policy || {}),
+    };
+    const toolSlug = String(params.toolSlug || "instant.web.search").trim();
+    const riskLevel = params.riskLevel ||
+        (toolSlug.startsWith("instant.")
+            ? "read"
+            : toolSlug.startsWith("resource.")
+                ? "provisioning"
+                : toolSlug.startsWith("billing.")
+                    ? "financial"
+                    : "write");
+    const creditCost = Number(params.creditCost ?? (riskLevel === "read" ? 2 : 5));
+    const rawInput = { ...(params.input || {}) };
+    const defaults = params.activeDefaults || {};
+    const effectiveInput = { ...rawInput };
+    const autoFilledInput = {};
+    for (const [k, v] of Object.entries(defaults)) {
+        if (effectiveInput[k] === undefined && v !== undefined) {
+            effectiveInput[k] = v;
+            autoFilledInput[k] = v;
+        }
+    }
+    const reasons = [];
+    let decision = "auto_approved";
+    const isMonitor = policy.mode === "monitor";
+    if (policy.killSwitchActive && !isMonitor) {
+        decision = "blocked";
+        reasons.push(`Workspace kill switch is active (${policy.killSwitchReason || "emergency pause"}).`);
+    }
+    if (decision !== "blocked" &&
+        (policy.blockedToolSlugs || []).some((s) => s.toLowerCase() === toolSlug.toLowerCase()) &&
+        !isMonitor) {
+        decision = "blocked";
+        reasons.push(`Tool '${toolSlug}' is on the workspace blockedToolSlugs list.`);
+    }
+    if (decision !== "blocked" &&
+        policy.executionRing === 3 &&
+        riskLevel !== "read" &&
+        !isMonitor) {
+        decision = "blocked";
+        reasons.push(`Workspace is in Ring 3 (Read-Only Sandbox mode), which blocks '${riskLevel}' tools.`);
+    }
+    if (decision !== "blocked" &&
+        riskLevel === "provisioning" &&
+        policy.allowProvisioning === false &&
+        !isMonitor) {
+        decision = "blocked";
+        reasons.push("Cloud infrastructure provisioning is disabled (allowProvisioning=false).");
+    }
+    const maxCredits = Number(policy.maxCreditsPerRun ?? 50);
+    if (decision !== "blocked" && creditCost > maxCredits && !isMonitor) {
+        decision = "blocked";
+        reasons.push(`Tool credit cost (${creditCost} cr) exceeds policy maxCreditsPerRun (${maxCredits} cr).`);
+    }
+    if (decision !== "blocked" &&
+        typeof params.creditsBalance === "number" &&
+        creditCost > params.creditsBalance) {
+        decision = "blocked";
+        reasons.push(`Insufficient workspace credits: tool requires ${creditCost} cr, balance is ${params.creditsBalance} cr.`);
+    }
+    const paramEval = evaluateParameterPolicyRules({
+        policy,
+        toolSlug,
+        input: effectiveInput,
+    });
+    if (decision !== "blocked") {
+        if (paramEval.violated && paramEval.action === "block" && !isMonitor) {
+            decision = "blocked";
+            reasons.push(paramEval.reason || "Blocked by conditional parameter guardrail.");
+        }
+        else if (paramEval.violated &&
+            paramEval.action === "require_approval" &&
+            !isMonitor) {
+            decision = "pending_approval";
+            reasons.push(paramEval.reason || "Parameter guardrail requires human owner approval.");
+        }
+        else if (paramEval.explicitAllow && paramEval.action === "auto_approve") {
+            decision = "auto_approved";
+            reasons.push(paramEval.reason ||
+                "Auto-approved by conditional parameter guardrail (elseAction='auto_approve').");
+        }
+        else if ((policy.requireApprovalFor || []).includes(riskLevel) &&
+            !isMonitor) {
+            decision = "pending_approval";
+            reasons.push(`Risk level '${riskLevel}' requires human owner approval under active workspace policy.`);
+        }
+        else {
+            decision = "auto_approved";
+            reasons.push(`Allowed and auto-approved under workspace policy (riskLevel='${riskLevel}', cost=${creditCost} cr <= ${maxCredits} cr).`);
+        }
+    }
+    const executeTool = `execute_${riskLevel}`;
+    let remediationForLlm = "";
+    const nextToolCalls = [];
+    if (decision === "auto_approved") {
+        remediationForLlm = `Action will be auto_approved. Call plan_action({ tool_slug: '${toolSlug}', input: ${JSON.stringify(effectiveInput)} }) and then ${executeTool}.`;
+        nextToolCalls.push({
+            tool: "plan_action",
+            input: {
+                tool_slug: toolSlug,
+                input: effectiveInput,
+                reason: `Execute ${toolSlug}`,
+            },
+            when: "Ready to create an auto-approved plan",
+        });
+    }
+    else if (decision === "pending_approval") {
+        remediationForLlm = `Action is allowed to be planned but will enter 'pending_approval' (${reasons.join("; ")}). Call plan_action, share humanHandoff.url with the user, and call get_plan({ plan_id, wait_for_approval: true }).`;
+        nextToolCalls.push({
+            tool: "plan_action",
+            input: {
+                tool_slug: toolSlug,
+                input: effectiveInput,
+                reason: `Request approval for ${toolSlug}`,
+            },
+            when: "To generate the plan and human approval URL",
+        });
+    }
+    else {
+        const ruleHint = paramEval.violatedRule
+            ? ` Adjust arguments to satisfy: ${describeParameterRuleCompliance(paramEval.violatedRule)}`
+            : "";
+        remediationForLlm = `Action is currently BLOCKED (${reasons.join("; ")}).${ruleHint} Or ask the user if they want to update the guardrail via get_run_context({ action: 'set_guardrail', prompt: '...' }).`;
+        nextToolCalls.push({
+            tool: "get_run_context",
+            input: {
+                action: "governance_status",
+            },
+            when: "To inspect active guardrails or adjust workspace policy with the user's permission",
+        });
+    }
+    return {
+        ok: true,
+        action: "check_policy",
+        toolSlug,
+        ...(params.toolName ? { toolName: params.toolName } : {}),
+        riskLevel,
+        creditCost,
+        decision,
+        approvalStatus: decision,
+        allowed: decision !== "blocked",
+        requiresApproval: decision === "pending_approval",
+        blocked: decision === "blocked",
+        executeTool,
+        effectiveInput,
+        autoFilledInput,
+        reasons,
+        matchedParameterRule: paramEval.matchedRule,
+        violatedParameterRule: paramEval.violatedRule,
+        remediationForLlm,
+        nextToolCalls,
+    };
+}