@nebutra/agent-runtime 0.2.1 → 2.0.0

package/src/orchestration.test.ts

@@ -1,53 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { type Brief, costReport, fanOutSubagents, planSubagentDispatch } from "./orchestration";
-
-function brief(name: string, dependsOn: readonly string[] = []): Brief {
-  return {
-    id: name,
-    objective: `do ${name}`,
-    outputFormat: { type: "object", properties: { value: { type: "string" } } },
-    allowedTools: ["read"],
-    contextRefs: [],
-    boundaries: ["do not write outside scope"],
-    budget: { durationMs: 1_000, costUsd: 0.01, tokenLimit: 1_000 },
-    dependsOn,
-  };
-}
-
-describe("subagent orchestration", () => {
-  it("defaults dependent briefs to sequential dispatch", () => {
-    const plan = planSubagentDispatch([brief("research"), brief("write", ["research"])]);
-    expect(plan.strategy).toBe("sequential");
-    expect(plan.order.map((item) => item.id)).toEqual(["research", "write"]);
-  });
-
-  it("refuses fan-out when briefs depend on each other", () => {
-    expect(() =>
-      planSubagentDispatch([brief("research"), brief("write", ["research"])], {
-        strategy: "fanout",
-      }),
-    ).toThrow(/fan-out|depend/i);
-  });
-
-  it("runs independent fan-out briefs and preserves result ownership", async () => {
-    const results = await fanOutSubagents([brief("logo"), brief("copy")], async (item) => ({
-      briefId: item.id,
-      output: { value: item.objective },
-      usage: { inputTokens: 10, cachedInputTokens: 0, outputTokens: 3, reasoningOutputTokens: 0 },
-      durationMs: 5,
-    }));
-
-    expect(results.map((result) => result.briefId)).toEqual(["logo", "copy"]);
-    expect(costReport(results)).toEqual({
-      totalInputTokens: 20,
-      totalOutputTokens: 6,
-      totalReasoningTokens: 0,
-      maxDurationMs: 5,
-      subagents: 2,
-    });
-  });
-
-  it("requires precise brief fields", () => {
-    expect(() => planSubagentDispatch([{ ...brief("bad"), objective: "" }])).toThrow(/objective/i);
-  });
-});

package/src/orchestration.ts

@@ -1,146 +0,0 @@
-import type { TurnUsage } from "./model";
-
-export interface BudgetCap {
-  readonly durationMs: number;
-  readonly costUsd: number;
-  readonly tokenLimit: number;
-}
-
-export interface Brief {
-  readonly id: string;
-  readonly objective: string;
-  readonly outputFormat: Record<string, unknown>;
-  readonly allowedTools: readonly string[];
-  readonly contextRefs: readonly string[];
-  readonly boundaries: readonly string[];
-  readonly budget: BudgetCap;
-  readonly dependsOn?: readonly string[];
-}
-
-export type DispatchStrategy = "auto" | "sequential" | "fanout";
-
-export interface DispatchPlan {
-  readonly strategy: Exclude<DispatchStrategy, "auto">;
-  readonly order: readonly Brief[];
-}
-
-export interface DispatchPlanOptions {
-  readonly strategy?: DispatchStrategy;
-}
-
-export interface SubagentResult {
-  readonly briefId: string;
-  readonly output: unknown;
-  readonly usage: TurnUsage;
-  readonly durationMs: number;
-}
-
-export interface SubagentCostReport {
-  readonly totalInputTokens: number;
-  readonly totalOutputTokens: number;
-  readonly totalReasoningTokens: number;
-  readonly maxDurationMs: number;
-  readonly subagents: number;
-}
-
-function fail(message: string, suggestion: string): never {
-  throw new Error(`${message}. Suggestion: ${suggestion}`);
-}
-
-function validateBrief(brief: Brief): void {
-  if (!brief.id.trim()) fail("brief.id is required", "Use a stable role or task id.");
-  if (!brief.objective.trim()) {
-    fail("brief.objective is required", "Write a concrete objective before dispatching.");
-  }
-  if (brief.allowedTools.length === 0) {
-    fail("brief.allowedTools is required", "Constrain each subagent to an explicit tool scope.");
-  }
-  if (brief.boundaries.length === 0) {
-    fail("brief.boundaries is required", "State at least one boundary for the worker.");
-  }
-  if (brief.budget.tokenLimit <= 0 || brief.budget.durationMs <= 0 || brief.budget.costUsd < 0) {
-    fail("brief.budget is invalid", "Set positive token/time caps and a non-negative cost cap.");
-  }
-}
-
-function dependencySet(briefs: readonly Brief[]): Set<string> {
-  const dependencies = new Set<string>();
-  for (const brief of briefs) {
-    for (const dep of brief.dependsOn ?? []) dependencies.add(dep);
-  }
-  return dependencies;
-}
-
-function topologicalOrder(briefs: readonly Brief[]): Brief[] {
-  const byId = new Map(briefs.map((brief) => [brief.id, brief]));
-  const visited = new Set<string>();
-  const visiting = new Set<string>();
-  const ordered: Brief[] = [];
-
-  const visit = (brief: Brief): void => {
-    if (visited.has(brief.id)) return;
-    if (visiting.has(brief.id)) {
-      fail(
-        `subagent dependency cycle includes '${brief.id}'`,
-        "Remove the cycle or collapse the dependent work into one sequential brief.",
-      );
-    }
-    visiting.add(brief.id);
-    for (const dep of brief.dependsOn ?? []) {
-      const dependency = byId.get(dep);
-      if (dependency) visit(dependency);
-    }
-    visiting.delete(brief.id);
-    visited.add(brief.id);
-    ordered.push(brief);
-  };
-
-  for (const brief of briefs) visit(brief);
-  return ordered;
-}
-
-export function planSubagentDispatch(
-  briefs: readonly Brief[],
-  options: DispatchPlanOptions = {},
-): DispatchPlan {
-  if (briefs.length === 0) {
-    fail("at least one brief is required", "Create a concrete worker brief before dispatching.");
-  }
-  for (const brief of briefs) validateBrief(brief);
-
-  const dependencies = dependencySet(briefs);
-  if ((options.strategy ?? "auto") === "fanout" && dependencies.size > 0) {
-    fail(
-      "fan-out cannot run briefs that depend on each other",
-      "Use sequential dispatch for dependent work or split independent briefs only.",
-    );
-  }
-
-  const order = topologicalOrder(briefs);
-  const strategy =
-    options.strategy === "fanout" || (options.strategy === "auto" && dependencies.size === 0)
-      ? "fanout"
-      : "sequential";
-  return { strategy, order };
-}
-
-export async function fanOutSubagents(
-  briefs: readonly Brief[],
-  run: (brief: Brief) => Promise<SubagentResult>,
-): Promise<readonly SubagentResult[]> {
-  const plan = planSubagentDispatch(briefs, { strategy: "fanout" });
-  return Promise.all(plan.order.map((brief) => run(brief)));
-}
-
-export function costReport(results: readonly SubagentResult[]): SubagentCostReport {
-  return {
-    totalInputTokens: results.reduce((sum, result) => sum + result.usage.inputTokens, 0),
-    totalOutputTokens: results.reduce((sum, result) => sum + result.usage.outputTokens, 0),
-    totalReasoningTokens: results.reduce(
-      (sum, result) => sum + result.usage.reasoningOutputTokens,
-      0,
-    ),
-    maxDurationMs: results.reduce((max, result) => Math.max(max, result.durationMs), 0),
-    subagents: results.length,
-  };
-}

package/src/permission-ruleset.test.ts

@@ -1,301 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  type Action,
-  BUILTIN_ARITY,
-  commandPermissionKey,
-  commandPrefix,
-  evaluate,
-  type Rule,
-  type Ruleset,
-  wildcardMatch,
-} from "./permission-ruleset.js";
-
-describe("wildcardMatch — anchored full-string glob", () => {
-  it("matches literal strings exactly", () => {
-    expect(wildcardMatch("git", "git")).toBe(true);
-    expect(wildcardMatch("git", "npm")).toBe(false);
-  });
-
-  it("is anchored (no partial matches)", () => {
-    expect(wildcardMatch("git status", "git")).toBe(false);
-    expect(wildcardMatch("agit", "git")).toBe(false);
-    expect(wildcardMatch("gitx", "git")).toBe(false);
-  });
-
-  it("treats * as any run including empty", () => {
-    expect(wildcardMatch("", "*")).toBe(true);
-    expect(wildcardMatch("anything at all", "*")).toBe(true);
-    expect(wildcardMatch("abc", "a*c")).toBe(true);
-    expect(wildcardMatch("ac", "a*c")).toBe(true);
-    expect(wildcardMatch("abbbbc", "a*c")).toBe(true);
-    expect(wildcardMatch("abd", "a*c")).toBe(false);
-  });
-
-  it("treats ? as exactly one char", () => {
-    expect(wildcardMatch("a", "?")).toBe(true);
-    expect(wildcardMatch("", "?")).toBe(false);
-    expect(wildcardMatch("ab", "?")).toBe(false);
-    expect(wildcardMatch("abc", "a?c")).toBe(true);
-    expect(wildcardMatch("ac", "a?c")).toBe(false);
-  });
-
-  it("combines * and ? together", () => {
-    expect(wildcardMatch("file.test.ts", "*.ts")).toBe(true);
-    // `*` swallows "file.test", then ".t" + one `?` (= "s") consumes ".ts"
-    expect(wildcardMatch("file.test.ts", "*.t?")).toBe(true);
-    // ".t??" needs two trailing chars after ".t" — only one ("s") remains
-    expect(wildcardMatch("file.test.ts", "*.t??")).toBe(false);
-    expect(wildcardMatch("file.test.tsx", "*.t??")).toBe(true);
-  });
-
-  it("treats regex metacharacters in the pattern as literals", () => {
-    expect(wildcardMatch("a.b", "a.b")).toBe(true);
-    expect(wildcardMatch("axb", "a.b")).toBe(false);
-    expect(wildcardMatch("a+b", "a+b")).toBe(true);
-    expect(wildcardMatch("(x)", "(x)")).toBe(true);
-    expect(wildcardMatch("a$b^", "a$b^")).toBe(true);
-    expect(wildcardMatch("a[b]c", "a[b]c")).toBe(true);
-  });
-
-  it("empty pattern matches only empty string", () => {
-    expect(wildcardMatch("", "")).toBe(true);
-    expect(wildcardMatch("x", "")).toBe(false);
-  });
-
-  describe("SPECIAL RULE — trailing ' *' is optional", () => {
-    it('pattern "git *" matches the head-only "git"', () => {
-      expect(wildcardMatch("git", "git *")).toBe(true);
-    });
-
-    it('pattern "git *" matches "git <rest>"', () => {
-      expect(wildcardMatch("git status", "git *")).toBe(true);
-      expect(wildcardMatch("git commit -m x", "git *")).toBe(true);
-    });
-
-    it('pattern "git *" still requires the head prefix', () => {
-      expect(wildcardMatch("npm", "git *")).toBe(false);
-      expect(wildcardMatch("gitx", "git *")).toBe(false);
-      expect(wildcardMatch("", "git *")).toBe(false);
-    });
-
-    it("the space before * is required for the optional rule (the space is consumed)", () => {
-      // "git " (head + trailing space, nothing after) does NOT match the
-      // head-only branch (which is exactly "git"), but matches via "git " + empty *
-      expect(wildcardMatch("git ", "git *")).toBe(true);
-      expect(wildcardMatch("git", "git *")).toBe(true);
-    });
-
-    it('multi-token head before " *"', () => {
-      expect(wildcardMatch("npm run", "npm run *")).toBe(true);
-      expect(wildcardMatch("npm run dev", "npm run *")).toBe(true);
-      expect(wildcardMatch("npm", "npm run *")).toBe(false);
-    });
-
-    it('a bare "*" pattern is not treated as the optional-suffix rule', () => {
-      expect(wildcardMatch("", "*")).toBe(true);
-      expect(wildcardMatch("x", "*")).toBe(true);
-    });
-  });
-
-  it("handles adversarial patterns with many wildcards without catastrophic backtracking", () => {
-    const pattern = "*".repeat(30);
-    const subject = "a".repeat(200);
-    const start = Date.now();
-    expect(wildcardMatch(subject, pattern)).toBe(true);
-    expect(wildcardMatch("", pattern)).toBe(true);
-    // a near-worst-case alternation that would explode under naive regex backtracking
-    const mixed = `${"*a".repeat(30)}*`;
-    expect(wildcardMatch(`${"a".repeat(100)}`, mixed)).toBe(true);
-    expect(wildcardMatch(`${"b".repeat(100)}`, mixed)).toBe(false);
-    expect(Date.now() - start).toBeLessThan(500);
-  });
-
-  it("is deterministic across repeated calls", () => {
-    for (let i = 0; i < 50; i++) {
-      expect(wildcardMatch("git push origin main", "git *")).toBe(true);
-      expect(wildcardMatch("rm -rf /", "git *")).toBe(false);
-    }
-  });
-});
-
-describe("evaluate — two-dimensional first-match wildcard resolution", () => {
-  const allowGitRead: Rule = { permission: "bash", pattern: "git status", action: "allow" };
-  const denyRm: Rule = { permission: "bash", pattern: "rm *", action: "deny" };
-  const askGit: Rule = { permission: "bash", pattern: "git *", action: "ask" };
-
-  it("returns the first matching rule (order matters)", () => {
-    const set: Ruleset = [allowGitRead, askGit, denyRm];
-    const r = evaluate("bash", "git status", set);
-    expect(r).toEqual(allowGitRead);
-  });
-
-  it("falls through to the next rule when the first does not match", () => {
-    const set: Ruleset = [allowGitRead, askGit];
-    const r = evaluate("bash", "git push", set);
-    expect(r).toEqual(askGit);
-  });
-
-  it("requires BOTH permission AND pattern to match (two-dimensional)", () => {
-    const set: Ruleset = [{ permission: "edit", pattern: "git *", action: "allow" }];
-    // pattern matches but permission does not -> no match -> default ask
-    const r = evaluate("bash", "git status", set);
-    expect(r).toEqual({ permission: "bash", pattern: "*", action: "ask" });
-  });
-
-  it("supports wildcard permissions", () => {
-    const set: Ruleset = [{ permission: "*", pattern: "git *", action: "allow" }];
-    expect(evaluate("bash", "git status", set).action).toBe("allow");
-    expect(evaluate("edit", "git status", set).action).toBe("allow");
-  });
-
-  it("concatenates multiple rulesets in argument order", () => {
-    const base: Ruleset = [{ permission: "bash", pattern: "*", action: "ask" }];
-    const overrides: Ruleset = [{ permission: "bash", pattern: "git *", action: "allow" }];
-    // base comes first -> its catch-all wins over the later override
-    expect(evaluate("bash", "git status", base, overrides).action).toBe("ask");
-    // reversed order -> the specific allow is reached first
-    expect(evaluate("bash", "git status", overrides, base).action).toBe("allow");
-  });
-
-  it("returns the fail-safe default (ask) when nothing matches", () => {
-    const r = evaluate("bash", "curl http://evil", []);
-    expect(r).toEqual({ permission: "bash", pattern: "*", action: "ask" });
-  });
-
-  it("default carries the queried permission and pattern verbatim", () => {
-    const r = evaluate("net", "https://example.com/x", [
-      { permission: "bash", pattern: "*", action: "allow" },
-    ]);
-    expect(r.permission).toBe("net");
-    expect(r.pattern).toBe("*");
-    expect(r.action).toBe("ask");
-  });
-
-  it("does not mutate the input rulesets", () => {
-    const a: Ruleset = [{ permission: "bash", pattern: "git *", action: "allow" }];
-    const b: Ruleset = [{ permission: "bash", pattern: "*", action: "deny" }];
-    const aSnap = JSON.stringify(a);
-    const bSnap = JSON.stringify(b);
-    evaluate("bash", "git status", a, b);
-    evaluate("bash", "rm -rf", a, b);
-    expect(JSON.stringify(a)).toBe(aSnap);
-    expect(JSON.stringify(b)).toBe(bSnap);
-    expect(a.length).toBe(1);
-    expect(b.length).toBe(1);
-  });
-
-  it("is deterministic", () => {
-    const set: Ruleset = [askGit, denyRm];
-    for (let i = 0; i < 25; i++) {
-      expect(evaluate("bash", "git pull", set).action).toBe("ask");
-      expect(evaluate("bash", "rm x", set).action).toBe("deny");
-    }
-  });
-
-  it("Action type accepts the three documented values", () => {
-    const actions: Action[] = ["allow", "deny", "ask"];
-    expect(actions).toHaveLength(3);
-  });
-});
-
-describe("commandPrefix — longest-prefix-wins extraction", () => {
-  it("uses the built-in arity for git (2)", () => {
-    expect(commandPrefix(["git", "checkout", "main"])).toEqual(["git", "checkout"]);
-    expect(commandPrefix(["git", "status"])).toEqual(["git", "status"]);
-  });
-
-  it("prefers the longest matching prefix (npm run = 3 over npm = 2)", () => {
-    expect(commandPrefix(["npm", "run", "dev"])).toEqual(["npm", "run", "dev"]);
-    expect(commandPrefix(["npm", "install", "left-pad"])).toEqual(["npm", "install"]);
-  });
-
-  it("falls back to the first token for unknown commands", () => {
-    expect(commandPrefix(["foobar", "a", "b", "c"])).toEqual(["foobar"]);
-  });
-
-  it("returns an empty array for empty tokens", () => {
-    expect(commandPrefix([])).toEqual([]);
-  });
-
-  it("clamps the slice when arity exceeds the token count", () => {
-    expect(commandPrefix(["git"])).toEqual(["git"]);
-  });
-
-  it("respects single-arity commands", () => {
-    expect(commandPrefix(["ls", "-la", "src"])).toEqual(["ls"]);
-    expect(commandPrefix(["cat", "file.ts"])).toEqual(["cat"]);
-    expect(commandPrefix(["rm", "x", "y"])).toEqual(["rm"]);
-  });
-
-  it("merges a caller-supplied arity over the built-in table", () => {
-    expect(commandPrefix(["git", "checkout", "main"], { git: 1 })).toEqual(["git"]);
-    // extend with a new command
-    expect(commandPrefix(["terraform", "apply", "-auto"], { terraform: 2 })).toEqual([
-      "terraform",
-      "apply",
-    ]);
-    // a multi-word override
-    expect(commandPrefix(["pnpm", "dlx", "create-x", "y"], { "pnpm dlx": 3 })).toEqual([
-      "pnpm",
-      "dlx",
-      "create-x",
-    ]);
-  });
-
-  it("does not mutate the caller arity or the built-in table", () => {
-    const override = { git: 1 };
-    const snap = JSON.stringify(override);
-    const builtinSnap = JSON.stringify(BUILTIN_ARITY);
-    commandPrefix(["git", "a", "b"], override);
-    expect(JSON.stringify(override)).toBe(snap);
-    expect(JSON.stringify(BUILTIN_ARITY)).toBe(builtinSnap);
-  });
-
-  it("is deterministic", () => {
-    for (let i = 0; i < 25; i++) {
-      expect(commandPrefix(["docker", "compose", "up"])).toEqual(["docker", "compose"]);
-    }
-  });
-});
-
-describe("commandPermissionKey — flag-stripped prefix key", () => {
-  it("strips dash-prefixed tokens then applies the prefix", () => {
-    // Faithful model: tokens starting with "-" are dropped wholesale. There
-    // is no flag-argument awareness, so non-dash operands survive.
-    expect(commandPermissionKey("git --no-pager commit -m x")).toBe("git commit");
-    // "." is not a flag, so it survives and fills the git:2 slot.
-    expect(commandPermissionKey("git -C . commit -m x")).toBe("git .");
-  });
-
-  it("derives a simple key for unknown commands (first token)", () => {
-    expect(commandPermissionKey("curl -sSL https://example.com")).toBe("curl");
-  });
-
-  it("handles npm run with flags interleaved", () => {
-    expect(commandPermissionKey("npm --silent run build --prod")).toBe("npm run build");
-  });
-
-  it("collapses arbitrary whitespace between tokens", () => {
-    expect(commandPermissionKey("git   checkout\tmain")).toBe("git checkout");
-  });
-
-  it("returns an empty string for an empty/whitespace command", () => {
-    expect(commandPermissionKey("")).toBe("");
-    expect(commandPermissionKey("   ")).toBe("");
-    expect(commandPermissionKey("--only --flags")).toBe("");
-  });
-
-  it("feeds cleanly into evaluate as the pattern dimension", () => {
-    const set: Ruleset = [{ permission: "bash", pattern: "git commit", action: "ask" }];
-    const key = commandPermissionKey("git -C /repo commit -m 'msg'");
-    expect(evaluate("bash", key, set).action).toBe("ask");
-  });
-
-  it("is deterministic", () => {
-    for (let i = 0; i < 25; i++) {
-      // No flag-argument awareness: "-n" is dropped, "ns" survives and fills
-      // the kubectl:2 slot, yielding a stable "kubectl ns".
-      expect(commandPermissionKey("kubectl -n ns get pods")).toBe("kubectl ns");
-    }
-  });
-});

package/src/permission-ruleset.ts

@@ -1 +0,0 @@
-export * from "@nebutra/execution-policy";

package/src/policy.ts

@@ -1,151 +0,0 @@
-/**
- * Approval + capability policy (WRAP — capability #8).
- *
- * Faithful re-expression of the upstream two orthogonal axes:
- *   1. Approval policy  — *when* to ask a human (AskForApproval).
- *   2. Capability policy — *what* an external executor is permitted to do
- *      (SandboxPolicy). Policy/semantics only; enforcement is out of scope
- *      and lives behind the external-sandbox seam (see ./sandbox).
- *
- * Plus the static rule decision (execpolicy `Decision`) and the human's rich
- * answer (`ReviewDecision`). Built on `@nebutra/permissions` for *who may
- * approve*; this module models *what tier / what answer*.
- */
-
-import { z } from "zod";
-
-// ── Axis 1: approval policy ──────────────────────────────────────────────────
-
-/** Fine-grained per-category gates. `false` = auto-reject (not auto-ask). */
-export const granularApprovalConfigSchema = z.object({
-  sandboxApproval: z.boolean(),
-  rules: z.boolean(),
-  skillApproval: z.boolean().default(false),
-  requestPermissions: z.boolean().default(false),
-  mcpElicitations: z.boolean(),
-});
-export type GranularApprovalConfig = z.infer<typeof granularApprovalConfigSchema>;
-
-/**
- * Approval tier.
- *  - `unless_trusted` : only known-safe read-only ops auto-approved; else ask.
- *  - `on_failure`     : DEPRECATED — auto-run sandboxed, escalate on failure.
- *  - `on_request`     : the model decides when to ask (default).
- *  - `granular`       : per-category booleans.
- *  - `never`          : failures returned to the model, never escalated.
- */
-export const approvalPolicySchema = z.discriminatedUnion("kind", [
-  z.object({ kind: z.literal("unless_trusted") }),
-  z.object({ kind: z.literal("on_failure") }),
-  z.object({ kind: z.literal("on_request") }),
-  z.object({ kind: z.literal("granular"), config: granularApprovalConfigSchema }),
-  z.object({ kind: z.literal("never") }),
-]);
-export type ApprovalPolicy = z.infer<typeof approvalPolicySchema>;
-
-export const DEFAULT_APPROVAL_POLICY: ApprovalPolicy = { kind: "on_request" };
-
-// ── Axis 2: capability policy ────────────────────────────────────────────────
-
-/** A writable root with read-only sub-paths and escalation-protected names. */
-export const writableRootSchema = z.object({
-  root: z.string(),
-  readOnlySubpaths: z.array(z.string()).default([]),
-  /** Names that must never be writable even under this root (e.g. ".git/hooks"). */
-  protectedMetadataNames: z.array(z.string()).default([]),
-});
-export type WritableRoot = z.infer<typeof writableRootSchema>;
-
-/**
- * Capability policy — a vocabulary of *capabilities*, not OS mechanisms.
- * Per the dual-track governance decision, `external_sandbox` is the default
- * posture: this runtime never enforces isolation itself.
- */
-export const capabilityPolicySchema = z.discriminatedUnion("kind", [
-  z.object({ kind: z.literal("danger_full_access") }),
-  z.object({ kind: z.literal("read_only"), networkAccess: z.boolean().default(false) }),
-  z.object({
-    kind: z.literal("external_sandbox"),
-    networkAccess: z.boolean().default(false),
-  }),
-  z.object({
-    kind: z.literal("workspace_write"),
-    writableRoots: z.array(writableRootSchema).default([]),
-    networkAccess: z.boolean().default(false),
-    excludeTmpdir: z.boolean().default(false),
-    excludeSlashTmp: z.boolean().default(false),
-  }),
-]);
-export type CapabilityPolicy = z.infer<typeof capabilityPolicySchema>;
-
-/** Default posture for a multi-tenant web runtime (governance: ExternalSandbox). */
-export const DEFAULT_CAPABILITY_POLICY: CapabilityPolicy = {
-  kind: "external_sandbox",
-  networkAccess: false,
-};
-
-// ── Static rule decision (policy-as-data evaluator output) ────────────────────
-
-/** Classification of a command *before* approval. */
-export type RuleDecision = "allow" | "prompt" | "forbidden";
-
-// ── The human's answer ───────────────────────────────────────────────────────
-
-/** A session-scoped amendment that remembers an allowed command prefix. */
-export interface RuleAmendment {
-  readonly allowPrefix: readonly string[];
-}
-
-/** Persist allow/deny for future requests to the same host. */
-export interface NetworkPolicyAmendment {
-  readonly host: string;
-  readonly effect: "allow" | "deny";
-}
-
-/**
- * The reviewer's rich answer. Mirrors upstream `ReviewDecision`; `denied`
- * is the safe default.
- */
-export type ReviewDecision =
-  | { readonly kind: "approved" }
-  | { readonly kind: "approved_rule_amendment"; readonly amendment: RuleAmendment }
-  | { readonly kind: "approved_for_session" }
-  | { readonly kind: "network_policy_amendment"; readonly amendment: NetworkPolicyAmendment }
-  | { readonly kind: "denied" }
-  | { readonly kind: "timed_out" }
-  | { readonly kind: "abort" };
-
-export const DENIED: ReviewDecision = { kind: "denied" };
-
-/** Whether a decision permits the action to proceed. */
-export function isApproval(decision: ReviewDecision): boolean {
-  return (
-    decision.kind === "approved" ||
-    decision.kind === "approved_rule_amendment" ||
-    decision.kind === "approved_for_session"
-  );
-}
-
-/**
- * Resolve a static rule decision against an approval policy into whether the
- * action proceeds without a human, must be asked, or is auto-rejected.
- * Pure; the actual prompting/escalation transport lives in ./protocol.
- */
-export function resolveRuleDecision(
-  rule: RuleDecision,
-  policy: ApprovalPolicy,
-): "auto_allow" | "ask_human" | "auto_reject" {
-  if (rule === "forbidden") return "auto_reject";
-  if (rule === "allow") return "auto_allow";
-  // rule === "prompt"
-  switch (policy.kind) {
-    case "never":
-      return "auto_reject";
-    case "unless_trusted":
-    case "on_request":
-    case "on_failure":
-      return "ask_human";
-    case "granular":
-      return policy.config.rules ? "ask_human" : "auto_reject";
-  }
-}