@neuroverseos/governance 0.3.0 → 0.3.3

package/dist/adapters/openai.cjs

@@ -30,24 +30,34 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/adapters/openai.ts
 var openai_exports = {};
 __export(openai_exports, {
-  GovernanceBlockedError: () => GovernanceBlockedError,
+  GovernanceBlockedError: () => GovernanceBlockedError2,
   GovernedToolExecutor: () => GovernedToolExecutor,
   createGovernedToolExecutor: () => createGovernedToolExecutor,
   createGovernedToolExecutorFromWorld: () => createGovernedToolExecutorFromWorld
 });
 module.exports = __toCommonJS(openai_exports);
 
-// src/engine/plan-engine.ts
-function keywordMatch(eventText, step) {
-  const stepText = [
-    step.label,
-    step.description ?? "",
-    ...step.tags ?? []
+// src/engine/text-utils.ts
+function normalizeEventText(event) {
+  return [
+    event.intent,
+    event.tool ?? "",
+    event.scope ?? ""
   ].join(" ").toLowerCase();
-  const keywords = stepText.split(/\s+/).filter((w) => w.length > 3);
+}
+function extractKeywords(text, minLength = 3) {
+  return text.toLowerCase().split(/\s+/).filter((w) => w.length > minLength);
+}
+function matchesAllKeywords(eventText, ruleText) {
+  const keywords = extractKeywords(ruleText);
+  if (keywords.length === 0) return false;
+  return keywords.every((kw) => eventText.includes(kw));
+}
+function matchesKeywordThreshold(eventText, ruleText, threshold = 0.5) {
+  const keywords = extractKeywords(ruleText);
   if (keywords.length === 0) return false;
   const matched = keywords.filter((kw) => eventText.includes(kw));
-  return matched.length >= Math.ceil(keywords.length * 0.5);
+  return matched.length >= Math.ceil(keywords.length * threshold);
 }
 function tokenSimilarity(a, b) {
   const tokensA = new Set(a.toLowerCase().split(/\s+/).filter((w) => w.length > 2));
@@ -60,6 +70,19 @@ function tokenSimilarity(a, b) {
   const union = (/* @__PURE__ */ new Set([...tokensA, ...tokensB])).size;
   return union > 0 ? intersection / union : 0;
 }
+
+// src/engine/plan-engine.ts
+function keywordMatch(eventText, step) {
+  const stepText = [
+    step.label,
+    step.description ?? "",
+    ...step.tags ?? []
+  ].join(" ");
+  return matchesKeywordThreshold(eventText, stepText, 0.5);
+}
+function tokenSimilarity2(a, b) {
+  return tokenSimilarity(a, b);
+}
 function findMatchingStep(eventText, event, steps) {
   const pendingOrActive = steps.filter((s) => s.status === "pending" || s.status === "active");
   if (pendingOrActive.length === 0) {
@@ -78,7 +101,7 @@ function findMatchingStep(eventText, event, steps) {
   let bestScore = 0;
   for (const step of pendingOrActive) {
     const stepText = [step.label, step.description ?? "", ...step.tags ?? []].join(" ");
-    const score = tokenSimilarity(intentText, stepText);
+    const score = tokenSimilarity2(intentText, stepText);
     if (score > bestScore) {
       bestScore = score;
       bestStep = step;
@@ -119,7 +142,7 @@ function checkConstraints(event, eventText, constraints) {
       continue;
     }
     if (constraint.type === "scope" && constraint.trigger) {
-      const keywords = constraint.trigger.split(/\s+/).filter((w) => w.length > 3);
+      const keywords = extractKeywords(constraint.trigger);
       const violated = keywords.length > 0 && keywords.every((kw) => eventText.includes(kw));
       checks.push({
         constraintId: constraint.id,
@@ -200,11 +223,7 @@ function evaluatePlan(event, plan) {
       progress
     };
   }
-  const eventText = [
-    event.intent,
-    event.tool ?? "",
-    event.scope ?? ""
-  ].join(" ").toLowerCase();
+  const eventText = normalizeEventText(event);
   const { matched, closest, closestScore } = findMatchingStep(eventText, event, plan.steps);
   if (!matched) {
     return {
@@ -245,7 +264,7 @@ function evaluatePlan(event, plan) {
   };
 }
 function buildPlanCheck(event, plan, verdict) {
-  const eventText = [event.intent, event.tool ?? "", event.scope ?? ""].join(" ").toLowerCase();
+  const eventText = normalizeEventText(event);
   const { matched, closest, closestScore } = findMatchingStep(eventText, event, plan.steps);
   const { checks: constraintChecks } = checkConstraints(event, eventText, plan.constraints);
   const progress = getPlanProgress(plan);
@@ -347,11 +366,49 @@ function isExternalScope(scope) {
   ];
   return !internalPatterns.some((p) => p.test(scope));
 }
+var MAX_INPUT_LENGTH = 1e5;
 function evaluateGuard(event, world, options = {}) {
   const startTime = performance.now();
   const level = options.level ?? "standard";
   const includeTrace = options.trace ?? false;
-  const eventText = (event.intent + " " + (event.tool ?? "") + " " + (event.scope ?? "")).toLowerCase();
+  if (!event.intent || typeof event.intent !== "string") {
+    return {
+      status: "BLOCK",
+      reason: "GuardEvent.intent is required and must be a string",
+      ruleId: "safety-input-validation",
+      evidence: {
+        worldId: world.world?.world_id ?? "",
+        worldName: world.world?.name ?? "",
+        worldVersion: world.world?.version ?? "",
+        evaluatedAt: Date.now(),
+        invariantsSatisfied: 0,
+        invariantsTotal: 0,
+        guardsMatched: [],
+        rulesMatched: [],
+        enforcementLevel: level
+      }
+    };
+  }
+  const inputLength = event.intent.length + (event.tool?.length ?? 0) + (event.scope?.length ?? 0) + (event.payload ? JSON.stringify(event.payload).length : 0);
+  if (inputLength > MAX_INPUT_LENGTH) {
+    return {
+      status: "BLOCK",
+      reason: `Input exceeds maximum allowed length (${MAX_INPUT_LENGTH} characters)`,
+      ruleId: "safety-input-length",
+      evidence: {
+        worldId: world.world?.world_id ?? "",
+        worldName: world.world?.name ?? "",
+        worldVersion: world.world?.version ?? "",
+        evaluatedAt: Date.now(),
+        invariantsSatisfied: 0,
+        invariantsTotal: 0,
+        guardsMatched: [],
+        rulesMatched: [],
+        enforcementLevel: level
+      }
+    };
+  }
+  const eventText = normalizeEventText(event);
   const invariantChecks = [];
   const safetyChecks = [];
   let planCheckResult;
@@ -364,6 +421,43 @@ function evaluateGuard(event, world, options = {}) {
   const guardsMatched = [];
   const rulesMatched = [];
   checkInvariantCoverage(world, invariantChecks);
+  if (event.roleId && options.agentStates) {
+    const agentState = options.agentStates.get(event.roleId);
+    if (agentState && agentState.cooldownRemaining > 0) {
+      decidingLayer = "safety";
+      decidingId = `penalize-cooldown-${event.roleId}`;
+      const verdict = buildVerdict(
+        "PENALIZE",
+        `Agent "${event.roleId}" is frozen for ${agentState.cooldownRemaining} more round(s) due to prior penalty.`,
+        `penalize-cooldown-${event.roleId}`,
+        void 0,
+        world,
+        level,
+        invariantChecks,
+        guardsMatched,
+        rulesMatched,
+        includeTrace ? buildTrace(
+          invariantChecks,
+          safetyChecks,
+          planCheckResult,
+          roleChecks,
+          guardChecks,
+          kernelRuleChecks,
+          levelChecks,
+          decidingLayer,
+          decidingId,
+          startTime
+        ) : void 0
+      );
+      verdict.intentRecord = {
+        originalIntent: event.intent,
+        finalAction: "blocked (agent frozen)",
+        enforcement: "PENALIZE",
+        consequence: { type: "freeze", rounds: agentState.cooldownRemaining, description: "Agent still in cooldown from prior penalty" }
+      };
+      return verdict;
+    }
+  }
   if (options.sessionAllowlist) {
     const key = eventToAllowlistKey(event);
     if (options.sessionAllowlist.has(key)) {
@@ -491,7 +585,16 @@ function evaluateGuard(event, world, options = {}) {
     if (guardVerdict.status !== "ALLOW") {
       decidingLayer = "guard";
       decidingId = guardVerdict.ruleId;
-      return buildVerdict(
+      const intentRecord = {
+        originalIntent: event.intent,
+        finalAction: guardVerdict.status === "MODIFY" ? guardVerdict.modifiedTo ?? "modified" : guardVerdict.status === "PENALIZE" ? "blocked + penalized" : guardVerdict.status === "REWARD" ? event.intent : guardVerdict.status === "NEUTRAL" ? event.intent : guardVerdict.status === "BLOCK" ? "blocked" : "paused",
+        ruleApplied: guardVerdict.ruleId,
+        enforcement: guardVerdict.status,
+        modifiedTo: guardVerdict.modifiedTo,
+        consequence: guardVerdict.consequence,
+        reward: guardVerdict.reward
+      };
+      const verdict = buildVerdict(
         guardVerdict.status,
         guardVerdict.reason,
         guardVerdict.ruleId,
@@ -514,6 +617,10 @@ function evaluateGuard(event, world, options = {}) {
           startTime
         ) : void 0
       );
+      verdict.intentRecord = intentRecord;
+      if (guardVerdict.consequence) verdict.consequence = guardVerdict.consequence;
+      if (guardVerdict.reward) verdict.reward = guardVerdict.reward;
+      return verdict;
     }
   }
   const kernelVerdict = checkKernelRules(eventText, world, kernelRuleChecks, rulesMatched);
@@ -808,6 +915,21 @@ function checkGuards(event, eventText, world, checks, guardsMatched) {
     if (actionMode === "pause") {
       return { status: "PAUSE", reason, ruleId: `guard-${guard.id}` };
     }
+    if (actionMode === "penalize") {
+      const consequence = guard.consequence ? { ...guard.consequence } : { type: "freeze", rounds: 1, description: `Penalized for violating: ${guard.label}` };
+      return { status: "PENALIZE", reason, ruleId: `guard-${guard.id}`, consequence };
+    }
+    if (actionMode === "reward") {
+      const reward = guard.reward ? { ...guard.reward } : { type: "boost_influence", magnitude: 0.1, description: `Rewarded for: ${guard.label}` };
+      return { status: "REWARD", reason, ruleId: `guard-${guard.id}`, reward };
+    }
+    if (actionMode === "modify") {
+      const modifiedTo = guard.modify_to ?? guard.redirect ?? "hold";
+      return { status: "MODIFY", reason: `${reason} \u2192 Modified to: ${modifiedTo}`, ruleId: `guard-${guard.id}`, modifiedTo };
+    }
+    if (actionMode === "neutral") {
+      return { status: "NEUTRAL", reason, ruleId: `guard-${guard.id}` };
+    }
     if (actionMode === "warn" && !warnResult) {
       warnResult = { status: "ALLOW", warning: reason, ruleId: `guard-${guard.id}` };
     }
@@ -917,9 +1039,7 @@ function checkLevelConstraints(event, level, checks) {
   return null;
 }
 function matchesKeywords(eventText, ruleText) {
-  const keywords = ruleText.toLowerCase().split(/\s+/).filter((w) => w.length > 3);
-  if (keywords.length === 0) return false;
-  return keywords.every((kw) => eventText.includes(kw));
+  return matchesAllKeywords(eventText, ruleText);
 }
 function eventToAllowlistKey(event) {
   return `${(event.tool ?? "*").toLowerCase()}::${event.intent.toLowerCase().trim()}`;
@@ -987,10 +1107,18 @@ async function loadWorldFromDirectory(dirPath) {
   const { join } = await import("path");
   const { readdirSync } = await import("fs");
   async function readJson(filename) {
+    const filePath = join(dirPath, filename);
     try {
-      const content = await readFile(join(dirPath, filename), "utf-8");
+      const content = await readFile(filePath, "utf-8");
       return JSON.parse(content);
-    } catch {
+    } catch (err) {
+      if (err instanceof Error && "code" in err && err.code === "ENOENT") {
+        return void 0;
+      }
+      process.stderr.write(
+        `[neuroverse] Warning: Failed to read ${filename}: ${err instanceof Error ? err.message : String(err)}
+`
+      );
       return void 0;
     }
   }
@@ -1012,10 +1140,23 @@ async function loadWorldFromDirectory(dirPath) {
     const rulesDir = join(dirPath, "rules");
     const ruleFiles = readdirSync(rulesDir).filter((f) => f.endsWith(".json")).sort();
     for (const file of ruleFiles) {
-      const content = await readFile(join(rulesDir, file), "utf-8");
-      rules.push(JSON.parse(content));
+      try {
+        const content = await readFile(join(rulesDir, file), "utf-8");
+        rules.push(JSON.parse(content));
+      } catch (err) {
+        process.stderr.write(
+          `[neuroverse] Warning: Failed to parse rule ${file}: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+      }
+    }
+  } catch (err) {
+    if (!(err instanceof Error && "code" in err && err.code === "ENOENT")) {
+      process.stderr.write(
+        `[neuroverse] Warning: Failed to read rules directory: ${err instanceof Error ? err.message : String(err)}
+`
+      );
     }
-  } catch {
   }
   return {
     world: worldJson,
@@ -1050,20 +1191,58 @@ async function loadWorld(worldPath) {
   if (info.isDirectory()) {
     return loadWorldFromDirectory(worldPath);
   }
-  if (worldPath.endsWith(".nv-world.zip")) {
-    throw new Error(".nv-world.zip loading not yet implemented \u2014 use a world directory");
-  }
-  throw new Error(`Cannot load world from: ${worldPath} \u2014 expected a directory or .nv-world.zip`);
+  throw new Error(`Cannot load world from: ${worldPath} \u2014 expected a directory`);
 }
 
-// src/adapters/openai.ts
+// src/adapters/shared.ts
 var GovernanceBlockedError = class extends Error {
   verdict;
-  toolCallId;
-  constructor(verdict, toolCallId) {
-    super(`[NeuroVerse] BLOCKED: ${verdict.reason ?? verdict.ruleId ?? "governance rule"}`);
+  constructor(verdict, message) {
+    super(message ?? `[NeuroVerse] BLOCKED: ${verdict.reason ?? verdict.ruleId ?? "governance rule"}`);
     this.name = "GovernanceBlockedError";
     this.verdict = verdict;
+  }
+};
+function trackPlanProgress(event, state, callbacks) {
+  if (!state.activePlan) return;
+  const planVerdict = evaluatePlan(event, state.activePlan);
+  if (planVerdict.matchedStep) {
+    const advResult = advancePlan(state.activePlan, planVerdict.matchedStep);
+    if (advResult.success && advResult.plan) {
+      state.activePlan = advResult.plan;
+      state.engineOptions.plan = state.activePlan;
+    }
+    const progress = getPlanProgress(state.activePlan);
+    callbacks.onPlanProgress?.(progress);
+    if (progress.completed === progress.total) {
+      callbacks.onPlanComplete?.();
+    }
+  }
+}
+function extractScope(args) {
+  if (typeof args.path === "string") return args.path;
+  if (typeof args.file_path === "string") return args.file_path;
+  if (typeof args.filename === "string") return args.filename;
+  if (typeof args.url === "string") return args.url;
+  if (typeof args.command === "string") return args.command;
+  return void 0;
+}
+function buildEngineOptions(options, plan) {
+  return {
+    trace: options.trace ?? false,
+    level: options.level,
+    plan: plan ?? options.plan
+  };
+}
+function defaultBlockMessage(verdict) {
+  return `Action blocked by governance policy: ${verdict.reason ?? "rule violation"}. Rule: ${verdict.ruleId ?? "unknown"}.`;
+}
+
+// src/adapters/openai.ts
+var GovernanceBlockedError2 = class extends GovernanceBlockedError {
+  toolCallId;
+  constructor(verdict, toolCallId) {
+    super(verdict);
     this.toolCallId = toolCallId;
   }
 };
@@ -1071,14 +1250,11 @@ function defaultMapFunctionCall(name, args) {
   return {
     intent: name,
     tool: name,
-    scope: typeof args.path === "string" ? args.path : typeof args.url === "string" ? args.url : void 0,
+    scope: extractScope(args),
     args,
     direction: "input"
   };
 }
-function defaultBlockMessage(verdict) {
-  return `Action blocked by governance policy: ${verdict.reason ?? "rule violation"}. Rule: ${verdict.ruleId ?? "unknown"}.`;
-}
 var GovernedToolExecutor = class {
   world;
   options;
@@ -1090,11 +1266,7 @@ var GovernedToolExecutor = class {
     this.world = world;
     this.options = options;
     this.activePlan = options.plan;
-    this.engineOptions = {
-      trace: options.trace ?? false,
-      level: options.level,
-      plan: this.activePlan
-    };
+    this.engineOptions = buildEngineOptions(options, this.activePlan);
     this.mapFn = options.mapFunctionCall ?? defaultMapFunctionCall;
     this.blockMsg = options.blockMessage ?? defaultBlockMessage;
   }
@@ -1113,20 +1285,8 @@ var GovernedToolExecutor = class {
     this.engineOptions.plan = this.activePlan;
     const verdict = evaluateGuard(event, this.world, this.engineOptions);
     this.options.onEvaluate?.(verdict, event);
-    if (verdict.status === "ALLOW" && this.activePlan) {
-      const planVerdict = evaluatePlan(event, this.activePlan);
-      if (planVerdict.matchedStep) {
-        const advResult = advancePlan(this.activePlan, planVerdict.matchedStep);
-        if (advResult.success && advResult.plan) {
-          this.activePlan = advResult.plan;
-          this.engineOptions.plan = this.activePlan;
-        }
-        const progress = getPlanProgress(this.activePlan);
-        this.options.onPlanProgress?.(progress);
-        if (progress.completed === progress.total) {
-          this.options.onPlanComplete?.();
-        }
-      }
+    if (verdict.status === "ALLOW") {
+      trackPlanProgress(event, this, this.options);
     }
     return verdict;
   }
@@ -1152,7 +1312,7 @@ var GovernedToolExecutor = class {
       };
     }
     if (verdict.status === "PAUSE") {
-      throw new GovernanceBlockedError(verdict, toolCall.id);
+      throw new GovernanceBlockedError2(verdict, toolCall.id);
     }
     let args;
     try {

package/dist/adapters/openai.d.cts

@@ -1,4 +1,5 @@
-import { a as GuardVerdict, G as GuardEvent, P as PlanDefinition, b as PlanProgress, W as WorldDefinition } from '../guard-contract-WZx__PmU.cjs';
+import { a as GuardVerdict, G as GuardEvent, P as PlanDefinition, c as PlanProgress, b as GuardEngineOptions, W as WorldDefinition } from '../guard-contract-DqFcTScd.cjs';
+import { G as GovernanceBlockedError$1 } from '../shared-B8dvUUD8.cjs';
 
 /**
  * NeuroVerse Adapter — OpenAI
@@ -52,8 +53,7 @@ interface GovernedExecutorOptions {
     /** Called when all plan steps are completed. */
     onPlanComplete?: () => void;
 }
-declare class GovernanceBlockedError extends Error {
-    readonly verdict: GuardVerdict;
+declare class GovernanceBlockedError extends GovernanceBlockedError$1 {
     readonly toolCallId: string;
     constructor(verdict: GuardVerdict, toolCallId: string);
 }
@@ -64,10 +64,10 @@ declare class GovernanceBlockedError extends Error {
 declare class GovernedToolExecutor {
     private world;
     private options;
-    private engineOptions;
+    engineOptions: GuardEngineOptions;
     private mapFn;
     private blockMsg;
-    private activePlan?;
+    activePlan?: PlanDefinition;
     constructor(world: WorldDefinition, options?: GovernedExecutorOptions);
     /**
      * Evaluate a single tool call against governance rules.

package/dist/adapters/openai.d.ts

@@ -1,4 +1,5 @@
-import { a as GuardVerdict, G as GuardEvent, P as PlanDefinition, b as PlanProgress, W as WorldDefinition } from '../guard-contract-WZx__PmU.js';
+import { a as GuardVerdict, G as GuardEvent, P as PlanDefinition, c as PlanProgress, b as GuardEngineOptions, W as WorldDefinition } from '../guard-contract-DqFcTScd.js';
+import { G as GovernanceBlockedError$1 } from '../shared-Dr5Wiay8.js';
 
 /**
  * NeuroVerse Adapter — OpenAI
@@ -52,8 +53,7 @@ interface GovernedExecutorOptions {
     /** Called when all plan steps are completed. */
     onPlanComplete?: () => void;
 }
-declare class GovernanceBlockedError extends Error {
-    readonly verdict: GuardVerdict;
+declare class GovernanceBlockedError extends GovernanceBlockedError$1 {
     readonly toolCallId: string;
     constructor(verdict: GuardVerdict, toolCallId: string);
 }
@@ -64,10 +64,10 @@ declare class GovernanceBlockedError extends Error {
 declare class GovernedToolExecutor {
     private world;
     private options;
-    private engineOptions;
+    engineOptions: GuardEngineOptions;
     private mapFn;
     private blockMsg;
-    private activePlan?;
+    activePlan?: PlanDefinition;
     constructor(world: WorldDefinition, options?: GovernedExecutorOptions);
     /**
      * Evaluate a single tool call against governance rules.

package/dist/adapters/openai.js

@@ -3,11 +3,12 @@ import {
   GovernedToolExecutor,
   createGovernedToolExecutor,
   createGovernedToolExecutorFromWorld
-} from "../chunk-ER62HNGF.js";
-import "../chunk-4JRYGIO7.js";
-import "../chunk-4QXB6PEO.js";
-import "../chunk-JZPQGIKR.js";
-import "../chunk-YZFATT7X.js";
+} from "../chunk-4FLICVVA.js";
+import "../chunk-5U2MQO5P.js";
+import "../chunk-W7LLXRGY.js";
+import "../chunk-QLPTHTVB.js";
+import "../chunk-CTZHONLA.js";
+import "../chunk-QWGCMQQD.js";
 export {
   GovernanceBlockedError,
   GovernedToolExecutor,