@nexus-ai-nexoralabs/cli 0.1.0

package/dist/tools/index.js

@@ -0,0 +1,353 @@
+import { ToolRegistry } from './toolRegistry.js';
+import { PermissionEngine } from './permissionEngine.js';
+import { ToolExecutor } from './toolExecutor.js';
+import { Logger } from '../common/logger.js';
+export * from './types.js';
+export * from './approvalTypes.js';
+export * from './adapters/terminalTypes.js';
+export { ToolRegistry } from './toolRegistry.js';
+export { PermissionEngine } from './permissionEngine.js';
+export { ToolExecutor } from './toolExecutor.js';
+export { ApprovalPolicyEngine } from './approvalPolicyEngine.js';
+export { ApprovalGate } from './approvalGate.js';
+export { FilesystemAdapter, ReadonlyFilesystemAdapter, calculateContentHash, isSecretFile, generateUnifiedDiff } from './adapters/filesystemAdapter.js';
+export { TerminalAdapter, buildSanitizedEnv, validateWorkspaceCwd } from './adapters/terminalAdapter.js';
+export { TerminalCommandPolicy } from './adapters/terminalCommandPolicy.js';
+export const READONLY_FILESYSTEM_TOOL_DEFINITION = {
+    id: 'filesystem_read',
+    name: 'Workspace File Reader',
+    description: 'Safely reads content of files located strictly inside the configured workspace sandbox. READ-ONLY file content inspection. Cannot modify files or create directories.',
+    version: '1.0.0',
+    category: 'filesystem',
+    riskLevel: 'low',
+    requiredPermissions: ['filesystem.read'],
+    inputSchema: {
+        relativePath: {
+            type: 'string',
+            description: 'Workspace-relative path of file to read',
+        },
+    },
+    enabled: true,
+};
+export const WORKSPACE_TREE_TOOL_DEFINITION = {
+    id: 'workspace_tree',
+    name: 'Workspace Directory Tree Explorer',
+    description: 'Returns a safe, bounded metadata representation of the workspace/project directory tree. READ-ONLY directory/workspace inspection. Strictly read-only: cannot create directories, cannot modify files, cannot create files.',
+    version: '1.0.0',
+    category: 'filesystem',
+    riskLevel: 'low',
+    requiredPermissions: ['filesystem.read'],
+    inputSchema: {
+        path: {
+            type: 'string',
+            description: 'Workspace-relative directory path to explore (default ".")',
+        },
+        maxDepth: {
+            type: 'number',
+            description: 'Maximum directory traversal depth (default 5)',
+        },
+        maxEntries: {
+            type: 'number',
+            description: 'Maximum total entries to return (default 500)',
+        },
+    },
+    enabled: true,
+};
+export const CODE_SEARCH_TOOL_DEFINITION = {
+    id: 'code_search',
+    name: 'Workspace Code Base Search',
+    description: 'Searches source files within the workspace using deterministic text matching. READ-ONLY source/code search. Cannot modify files or create directories.',
+    version: '1.0.0',
+    category: 'filesystem',
+    riskLevel: 'low',
+    requiredPermissions: ['filesystem.read'],
+    inputSchema: {
+        query: {
+            type: 'string',
+            description: 'Text query to search for in source files',
+        },
+        path: {
+            type: 'string',
+            description: 'Workspace-relative path to search within (default ".")',
+        },
+        maxResults: {
+            type: 'number',
+            description: 'Maximum matching results to return (default 50)',
+        },
+        fileExtensions: {
+            type: 'array',
+            description: 'Optional list of file extensions to filter by (e.g. [".ts", ".js"])',
+        },
+    },
+    enabled: true,
+};
+export const FILESYSTEM_WRITE_TOOL_DEFINITION = {
+    id: 'filesystem_write',
+    name: 'Workspace File Writer',
+    description: 'Creates or replaces a file strictly inside the configured workspace sandbox. CREATE/REPLACE file operation. Medium risk, approval required according to P5-F policy.',
+    version: '1.0.0',
+    category: 'filesystem',
+    riskLevel: 'medium',
+    requiredPermissions: ['filesystem.write'],
+    inputSchema: {
+        path: {
+            type: 'string',
+            description: 'Workspace-relative target file path',
+        },
+        content: {
+            type: 'string',
+            description: 'Content to write into the file',
+        },
+    },
+    enabled: true,
+};
+export const FILESYSTEM_EDIT_TOOL_DEFINITION = {
+    id: 'filesystem_edit',
+    name: 'Workspace File Editor',
+    description: 'Applies a deterministic, hash-verified edit to an existing file in the workspace. MODIFY existing file operation. Medium risk, approval required according to P5-F policy.',
+    version: '1.0.0',
+    category: 'filesystem',
+    riskLevel: 'medium',
+    requiredPermissions: ['filesystem.write'],
+    inputSchema: {
+        path: {
+            type: 'string',
+            description: 'Workspace-relative target file path',
+        },
+        expectedContentHash: {
+            type: 'string',
+            description: 'SHA-256 hash of expected current file content',
+        },
+        oldText: {
+            type: 'string',
+            description: 'Exact text to replace',
+        },
+        newText: {
+            type: 'string',
+            description: 'Replacement text',
+        },
+        replaceMode: {
+            type: 'string',
+            description: 'Replacement mode: "single" (default)',
+        },
+    },
+    enabled: true,
+};
+export const TERMINAL_EXECUTE_TOOL_DEFINITION = {
+    id: 'terminal_execute',
+    name: 'Bounded Terminal Execution Adapter',
+    description: 'Executes an explicitly allowed development command inside the configured workspace. High risk, bounded, approval-controlled. Never bypasses PermissionEngine or ApprovalGate.',
+    version: '1.0.0',
+    category: 'terminal',
+    riskLevel: 'high',
+    requiredPermissions: ['terminal.execute'],
+    inputSchema: {
+        command: {
+            type: 'string',
+            description: 'The executable to run (e.g. "npm", "git", "node")',
+        },
+        args: {
+            type: 'array',
+            description: 'Array of command arguments',
+        },
+        cwd: {
+            type: 'string',
+            description: 'Optional workspace-relative working directory',
+        },
+        timeoutMs: {
+            type: 'number',
+            description: 'Execution timeout in milliseconds (default 30000)',
+        },
+    },
+    enabled: true,
+};
+export class ToolGateway {
+    initialized = false;
+    workspaceRoot = './workspace';
+    registry;
+    permissionEngine;
+    executor = null;
+    taskService = null;
+    logger;
+    logLevel;
+    constructor(policy, logLevel = 'info') {
+        this.logLevel = logLevel;
+        this.logger = new Logger('ToolGateway', logLevel);
+        this.registry = new ToolRegistry(logLevel);
+        this.permissionEngine = new PermissionEngine(this.registry, policy, logLevel);
+    }
+    async initialize(taskService, workspaceRoot = './workspace') {
+        this.workspaceRoot = workspaceRoot;
+        if (taskService) {
+            this.taskService = taskService;
+        }
+        // Automatically register tools if not registered
+        if (!this.registry.isRegistered(READONLY_FILESYSTEM_TOOL_DEFINITION.id)) {
+            this.registry.registerTool(READONLY_FILESYSTEM_TOOL_DEFINITION);
+        }
+        if (!this.registry.isRegistered(WORKSPACE_TREE_TOOL_DEFINITION.id)) {
+            this.registry.registerTool(WORKSPACE_TREE_TOOL_DEFINITION);
+        }
+        if (!this.registry.isRegistered(CODE_SEARCH_TOOL_DEFINITION.id)) {
+            this.registry.registerTool(CODE_SEARCH_TOOL_DEFINITION);
+        }
+        if (!this.registry.isRegistered(FILESYSTEM_WRITE_TOOL_DEFINITION.id)) {
+            this.registry.registerTool(FILESYSTEM_WRITE_TOOL_DEFINITION);
+        }
+        if (!this.registry.isRegistered(FILESYSTEM_EDIT_TOOL_DEFINITION.id)) {
+            this.registry.registerTool(FILESYSTEM_EDIT_TOOL_DEFINITION);
+        }
+        if (!this.registry.isRegistered(TERMINAL_EXECUTE_TOOL_DEFINITION.id)) {
+            this.registry.registerTool(TERMINAL_EXECUTE_TOOL_DEFINITION);
+        }
+        // Initialize tool executor with workspace sandbox root
+        this.executor = new ToolExecutor(workspaceRoot, 2 * 1024 * 1024, this.logLevel);
+        this.initialized = true;
+        this.logger.info(`ToolGateway & security policy engine fully initialized with workspace root: '${workspaceRoot}'`);
+        return this.getStatus();
+    }
+    /**
+     * Register a tool definition with the central registry.
+     */
+    registerTool(definition) {
+        this.registry.registerTool(definition);
+    }
+    /**
+     * Retrieve a registered tool by ID.
+     */
+    getTool(id) {
+        return this.registry.getTool(id);
+    }
+    /**
+     * Get workspace root directory path.
+     */
+    getWorkspaceRoot() {
+        return this.executor?.getWorkspaceRoot() || this.workspaceRoot;
+    }
+    /**
+     * List all registered tools.
+     */
+    listTools() {
+        return this.registry.listTools();
+    }
+    /**
+     * Authorize a tool invocation request against security policy and registry.
+     * NOTE: Returns authorization status ONLY. Does NOT execute code.
+     */
+    authorizeInvocation(request) {
+        const taskExistsFn = this.taskService
+            ? (taskId) => {
+                try {
+                    return !!this.taskService?.getTask(taskId);
+                }
+                catch {
+                    return false;
+                }
+            }
+            : undefined;
+        const authResult = this.permissionEngine.authorize(request, taskExistsFn);
+        return {
+            requestId: authResult.requestId,
+            taskId: authResult.taskId,
+            toolId: authResult.toolId,
+            authorized: authResult.allowed,
+            decision: authResult.decision,
+            reason: authResult.reason,
+            timestamp: authResult.timestamp,
+            executed: false,
+        };
+    }
+    /**
+     * Execute an authorized tool request through the secure execution pipeline:
+     * Agent Task -> Tool Invocation Request -> Tool Registry -> Permission Engine -> Authorization -> Workspace Validation -> Adapter -> Result.
+     *
+     * SECURITY GUARANTEE: If authorization is DENIED, execution is NEVER attempted.
+     */
+    executeTool(request) {
+        const timestamp = new Date().toISOString();
+        // STEP 1: Mandatory P5-B Authorization Check
+        const authResult = this.authorizeInvocation({
+            requestId: request.requestId,
+            taskId: request.taskId,
+            toolId: request.toolId,
+            requestedCapabilities: request.requestedCapabilities,
+            inputMetadata: request.params,
+        });
+        // STEP 2: Strict Authorization Gate — NO AUTHORIZATION => NO EXECUTION!
+        if (!authResult.authorized) {
+            this.logger.warn(`Tool execution blocked: authorization denied`, {
+                requestId: request.requestId,
+                taskId: request.taskId,
+                toolId: request.toolId,
+                reason: authResult.reason,
+            });
+            return {
+                requestId: request.requestId,
+                taskId: request.taskId,
+                toolId: request.toolId,
+                authorized: false,
+                executed: false, // NO EXECUTION OCCURRED!
+                success: false,
+                decision: authResult.decision,
+                errorCategory: 'PERMISSION_DENIED',
+                errorMessage: authResult.reason,
+                timestamp,
+            };
+        }
+        // STEP 3: Execute tool via Executor
+        if (!this.executor) {
+            return {
+                requestId: request.requestId,
+                taskId: request.taskId,
+                toolId: request.toolId,
+                authorized: true,
+                executed: false,
+                success: false,
+                decision: 'ALLOWED',
+                errorCategory: 'EXECUTOR_UNINITIALIZED',
+                errorMessage: 'ToolGateway executor is uninitialized. Call initialize() first.',
+                timestamp,
+            };
+        }
+        const execResult = this.executor.execute(request);
+        if (execResult instanceof Promise) {
+            return execResult.then((res) => ({
+                requestId: res.requestId,
+                taskId: res.taskId,
+                toolId: res.toolId,
+                authorized: true,
+                executed: res.executed,
+                success: res.success,
+                decision: 'ALLOWED',
+                errorCategory: res.errorCategory,
+                errorMessage: res.errorMessage,
+                output: res.output,
+                timestamp: res.timestamp,
+            }));
+        }
+        return {
+            requestId: execResult.requestId,
+            taskId: execResult.taskId,
+            toolId: execResult.toolId,
+            authorized: true,
+            executed: execResult.executed,
+            success: execResult.success,
+            decision: 'ALLOWED',
+            errorCategory: execResult.errorCategory,
+            errorMessage: execResult.errorMessage,
+            output: execResult.output,
+            timestamp: execResult.timestamp,
+        };
+    }
+    getStatus() {
+        return {
+            name: 'ToolGateway',
+            initialized: this.initialized,
+            status: this.initialized ? 'ok' : 'degraded',
+            message: this.initialized
+                ? `Tool gateway & security policy engine ready (${this.registry.listTools().length} tools registered)`
+                : 'Uninitialized',
+        };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAY,MAAM,qBAAqB,CAAC;AAEvD,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACxJ,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAS5E,MAAM,CAAC,MAAM,mCAAmC,GAAmB;IACjE,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,uKAAuK;IACpL,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,KAAK;IAChB,mBAAmB,EAAE,CAAC,iBAAiB,CAAC;IACxC,WAAW,EAAE;QACX,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,yCAAyC;SACvD;KACF;IACD,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAmB;IAC5D,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,mCAAmC;IACzC,WAAW,EAAE,6NAA6N;IAC1O,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,KAAK;IAChB,mBAAmB,EAAE,CAAC,iBAAiB,CAAC;IACxC,WAAW,EAAE;QACX,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,4DAA4D;SAC1E;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,+CAA+C;SAC7D;QACD,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,+CAA+C;SAC7D;KACF;IACD,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAmB;IACzD,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,4BAA4B;IAClC,WAAW,EAAE,wJAAwJ;IACrK,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,KAAK;IAChB,mBAAmB,EAAE,CAAC,iBAAiB,CAAC;IACxC,WAAW,EAAE;QACX,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,0CAA0C;SACxD;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,wDAAwD;SACtE;QACD,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,iDAAiD;SAC/D;QACD,cAAc,EAAE;YACd,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,qEAAqE;SACnF;KACF;IACD,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAmB;IAC9D,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,sKAAsK;IACnL,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,QAAQ;IACnB,mBAAmB,EAAE,CAAC,kBAAkB,CAAC;IACzC,WAAW,EAAE;QACX,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,qCAAqC;SACnD;QACD,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,gCAAgC;SAC9C;KACF;IACD,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAmB;IAC7D,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,4KAA4K;IACzL,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,QAAQ;IACnB,mBAAmB,EAAE,CAAC,kBAAkB,CAAC;IACzC,WAAW,EAAE;QACX,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,qCAAqC;SACnD;QACD,mBAAmB,EAAE;YACnB,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,+CAA+C;SAC7D;QACD,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,uBAAuB;SACrC;QACD,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,kBAAkB;SAChC;QACD,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,sCAAsC;SACpD;KACF;IACD,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAmB;IAC9D,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,oCAAoC;IAC1C,WAAW,EAAE,+KAA+K;IAC5L,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,MAAM;IACjB,mBAAmB,EAAE,CAAC,kBAAkB,CAAC;IACzC,WAAW,EAAE;QACX,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,mDAAmD;SACjE;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,4BAA4B;SAC1C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,+CAA+C;SAC7D;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,mDAAmD;SACjE;KACF;IACD,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,MAAM,OAAO,WAAW;IACd,WAAW,GAAG,KAAK,CAAC;IACpB,aAAa,GAAG,aAAa,CAAC;IAC/B,QAAQ,CAAe;IACvB,gBAAgB,CAAmB;IACnC,QAAQ,GAAwB,IAAI,CAAC;IACpC,WAAW,GAA4B,IAAI,CAAC;IAC5C,MAAM,CAAS;IACf,QAAQ,CAAW;IAE3B,YACE,MAAyB,EACzB,WAAqB,MAAM;QAE3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,WAA8B,EAAE,gBAAwB,aAAa;QACpF,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QACjC,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,mCAAmC,CAAC,EAAE,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,mCAAmC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,8BAA8B,CAAC,EAAE,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,2BAA2B,CAAC,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,gCAAgC,CAAC,EAAE,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,gCAAgC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,+BAA+B,CAAC,EAAE,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,+BAA+B,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,gCAAgC,CAAC,EAAE,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,gCAAgC,CAAC,CAAC;QAC/D,CAAC;QAED,uDAAuD;QACvD,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEhF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gFAAgF,aAAa,GAAG,CAAC,CAAC;QACnH,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,UAA0B;QACrC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,OAA8B;QAChD,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW;YACnC,CAAC,CAAC,CAAC,MAAc,EAAE,EAAE;gBACjB,IAAI,CAAC;oBACH,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,UAAU,GAAwB,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAE/F,OAAO;YACL,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,UAAU,EAAE,UAAU,CAAC,OAAO;YAC9B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,QAAQ,EAAE,KAAK;SAChB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,OAA6B;QACvC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,6CAA6C;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC;YAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;YACpD,aAAa,EAAE,OAAO,CAAC,MAAM;SAC9B,CAAC,CAAC;QAEH,wEAAwE;QACxE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC/D,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,KAAK,EAAE,yBAAyB;gBAC1C,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,aAAa,EAAE,mBAAmB;gBAClC,YAAY,EAAE,UAAU,CAAC,MAAM;gBAC/B,SAAS;aACV,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,SAAS;gBACnB,aAAa,EAAE,wBAAwB;gBACvC,YAAY,EAAE,iEAAiE;gBAC/E,SAAS;aACV,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAElD,IAAI,UAAU,YAAY,OAAO,EAAE,CAAC;YAClC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ,EAAE,SAAS;gBACnB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC,CAAC,CAAC;QACN,CAAC;QAED,OAAO;YACL,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,QAAQ,EAAE,SAAS;YACnB,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC;IACJ,CAAC;IAED,SAAS;QACP,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;YAC5C,OAAO,EAAE,IAAI,CAAC,WAAW;gBACvB,CAAC,CAAC,gDAAgD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,oBAAoB;gBACtG,CAAC,CAAC,eAAe;SACpB,CAAC;IACJ,CAAC;CACF"}

package/dist/tools/permissionEngine.d.ts

@@ -0,0 +1,27 @@
+import type { ToolRegistry } from './toolRegistry.js';
+import type { ToolInvocationRequest, AuthorizationResult, PermissionPolicy } from './types.js';
+import { LogLevel } from '../common/logger.js';
+export declare class PermissionEngine {
+    private registry;
+    private logger;
+    private policy;
+    constructor(registry: ToolRegistry, policy?: PermissionPolicy, logLevel?: LogLevel);
+    /**
+     * Get current active permission policy.
+     */
+    getPolicy(): PermissionPolicy;
+    /**
+     * Update active permission policy.
+     */
+    setPolicy(policy: PermissionPolicy): void;
+    /**
+     * Authorize a tool invocation request against the registry and security policy.
+     *
+     * @param request The tool invocation request.
+     * @param taskExistsFn Optional callback to verify if the referenced task ID exists.
+     * @returns Deterministic AuthorizationResult.
+     */
+    authorize(request: ToolInvocationRequest, taskExistsFn?: (taskId: string) => boolean): AuthorizationResult;
+    private deny;
+}
+//# sourceMappingURL=permissionEngine.d.ts.map

package/dist/tools/permissionEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionEngine.d.ts","sourceRoot":"","sources":["../../src/tools/permissionEngine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAEjB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAU,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEvD,qBAAa,gBAAgB;IAKzB,OAAO,CAAC,QAAQ;IAJlB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAmB;gBAGvB,QAAQ,EAAE,YAAY,EAC9B,MAAM,GAAE,gBAA4C,EACpD,QAAQ,GAAE,QAAiB;IAM7B;;OAEG;IACH,SAAS,IAAI,gBAAgB;IAI7B;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAKzC;;;;;;OAMG;IACH,SAAS,CACP,OAAO,EAAE,qBAAqB,EAC9B,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GACzC,mBAAmB;IA+JtB,OAAO,CAAC,IAAI;CA+Bb"}

package/dist/tools/permissionEngine.js

@@ -0,0 +1,130 @@
+import { DEFAULT_PERMISSION_POLICY, VALID_CAPABILITIES, RISK_LEVEL_ORDER, } from './types.js';
+import { Logger } from '../common/logger.js';
+export class PermissionEngine {
+    registry;
+    logger;
+    policy;
+    constructor(registry, policy = DEFAULT_PERMISSION_POLICY, logLevel = 'info') {
+        this.registry = registry;
+        this.logger = new Logger('PermissionEngine', logLevel);
+        this.policy = policy;
+    }
+    /**
+     * Get current active permission policy.
+     */
+    getPolicy() {
+        return { ...this.policy, allowedCapabilities: [...this.policy.allowedCapabilities] };
+    }
+    /**
+     * Update active permission policy.
+     */
+    setPolicy(policy) {
+        this.policy = { ...policy, allowedCapabilities: [...policy.allowedCapabilities] };
+        this.logger.info(`Updated permission policy`, { policyId: policy.id, maxRisk: policy.maxRiskLevel });
+    }
+    /**
+     * Authorize a tool invocation request against the registry and security policy.
+     *
+     * @param request The tool invocation request.
+     * @param taskExistsFn Optional callback to verify if the referenced task ID exists.
+     * @returns Deterministic AuthorizationResult.
+     */
+    authorize(request, taskExistsFn) {
+        const timestamp = new Date().toISOString();
+        // 1. Structure validation
+        if (!request ||
+            !request.requestId ||
+            !request.taskId ||
+            !request.toolId ||
+            !Array.isArray(request.requestedCapabilities)) {
+            return this.deny(request?.requestId || 'unknown', request?.taskId || 'unknown', request?.toolId || 'unknown', request?.requestedCapabilities || [], 'INVALID_REQUEST: Invocation request is missing required fields (requestId, taskId, toolId, or requestedCapabilities).', timestamp);
+        }
+        // 2. Task identity verification
+        if (taskExistsFn && !taskExistsFn(request.taskId)) {
+            return this.deny(request.requestId, request.taskId, request.toolId, request.requestedCapabilities, `UNKNOWN_TASK: Agent task '${request.taskId}' does not exist or is invalid.`, timestamp);
+        }
+        // 3. Unknown capability check
+        for (const cap of request.requestedCapabilities) {
+            if (!VALID_CAPABILITIES.has(cap)) {
+                return this.deny(request.requestId, request.taskId, request.toolId, request.requestedCapabilities, `UNKNOWN_CAPABILITY: Requested capability '${cap}' is not a recognized system capability.`, timestamp);
+            }
+        }
+        // 4. Tool registration check
+        const tool = this.registry.getTool(request.toolId);
+        if (!tool) {
+            return this.deny(request.requestId, request.taskId, request.toolId, request.requestedCapabilities, `UNKNOWN_TOOL: Tool '${request.toolId}' is not registered in the ToolRegistry.`, timestamp);
+        }
+        // 5. Tool enabled state check
+        if (!tool.enabled && !this.policy.allowDisabledTools) {
+            return this.deny(request.requestId, request.taskId, request.toolId, request.requestedCapabilities, `DISABLED_TOOL: Tool '${request.toolId}' is currently disabled.`, timestamp, tool.riskLevel);
+        }
+        // 6. Risk level check against policy
+        const toolRisk = RISK_LEVEL_ORDER[tool.riskLevel] ?? 4;
+        const policyMaxRisk = RISK_LEVEL_ORDER[this.policy.maxRiskLevel] ?? 3;
+        if (toolRisk > policyMaxRisk) {
+            return this.deny(request.requestId, request.taskId, request.toolId, request.requestedCapabilities, `EXCEEDS_POLICY_RISK: Tool risk level '${tool.riskLevel}' exceeds policy limit '${this.policy.maxRiskLevel}'.`, timestamp, tool.riskLevel);
+        }
+        // 7. Permission policy allowed capabilities check
+        const policyAllowedSet = new Set(this.policy.allowedCapabilities);
+        for (const cap of request.requestedCapabilities) {
+            if (!policyAllowedSet.has(cap)) {
+                return this.deny(request.requestId, request.taskId, request.toolId, request.requestedCapabilities, `MISSING_PERMISSION: Capability '${cap}' is not allowed under policy '${this.policy.id}'.`, timestamp, tool.riskLevel);
+            }
+        }
+        // 8. Tool declared capabilities check (requested capability must be declared by tool AND request must satisfy tool required permissions)
+        const toolDeclaredSet = new Set(tool.requiredPermissions);
+        for (const cap of request.requestedCapabilities) {
+            if (!toolDeclaredSet.has(cap)) {
+                return this.deny(request.requestId, request.taskId, request.toolId, request.requestedCapabilities, `MISSING_PERMISSION: Capability '${cap}' is not declared in tool '${tool.id}' required permissions.`, timestamp, tool.riskLevel);
+            }
+        }
+        const requestedSet = new Set(request.requestedCapabilities);
+        for (const reqCap of tool.requiredPermissions) {
+            if (!requestedSet.has(reqCap)) {
+                return this.deny(request.requestId, request.taskId, request.toolId, request.requestedCapabilities, `MISSING_PERMISSION: Request is missing required capability '${reqCap}' for tool '${tool.id}'.`, timestamp, tool.riskLevel);
+            }
+        }
+        // All checks passed — ALLOW
+        const result = {
+            requestId: request.requestId,
+            taskId: request.taskId,
+            toolId: request.toolId,
+            allowed: true,
+            decision: 'ALLOWED',
+            reason: `Invocation authorized for task '${request.taskId}' and tool '${request.toolId}'.`,
+            requestedCapabilities: [...request.requestedCapabilities],
+            riskLevel: tool.riskLevel,
+            timestamp,
+        };
+        this.logger.info(`Security decision: ALLOWED`, {
+            requestId: result.requestId,
+            taskId: result.taskId,
+            toolId: result.toolId,
+            decision: result.decision,
+            capabilities: result.requestedCapabilities,
+        });
+        return result;
+    }
+    deny(requestId, taskId, toolId, requestedCapabilities, reason, timestamp, riskLevel) {
+        const result = {
+            requestId,
+            taskId,
+            toolId,
+            allowed: false,
+            decision: 'DENIED',
+            reason,
+            requestedCapabilities: [...requestedCapabilities],
+            riskLevel,
+            timestamp,
+        };
+        this.logger.warn(`Security decision: DENIED`, {
+            requestId: result.requestId,
+            taskId: result.taskId,
+            toolId: result.toolId,
+            decision: result.decision,
+            reason: result.reason,
+        });
+        return result;
+    }
+}
+//# sourceMappingURL=permissionEngine.js.map

package/dist/tools/permissionEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionEngine.js","sourceRoot":"","sources":["../../src/tools/permissionEngine.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,MAAM,EAAY,MAAM,qBAAqB,CAAC;AAEvD,MAAM,OAAO,gBAAgB;IAKjB;IAJF,MAAM,CAAS;IACf,MAAM,CAAmB;IAEjC,YACU,QAAsB,EAC9B,SAA2B,yBAAyB,EACpD,WAAqB,MAAM;QAFnB,aAAQ,GAAR,QAAQ,CAAc;QAI9B,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;IACvF,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAwB;QAChC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,mBAAmB,EAAE,CAAC,GAAG,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACvG,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CACP,OAA8B,EAC9B,YAA0C;QAE1C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,0BAA0B;QAC1B,IACE,CAAC,OAAO;YACR,CAAC,OAAO,CAAC,SAAS;YAClB,CAAC,OAAO,CAAC,MAAM;YACf,CAAC,OAAO,CAAC,MAAM;YACf,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAC7C,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,EAAE,SAAS,IAAI,SAAS,EAC/B,OAAO,EAAE,MAAM,IAAI,SAAS,EAC5B,OAAO,EAAE,MAAM,IAAI,SAAS,EAC5B,OAAO,EAAE,qBAAqB,IAAI,EAAE,EACpC,uHAAuH,EACvH,SAAS,CACV,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,qBAAqB,EAC7B,6BAA6B,OAAO,CAAC,MAAM,iCAAiC,EAC5E,SAAS,CACV,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;YAChD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,qBAAqB,EAC7B,6CAA6C,GAAG,0CAA0C,EAC1F,SAAS,CACV,CAAC;YACJ,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,qBAAqB,EAC7B,uBAAuB,OAAO,CAAC,MAAM,0CAA0C,EAC/E,SAAS,CACV,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,qBAAqB,EAC7B,wBAAwB,OAAO,CAAC,MAAM,0BAA0B,EAChE,SAAS,EACT,IAAI,CAAC,SAAS,CACf,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,QAAQ,GAAG,aAAa,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,qBAAqB,EAC7B,yCAAyC,IAAI,CAAC,SAAS,2BAA2B,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAC9G,SAAS,EACT,IAAI,CAAC,SAAS,CACf,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAClE,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;YAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,qBAAqB,EAC7B,mCAAmC,GAAG,kCAAkC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAC1F,SAAS,EACT,IAAI,CAAC,SAAS,CACf,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yIAAyI;QACzI,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC1D,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;YAChD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,qBAAqB,EAC7B,mCAAmC,GAAG,8BAA8B,IAAI,CAAC,EAAE,yBAAyB,EACpG,SAAS,EACT,IAAI,CAAC,SAAS,CACf,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC5D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,qBAAqB,EAC7B,+DAA+D,MAAM,eAAe,IAAI,CAAC,EAAE,IAAI,EAC/F,SAAS,EACT,IAAI,CAAC,SAAS,CACf,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,MAAM,GAAwB;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,mCAAmC,OAAO,CAAC,MAAM,eAAe,OAAO,CAAC,MAAM,IAAI;YAC1F,qBAAqB,EAAE,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC;YACzD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS;SACV,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;YAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,qBAAqB;SAC3C,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,IAAI,CACV,SAAiB,EACjB,MAAc,EACd,MAAc,EACd,qBAAuC,EACvC,MAAc,EACd,SAAiB,EACjB,SAA4C;QAE5C,MAAM,MAAM,GAAwB;YAClC,SAAS;YACT,MAAM;YACN,MAAM;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,QAAQ;YAClB,MAAM;YACN,qBAAqB,EAAE,CAAC,GAAG,qBAAqB,CAAC;YACjD,SAAS;YACT,SAAS;SACV,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YAC5C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/tools/toolExecutor.d.ts

@@ -0,0 +1,37 @@
+import type { ToolExecutionRequest, ToolExecutionResult } from './types.js';
+import { FilesystemAdapter } from './adapters/filesystemAdapter.js';
+import { TerminalAdapter } from './adapters/terminalAdapter.js';
+import { TerminalCommandPolicy } from './adapters/terminalCommandPolicy.js';
+import { LogLevel } from '../common/logger.js';
+export declare class ToolExecutor {
+    private fsAdapter;
+    private terminalAdapter;
+    private terminalPolicy;
+    private logger;
+    private workspaceRoot;
+    constructor(workspaceRoot: string, maxFileSize?: number, logLevel?: LogLevel);
+    /**
+     * Get the workspace root directory path.
+     */
+    getWorkspaceRoot(): string;
+    /**
+     * Get the underlying filesystem adapter (useful for testing or direct sandbox checks).
+     */
+    getFilesystemAdapter(): FilesystemAdapter;
+    /**
+     * Execute an authorized tool request.
+     *
+     * @param request Authorized ToolExecutionRequest.
+     * @returns Normalized ToolExecutionResult contract.
+     */
+    execute(request: ToolExecutionRequest): Omit<ToolExecutionResult, 'authorized' | 'decision'> | Promise<Omit<ToolExecutionResult, 'authorized' | 'decision'>>;
+    /**
+     * Get the underlying terminal adapter.
+     */
+    getTerminalAdapter(): TerminalAdapter;
+    /**
+     * Get the underlying terminal command policy.
+     */
+    getTerminalPolicy(): TerminalCommandPolicy;
+}
+//# sourceMappingURL=toolExecutor.d.ts.map

package/dist/tools/toolExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolExecutor.d.ts","sourceRoot":"","sources":["../../src/tools/toolExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,OAAO,EAAU,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEvD,qBAAa,YAAY;IACvB,OAAO,CAAC,SAAS,CAAoB;IACrC,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAAS;gBAG5B,aAAa,EAAE,MAAM,EACrB,WAAW,GAAE,MAAwB,EACrC,QAAQ,GAAE,QAAiB;IAS7B;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;OAEG;IACH,oBAAoB,IAAI,iBAAiB;IAIzC;;;;;OAKG;IACH,OAAO,CACL,OAAO,EAAE,oBAAoB,GAC5B,IAAI,CAAC,mBAAmB,EAAE,YAAY,GAAG,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,YAAY,GAAG,UAAU,CAAC,CAAC;IAubvH;;OAEG;IACH,kBAAkB,IAAI,eAAe;IAIrC;;OAEG;IACH,iBAAiB,IAAI,qBAAqB;CAG3C"}