@open-everywhere/core 0.1.0

package/dist/agent/access/audience-floor.d.ts

@@ -0,0 +1,69 @@
+import { type Domain } from "../memory/domain.js";
+/** The privilege floor of a room's audience — the LOWEST standing present. A disclosure never rises
+ *  above the floor; a governance venue arms only at `admin`. */
+export type AudienceFloor = "guest" | "member" | "admin";
+/** The live membership facts a floor is computed from — the platform's answer to "who is in this
+ *  room, and is it private?". Every field fails closed (see {@link computeAudienceFloor}). */
+export interface RoomRoster {
+    /** Human member principal ids (bot ids excluded — see the supplier). */
+    readonly humanMemberIds: readonly string[];
+    /** Did the membership API positively resolve? `false` ⇒ we know nothing ⇒ floor = guest. */
+    readonly resolved: boolean;
+    /** Platform reports the channel private/members-only. A public channel can never floor to admin. */
+    readonly isPrivate: boolean;
+    /** Any external/guest member present (the platform's guest bit / trust gate). */
+    readonly hasGuest: boolean;
+}
+/** Fail closed: an unresolved roster or a guest present gives guest. Only a private room with at least one human, all of them admins, gives admin; a public room never does. */
+export declare function computeAudienceFloor(roster: RoomRoster, admins: ReadonlySet<string>): AudienceFloor;
+/** Why a governance channel failed to arm — drives both the visible demote line and the audit row. */
+export type FloorBreachReason = "members-unresolved" | "public-channel" | "guest-present" | "non-admin-member";
+/** The attestation of a governance channel: armed iff floor === "admin"; a breach otherwise. */
+export interface FloorAttestation {
+    readonly armed: boolean;
+    readonly floor: AudienceFloor;
+    /** Present iff NOT armed — the reason + the specifics the demote line and audit row need. */
+    readonly breach?: {
+        readonly reason: FloorBreachReason;
+        /** Human members NOT on the admin roster (the "@U_NEW isn't on the roster" copy). */
+        readonly missing: readonly string[];
+        /** The full human member list at attestation time (for the audit detail). */
+        readonly members: readonly string[];
+    };
+}
+/** Armed only when the floor is exactly admin. The breach names the FIRST failing condition, in the order unresolved, public, guest, non-admin member. */
+export declare function attestGovernanceFloor(roster: RoomRoster, admins: ReadonlySet<string>): FloorAttestation;
+/** Returns BARE ids in this channel's own platform namespace, because a roster carries the ids the platform handed over. Other platforms and, on a tenant-scoped platform, other workspaces drop out; an unreadable platform or tenant yields an empty set, which floors to non-admin member. */
+export declare function governanceAdminSet(channelKey: string, domains: readonly Domain[]): ReadonlySet<string>;
+/** Fetch the live roster for a channel key (`platform/workspace/surface`). `undefined` ⇒ the
+ *  platform can't answer (no supplier for this platform, or the call failed) ⇒ fail closed. */
+export type GovernanceMemberSupplier = (channelKey: string) => Promise<RoomRoster | undefined>;
+/** Register the deploy's governance member supplier (app boot; a later call REPLACES the previous). */
+export declare function registerGovernanceMemberSupplier(fn: GovernanceMemberSupplier): void;
+/** Test seam: drop the registered supplier so one test can't inherit another's. */
+export declare function _resetGovernanceMemberSupplierForTest(): void;
+/** Test seam: clear BOTH memos (roster + governance attestation) so a supplier change is seen
+ *  immediately. {@link _resetGovernanceFloorCacheForTest} is the pre-promotion alias. */
+export declare function _resetAudienceFloorCacheForTest(): void;
+export declare function _resetGovernanceFloorCacheForTest(): void;
+/** A resolved floor plus the live roster it was computed from (consumers that need the raw facts —
+ *  e.g. "was a guest POSITIVELY observed, or did the platform simply not answer?" — read the roster). */
+export interface AudienceFloorResolution {
+    readonly floor: AudienceFloor;
+    readonly roster: RoomRoster;
+}
+/** Memoized and shared by every floor consumer, so two consumers on one turn cost one platform call. The memo key is the channel ONLY: the admin set is config and must not be baked in, or a config change would be invisible for a window. */
+export declare function resolveRoomRoster(channelKey: string): Promise<RoomRoster>;
+export declare function resolveAudienceFloor(channelKey: string, admins: ReadonlySet<string>): Promise<AudienceFloorResolution>;
+export interface FloorAttestContext {
+    readonly org: string;
+    readonly platform: string;
+    readonly workspace: string;
+    /** The channel surface key segment (partition.surface). */
+    readonly surface: string;
+    readonly principalId?: string;
+}
+/** On a breach it emits one governance.floor_breach audit row, best-effort and never throwing. The attestation memo sits in front of the roster memo, which is what keeps the breach row to one per window. */
+export declare function attestGovernanceChannel(channelKey: string, domains: readonly Domain[], ctx: FloorAttestContext): Promise<FloorAttestation>;
+export declare function floorBreachNotice(breach: NonNullable<FloorAttestation["breach"]>): string;
+//# sourceMappingURL=audience-floor.d.ts.map

package/dist/agent/access/audience-floor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience-floor.d.ts","sourceRoot":"","sources":["../../../agent/access/audience-floor.ts"],"names":[],"mappings":"AA0DA,OAAO,EAAoC,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAKpF;gEACgE;AAChE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzD;8FAC8F;AAC9F,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,gLAAgL;AAChL,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,aAAa,CAMnG;AAED,sGAAsG;AACtG,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAE/G,gGAAgG;AAChG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACnC,qFAAqF;QACrF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,6EAA6E;QAC7E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC;CACH;AAED,0JAA0J;AAC1J,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAavG;AAED,iSAAiS;AACjS,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAOtG;AAED;+FAC+F;AAC/F,MAAM,MAAM,wBAAwB,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;AAI/F,uGAAuG;AACvG,wBAAgB,gCAAgC,CAAC,EAAE,EAAE,wBAAwB,GAAG,IAAI,CAEnF;AAED,mFAAmF;AACnF,wBAAgB,qCAAqC,IAAI,IAAI,CAE5D;AAgCD;yFACyF;AACzF,wBAAgB,+BAA+B,IAAI,IAAI,CAGtD;AAED,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAED;yGACyG;AACzG,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,gPAAgP;AAChP,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAM/E;AAED,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAGlC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,+MAA+M;AAC/M,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAazF"}

package/dist/agent/access/audience-floor.js

@@ -0,0 +1,189 @@
+// THE AUDIENCE-FLOOR SEAM — the one place a room's privilege floor is computed
+// (OPE-110 built the primitive; OPE-54 leg 1 PROMOTED it to a first-class core seam,
+// a design note §4.2, §7, §9.2).
+//
+// ONE computation, FIVE consumers — and that is a pinned invariant, not a convention
+// (scripts/connector-disclosure-test.ts §1 scans the tree for a second definition and fails on it):
+//   1. access/pane-venue.ts — the ADMIN floor a governance channel must continuously attest
+//      before it renders pane output ({@link attestGovernanceChannel}, the §4.2 tripwire);
+//   2. access/connector-disclosure.ts — the DISCLOSURE floor a guest imposes on what the agent
+//      may volunteer into a room from an org-internal connector (OPE-54 leg 1);
+//   3. routines/fire-disclosure.ts — the same disclosure floor applied to an UNATTENDED
+//      TRIGGERED fire, where the authorization gate proves the domain may read the content but
+//      nothing yet asked whether the reporting room is a fit audience for it. ONE module, TWO
+//      trigger legs: the GitHub event fan-out (OPE-166, routines/github-fanout.ts) and the
+//      config-declared webhook hook (OPE-183, webhooks/dispatch.ts). It stays ONE consumer
+//      because it is ONE policy — cron/event/webhook fires are one concept with three
+//      mechanisms, so a second classifier here would be two registries for one concern.
+//   4. approvals/clicker-floor.ts — the CLICKER-side constraint on a member-tier approval card
+//      (OPE-185). Not a disclosure question but a standing one: the tier short-circuited the
+//      approver check entirely, so nothing asked whether the hand on the button was inside the org
+//      boundary. It reads the same floor for a different verdict, and adds one arm the others have
+//      no use for — a BENEFICIARY kind (the click MINTS a live signing secret and destroys the one
+//      in use; the reveal itself goes to the asker, OPE-327) demands
+//      a POSITIVELY resolved roster, not merely the absence of an observed guest.
+//   5. approvals/card-disclosure.ts — the DISCLOSURE floor on the approval card ITSELF (OPE-220).
+//      The other half of #4, and the half that bites one step earlier: #4 asks whose hand is on the
+//      button, this asks who was in the room when the button APPEARED. A card is a complete
+//      code-rendered statement of what will execute (spend figures, domain, target), so posting one
+//      into an externally-shared room is a disclosure no authorization check can catch — the
+//      decision there is perfectly authorised, which is exactly why it passes. Unlike #4 it is
+//      deliberately tier-blind and kind-blind: posting never reads ActionKind.policy, so a property
+//      that attaches to the post cannot be tier-dependent (and member-tier memory.purge renders a
+//      verbatim memory bullet, so an admin-only scoping would have missed the worst case).
+// Same primitive, opposite ends of the range: a guest floors a room DOWN out of org-internal
+// data; a uniformly-admin private room floors it UP into pane output.
+// Consumers 2, 3, 4 and 5 share one polarity rule, stated once and enforced in all four: an OBSERVED
+// guest refuses; an UNOBSERVABLE roster (the state of every non-Slack surface today) leaves the gate
+// INERT rather than refusing, because "we could not ask" must never become a silent product outage.
+//
+// THE PROMOTION (what OPE-54 leg 1 concretely added): before it, the only runtime entry point was
+// {@link attestGovernanceChannel} — governance-specific by construction (governance admin set,
+// governance-shaped return, governance-keyed memo), so a second consumer could only have re-rolled
+// the membership fetch. The general entries {@link resolveRoomRoster} / {@link resolveAudienceFloor}
+// are that seam: any surface, any admin set, ONE shared roster memo (so two consumers on the same
+// turn cost ONE platform call). The governance tripwire is now a thin consumer of it and is
+// behaviour-identical (same memo TTL, same one-breach-row-per-window audit).
+//
+// THE STANCE (zero-trust, §8.5): a governance channel's safety is NOT "we configured it once" — it
+// is "the agent re-derives the floor from LIVE membership before every sensitive render". So the
+// floor is computed from platform membership × the admin rosters × the private-channel bit, and it
+// FAILS CLOSED on every uncertainty: members unresolved, a guest present, or a public channel all
+// collapse to the lowest floor. A governance channel only ARMS while the floor is exactly "admin".
+//
+// PURE CORE (computeAudienceFloor / attestGovernanceFloor) takes its inputs explicitly so it is
+// trivially matrix-testable; the runtime glue (the member supplier seam + memoization + the
+// governance.floor_breach audit emit) wraps it below.
+import { appendAudit } from "../audit/audit.js";
+import { criteriaDomain, domainForChannel } from "../memory/domain.js";
+import { principalIdsOnPlatform } from "../identity/principal-key.js";
+import { parseScopeKey } from "./scope-key.js";
+import { getSettings } from "../settings/settings.js";
+/** Fail closed: an unresolved roster or a guest present gives guest. Only a private room with at least one human, all of them admins, gives admin; a public room never does. */
+export function computeAudienceFloor(roster, admins) {
+    if (!roster.resolved || roster.hasGuest)
+        return "guest";
+    const humans = roster.humanMemberIds;
+    const allAdmins = humans.length > 0 && humans.every((id) => admins.has(id));
+    if (allAdmins && roster.isPrivate)
+        return "admin";
+    return "member";
+}
+/** Armed only when the floor is exactly admin. The breach names the FIRST failing condition, in the order unresolved, public, guest, non-admin member. */
+export function attestGovernanceFloor(roster, admins) {
+    const floor = computeAudienceFloor(roster, admins);
+    if (floor === "admin")
+        return { armed: true, floor };
+    const members = roster.humanMemberIds;
+    const missing = members.filter((id) => !admins.has(id));
+    const reason = !roster.resolved
+        ? "members-unresolved"
+        : roster.hasGuest
+            ? "guest-present"
+            : !roster.isPrivate
+                ? "public-channel"
+                : "non-admin-member";
+    return { armed: false, floor, breach: { reason, missing, members } };
+}
+/** Returns BARE ids in this channel's own platform namespace, because a roster carries the ids the platform handed over. Other platforms and, on a tenant-scoped platform, other workspaces drop out; an unreadable platform or tenant yields an empty set, which floors to non-admin member. */
+export function governanceAdminSet(channelKey, domains) {
+    const parsed = parseScopeKey(channelKey);
+    const platform = parsed.kind === "tenant" || parsed.kind === "surface" || parsed.kind === "principal" ? parsed.platform : undefined;
+    const tenant = parsed.kind === "tenant" || parsed.kind === "surface" ? parsed.workspace : undefined;
+    const keys = new Set(criteriaDomain("org", domains)?.admins ?? []);
+    for (const a of domainForChannel(channelKey, domains)?.admins ?? [])
+        keys.add(a);
+    return new Set(principalIdsOnPlatform(keys, platform, tenant));
+}
+let supplier = null;
+/** Register the deploy's governance member supplier (app boot; a later call REPLACES the previous). */
+export function registerGovernanceMemberSupplier(fn) {
+    supplier = fn;
+}
+/** Test seam: drop the registered supplier so one test can't inherit another's. */
+export function _resetGovernanceMemberSupplierForTest() {
+    supplier = null;
+}
+/** The registered supplier, or a fail-closed stub (no supplier ⇒ nothing resolves ⇒ never arms). */
+function governanceMemberSupplier() {
+    return supplier ?? (async () => undefined);
+}
+/** Resolved per call, never at module load: ESM evaluates this module before registerSettings runs, so a load-time read would silently ignore the deployment's own value. Both call sites use it only as an expiry comparison, so a mid-flight change moves the expiry and never a verdict. */
+function floorTtlMs() {
+    return getSettings().governance.floorTtlMs;
+}
+const floorCache = new Map();
+const rosterCache = new Map();
+/** The roster used whenever the platform cannot answer — every field at its fail-closed value, so
+ *  {@link computeAudienceFloor} floors to `guest`. Frozen: one shared instance, never mutated. */
+const UNRESOLVED_ROSTER = Object.freeze({
+    humanMemberIds: Object.freeze([]),
+    resolved: false,
+    isPrivate: false,
+    hasGuest: false,
+});
+/** Test seam: clear BOTH memos (roster + governance attestation) so a supplier change is seen
+ *  immediately. {@link _resetGovernanceFloorCacheForTest} is the pre-promotion alias. */
+export function _resetAudienceFloorCacheForTest() {
+    floorCache.clear();
+    rosterCache.clear();
+}
+export function _resetGovernanceFloorCacheForTest() {
+    _resetAudienceFloorCacheForTest();
+}
+/** Memoized and shared by every floor consumer, so two consumers on one turn cost one platform call. The memo key is the channel ONLY: the admin set is config and must not be baked in, or a config change would be invisible for a window. */
+export async function resolveRoomRoster(channelKey) {
+    const cached = rosterCache.get(channelKey);
+    if (cached && Date.now() - cached.at < floorTtlMs())
+        return cached.roster;
+    const roster = (await governanceMemberSupplier()(channelKey)) ?? UNRESOLVED_ROSTER;
+    rosterCache.set(channelKey, { roster, at: Date.now() });
+    return roster;
+}
+export async function resolveAudienceFloor(channelKey, admins) {
+    const roster = await resolveRoomRoster(channelKey);
+    return { floor: computeAudienceFloor(roster, admins), roster };
+}
+/** On a breach it emits one governance.floor_breach audit row, best-effort and never throwing. The attestation memo sits in front of the roster memo, which is what keeps the breach row to one per window. */
+export async function attestGovernanceChannel(channelKey, domains, ctx) {
+    const cached = floorCache.get(channelKey);
+    if (cached && Date.now() - cached.at < floorTtlMs())
+        return cached.attestation;
+    const roster = await resolveRoomRoster(channelKey);
+    const attestation = attestGovernanceFloor(roster, governanceAdminSet(channelKey, domains));
+    floorCache.set(channelKey, { attestation, at: Date.now() });
+    if (!attestation.armed && attestation.breach) {
+        const domainName = domainForChannel(channelKey, domains)?.name;
+        await appendAudit({
+            org: ctx.org,
+            platform: ctx.platform,
+            workspace: ctx.workspace,
+            surface: ctx.surface,
+            principalId: ctx.principalId,
+            action: "governance.floor_breach",
+            detail: {
+                domain: domainName,
+                channelKey,
+                reason: attestation.breach.reason,
+                missing: attestation.breach.missing,
+                members: attestation.breach.members,
+            },
+        });
+    }
+    return attestation;
+}
+export function floorBreachNotice(breach) {
+    switch (breach.reason) {
+        case "members-unresolved":
+            return "governance behaviour is suspended: I couldn't verify this channel's membership (fail-closed).";
+        case "public-channel":
+            return "governance behaviour is suspended: this channel is public — a governance venue must be private.";
+        case "guest-present":
+            return "governance behaviour is suspended: a guest/external member is present in this channel.";
+        case "non-admin-member": {
+            const who = breach.missing.length > 0 ? breach.missing.map((m) => `@${m}`).join(", ") : "someone";
+            return `this channel has members without admin standing — governance behaviour is suspended: ${who} isn't on the roster.`;
+        }
+    }
+}
+//# sourceMappingURL=audience-floor.js.map

package/dist/agent/access/audience-floor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience-floor.js","sourceRoot":"","sources":["../../../agent/access/audience-floor.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,qFAAqF;AACrF,iCAAiC;AACjC,EAAE;AACF,qFAAqF;AACrF,oGAAoG;AACpG,4FAA4F;AAC5F,2FAA2F;AAC3F,+FAA+F;AAC/F,gFAAgF;AAChF,wFAAwF;AACxF,+FAA+F;AAC/F,8FAA8F;AAC9F,2FAA2F;AAC3F,2FAA2F;AAC3F,sFAAsF;AACtF,wFAAwF;AACxF,+FAA+F;AAC/F,6FAA6F;AAC7F,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,qEAAqE;AACrE,kFAAkF;AAClF,kGAAkG;AAClG,oGAAoG;AACpG,4FAA4F;AAC5F,oGAAoG;AACpG,6FAA6F;AAC7F,+FAA+F;AAC/F,oGAAoG;AACpG,kGAAkG;AAClG,2FAA2F;AAC3F,6FAA6F;AAC7F,sEAAsE;AACtE,qGAAqG;AACrG,qGAAqG;AACrG,oGAAoG;AACpG,EAAE;AACF,kGAAkG;AAClG,+FAA+F;AAC/F,mGAAmG;AACnG,qGAAqG;AACrG,kGAAkG;AAClG,4FAA4F;AAC5F,6EAA6E;AAC7E,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,EAAE;AACF,gGAAgG;AAChG,4FAA4F;AAC5F,sDAAsD;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAmBtD,gLAAgL;AAChL,MAAM,UAAU,oBAAoB,CAAC,MAAkB,EAAE,MAA2B;IAClF,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,IAAI,SAAS,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC;IAClD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAmBD,0JAA0J;AAC1J,MAAM,UAAU,qBAAqB,CAAC,MAAkB,EAAE,MAA2B;IACnF,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAsB,CAAC,MAAM,CAAC,QAAQ;QAChD,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,MAAM,CAAC,QAAQ;YACf,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,kBAAkB,CAAC;IAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,iSAAiS;AACjS,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,OAA0B;IAC/E,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACpI,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAC3E,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,IAAI,EAAE;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,IAAI,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACjE,CAAC;AAMD,IAAI,QAAQ,GAAoC,IAAI,CAAC;AAErD,uGAAuG;AACvG,MAAM,UAAU,gCAAgC,CAAC,EAA4B;IAC3E,QAAQ,GAAG,EAAE,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qCAAqC;IACnD,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,oGAAoG;AACpG,SAAS,wBAAwB;IAC/B,OAAO,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAMD,+RAA+R;AAC/R,SAAS,UAAU;IACjB,OAAO,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;AAC7C,CAAC;AACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;AAMxD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEpD;kGACkG;AAClG,MAAM,iBAAiB,GAAe,MAAM,CAAC,MAAM,CAAC;IAClD,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAsB;IACtD,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;IAChB,QAAQ,EAAE,KAAK;CAChB,CAAC,CAAC;AAEH;yFACyF;AACzF,MAAM,UAAU,+BAA+B;IAC7C,UAAU,CAAC,KAAK,EAAE,CAAC;IACnB,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iCAAiC;IAC/C,+BAA+B,EAAE,CAAC;AACpC,CAAC;AASD,gPAAgP;AAChP,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM,MAAM,GAAG,CAAC,MAAM,wBAAwB,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,iBAAiB,CAAC;IACnF,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,MAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;AACjE,CAAC;AAWD,+MAA+M;AAC/M,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAkB,EAClB,OAA0B,EAC1B,GAAuB;IAEvB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC;IAE/E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3F,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAE5D,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC;QAC/D,MAAM,WAAW,CAAC;YAChB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM,EAAE,yBAAyB;YACjC,MAAM,EAAE;gBACN,MAAM,EAAE,UAAU;gBAClB,UAAU;gBACV,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM;gBACjC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO;gBACnC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO;aACpC;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAA+C;IAC/E,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,oBAAoB;YACvB,OAAO,+FAA+F,CAAC;QACzG,KAAK,gBAAgB;YACnB,OAAO,iGAAiG,CAAC;QAC3G,KAAK,eAAe;YAClB,OAAO,wFAAwF,CAAC;QAClG,KAAK,kBAAkB,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,OAAO,wFAAwF,GAAG,uBAAuB,CAAC;QAC5H,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/agent/access/aws-output.d.ts

@@ -0,0 +1,39 @@
+/** One redaction rule's tally. Names and counts ONLY — the struck VALUE is never carried anywhere. */
+export interface AwsRedactionHit {
+    readonly rule: "minted-credential" | "access-key-id" | "labelled-secret";
+    readonly count: number;
+}
+export interface AwsRedactedOutput {
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly hits: readonly AwsRedactionHit[];
+}
+export declare function redactAwsCredentialShapes(text: string): {
+    readonly text: string;
+    readonly hits: readonly AwsRedactionHit[];
+};
+/** Both rules over both streams, with ONE merged tally. Rule A runs FIRST: striking the minted credential by equality means rule B never has to guess about it. */
+export declare function redactAwsOutput(input: {
+    readonly stdout: string;
+    readonly stderr: string;
+    /** The credential strings this call minted. Never logged, never returned — only struck. */
+    readonly secrets?: readonly (string | undefined)[];
+}): AwsRedactedOutput;
+export declare function redactionCount(hits: readonly {
+    readonly count: number;
+}[]): number;
+export interface AwsModelResult {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly roleArn: string;
+    readonly identity: string;
+    /** Widened to a plain `rule` string on purpose: the renderer reads the tool's zod-inferred output, and nothing here branches on the rule name. */
+    readonly redactions?: readonly {
+        readonly rule: string;
+        readonly count: number;
+    }[];
+}
+/** Host-derived structure stays OUTSIDE the fence and each CLI stream is fenced as untrusted DATA, or the model cannot tell which stream it is reading. `aws` is a static tool, so eve preserves this authored `toModelOutput`. */
+export declare function renderAwsResultForModel(r: AwsModelResult): string;
+//# sourceMappingURL=aws-output.d.ts.map

package/dist/agent/access/aws-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-output.d.ts","sourceRoot":"","sources":["../../../agent/access/aws-output.ts"],"names":[],"mappings":"AAIA,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe,GAAG,iBAAiB,CAAC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,eAAe,EAAE,CAAC;CAC3C;AA2CD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,CAiB5H;AAED,mKAAmK;AACnK,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;CACpD,GAAG,iBAAiB,CAUpB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,MAAM,CAElF;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kJAAkJ;IAClJ,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACpF;AAED,mOAAmO;AACnO,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAsBjE"}

package/dist/agent/access/aws-output.js

@@ -0,0 +1,94 @@
+// Redacts AWS CLI output, then fences it as untrusted data. Redaction is ALWAYS disclosed — a struck value becomes a NAMED marker and the count rides back to the caller — and only two third-party shapes are matched, because a false positive on ordinary output is worse than a miss.
+import { ingestUntrusted } from "./untrusted.js";
+const MARKER = {
+    "minted-credential": "[redacted by Open Everywhere: this call's own minted AWS credential]",
+    "access-key-id": "[redacted by Open Everywhere: AWS access key id]",
+    "labelled-secret": "[redacted by Open Everywhere: AWS secret/session-token value]",
+};
+/** Matches AWS access key ids bounded by non-alphanumerics, so a longer token that merely contains the sequence is not struck. Only the credential prefixes AKIA and ASIA; the public principal-id prefixes (AIDA, AROA) are deliberately NOT struck. */
+const ACCESS_KEY_ID = /(?<![A-Za-z0-9])(?:AKIA|ASIA)[A-Z0-9]{16}(?![A-Za-z0-9])/gu;
+/** The LABEL is the whole evidence here — a secret access key value has no shape worth matching. Covers the INI, env and STS-JSON spellings, case-insensitively. */
+const LABELLED_SECRET = /((?:aws[_-]?)?(?:secret[_-]?access[_-]?key|session[_-]?token)"?\s*[:=]\s*"?)([^\s"',;}\]]+)/giu;
+/** Below this, a labelled value is a placeholder (`null`, `""`, `none`, `xxx`), not a credential.
+ *  A real secret access key is 40 characters and a session token is hundreds. */
+const MIN_SECRET_LENGTH = 16;
+function tally(hits, rule, count) {
+    if (count === 0)
+        return;
+    const existing = hits.find((h) => h.rule === rule);
+    if (existing === undefined)
+        hits.push({ rule, count });
+    else
+        hits[hits.indexOf(existing)] = { rule, count: existing.count + count };
+}
+/** Strikes the EXACT credential strings this call minted, by equality, so no false positive is possible. Short entries are skipped so a stub or a truncated value can never become a global string replacement. */
+function redactKnownSecrets(text, secrets, hits) {
+    let out = text;
+    let count = 0;
+    for (const secret of secrets) {
+        if (typeof secret !== "string" || secret.length < MIN_SECRET_LENGTH)
+            continue;
+        let idx = out.indexOf(secret);
+        while (idx >= 0) {
+            count++;
+            out = out.slice(0, idx) + MARKER["minted-credential"] + out.slice(idx + secret.length);
+            idx = out.indexOf(secret, idx + MARKER["minted-credential"].length);
+        }
+    }
+    tally(hits, "minted-credential", count);
+    return out;
+}
+export function redactAwsCredentialShapes(text) {
+    const hits = [];
+    let keyIds = 0;
+    let out = text.replace(ACCESS_KEY_ID, () => {
+        keyIds++;
+        return MARKER["access-key-id"];
+    });
+    tally(hits, "access-key-id", keyIds);
+    let labelled = 0;
+    out = out.replace(LABELLED_SECRET, (whole, label, value) => {
+        if (value.length < MIN_SECRET_LENGTH)
+            return whole; // a placeholder, not a credential
+        labelled++;
+        return `${label}${MARKER["labelled-secret"]}`;
+    });
+    tally(hits, "labelled-secret", labelled);
+    return { text: out, hits };
+}
+/** Both rules over both streams, with ONE merged tally. Rule A runs FIRST: striking the minted credential by equality means rule B never has to guess about it. */
+export function redactAwsOutput(input) {
+    const hits = [];
+    const secrets = (input.secrets ?? []).filter((s) => typeof s === "string");
+    const pass = (text) => {
+        const known = redactKnownSecrets(text, secrets, hits);
+        const shaped = redactAwsCredentialShapes(known);
+        for (const h of shaped.hits)
+            tally(hits, h.rule, h.count);
+        return shaped.text;
+    };
+    return { stdout: pass(input.stdout), stderr: pass(input.stderr), hits };
+}
+export function redactionCount(hits) {
+    return hits.reduce((n, h) => n + h.count, 0);
+}
+/** Host-derived structure stays OUTSIDE the fence and each CLI stream is fenced as untrusted DATA, or the model cannot tell which stream it is reading. `aws` is a static tool, so eve preserves this authored `toModelOutput`. */
+export function renderAwsResultForModel(r) {
+    const ingestion = { kind: "aws", label: "aws" };
+    const out = [`aws exited ${r.exitCode} (identity: ${r.identity}, role: ${r.roleArn})`];
+    out.push("", "stdout:");
+    out.push(r.stdout.length === 0 ? "  (empty)" : ingestUntrusted(r.stdout, { source: "aws cli stdout", ingestion }));
+    out.push("", "stderr:");
+    out.push(r.stderr.length === 0 ? "  (empty)" : ingestUntrusted(r.stderr, { source: "aws cli stderr", ingestion }));
+    // The disclosure line, deliberately OUTSIDE both fences: it is Open Everywhere's own statement
+    // about what it removed, and a model that reads it as part of the account's data would report the
+    // marker text back as if the account contained it.
+    const hits = r.redactions ?? [];
+    if (hits.length > 0) {
+        const detail = hits.map((h) => `${h.rule}×${h.count}`).join(", ");
+        out.push("", `NOTE (Open Everywhere, not the AWS CLI): ${redactionCount(hits)} credential-shaped value(s) were REDACTED from the output above (${detail}). ` +
+            "The markers are ours; the account does not contain them. Do not attempt to recover, reconstruct or work around a redacted value.");
+    }
+    return out.join("\n");
+}
+//# sourceMappingURL=aws-output.js.map

package/dist/agent/access/aws-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-output.js","sourceRoot":"","sources":["../../../agent/access/aws-output.ts"],"names":[],"mappings":"AAAA,0RAA0R;AAE1R,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAcjD,MAAM,MAAM,GAAsD;IAChE,mBAAmB,EAAE,sEAAsE;IAC3F,eAAe,EAAE,kDAAkD;IACnE,iBAAiB,EAAE,+DAA+D;CACnF,CAAC;AAEF,yPAAyP;AACzP,MAAM,aAAa,GAAG,4DAA4D,CAAC;AAEnF,oKAAoK;AACpK,MAAM,eAAe,GACnB,gGAAgG,CAAC;AAEnG;iFACiF;AACjF,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,SAAS,KAAK,CAAC,IAAuB,EAAE,IAA6B,EAAE,KAAa;IAClF,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;;QAClD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;AAC9E,CAAC;AAED,mNAAmN;AACnN,SAAS,kBAAkB,CAAC,IAAY,EAAE,OAA0B,EAAE,IAAuB;IAC3F,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB;YAAE,SAAS;QAC9E,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC;YAChB,KAAK,EAAE,CAAC;YACR,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,mBAAmB,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YACvF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE;QACzC,MAAM,EAAE,CAAC;QACT,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IAErC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE;QACzE,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB;YAAE,OAAO,KAAK,CAAC,CAAC,kCAAkC;QACtF,QAAQ,EAAE,CAAC;QACX,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACzC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,mKAAmK;AACnK,MAAM,UAAU,eAAe,CAAC,KAK/B;IACC,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE;QACpC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAA2C;IACxE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAYD,mOAAmO;AACnO,MAAM,UAAU,uBAAuB,CAAC,CAAiB;IACvD,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAW,CAAC;IACzD,MAAM,GAAG,GAAa,CAAC,cAAc,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,QAAQ,WAAW,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;IAEjG,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACxB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACnH,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACxB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAEnH,+FAA+F;IAC/F,kGAAkG;IAClG,mDAAmD;IACnD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,CACN,EAAE,EACF,4CAA4C,cAAc,CAAC,IAAI,CAAC,oEAAoE,MAAM,KAAK;YAC7I,kIAAkI,CACrI,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/agent/access/aws-screen.d.ts

@@ -0,0 +1,24 @@
+/** Input to the screen: the full `aws` argv (after the word `aws`) + the grant's allow list. */
+export interface AwsScreenInput {
+    readonly argv: readonly string[];
+    /** The VERIFIED grant's allow list (never model input). Absent/empty ⇒ REFUSE (fail closed). */
+    readonly allow: readonly string[] | undefined;
+}
+/** One screen verdict. `code` is the audit row's closed reason vocabulary. */
+export type AwsScreenVerdict = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: "credential-read" | "argv-option" | "allow-list";
+    readonly reason: string;
+};
+/** The s3 high-level command fan-outs — `s3 cp` is not one IAM action. A fanned command is allowed only when EVERY action in its set is allowed; a high-level command not listed here matches only a CLI-form allow entry. */
+export declare const AWS_S3_HIGH_LEVEL_FANOUT: Readonly<Record<string, readonly string[]>>;
+/** kebab-or-snake CLI operation → Pascal IAM action name (`start-query` → `StartQuery`).
+ *  Mechanical; `*` survives as a glob (`describe-*` → `Describe*`). */
+export declare function cliOpToIamAction(op: string): string;
+/** The screen: pure, fail-closed, refuse-only. See the header for the three fences and their verified defeats. */
+export declare function awsCommandVerdict(input: AwsScreenInput): AwsScreenVerdict;
+/** Compile an `allow` grammar into an STS session policy for the AssumeRoleWithWebIdentity path, where `Policy` INTERSECTS at mint time; the per-user path takes none at all. It returns undefined for an unrestricted grant and for any entry not safely compilable, since a partial list would narrow BELOW the grant. */
+export declare function awsSessionPolicyFromAllow(allow: readonly string[]): string | undefined;
+//# sourceMappingURL=aws-screen.d.ts.map

package/dist/agent/access/aws-screen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-screen.d.ts","sourceRoot":"","sources":["../../../agent/access/aws-screen.ts"],"names":[],"mappings":"AAEA,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,gGAAgG;IAChG,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC/C;AAED,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,GAAG,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAqBrH,8NAA8N;AAC9N,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAShF,CAAC;AAEF;uEACuE;AACvE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAMnD;AAoCD,kHAAkH;AAClH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,gBAAgB,CAyEzE;AAED,4TAA4T;AAC5T,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CA+BtF"}

package/dist/agent/access/aws-screen.js

@@ -0,0 +1,177 @@
+// The pure AWS command screen — three fences in order: an unconditional credential-self-read denylist, an unconditional whole-argv option screen, and the grant's allow list, which REFUSES when absent or empty. It can only ever refuse a command the role would have permitted, never widen one.
+/** Options refused ANYWHERE in argv — redirect, host-read and credential-echo. The option list in docs/capabilities/connectors-and-providers.md is hand-written and is NOT derived from this table. */
+const AWS_REFUSED_ARGV_OPTIONS = [
+    "--endpoint-url",
+    "--ca-bundle",
+    "--no-verify-ssl",
+    "--profile",
+    "--outfile",
+    "--debug",
+];
+/** `configure` subcommands refused by name (fence 1) — they echo the injected credentials. */
+const AWS_CREDENTIAL_SELF_READ_SUBCOMMANDS = ["export-credentials", "list"];
+/** CLI service token → IAM action prefix, where they differ. Deliberately tiny; equality is the
+ *  default and no general mapping is attempted. */
+const CLI_SERVICE_TO_IAM_PREFIX = {
+    s3api: "s3",
+};
+/** The s3 high-level command fan-outs — `s3 cp` is not one IAM action. A fanned command is allowed only when EVERY action in its set is allowed; a high-level command not listed here matches only a CLI-form allow entry. */
+export const AWS_S3_HIGH_LEVEL_FANOUT = {
+    ls: ["s3:ListBucket", "s3:ListAllMyBuckets"],
+    cp: ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
+    mv: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket"],
+    sync: ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
+    rm: ["s3:DeleteObject", "s3:ListBucket"],
+    mb: ["s3:CreateBucket"],
+    rb: ["s3:DeleteBucket"],
+    presign: ["s3:GetObject"],
+};
+/** kebab-or-snake CLI operation → Pascal IAM action name (`start-query` → `StartQuery`).
+ *  Mechanical; `*` survives as a glob (`describe-*` → `Describe*`). */
+export function cliOpToIamAction(op) {
+    return op
+        .trim()
+        .split(/[-_]/u)
+        .map((seg) => (seg.length === 0 ? "" : seg[0].toUpperCase() + seg.slice(1)))
+        .join("");
+}
+/** Case-insensitive glob match (`*` = any run). Anchored both ends. */
+function globMatch(pattern, value) {
+    const rx = new RegExp("^" + pattern.toLowerCase().split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join(".*") + "$", "u");
+    return rx.test(value.toLowerCase());
+}
+/** Normalise a CLI op token for CLI-form comparison: lowercase, `_` → `-`. */
+function normCliOp(op) {
+    return op.trim().toLowerCase().replace(/_/gu, "-");
+}
+/** Does ONE allow entry match ONE candidate `service`/`operation` pair (both grammars)? */
+function entryMatches(entry, service, cliOp, iamPrefix, iamAction) {
+    const sep = entry.indexOf(":");
+    if (sep < 0) {
+        // Bare service entry — any operation of that service (either service spelling).
+        return globMatch(entry.trim(), service) || globMatch(entry.trim(), iamPrefix);
+    }
+    const entryService = entry.slice(0, sep).trim();
+    const entryOp = entry.slice(sep + 1).trim();
+    const serviceOk = globMatch(entryService, service) || globMatch(entryService, iamPrefix);
+    if (!serviceOk)
+        return false;
+    if (cliOp !== undefined && globMatch(normCliOp(entryOp), normCliOp(cliOp)))
+        return true;
+    if (iamAction !== undefined && globMatch(entryOp, iamAction))
+        return true;
+    // A CLI-form (kebab) entry must also match the IAM action it translates to, and vice versa —
+    // so `logs:start-query` matches candidate IAM `StartQuery`, and `logs:StartQuery` matches the
+    // CLI op `start-query`.
+    if (iamAction !== undefined && globMatch(cliOpToIamAction(entryOp), iamAction))
+        return true;
+    return false;
+}
+/** The screen: pure, fail-closed, refuse-only. See the header for the three fences and their verified defeats. */
+export function awsCommandVerdict(input) {
+    const argv = input.argv;
+    const service = argv[0]?.trim().toLowerCase();
+    if (service === undefined || service.length === 0) {
+        return { ok: false, code: "allow-list", reason: "no service named — nothing to allow" };
+    }
+    // Fence 1 — credential self-read, UNCONDITIONAL (holds under allow: ["*"]).
+    if (service === "configure") {
+        const sub = argv[1]?.trim().toLowerCase();
+        if (sub !== undefined && AWS_CREDENTIAL_SELF_READ_SUBCOMMANDS.includes(sub)) {
+            return {
+                ok: false,
+                code: "credential-read",
+                reason: `\`aws configure ${sub}\` echoes the injected credentials to the model and is refused unconditionally`,
+            };
+        }
+    }
+    // Fence 2 — whole-argv option screen, UNCONDITIONAL. Both `--opt value` and `--opt=value`.
+    for (const raw of argv) {
+        const token = raw.trim();
+        const optName = token.startsWith("--") ? token.split("=", 1)[0].toLowerCase() : undefined;
+        if (optName !== undefined && AWS_REFUSED_ARGV_OPTIONS.includes(optName)) {
+            return {
+                ok: false,
+                code: optName === "--debug" ? "credential-read" : "argv-option",
+                reason: `\`${optName}\` is refused on every aws command — it ${optName === "--debug" ? "logs the resolved credential chain to output the model reads" : "redirects the signed request or reads/writes host state outside the injected credentials"}`,
+            };
+        }
+        if (token.toLowerCase().includes("file://")) {
+            return { ok: false, code: "argv-option", reason: "a `file://`-valued argument reads a host file into the request and is refused" };
+        }
+    }
+    // Fence 3 — the allow-list, REQUIRED. Absent/empty ⇒ refuse (the old unrestricted default died).
+    const allow = input.allow;
+    if (allow === undefined || allow.length === 0) {
+        return {
+            ok: false,
+            code: "allow-list",
+            reason: "this grant carries no `allow` list — unrestricted access must be spelled `allow: [\"*\"]` explicitly (access/bundle.ts awsRoles)",
+        };
+    }
+    if (allow.some((e) => e.trim() === "*"))
+        return { ok: true };
+    const cliOp = argv[1]?.trim();
+    const iamPrefix = CLI_SERVICE_TO_IAM_PREFIX[service] ?? service;
+    // High-level fan-out: EVERY action in the enumerated set must be allowed.
+    const fanout = service === "s3" && cliOp !== undefined ? AWS_S3_HIGH_LEVEL_FANOUT[cliOp.toLowerCase()] : undefined;
+    if (fanout !== undefined) {
+        const allOk = fanout.every((qualified) => {
+            const [fanPrefix, fanAction] = qualified.split(":");
+            return allow.some((entry) => entryMatches(entry, service, cliOp, fanPrefix, fanAction));
+        });
+        if (allOk)
+            return { ok: true };
+        return {
+            ok: false,
+            code: "allow-list",
+            reason: `\`${service} ${cliOp}\` fans out to ${fanout.join(", ")} and the grant's allow list does not cover all of them`,
+        };
+    }
+    const iamAction = cliOp === undefined ? undefined : cliOpToIamAction(cliOp);
+    if (allow.some((entry) => entryMatches(entry, service, cliOp, iamPrefix, iamAction)))
+        return { ok: true };
+    return {
+        ok: false,
+        code: "allow-list",
+        reason: `\`${cliOp !== undefined ? `${service}:${cliOp}` : service}\` matches no entry of the grant's allow list`,
+    };
+}
+/** Compile an `allow` grammar into an STS session policy for the AssumeRoleWithWebIdentity path, where `Policy` INTERSECTS at mint time; the per-user path takes none at all. It returns undefined for an unrestricted grant and for any entry not safely compilable, since a partial list would narrow BELOW the grant. */
+export function awsSessionPolicyFromAllow(allow) {
+    if (allow.length === 0)
+        return undefined; // invalid grant — the screen refuses; nothing to compile
+    if (allow.some((e) => e.trim() === "*"))
+        return undefined; // explicitly unrestricted
+    const actions = [];
+    for (const entry of allow) {
+        const sep = entry.indexOf(":");
+        if (sep < 0) {
+            const service = entry.trim().toLowerCase();
+            if (service.includes("*"))
+                return undefined; // a service glob is not safely compilable
+            actions.push(`${CLI_SERVICE_TO_IAM_PREFIX[service] ?? service}:*`);
+            continue;
+        }
+        const service = entry.slice(0, sep).trim().toLowerCase();
+        const op = entry.slice(sep + 1).trim();
+        if (service.includes("*"))
+            return undefined; // `*:Get*` — service-half glob; leave to the host screen
+        const iamPrefix = CLI_SERVICE_TO_IAM_PREFIX[service] ?? service;
+        // s3 high-level CLI entries fan out to their enumerated IAM sets.
+        const fanout = service === "s3" ? AWS_S3_HIGH_LEVEL_FANOUT[op.toLowerCase()] : undefined;
+        if (fanout !== undefined) {
+            actions.push(...fanout);
+            continue;
+        }
+        // kebab/snake CLI form → Pascal (globs survive); an already-IAM-form entry passes through
+        // unchanged (it contains no separator, so the translation is the identity on it).
+        actions.push(`${iamPrefix}:${cliOpToIamAction(op)}`);
+    }
+    const unique = [...new Set(actions)].sort();
+    return JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [{ Effect: "Allow", Action: unique, Resource: "*" }],
+    });
+}
+//# sourceMappingURL=aws-screen.js.map