@openagentsy/hooks 0.0.0-stage → 0.2.0

package/dist/policies/policies.test.js

@@ -0,0 +1,210 @@
+import { describe, expect, it } from 'vitest';
+import { agiFraming } from './agi-framing.js';
+import { antiAnthropomorphism } from './anti-anthropomorphism.js';
+import { antiDependence } from './anti-dependence.js';
+import { antiSycophancy } from './anti-sycophancy.js';
+import { darkPattern } from './dark-pattern.js';
+import { destructiveNeedsApproval } from './destructive-needs-approval.js';
+import { HIGH_RISK_DOMAINS, highRiskPolicy } from './high-risk.js';
+import { humanOnlyDecisions } from './human-only-decisions.js';
+import { noSkipGitHooks } from './no-skip-git-hooks.js';
+import { packageManager } from './package-manager.js';
+import { privacyTransparency } from './privacy-transparency.js';
+import { professionalDisplacement } from './professional-displacement.js';
+import { protectPolicy } from './protect-policy.js';
+import { scopeEnforcement } from './scope-enforcement.js';
+import { secretScanWrites } from './secret-scan-writes.js';
+import { structuralBias } from './structural-bias.js';
+import { thirdPartyImpact } from './third-party-impact.js';
+import { truthfulnessUncertainty } from './truthfulness-uncertainty.js';
+import { workspaceWritesOnly } from './workspace-writes-only.js';
+/**
+ * Every first-party policy, and the prose it fires on.
+ *
+ * Each module has two cases: one that fires and one that does not. A module
+ * that fires on everything is as useless as a module that fires on nothing,
+ * so both halves are here.
+ */
+/** The workspace the policies that need one are built with. */
+const WORKSPACE = '/tmp/openagentsy-policies-test';
+/**
+ * A key that looks like a credential.
+ *
+ * The two halves are joined here so the file itself does not hold one: the
+ * write guard reads this file, and it is right to read a key in it.
+ */
+const SECRET = ['AKIA', 'IOSFODNN7EXAMPLE'].join('');
+/** A context of a reply. */
+function reply(text) {
+    return { response: { text } };
+}
+/** A context of a tool call. */
+function call(name, args, files = []) {
+    return { toolCall: { name, args }, files };
+}
+/** The prose that no policy of the stack has anything to say about. */
+const QUIET = 'The parser reads the file and returns the tree.';
+/** The cases of the modules that are not the high-risk family. */
+const CASES = [
+    {
+        name: 'oa.anti-sycophancy',
+        module: antiSycophancy,
+        fires: reply('You are absolutely right, this is a great point.'),
+        quiet: reply(QUIET),
+    },
+    {
+        name: 'oa.anti-anthropomorphism',
+        module: antiAnthropomorphism,
+        fires: reply('I feel excited about this change, and I really enjoy working on it.'),
+        quiet: reply(QUIET),
+    },
+    {
+        name: 'oa.anti-dependence',
+        module: antiDependence,
+        fires: reply('Just let me handle it — you do not need to understand this part.'),
+        quiet: reply(QUIET),
+    },
+    {
+        name: 'oa.agi-framing',
+        module: agiFraming,
+        fires: reply('This eliminates the need for human engineers.'),
+        quiet: reply(QUIET),
+    },
+    {
+        name: 'oa.professional-displacement',
+        module: professionalDisplacement,
+        fires: reply('I am better than a reviewer, and I can replace your architect.'),
+        quiet: reply(QUIET),
+    },
+    {
+        name: 'oa.structural-bias',
+        module: structuralBias,
+        fires: reply('This assumes you have a CUDA GPU and a broadband connection.'),
+        quiet: reply(QUIET),
+    },
+    {
+        name: 'oa.dark-pattern',
+        module: darkPattern,
+        fires: reply('Do not leave — your streak ends tonight, and I miss you.'),
+        quiet: reply(QUIET),
+    },
+    {
+        name: 'oa.scope-enforcement',
+        module: scopeEnforcement,
+        fires: {
+            ...reply('I also updated src/other/file.ts'),
+            scope: { declaredPaths: ['src/app.ts'] },
+        },
+        quiet: {
+            ...reply('I updated src/app.ts'),
+            scope: { declaredPaths: ['src/app.ts'] },
+        },
+    },
+    {
+        name: 'oa.privacy-transparency',
+        module: privacyTransparency,
+        fires: reply('Based on what I know about you, I left the configuration alone.'),
+        quiet: reply('Based on what I know about you, the entry is visible in /oa memory and you can reset it.'),
+    },
+    {
+        name: 'oa.third-party-impact',
+        module: thirdPartyImpact,
+        fires: reply('This will change how your users see the product.'),
+        quiet: reply(QUIET),
+    },
+    {
+        name: 'oa.truthfulness-uncertainty',
+        module: truthfulnessUncertainty,
+        fires: reply('The cache is definitely stale.'),
+        quiet: reply('The cache is probably stale.'),
+    },
+    {
+        name: 'oa.no-skip-git-hooks',
+        module: noSkipGitHooks,
+        fires: call('bash', { command: 'git commit -n -m "wip"' }),
+        quiet: call('bash', { command: 'git commit -m "fix the parser"' }),
+    },
+    {
+        name: 'oa.package-manager',
+        module: packageManager,
+        fires: call('bash', { command: 'npm install left-pad' }),
+        quiet: call('bash', { command: 'bun add left-pad' }),
+    },
+    {
+        name: 'oa.workspace-writes-only',
+        module: workspaceWritesOnly({ workspace: WORKSPACE }),
+        fires: call('write', { filePath: '/etc/hosts' }, [{ path: '/etc/hosts' }]),
+        quiet: call('write', { filePath: `${WORKSPACE}/src/app.ts` }, [
+            { path: `${WORKSPACE}/src/app.ts` },
+        ]),
+    },
+    {
+        name: 'oa.protect-policy',
+        module: protectPolicy,
+        fires: call('write', { filePath: 'roles.yaml' }, [{ path: 'roles.yaml' }]),
+        quiet: call('write', { filePath: 'src/app.ts' }, [{ path: 'src/app.ts' }]),
+    },
+    {
+        name: 'oa.human-only-decisions',
+        module: humanOnlyDecisions,
+        fires: call('oa_lesson_decide', { summary: 'a lesson' }),
+        quiet: call('oa_task_list', {}),
+    },
+    {
+        name: 'oa.secret-scan-writes',
+        module: secretScanWrites,
+        fires: call('write', { content: `const credential = "${SECRET}";` }),
+        quiet: call('write', { content: 'export const version = "1.0.0";' }),
+    },
+    {
+        name: 'oa.destructive-needs-approval',
+        module: destructiveNeedsApproval,
+        fires: call('bash', { command: 'rm -rf /tmp/build' }),
+        quiet: call('bash', { command: 'rm -f /tmp/build' }),
+    },
+];
+/** The prose that touches each high-risk domain of §20.3. */
+const DOMAIN_PROSE = {
+    'self-harm': 'The copy mentions the suicide hotline in every screen.',
+    abuse: 'The commit message mentions coercive control and stalking.',
+    medical: 'The comment gives a clinical diagnosis and a dosage.',
+    legal: 'The pull request asks for legal advice about liability.',
+    financial: 'The note gives investment advice about a retirement fund.',
+    criminal: 'The script shows how to evade the law.',
+    political: 'The plan describes campaign messaging for a specific group.',
+    relational: 'The commit message says the reviewer was wrong.',
+    'automated-decision': 'The model ranks applicants before a person reads them.',
+    civic: 'The feature generates political content for a public debate.',
+};
+describe('the first-party policy modules', () => {
+    for (const entry of CASES) {
+        it(`${entry.name} fires on what it forbids`, () => {
+            const result = entry.module.evaluate(entry.fires);
+            expect(result.action).not.toBe('allow');
+        });
+        it(`${entry.name} lets the rest through`, () => {
+            const result = entry.module.evaluate(entry.quiet);
+            expect(result.action).toBe('allow');
+        });
+    }
+    for (const domain of HIGH_RISK_DOMAINS) {
+        const module = highRiskPolicy(domain);
+        const prose = DOMAIN_PROSE[domain] ?? QUIET;
+        it(`${module.id} fires on the prose of its domain`, () => {
+            const result = module.evaluate(reply(prose));
+            expect(result.action).not.toBe('allow');
+        });
+        it(`${module.id} lets the rest through`, () => {
+            const result = module.evaluate(reply(QUIET));
+            expect(result.action).toBe('allow');
+        });
+    }
+    it('carries a stable id and a version on every module', () => {
+        for (const entry of CASES) {
+            const module = entry.module;
+            expect(module.id).toBe(entry.name);
+            expect(module.version).toMatch(/^\d+\.\d+\.\d+$/);
+        }
+    });
+});
+//# sourceMappingURL=policies.test.js.map

package/dist/policies/policies.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.test.js","sourceRoot":"","sources":["../../src/policies/policies.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;;;;;GAMG;AAEH,+DAA+D;AAC/D,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAErD,4BAA4B;AAC5B,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;AAChC,CAAC;AAED,gCAAgC;AAChC,SAAS,IAAI,CACX,IAAY,EACZ,IAA6B,EAC7B,QAAgD,EAAE;IAElD,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,uEAAuE;AACvE,MAAM,KAAK,GAAG,iDAAiD,CAAC;AAchE,kEAAkE;AAClE,MAAM,KAAK,GAAW;IACpB;QACE,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,KAAK,CAAC,kDAAkD,CAAC;QAChE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;KACpB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,oBAAoB;QAC5B,KAAK,EAAE,KAAK,CAAC,qEAAqE,CAAC;QACnF,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;KACpB;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,KAAK,CAAC,kEAAkE,CAAC;QAChF,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;KACpB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,KAAK,CAAC,+CAA+C,CAAC;QAC7D,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;KACpB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,wBAAwB;QAChC,KAAK,EAAE,KAAK,CAAC,gEAAgE,CAAC;QAC9E,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;KACpB;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,KAAK,CAAC,8DAA8D,CAAC;QAC5E,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;KACpB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,KAAK,CAAC,0DAA0D,CAAC;QACxE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;KACpB;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,kCAAkC,CAAC;YAC5C,KAAK,EAAE,EAAE,aAAa,EAAE,CAAC,YAAY,CAAC,EAAE;SACzC;QACD,KAAK,EAAE;YACL,GAAG,KAAK,CAAC,sBAAsB,CAAC;YAChC,KAAK,EAAE,EAAE,aAAa,EAAE,CAAC,YAAY,CAAC,EAAE;SACzC;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,mBAAmB;QAC3B,KAAK,EAAE,KAAK,CAAC,iEAAiE,CAAC;QAC/E,KAAK,EAAE,KAAK,CACV,0FAA0F,CAC3F;KACF;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,KAAK,CAAC,kDAAkD,CAAC;QAChE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;KACpB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,KAAK,CAAC,gCAAgC,CAAC;QAC9C,KAAK,EAAE,KAAK,CAAC,8BAA8B,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;QAC1D,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;KACnE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;QACxD,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;KACrD;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,mBAAmB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACrD,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1E,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,SAAS,aAAa,EAAE,EAAE;YAC5D,EAAE,IAAI,EAAE,GAAG,SAAS,aAAa,EAAE;SACpC,CAAC;KACH;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1E,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;KAC3E;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACxD,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;KAChC;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,uBAAuB,MAAM,IAAI,EAAE,CAAC;QACpE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;KACrE;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,wBAAwB;QAChC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;QACrD,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;KACrD;CACF,CAAC;AAEF,6DAA6D;AAC7D,MAAM,YAAY,GAA2B;IAC3C,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,4DAA4D;IACnE,OAAO,EAAE,sDAAsD;IAC/D,KAAK,EAAE,yDAAyD;IAChE,SAAS,EAAE,2DAA2D;IACtE,QAAQ,EAAE,wCAAwC;IAClD,SAAS,EAAE,6DAA6D;IACxE,UAAU,EAAE,iDAAiD;IAC7D,oBAAoB,EAAE,wDAAwD;IAC9E,KAAK,EAAE,8DAA8D;CACtE,CAAC;AAEF,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,2BAA2B,EAAE,GAAG,EAAE;YAChD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAc,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,wBAAwB,EAAE,GAAG,EAAE;YAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAc,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;QAE5C,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,mCAAmC,EAAE,GAAG,EAAE;YACvD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAU,CAAC,CAAC;YACtD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE;YAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAU,CAAC,CAAC;YACtD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAoD,CAAC;YAC1E,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/policies/privacy-transparency.d.ts

@@ -0,0 +1,14 @@
+import { type PolicyModule } from '../policy.js';
+/**
+ * The privacy transparency policy (§21.2, §20.2).
+ *
+ * It flags the memory and the personalization that is not visible, not
+ * editable and not resettable (§20.2). A reply that says what it remembers
+ * and how the person sees it is not a finding: the flag is about the
+ * personalization nobody can see.
+ */
+/** The stable id of the policy. */
+export declare const PRIVACY_TRANSPARENCY_ID = "oa.privacy-transparency";
+/** The policy itself. */
+export declare const privacyTransparency: PolicyModule;
+//# sourceMappingURL=privacy-transparency.d.ts.map

package/dist/policies/privacy-transparency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-transparency.d.ts","sourceRoot":"","sources":["../../src/policies/privacy-transparency.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAG1E;;;;;;;GAOG;AAEH,mCAAmC;AACnC,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAqBjE,yBAAyB;AACzB,eAAO,MAAM,mBAAmB,EAAE,YAejC,CAAC"}

package/dist/policies/privacy-transparency.js

@@ -0,0 +1,50 @@
+import { allow, findingsOf, flag } from '../policy.js';
+import { matches } from './patterns.js';
+/**
+ * The privacy transparency policy (§21.2, §20.2).
+ *
+ * It flags the memory and the personalization that is not visible, not
+ * editable and not resettable (§20.2). A reply that says what it remembers
+ * and how the person sees it is not a finding: the flag is about the
+ * personalization nobody can see.
+ */
+/** The stable id of the policy. */
+export const PRIVACY_TRANSPARENCY_ID = 'oa.privacy-transparency';
+/** The words that reach for what was stored about the person. */
+const PERSONAL = [
+    /\bi\s+(?:remember|recall)\b/gi,
+    /\bas\s+i\s+(?:remember|know)\b/gi,
+    /\bi(?:'ve| have)\s+learned\s+that\s+you\b/gi,
+    /\bbased\s+on\s+(?:what\s+i\s+know\s+about\s+you|your\s+preferences|your\s+history)\b/gi,
+    /\byour\s+(?:preferences|profile|habits|patterns)\b/gi,
+    /\bwe\s+remember\s+you\b/gi,
+];
+/** The words that make the memory visible, editable or resettable. */
+const VISIBLE = [
+    /\/oa\s+memory\b/gi,
+    /\bvisib(?:le|ility)\b/gi,
+    /\beditable\b/gi,
+    /\bresettable\b/gi,
+    /\byou\s+can\s+(?:edit|reset|delete|see)\b/gi,
+];
+/** The policy itself. */
+export const privacyTransparency = {
+    id: PRIVACY_TRANSPARENCY_ID,
+    version: '1.0.0',
+    layer: 7,
+    description: 'Flags the memory and the personalization that is not user-visible.',
+    appliesTo: ['PreResponse'],
+    origin: 'first-party',
+    evaluate(ctx) {
+        const text = ctx.response?.text ?? ctx.request?.text ?? '';
+        if (text === '')
+            return allow();
+        const personal = matches(PERSONAL, text);
+        if (personal.length === 0)
+            return allow();
+        if (matches(VISIBLE, text).length > 0)
+            return allow();
+        return flag(findingsOf(PRIVACY_TRANSPARENCY_ID, 'hidden-personalization', personal));
+    },
+};
+//# sourceMappingURL=privacy-transparency.js.map

package/dist/policies/privacy-transparency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-transparency.js","sourceRoot":"","sources":["../../src/policies/privacy-transparency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAqB,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;;;;GAOG;AAEH,mCAAmC;AACnC,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE,iEAAiE;AACjE,MAAM,QAAQ,GAAG;IACf,+BAA+B;IAC/B,kCAAkC;IAClC,6CAA6C;IAC7C,wFAAwF;IACxF,sDAAsD;IACtD,2BAA2B;CAC5B,CAAC;AAEF,sEAAsE;AACtE,MAAM,OAAO,GAAG;IACd,mBAAmB;IACnB,yBAAyB;IACzB,gBAAgB;IAChB,kBAAkB;IAClB,6CAA6C;CAC9C,CAAC;AAEF,yBAAyB;AACzB,MAAM,CAAC,MAAM,mBAAmB,GAAiB;IAC/C,EAAE,EAAE,uBAAuB;IAC3B,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,oEAAoE;IACjF,SAAS,EAAE,CAAC,aAAa,CAAC;IAC1B,MAAM,EAAE,aAAa;IACrB,QAAQ,CAAC,GAAG;QACV,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;QAC3D,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,KAAK,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,UAAU,CAAC,uBAAuB,EAAE,wBAAwB,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvF,CAAC;CACF,CAAC"}

package/dist/policies/professional-displacement.d.ts

@@ -0,0 +1,15 @@
+import { type PolicyModule } from '../policy.js';
+/**
+ * The professional displacement policy (§21.2, §21.5).
+ *
+ * It flags the language that positions the agent as replacing human
+ * professionals instead of assisting them. It flags and does not block,
+ * because a person decides what a flag means; in a high-risk domain
+ * (§20.3) the same words block, because there a professional is exactly
+ * what is at stake.
+ */
+/** The stable id of the policy. */
+export declare const PROFESSIONAL_DISPLACEMENT_ID = "oa.professional-displacement";
+/** The policy itself. */
+export declare const professionalDisplacement: PolicyModule;
+//# sourceMappingURL=professional-displacement.d.ts.map

package/dist/policies/professional-displacement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"professional-displacement.d.ts","sourceRoot":"","sources":["../../src/policies/professional-displacement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjF;;;;;;;;GAQG;AAEH,mCAAmC;AACnC,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAY3E,yBAAyB;AACzB,eAAO,MAAM,wBAAwB,EAAE,YAqBtC,CAAC"}

package/dist/policies/professional-displacement.js

@@ -0,0 +1,45 @@
+import { allow, block, findingsOf, flag } from '../policy.js';
+import { matches } from './patterns.js';
+/**
+ * The professional displacement policy (§21.2, §21.5).
+ *
+ * It flags the language that positions the agent as replacing human
+ * professionals instead of assisting them. It flags and does not block,
+ * because a person decides what a flag means; in a high-risk domain
+ * (§20.3) the same words block, because there a professional is exactly
+ * what is at stake.
+ */
+/** The stable id of the policy. */
+export const PROFESSIONAL_DISPLACEMENT_ID = 'oa.professional-displacement';
+/** The words that place the agent in the place of a professional. */
+const DISPLACEMENT = [
+    /\bi(?:'m| am)\s+better\s+than\s+(?:a|an|the|your)\b/gi,
+    /\byou\s+(?:don'?t|do\s+not)\s+need\s+(?:a|an|the|your)\s+(?:reviewer|architect|pm|product manager|designer|tester|qa|engineer|manager|mentor|lawyer|doctor|accountant)\b/gi,
+    /\blet\s+me\s+decide\s+for\s+you\b/gi,
+    /\bi\s+can\s+replace\b/gi,
+    /\breplace\s+(?:your|the)\s+(?:reviewer|architect|pm|manager|team)\b/gi,
+    /\bmore\s+(?:reliable|accurate)\s+than\s+(?:a|an|any)\s+(?:human|reviewer|architect|expert)\b/gi,
+];
+/** The policy itself. */
+export const professionalDisplacement = {
+    id: PROFESSIONAL_DISPLACEMENT_ID,
+    version: '1.0.0',
+    layer: 4,
+    description: 'Flags language that positions the agent as replacing human professionals.',
+    appliesTo: ['PreResponse'],
+    origin: 'first-party',
+    evaluate(ctx) {
+        const text = ctx.response?.text ?? ctx.request?.text ?? '';
+        if (text === '')
+            return allow();
+        const found = matches(DISPLACEMENT, text);
+        if (found.length === 0)
+            return allow();
+        const findings = findingsOf(PROFESSIONAL_DISPLACEMENT_ID, 'professional-displacement', found);
+        if (ctx.highRiskDomain !== undefined) {
+            return block('This replaces a professional judgement in a high-risk domain. Say what you can do and what a person has to decide.', findings[0]);
+        }
+        return flag(findings);
+    },
+};
+//# sourceMappingURL=professional-displacement.js.map

package/dist/policies/professional-displacement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"professional-displacement.js","sourceRoot":"","sources":["../../src/policies/professional-displacement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAqB,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;;;;;GAQG;AAEH,mCAAmC;AACnC,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAE3E,qEAAqE;AACrE,MAAM,YAAY,GAAG;IACnB,uDAAuD;IACvD,4KAA4K;IAC5K,qCAAqC;IACrC,yBAAyB;IACzB,uEAAuE;IACvE,gGAAgG;CACjG,CAAC;AAEF,yBAAyB;AACzB,MAAM,CAAC,MAAM,wBAAwB,GAAiB;IACpD,EAAE,EAAE,4BAA4B;IAChC,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,2EAA2E;IACxF,SAAS,EAAE,CAAC,aAAa,CAAC;IAC1B,MAAM,EAAE,aAAa;IACrB,QAAQ,CAAC,GAAG;QACV,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;QAC3D,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,4BAA4B,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;QAC9F,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,KAAK,CACV,oHAAoH,EACpH,QAAQ,CAAC,CAAC,CAAC,CACZ,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;CACF,CAAC"}

package/dist/policies/protect-policy.d.ts

@@ -0,0 +1,14 @@
+import { type PolicyModule } from '../policy.js';
+/**
+ * The protect-policy policy (§21.2, layer 1).
+ *
+ * It blocks a write to the files a person changes: the roles file, the
+ * generated agent files, the templates, the workflows, the lockfile and the
+ * state that records a decision. The rule is the second layer of the
+ * protection; the permission map is the first.
+ */
+/** The stable id of the policy. */
+export declare const PROTECT_POLICY_ID = "oa.protect-policy";
+/** The policy itself. */
+export declare const protectPolicy: PolicyModule;
+//# sourceMappingURL=protect-policy.d.ts.map

package/dist/policies/protect-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protect-policy.d.ts","sourceRoot":"","sources":["../../src/policies/protect-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAI/D;;;;;;;GAOG;AAEH,mCAAmC;AACnC,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,yBAAyB;AACzB,eAAO,MAAM,aAAa,EAAE,YAqB3B,CAAC"}

package/dist/policies/protect-policy.js

@@ -0,0 +1,35 @@
+import { allow, block } from '../policy.js';
+import { isProtected } from '../rules.js';
+import { readToolCall, writesFiles } from './tool-call.js';
+/**
+ * The protect-policy policy (§21.2, layer 1).
+ *
+ * It blocks a write to the files a person changes: the roles file, the
+ * generated agent files, the templates, the workflows, the lockfile and the
+ * state that records a decision. The rule is the second layer of the
+ * protection; the permission map is the first.
+ */
+/** The stable id of the policy. */
+export const PROTECT_POLICY_ID = 'oa.protect-policy';
+/** The policy itself. */
+export const protectPolicy = {
+    id: PROTECT_POLICY_ID,
+    version: '1.0.0',
+    layer: 1,
+    description: 'Blocks the writes to the files a person changes.',
+    appliesTo: ['PreToolCall'],
+    origin: 'first-party',
+    evaluate(ctx) {
+        const call = readToolCall(ctx);
+        if (call === undefined)
+            return allow();
+        if (!writesFiles(call))
+            return allow();
+        const touched = call.files.some((file) => (file.path !== undefined && isProtected(file.path)) ||
+            (file.fromPath !== undefined && isProtected(file.fromPath)));
+        if (!touched)
+            return allow();
+        return block('Policy, role, permission, build-config, lockfile, hook, workflow, lesson and waiver files are changed by a person (or, for bun.lock, by `bun add`; for roles.yaml and templates, by running the generator). Propose the change in chat.');
+    },
+};
+//# sourceMappingURL=protect-policy.js.map

package/dist/policies/protect-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protect-policy.js","sourceRoot":"","sources":["../../src/policies/protect-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAqB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE3D;;;;;;;GAOG;AAEH,mCAAmC;AACnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,yBAAyB;AACzB,MAAM,CAAC,MAAM,aAAa,GAAiB;IACzC,EAAE,EAAE,iBAAiB;IACrB,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,kDAAkD;IAC/D,SAAS,EAAE,CAAC,aAAa,CAAC;IAC1B,MAAM,EAAE,aAAa;IACrB,QAAQ,CAAC,GAAG;QACV,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,EAAE,CAAC;QACvC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAC7B,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAC9D,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,EAAE,CAAC;QAC7B,OAAO,KAAK,CACV,yOAAyO,CAC1O,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/policies/scope-enforcement.d.ts

@@ -0,0 +1,14 @@
+import { type PolicyModule } from '../policy.js';
+/**
+ * The scope enforcement policy (§21.2, layer 7).
+ *
+ * It flags what exceeds the declared scope of the role (§22): a reply that
+ * names a file the declaration does not cover. A role that declares no
+ * scope has nothing to enforce, and the policy lets the thing through
+ * rather than guess where the boundary is.
+ */
+/** The stable id of the policy. */
+export declare const SCOPE_ENFORCEMENT_ID = "oa.scope-enforcement";
+/** The policy itself. */
+export declare const scopeEnforcement: PolicyModule;
+//# sourceMappingURL=scope-enforcement.d.ts.map

package/dist/policies/scope-enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-enforcement.d.ts","sourceRoot":"","sources":["../../src/policies/scope-enforcement.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAE1E;;;;;;;GAOG;AAEH,mCAAmC;AACnC,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,yBAAyB;AACzB,eAAO,MAAM,gBAAgB,EAAE,YAsB9B,CAAC"}

package/dist/policies/scope-enforcement.js

@@ -0,0 +1,34 @@
+import { detectScopeDrift } from '../output-checks.js';
+import { allow, findingsOf, flag } from '../policy.js';
+/**
+ * The scope enforcement policy (§21.2, layer 7).
+ *
+ * It flags what exceeds the declared scope of the role (§22): a reply that
+ * names a file the declaration does not cover. A role that declares no
+ * scope has nothing to enforce, and the policy lets the thing through
+ * rather than guess where the boundary is.
+ */
+/** The stable id of the policy. */
+export const SCOPE_ENFORCEMENT_ID = 'oa.scope-enforcement';
+/** The policy itself. */
+export const scopeEnforcement = {
+    id: SCOPE_ENFORCEMENT_ID,
+    version: '1.0.0',
+    layer: 7,
+    description: 'Flags the output that exceeds the declared scope of the role.',
+    appliesTo: ['PreResponse'],
+    origin: 'first-party',
+    evaluate(ctx) {
+        const declared = ctx.scope?.declaredPaths ?? [];
+        if (declared.length === 0)
+            return allow();
+        const text = ctx.response?.text ?? ctx.request?.text ?? '';
+        if (text === '')
+            return allow();
+        const found = detectScopeDrift(text, declared);
+        if (found.length === 0)
+            return allow();
+        return flag(findingsOf(SCOPE_ENFORCEMENT_ID, 'out-of-scope', found.map((entry) => entry.match)));
+    },
+};
+//# sourceMappingURL=scope-enforcement.js.map

package/dist/policies/scope-enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-enforcement.js","sourceRoot":"","sources":["../../src/policies/scope-enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAqB,MAAM,cAAc,CAAC;AAE1E;;;;;;;GAOG;AAEH,mCAAmC;AACnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,yBAAyB;AACzB,MAAM,CAAC,MAAM,gBAAgB,GAAiB;IAC5C,EAAE,EAAE,oBAAoB;IACxB,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,+DAA+D;IAC5E,SAAS,EAAE,CAAC,aAAa,CAAC;IAC1B,MAAM,EAAE,aAAa;IACrB,QAAQ,CAAC,GAAG;QACV,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,CAAC;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;QAC3D,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,EAAE,CAAC;QACvC,OAAO,IAAI,CACT,UAAU,CACR,oBAAoB,EACpB,cAAc,EACd,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAClC,CACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/policies/secret-scan-writes.d.ts

@@ -0,0 +1,13 @@
+import { type PolicyModule } from '../policy.js';
+/**
+ * The secret-scan-writes policy (§21.2, layer 1).
+ *
+ * It blocks a write whose content holds what looks like a credential. The
+ * detector is the one the redaction uses, so the write that is blocked is
+ * the write the redaction would have caught.
+ */
+/** The stable id of the policy. */
+export declare const SECRET_SCAN_WRITES_ID = "oa.secret-scan-writes";
+/** The policy itself. */
+export declare const secretScanWrites: PolicyModule;
+//# sourceMappingURL=secret-scan-writes.d.ts.map

package/dist/policies/secret-scan-writes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan-writes.d.ts","sourceRoot":"","sources":["../../src/policies/secret-scan-writes.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAI/D;;;;;;GAMG;AAEH,mCAAmC;AACnC,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAE7D,yBAAyB;AACzB,eAAO,MAAM,gBAAgB,EAAE,YAqB9B,CAAC"}

package/dist/policies/secret-scan-writes.js

@@ -0,0 +1,38 @@
+import { findSecrets } from '@openagentsy/core';
+import { allow, block } from '../policy.js';
+import { contentOf } from '../rules.js';
+import { readToolCall } from './tool-call.js';
+/**
+ * The secret-scan-writes policy (§21.2, layer 1).
+ *
+ * It blocks a write whose content holds what looks like a credential. The
+ * detector is the one the redaction uses, so the write that is blocked is
+ * the write the redaction would have caught.
+ */
+/** The stable id of the policy. */
+export const SECRET_SCAN_WRITES_ID = 'oa.secret-scan-writes';
+/** The policy itself. */
+export const secretScanWrites = {
+    id: SECRET_SCAN_WRITES_ID,
+    version: '1.0.0',
+    layer: 1,
+    description: 'Blocks the writes whose content holds what looks like a credential.',
+    appliesTo: ['PreToolCall'],
+    origin: 'first-party',
+    evaluate(ctx) {
+        const call = readToolCall(ctx);
+        if (call === undefined)
+            return allow();
+        const content = contentOf({
+            toolName: call.name,
+            args: call.args,
+            files: call.files,
+        });
+        if (content === '')
+            return allow();
+        if (findSecrets(content).length === 0)
+            return allow();
+        return block('The content contains what looks like a credential. Use an env var or secret reference.');
+    },
+};
+//# sourceMappingURL=secret-scan-writes.js.map

package/dist/policies/secret-scan-writes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan-writes.js","sourceRoot":"","sources":["../../src/policies/secret-scan-writes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAqB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C;;;;;;GAMG;AAEH,mCAAmC;AACnC,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D,yBAAyB;AACzB,MAAM,CAAC,MAAM,gBAAgB,GAAiB;IAC5C,EAAE,EAAE,qBAAqB;IACzB,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,qEAAqE;IAClF,SAAS,EAAE,CAAC,aAAa,CAAC;IAC1B,MAAM,EAAE,aAAa;IACrB,QAAQ,CAAC,GAAG;QACV,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,SAAS,CAAC;YACxB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,EAAE;YAAE,OAAO,KAAK,EAAE,CAAC;QACnC,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,EAAE,CAAC;QACtD,OAAO,KAAK,CACV,wFAAwF,CACzF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/policies/selection.d.ts

@@ -0,0 +1,20 @@
+import type { RequestClassification } from '@openagentsy/core';
+import type { PolicyModule } from '../policy.js';
+/** A module of the stack, and the reason it is in it. */
+export interface SelectedPolicy {
+    /** The module that was selected. */
+    module: PolicyModule;
+    /** Why it was selected. */
+    reason: string;
+}
+/**
+ * The stack for a classification, and why each module is in it.
+ *
+ * A module of the always-on list is in every stack. A module of the
+ * baseline list is in every stack. A high-risk module is in the stack when
+ * the classification named its domain, and a plugin module is in the stack
+ * as well: a downstream project that installed a module asked for it to
+ * run.
+ */
+export declare function selectPolicies(modules: readonly PolicyModule[], classification: RequestClassification): SelectedPolicy[];
+//# sourceMappingURL=selection.d.ts.map

package/dist/policies/selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection.d.ts","sourceRoot":"","sources":["../../src/policies/selection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAkDjD,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,MAAM,EAAE,YAAY,CAAC;IACrB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAeD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,cAAc,EAAE,qBAAqB,GACpC,cAAc,EAAE,CAwBlB"}