@pellux/goodvibes-sdk 0.18.3 → 0.18.12

package/dist/_internal/platform/runtime/permissions/policy-signer.js

@@ -0,0 +1,146 @@
+/** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
+/**
+ * GC-PERM-011 — Policy signing and provenance for the permissions runtime.
+ *
+ * Provides HMAC-SHA256-based signature creation and verification for policy
+ * bundles. Used by the policy loader to validate bundle integrity before
+ * the evaluator processes any rules.
+ *
+ * Signing key is supplied at runtime (environment or config). The signer
+ * never stores keys in bundle payloads.
+ */
+import { createHmac, timingSafeEqual } from 'node:crypto';
+// ── Canonical serialisation ───────────────────────────────────────────────────
+/**
+ * canonicalise — Produces a deterministic JSON string for the given value.
+ *
+ * Keys are sorted recursively so that the representation is stable
+ * regardless of insertion order, ensuring consistent HMAC inputs.
+ *
+ * @param value — The value to serialise.
+ */
+export function canonicalise(value) {
+    if (value === null || typeof value !== 'object') {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return '[' + value.map(canonicalise).join(',') + ']';
+    }
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    const pairs = keys.map((k) => `${JSON.stringify(k)}:${canonicalise(obj[k])}`);
+    return '{' + pairs.join(',') + '}';
+}
+// ── Signing ───────────────────────────────────────────────────────────────────
+/**
+ * signBundle — Creates a signed policy bundle from a payload.
+ *
+ * Generates a hex-encoded HMAC-SHA256 signature over the canonical JSON
+ * of the payload and embeds it in the returned `SignedPolicyBundle`.
+ *
+ * @param bundleId — Unique identifier for this bundle.
+ * @param payload  — The policy payload to sign.
+ * @param key      — Raw signing key (Buffer or hex string).
+ * @param issuer   — Optional human-readable issuer label.
+ */
+export function signBundle(bundleId, payload, key, issuer) {
+    const issuedAt = new Date().toISOString();
+    const composite = { bundleId, issuedAt, issuer, payload };
+    const canonical = canonicalise(composite);
+    const keyBuf = typeof key === 'string' ? Buffer.from(key, 'hex') : key;
+    const signature = createHmac('sha256', keyBuf)
+        .update(canonical, 'utf8')
+        .digest('hex');
+    const bundle = {
+        bundleId,
+        issuedAt,
+        payload,
+        signature,
+    };
+    if (issuer !== undefined)
+        bundle.issuer = issuer;
+    return bundle;
+}
+// ── Verification ──────────────────────────────────────────────────────────────
+/**
+ * verifyBundle — Validates the HMAC-SHA256 signature of a policy bundle.
+ *
+ * Computes the expected HMAC over the canonical payload and performs
+ * a constant-time comparison against the stored signature to prevent
+ * timing side-channel attacks.
+ *
+ * Returns `{ ok: false, status: 'missing' }` when the bundle carries no
+ * signature field. Callers decide whether to accept unsigned bundles.
+ *
+ * @param bundle — The bundle to verify.
+ * @param key    — The verification key (Buffer or hex string).
+ */
+export function verifyBundle(bundle, key) {
+    if (bundle.signature === undefined || bundle.signature === '') {
+        return {
+            ok: false,
+            status: 'missing',
+            message: `Bundle "${bundle.bundleId}" carries no signature.`,
+        };
+    }
+    const composite = {
+        bundleId: bundle.bundleId,
+        issuedAt: bundle.issuedAt,
+        issuer: bundle.issuer,
+        payload: bundle.payload,
+    };
+    const canonical = canonicalise(composite);
+    const keyBuf = typeof key === 'string' ? Buffer.from(key, 'hex') : key;
+    let expected;
+    try {
+        expected = createHmac('sha256', keyBuf)
+            .update(canonical, 'utf8')
+            .digest();
+    }
+    catch {
+        // Non-fatal: key is malformed; treat as invalid
+        return {
+            ok: false,
+            status: 'invalid',
+            message: `Bundle "${bundle.bundleId}": key error during signature computation.`,
+        };
+    }
+    if (!/^[0-9a-f]+$/i.test(bundle.signature)) {
+        return {
+            ok: false,
+            status: 'invalid',
+            message: `Bundle "${bundle.bundleId}": signature is not valid hex.`,
+        };
+    }
+    let actual;
+    try {
+        actual = Buffer.from(bundle.signature, 'hex');
+    }
+    catch {
+        return {
+            ok: false,
+            status: 'invalid',
+            message: `Bundle "${bundle.bundleId}": signature is not valid hex.`,
+        };
+    }
+    if (expected.length !== actual.length) {
+        return {
+            ok: false,
+            status: 'invalid',
+            message: `Bundle "${bundle.bundleId}": signature length mismatch.`,
+        };
+    }
+    const valid = timingSafeEqual(expected, actual);
+    if (!valid) {
+        return {
+            ok: false,
+            status: 'invalid',
+            message: `Bundle "${bundle.bundleId}": signature mismatch — payload may be tampered.`,
+        };
+    }
+    return {
+        ok: true,
+        status: 'valid',
+        message: `Bundle "${bundle.bundleId}": signature valid.`,
+    };
+}

package/dist/_internal/platform/runtime/permissions/risk-language.d.ts

@@ -0,0 +1,3 @@
+import type { PermissionRiskFamily } from './risk-model.js';
+export declare function explainPermissionRiskFamily(family: PermissionRiskFamily): string;
+//# sourceMappingURL=risk-language.d.ts.map

package/dist/_internal/platform/runtime/permissions/risk-language.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-language.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/permissions/risk-language.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAqB5D,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAEhF"}

package/dist/_internal/platform/runtime/permissions/risk-language.js

@@ -0,0 +1,21 @@
+const CHECKLISTS = {
+    delegation: 'Confirm delegated scope, review objective, tool ceiling, and whether fan-out is justified.',
+    'shell-read': 'Confirm the command is read-only and does not expose credentials or unexpected process output.',
+    'shell-mutation': 'Confirm shell side effects, write scope, and whether the command changes project state.',
+    'shell-destructive': 'Confirm destructive impact, rollback path, and whether the command can affect unrelated state.',
+    'dependency-install': 'Confirm dependency provenance, lockfile impact, install scripts, and trusted runtime changes.',
+    'file-mutation': 'Confirm target path, write intent, and whether the file contains critical or secret-bearing state.',
+    'config-mutation': 'Confirm configuration blast radius, startup/auth impact, and whether this change alters future runtime behavior.',
+    'notebook-edit': 'Confirm notebook cell intent, hidden output safety, and execution metadata impact.',
+    'network-egress': 'Confirm host trust, egress scope, and whether remote content should enter session context.',
+    'remote-dispatch': 'Confirm remote target, trust class, capability ceiling, and whether work should leave the local runtime.',
+    'agent-spawn': 'Confirm spawned agent scope, tool ceiling, recursion depth, and whether fan-out is justified.',
+    'sandbox-policy-change': 'Confirm isolation-mode impact and whether this weakens a security boundary.',
+    'mcp-escalation': 'Confirm server identity, trust justification, host/path scope, and why constrained modes are insufficient.',
+    'plugin-lifecycle': 'Confirm package provenance, capability impact, install or update scope, and trusted extension posture.',
+    'hook-execution': 'Confirm hook source, execution mode, deny/mutate authority, and blocking behavior.',
+    generic: 'Confirm scope, target, and expected side effects before approving.',
+};
+export function explainPermissionRiskFamily(family) {
+    return CHECKLISTS[family];
+}

package/dist/_internal/platform/runtime/permissions/risk-model.d.ts

@@ -0,0 +1,9 @@
+import type { PermissionRequestAnalysis, PermissionRiskLevel } from '../../permissions/types.js';
+export type PermissionRiskFamily = 'delegation' | 'shell-read' | 'shell-mutation' | 'shell-destructive' | 'dependency-install' | 'file-mutation' | 'config-mutation' | 'notebook-edit' | 'network-egress' | 'remote-dispatch' | 'agent-spawn' | 'sandbox-policy-change' | 'mcp-escalation' | 'plugin-lifecycle' | 'hook-execution' | 'generic';
+export interface PermissionRiskDescriptor {
+    readonly family: PermissionRiskFamily;
+    readonly level: PermissionRiskLevel;
+    readonly headline: string;
+}
+export declare function classifyPermissionRiskFamily(toolName: string, args: Record<string, unknown>, analysis: PermissionRequestAnalysis): PermissionRiskDescriptor;
+//# sourceMappingURL=risk-model.d.ts.map

package/dist/_internal/platform/runtime/permissions/risk-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-model.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/permissions/risk-model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjG,MAAM,MAAM,oBAAoB,GAC5B,YAAY,GACZ,YAAY,GACZ,gBAAgB,GAChB,mBAAmB,GACnB,oBAAoB,GACpB,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,aAAa,GACb,uBAAuB,GACvB,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,SAAS,CAAC;AAEd,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAcD,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,EAAE,yBAAyB,GAClC,wBAAwB,CAgD1B"}

package/dist/_internal/platform/runtime/permissions/risk-model.js

@@ -0,0 +1,58 @@
+function configLikePath(path) {
+    return /(^|\/)(\.env(\.|$)|package\.json$|tsconfig(\.[^.]+)?\.json$|bunfig\.toml$|\.npmrc$|\.bashrc$|\.zshrc$|settings\.json$|config\.[^.]+$)/i.test(path);
+}
+function notebookPath(path) {
+    return path.toLowerCase().endsWith('.ipynb');
+}
+function dependencyInstall(command) {
+    return /\b(npm|pnpm|yarn|bun)\s+(install|add|update|upgrade)\b/i.test(command);
+}
+export function classifyPermissionRiskFamily(toolName, args, analysis) {
+    const target = String(analysis.target ?? '');
+    const command = typeof args.command === 'string' ? args.command : '';
+    if (toolName === 'mcp' && args.mode === 'set-trust' && args.trustMode === 'allow-all') {
+        return { family: 'mcp-escalation', level: 'critical', headline: 'MCP trust escalation' };
+    }
+    if ((toolName === 'remote' || toolName === 'remote_trigger') || (toolName === 'agent' && typeof args.template === 'string' && String(args.template).includes('remote'))) {
+        return { family: 'remote-dispatch', level: 'high', headline: 'Remote dispatch' };
+    }
+    if (toolName === 'agent') {
+        if (typeof args.mode === 'string' && (args.mode === 'spawn' || args.mode === 'batch-spawn')) {
+            return { family: 'agent-spawn', level: 'high', headline: 'Agent spawn' };
+        }
+        return { family: 'delegation', level: analysis.riskLevel, headline: 'Agent delegation' };
+    }
+    if (toolName === 'workflow' && (typeof args.eventPath === 'string' || typeof args.hookName === 'string' || typeof args.chainName === 'string')) {
+        return { family: 'hook-execution', level: 'high', headline: 'Hook execution' };
+    }
+    if (/(^|\/)\.goodvibes\/(plugins|skills|hooks|policies)\b/.test(target) || (toolName === 'write' && /(^|\/)(plugins|skills|hooks|policies)\//.test(target))) {
+        return { family: 'plugin-lifecycle', level: analysis.riskLevel, headline: 'Plugin or ecosystem lifecycle change' };
+    }
+    if (/sandbox\.(replIsolation|mcpIsolation|windowsMode|vmBackend)/.test(target) || /(^|\/)(sandbox|vm)-/.test(target)) {
+        return { family: 'sandbox-policy-change', level: 'high', headline: 'Sandbox policy change' };
+    }
+    if (analysis.targetKind === 'url') {
+        return { family: 'network-egress', level: analysis.riskLevel, headline: 'External network access' };
+    }
+    if (analysis.targetKind === 'path' && notebookPath(target)) {
+        return { family: 'notebook-edit', level: analysis.riskLevel, headline: 'Notebook edit' };
+    }
+    if (analysis.targetKind === 'path' && configLikePath(target)) {
+        return { family: 'config-mutation', level: analysis.riskLevel, headline: 'Configuration mutation' };
+    }
+    if (analysis.targetKind === 'path' && analysis.classification === 'write') {
+        return { family: 'file-mutation', level: analysis.riskLevel, headline: 'File mutation' };
+    }
+    if (analysis.classification === 'destructive') {
+        return { family: 'shell-destructive', level: analysis.riskLevel, headline: 'Destructive shell command' };
+    }
+    if (dependencyInstall(command)) {
+        return { family: 'dependency-install', level: analysis.riskLevel, headline: 'Dependency install' };
+    }
+    if (analysis.surface === 'shell') {
+        if (analysis.classification === 'read')
+            return { family: 'shell-read', level: analysis.riskLevel, headline: 'Read-only shell command' };
+        return { family: 'shell-mutation', level: analysis.riskLevel, headline: 'Shell command with side effects' };
+    }
+    return { family: 'generic', level: analysis.riskLevel, headline: analysis.summary };
+}

package/dist/_internal/platform/runtime/permissions/rules/arg-shape.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Argument shape/content policy rule evaluator.
+ *
+ * ArgShapeRule matches tool calls by testing that all specified key/value pairs
+ * are present in the tool's arguments. Values may be literal matches or regex
+ * patterns (strings prefixed with `/`). Independently testable.
+ */
+import type { ArgShapeRule, EvaluationStep } from '../types.js';
+/** Result returned by evaluateArgShapeRule. */
+export interface ArgShapeRuleResult {
+    matched: boolean;
+    step: EvaluationStep;
+}
+/**
+ * evaluateArgShapeRule — Evaluates a single ArgShapeRule against a tool call.
+ *
+ * Returns `matched: true` only when:
+ *   1. The tool name matches the rule's `toolPattern`, AND
+ *   2. ALL key/value matchers in `argMatchers` match the corresponding arg values.
+ *
+ * @param rule     — The ArgShapeRule to evaluate.
+ * @param toolName — Name of the tool being called.
+ * @param args     — Arguments passed to the tool.
+ */
+export declare function evaluateArgShapeRule(rule: ArgShapeRule, toolName: string, args: Record<string, unknown>): ArgShapeRuleResult;
+//# sourceMappingURL=arg-shape.d.ts.map

package/dist/_internal/platform/runtime/permissions/rules/arg-shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arg-shape.d.ts","sourceRoot":"","sources":["../../../../../../src/_internal/platform/runtime/permissions/rules/arg-shape.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACf,MAAM,aAAa,CAAC;AAErB,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,cAAc,CAAC;CACtB;AA2CD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,kBAAkB,CA0DpB"}

package/dist/_internal/platform/runtime/permissions/rules/arg-shape.js

@@ -0,0 +1,109 @@
+/**
+ * Argument shape/content policy rule evaluator.
+ *
+ * ArgShapeRule matches tool calls by testing that all specified key/value pairs
+ * are present in the tool's arguments. Values may be literal matches or regex
+ * patterns (strings prefixed with `/`). Independently testable.
+ */
+/**
+ * toolMatchesArgPattern — Returns true if `toolName` is matched by the rule's
+ * `toolPattern` field (which may be a single string, `'*'`, or an array).
+ */
+function toolMatchesArgPattern(toolName, toolPattern) {
+    if (Array.isArray(toolPattern)) {
+        return toolPattern.some((p) => p === '*' || p === toolName);
+    }
+    return toolPattern === '*' || toolPattern === toolName;
+}
+/**
+ * matchArgValue — Tests a single argument value against an expected matcher.
+ *
+ * - If `expected` is a string starting with `/`, it is treated as a regex
+ *   pattern (the trailing `/` and flags are parsed out if present).
+ * - Otherwise, strict equality is used.
+ *
+ * @param actual   — The actual argument value.
+ * @param expected — The expected matcher value from the rule.
+ */
+function matchArgValue(actual, expected) {
+    if (typeof expected === 'string' && expected.startsWith('/')) {
+        // Regex pattern: /pattern/ or /pattern/flags
+        const lastSlash = expected.lastIndexOf('/');
+        const flags = lastSlash > 0 ? expected.slice(lastSlash + 1) : '';
+        const source = expected.slice(1, lastSlash > 0 ? lastSlash : undefined);
+        try {
+            const re = new RegExp(source, flags);
+            return re.test(String(actual));
+        }
+        catch {
+            // Invalid regex — treat as literal string match
+            return actual === expected;
+        }
+    }
+    return actual === expected;
+}
+/**
+ * evaluateArgShapeRule — Evaluates a single ArgShapeRule against a tool call.
+ *
+ * Returns `matched: true` only when:
+ *   1. The tool name matches the rule's `toolPattern`, AND
+ *   2. ALL key/value matchers in `argMatchers` match the corresponding arg values.
+ *
+ * @param rule     — The ArgShapeRule to evaluate.
+ * @param toolName — Name of the tool being called.
+ * @param args     — Arguments passed to the tool.
+ */
+export function evaluateArgShapeRule(rule, toolName, args) {
+    const toolMatches = toolMatchesArgPattern(toolName, rule.toolPattern);
+    if (!toolMatches) {
+        return {
+            matched: false,
+            step: {
+                layer: 'policy',
+                check: `arg-shape-rule:${rule.id}`,
+                matched: false,
+                detail: `tool "${toolName}" does not match pattern "${rule.toolPattern}"`,
+            },
+        };
+    }
+    const matchers = Object.entries(rule.argMatchers);
+    if (matchers.length === 0) {
+        // Empty matchers — matches any args for the tool
+        return {
+            matched: true,
+            step: {
+                layer: 'policy',
+                check: `arg-shape-rule:${rule.id}`,
+                matched: true,
+                detail: 'tool matched with empty arg matchers (wildcard)',
+            },
+        };
+    }
+    const failedMatchers = [];
+    for (const [key, expected] of matchers) {
+        const actual = args[key];
+        if (!matchArgValue(actual, expected)) {
+            failedMatchers.push(key);
+        }
+    }
+    if (failedMatchers.length === 0) {
+        return {
+            matched: true,
+            step: {
+                layer: 'policy',
+                check: `arg-shape-rule:${rule.id}`,
+                matched: true,
+                detail: `all ${matchers.length} arg matcher(s) satisfied`,
+            },
+        };
+    }
+    return {
+        matched: false,
+        step: {
+            layer: 'policy',
+            check: `arg-shape-rule:${rule.id}`,
+            matched: false,
+            detail: `arg matchers failed for keys: [${failedMatchers.join(', ')}]`,
+        },
+    };
+}

package/dist/_internal/platform/runtime/permissions/rules/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Runtime permissions policy rules barrel export.
+ *
+ * Re-exports all rule evaluator functions and result types.
+ */
+export { evaluatePrefixRule } from './prefix.js';
+export type { PrefixRuleResult } from './prefix.js';
+export { evaluateArgShapeRule } from './arg-shape.js';
+export type { ArgShapeRuleResult } from './arg-shape.js';
+export { evaluatePathScopeRule } from './path-scope.js';
+export type { PathScopeRuleResult } from './path-scope.js';
+export { evaluateNetworkScopeRule } from './network-scope.js';
+export type { NetworkScopeRuleResult } from './network-scope.js';
+export { evaluateModeConstraintRule } from './mode-constraint.js';
+export type { ModeConstraintRuleResult } from './mode-constraint.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/_internal/platform/runtime/permissions/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/_internal/platform/runtime/permissions/rules/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,YAAY,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/_internal/platform/runtime/permissions/rules/index.js

@@ -0,0 +1,10 @@
+/**
+ * Runtime permissions policy rules barrel export.
+ *
+ * Re-exports all rule evaluator functions and result types.
+ */
+export { evaluatePrefixRule } from './prefix.js';
+export { evaluateArgShapeRule } from './arg-shape.js';
+export { evaluatePathScopeRule } from './path-scope.js';
+export { evaluateNetworkScopeRule } from './network-scope.js';
+export { evaluateModeConstraintRule } from './mode-constraint.js';

package/dist/_internal/platform/runtime/permissions/rules/mode-constraint.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Mode-based constraint policy rule evaluator.
+ *
+ * ModeConstraintRule activates only when a specific PermissionMode is active.
+ * Primarily used by the mode evaluation layer (Layer 2) to enforce mode-level
+ * restrictions, but can also be used in user/managed policy rules.
+ * Independently testable.
+ */
+import type { ModeConstraintRule, PermissionMode, CommandClassification, EvaluationStep } from '../types.js';
+/** Result returned by evaluateModeConstraintRule. */
+export interface ModeConstraintRuleResult {
+    matched: boolean;
+    step: EvaluationStep;
+}
+/**
+ * evaluateModeConstraintRule — Evaluates a single ModeConstraintRule.
+ *
+ * Returns `matched: true` when:
+ *   1. The active mode is listed in `rule.activeModes`, AND
+ *   2. The tool name matches `rule.toolPattern`, AND
+ *   3. If `rule.classifications` is set, the tool classification is in that list.
+ *
+ * @param rule           — The ModeConstraintRule to evaluate.
+ * @param toolName       — Name of the tool being called.
+ * @param activeMode     — The currently active PermissionMode.
+ * @param classification — The semantic classification of the tool call (may be undefined).
+ */
+export declare function evaluateModeConstraintRule(rule: ModeConstraintRule, toolName: string, activeMode: PermissionMode, classification: CommandClassification | undefined): ModeConstraintRuleResult;
+//# sourceMappingURL=mode-constraint.d.ts.map

package/dist/_internal/platform/runtime/permissions/rules/mode-constraint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode-constraint.d.ts","sourceRoot":"","sources":["../../../../../../src/_internal/platform/runtime/permissions/rules/mode-constraint.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,cAAc,EACf,MAAM,aAAa,CAAC;AAErB,qDAAqD;AACrD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,cAAc,CAAC;CACtB;AAeD;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,qBAAqB,GAAG,SAAS,GAChD,wBAAwB,CAoD1B"}

package/dist/_internal/platform/runtime/permissions/rules/mode-constraint.js

@@ -0,0 +1,80 @@
+/**
+ * Mode-based constraint policy rule evaluator.
+ *
+ * ModeConstraintRule activates only when a specific PermissionMode is active.
+ * Primarily used by the mode evaluation layer (Layer 2) to enforce mode-level
+ * restrictions, but can also be used in user/managed policy rules.
+ * Independently testable.
+ */
+/**
+ * toolMatchesModePattern — Returns true if `toolName` matches the rule's toolPattern.
+ */
+function toolMatchesModePattern(toolName, toolPattern) {
+    if (Array.isArray(toolPattern)) {
+        return toolPattern.some((p) => p === '*' || p === toolName);
+    }
+    return toolPattern === '*' || toolPattern === toolName;
+}
+/**
+ * evaluateModeConstraintRule — Evaluates a single ModeConstraintRule.
+ *
+ * Returns `matched: true` when:
+ *   1. The active mode is listed in `rule.activeModes`, AND
+ *   2. The tool name matches `rule.toolPattern`, AND
+ *   3. If `rule.classifications` is set, the tool classification is in that list.
+ *
+ * @param rule           — The ModeConstraintRule to evaluate.
+ * @param toolName       — Name of the tool being called.
+ * @param activeMode     — The currently active PermissionMode.
+ * @param classification — The semantic classification of the tool call (may be undefined).
+ */
+export function evaluateModeConstraintRule(rule, toolName, activeMode, classification) {
+    // Check mode match
+    if (!rule.activeModes.includes(activeMode)) {
+        return {
+            matched: false,
+            step: {
+                layer: 'mode',
+                check: `mode-constraint-rule:${rule.id}`,
+                matched: false,
+                detail: `mode "${activeMode}" not in activeModes [${rule.activeModes.join(', ')}]`,
+            },
+        };
+    }
+    // Check tool name match
+    const toolMatches = toolMatchesModePattern(toolName, rule.toolPattern);
+    if (!toolMatches) {
+        return {
+            matched: false,
+            step: {
+                layer: 'mode',
+                check: `mode-constraint-rule:${rule.id}`,
+                matched: false,
+                detail: `tool "${toolName}" does not match pattern "${rule.toolPattern}"`,
+            },
+        };
+    }
+    // Check classification constraint (optional)
+    if (rule.classifications !== undefined && rule.classifications.length > 0) {
+        if (classification === undefined || !rule.classifications.includes(classification)) {
+            return {
+                matched: false,
+                step: {
+                    layer: 'mode',
+                    check: `mode-constraint-rule:${rule.id}`,
+                    matched: false,
+                    detail: `classification "${classification ?? 'unknown'}" not in [${rule.classifications.join(', ')}]`,
+                },
+            };
+        }
+    }
+    return {
+        matched: true,
+        step: {
+            layer: 'mode',
+            check: `mode-constraint-rule:${rule.id}`,
+            matched: true,
+            detail: `mode "${activeMode}" + tool "${toolName}" matched rule`,
+        },
+    };
+}

package/dist/_internal/platform/runtime/permissions/rules/network-scope.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Network scope (host/URL) policy rule evaluator with host trust tier classification.
+ *
+ * NetworkScopeRule matches tool calls that make network requests, restricting
+ * or allowing access based on whether the target hostname matches any of the
+ * specified host patterns. Supports glob wildcards. Independently testable.
+ */
+import type { NetworkScopeRule, EvaluationStep } from '../types.js';
+import { classifyHostTrustTier, extractHostname, type HostTrustTier, type TrustTierConfig } from '../../../tools/fetch/trust-tiers.js';
+/**
+ * Re-export host trust tier types from the network scope module for
+ * consumers that access trust classification via the permissions layer.
+ *
+ * The policy panel uses these exports to show host trust classification
+ * alongside permission decisions.
+ */
+export type { HostTrustTier, TrustTierConfig };
+export { classifyHostTrustTier, extractHostname };
+/** Result returned by evaluateNetworkScopeRule. */
+export interface NetworkScopeRuleResult {
+    matched: boolean;
+    step: EvaluationStep;
+}
+/**
+ * evaluateNetworkScopeRule — Evaluates a single NetworkScopeRule against a tool call.
+ *
+ * Returns `matched: true` when:
+ *   1. The tool name matches the rule's `toolPattern`, AND
+ *   2. A network host is found in the args, AND
+ *   3. The hostname matches at least one of the rule's `hostPatterns`, AND
+ *   4. If `ports` is specified, the request port is in the allowed set.
+ *
+ * @param rule     - The NetworkScopeRule to evaluate.
+ * @param toolName - Name of the tool being called.
+ * @param args     - Arguments passed to the tool.
+ */
+export declare function evaluateNetworkScopeRule(rule: NetworkScopeRule, toolName: string, args: Record<string, unknown>): NetworkScopeRuleResult;
+//# sourceMappingURL=network-scope.d.ts.map

package/dist/_internal/platform/runtime/permissions/rules/network-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-scope.d.ts","sourceRoot":"","sources":["../../../../../../src/_internal/platform/runtime/permissions/rules/network-scope.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,eAAe,EACrB,MAAM,qCAAqC,CAAC;AAE7C;;;;;;GAMG;AACH,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,CAAC;AAElD,mDAAmD;AACnD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,cAAc,CAAC;CACtB;AA2ED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,sBAAsB,CAoExB"}