@pellux/goodvibes-sdk 0.18.3 → 0.18.12

package/dist/_internal/platform/runtime/permissions/rules/network-scope.js

@@ -0,0 +1,153 @@
+/**
+ * Network scope (host/URL) policy rule evaluator with host trust tier classification.
+ *
+ * NetworkScopeRule matches tool calls that make network requests, restricting
+ * or allowing access based on whether the target hostname matches any of the
+ * specified host patterns. Supports glob wildcards. Independently testable.
+ */
+import { classifyHostTrustTier, extractHostname, } from '../../../tools/fetch/trust-tiers.js';
+export { classifyHostTrustTier, extractHostname };
+/**
+ * toolMatchesNetworkPattern — Returns true if `toolName` matches the rule's toolPattern.
+ */
+function toolMatchesNetworkPattern(toolName, toolPattern) {
+    if (Array.isArray(toolPattern)) {
+        return toolPattern.some((p) => p === '*' || p === toolName);
+    }
+    return toolPattern === '*' || toolPattern === toolName;
+}
+/**
+ * extractHostAndPort — Extracts the hostname and port from args.
+ *
+ * Checks `url`, `host`, `hostname`, `endpoint` fields.
+ * Parses full URLs to extract hostname + port.
+ *
+ * Returns `null` if no network-related argument is found.
+ */
+function extractHostAndPort(args) {
+    // Try URL-shaped fields first
+    const urlCandidates = ['url', 'endpoint', 'uri', 'href'];
+    for (const key of urlCandidates) {
+        if (typeof args[key] === 'string') {
+            const raw = args[key];
+            try {
+                const parsed = new URL(raw.startsWith('http') ? raw : `https://${raw}`);
+                const port = parsed.port ? parseInt(parsed.port, 10) : null;
+                return { host: parsed.hostname, port };
+            }
+            catch {
+                // Not a valid URL — validate it looks like a hostname before using it
+                // Reject strings with spaces or exceeding max hostname length (RFC 1035: 253 chars)
+                if (raw.includes(' ') || raw.length > 253 || raw.length === 0) {
+                    return null;
+                }
+                return { host: raw, port: null };
+            }
+        }
+    }
+    // Try plain host/hostname fields
+    if (typeof args['host'] === 'string')
+        return { host: args['host'], port: null };
+    if (typeof args['hostname'] === 'string')
+        return { host: args['hostname'], port: null };
+    return null;
+}
+/**
+ * hostGlobToRegex — Converts a host glob pattern to a RegExp.
+ *
+ * Supports:
+ *   - `*`  — matches any sequence of non-dot characters (one segment)
+ *   - `**` — matches any sequence including dots (crosses subdomain boundaries)
+ */
+function hostGlobToRegex(pattern) {
+    const escaped = pattern
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*\*/g, '\u0001DS\u0001')
+        .replace(/\*/g, '[^.]*')
+        .replace(/\u0001DS\u0001/g, '.*');
+    return new RegExp(`^${escaped}$`, 'i');
+}
+/**
+ * hostMatchesPattern — Returns true if `host` matches the glob `pattern`.
+ */
+function hostMatchesPattern(host, pattern) {
+    if (pattern === '*')
+        return true;
+    return hostGlobToRegex(pattern).test(host);
+}
+/**
+ * evaluateNetworkScopeRule — Evaluates a single NetworkScopeRule against a tool call.
+ *
+ * Returns `matched: true` when:
+ *   1. The tool name matches the rule's `toolPattern`, AND
+ *   2. A network host is found in the args, AND
+ *   3. The hostname matches at least one of the rule's `hostPatterns`, AND
+ *   4. If `ports` is specified, the request port is in the allowed set.
+ *
+ * @param rule     - The NetworkScopeRule to evaluate.
+ * @param toolName - Name of the tool being called.
+ * @param args     - Arguments passed to the tool.
+ */
+export function evaluateNetworkScopeRule(rule, toolName, args) {
+    const toolMatches = toolMatchesNetworkPattern(toolName, rule.toolPattern);
+    if (!toolMatches) {
+        return {
+            matched: false,
+            step: {
+                layer: 'policy',
+                check: `network-scope-rule:${rule.id}`,
+                matched: false,
+                detail: `tool "${toolName}" does not match pattern "${rule.toolPattern}"`,
+            },
+        };
+    }
+    const hostInfo = extractHostAndPort(args);
+    if (hostInfo === null) {
+        return {
+            matched: false,
+            step: {
+                layer: 'policy',
+                check: `network-scope-rule:${rule.id}`,
+                matched: false,
+                detail: 'no network host/URL argument found in args',
+            },
+        };
+    }
+    const { host, port } = hostInfo;
+    // Check port constraint
+    if (rule.ports !== undefined && rule.ports.length > 0 && port !== null) {
+        const portAllowed = rule.ports.includes(0) || rule.ports.includes(port);
+        if (!portAllowed) {
+            return {
+                matched: false,
+                step: {
+                    layer: 'policy',
+                    check: `network-scope-rule:${rule.id}`,
+                    matched: false,
+                    detail: `port ${port} not in allowed ports [${rule.ports.join(', ')}]`,
+                },
+            };
+        }
+    }
+    const matchedPattern = rule.hostPatterns.find((p) => hostMatchesPattern(host, p));
+    if (matchedPattern !== undefined) {
+        return {
+            matched: true,
+            step: {
+                layer: 'policy',
+                check: `network-scope-rule:${rule.id}`,
+                matched: true,
+                detail: `host "${host}" matched pattern "${matchedPattern}"`,
+            },
+        };
+    }
+    return {
+        matched: false,
+        step: {
+            layer: 'policy',
+            check: `network-scope-rule:${rule.id}`,
+            matched: false,
+            detail: `host "${host}" did not match any of [${rule.hostPatterns.join(', ')}]`,
+        },
+    };
+}

package/dist/_internal/platform/runtime/permissions/rules/path-scope.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Permissions v2 — Path scope restriction policy rule evaluator.
+ *
+ * PathScopeRule matches tool calls that operate on file paths, restricting
+ * or allowing access based on whether the path argument matches any of the
+ * specified path patterns. Supports glob-style `**` wildcards.
+ * Independently testable.
+ */
+import type { PathScopeRule, EvaluationStep } from '../types.js';
+/** Result returned by evaluatePathScopeRule. */
+export interface PathScopeRuleResult {
+    matched: boolean;
+    step: EvaluationStep;
+}
+/**
+ * evaluatePathScopeRule — Evaluates a single PathScopeRule against a tool call.
+ *
+ * Returns `matched: true` when:
+ *   1. The tool name matches the rule's `toolPattern`, AND
+ *   2. A path argument is found, AND
+ *   3. The normalized absolute path matches at least one of the rule's `pathPatterns`.
+ *
+ * @param rule     — The PathScopeRule to evaluate.
+ * @param toolName — Name of the tool being called.
+ * @param args     — Arguments passed to the tool.
+ */
+export declare function evaluatePathScopeRule(rule: PathScopeRule, toolName: string, args: Record<string, unknown>, projectRoot?: string): PathScopeRuleResult;
+//# sourceMappingURL=path-scope.d.ts.map

package/dist/_internal/platform/runtime/permissions/rules/path-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-scope.d.ts","sourceRoot":"","sources":["../../../../../../src/_internal/platform/runtime/permissions/rules/path-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACf,MAAM,aAAa,CAAC;AAErB,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,cAAc,CAAC;CACtB;AA4DD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,aAAa,EACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,CAAC,EAAE,MAAM,GACnB,mBAAmB,CAgErB"}

package/dist/_internal/platform/runtime/permissions/rules/prefix.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Prefix matching policy rule evaluator.
+ *
+ * PrefixRule matches tool calls by tool name and optionally the command prefix
+ * of the first string argument. Independently testable — no external dependencies.
+ */
+import type { PrefixRule, EvaluationStep } from '../types.js';
+/** Result returned by evaluatePrefixRule. */
+export interface PrefixRuleResult {
+    matched: boolean;
+    step: EvaluationStep;
+}
+/**
+ * evaluatePrefixRule — Evaluates a single PrefixRule against a tool call.
+ *
+ * Returns `matched: true` only when:
+ *   1. The tool name matches the rule's `toolPattern`, AND
+ *   2. Either no `commandPrefixes` are specified, OR the primary command arg
+ *      starts with at least one of the specified prefixes (case-insensitive).
+ *
+ * @param rule     — The PrefixRule to evaluate.
+ * @param toolName — Name of the tool being called.
+ * @param args     — Arguments passed to the tool.
+ */
+export declare function evaluatePrefixRule(rule: PrefixRule, toolName: string, args: Record<string, unknown>): PrefixRuleResult;
+//# sourceMappingURL=prefix.d.ts.map

package/dist/_internal/platform/runtime/permissions/rules/prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefix.d.ts","sourceRoot":"","sources":["../../../../../../src/_internal/platform/runtime/permissions/rules/prefix.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EACf,MAAM,aAAa,CAAC;AAErB,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,cAAc,CAAC;CACtB;AA6BD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,gBAAgB,CAmElB"}

package/dist/_internal/platform/runtime/permissions/rules/prefix.js

@@ -0,0 +1,103 @@
+/**
+ * Prefix matching policy rule evaluator.
+ *
+ * PrefixRule matches tool calls by tool name and optionally the command prefix
+ * of the first string argument. Independently testable — no external dependencies.
+ */
+/**
+ * toolMatchesPrefixPattern — Returns true if `toolName` is matched by the rule's
+ * `toolPattern` field (which may be a single string, `'*'`, or an array).
+ */
+function toolMatchesPrefixPattern(toolName, toolPattern) {
+    if (Array.isArray(toolPattern)) {
+        return toolPattern.some((p) => p === '*' || p === toolName);
+    }
+    return toolPattern === '*' || toolPattern === toolName;
+}
+/**
+ * extractCommandArg — Extracts the primary command string from args.
+ * Checks `command`, `cmd`, then the first string value.
+ */
+function extractCommandArg(args) {
+    if (typeof args['command'] === 'string')
+        return args['command'];
+    if (typeof args['cmd'] === 'string')
+        return args['cmd'];
+    for (const v of Object.values(args)) {
+        if (typeof v === 'string')
+            return v;
+    }
+    return null;
+}
+/**
+ * evaluatePrefixRule — Evaluates a single PrefixRule against a tool call.
+ *
+ * Returns `matched: true` only when:
+ *   1. The tool name matches the rule's `toolPattern`, AND
+ *   2. Either no `commandPrefixes` are specified, OR the primary command arg
+ *      starts with at least one of the specified prefixes (case-insensitive).
+ *
+ * @param rule     — The PrefixRule to evaluate.
+ * @param toolName — Name of the tool being called.
+ * @param args     — Arguments passed to the tool.
+ */
+export function evaluatePrefixRule(rule, toolName, args) {
+    const toolMatches = toolMatchesPrefixPattern(toolName, rule.toolPattern);
+    if (!toolMatches) {
+        return {
+            matched: false,
+            step: {
+                layer: 'policy',
+                check: `prefix-rule:${rule.id}`,
+                matched: false,
+                detail: `tool "${toolName}" does not match pattern "${rule.toolPattern}"`,
+            },
+        };
+    }
+    // No prefix constraint — tool name match alone is sufficient
+    if (!rule.commandPrefixes || rule.commandPrefixes.length === 0) {
+        return {
+            matched: true,
+            step: {
+                layer: 'policy',
+                check: `prefix-rule:${rule.id}`,
+                matched: true,
+                detail: `tool "${toolName}" matched (no prefix constraint)`,
+            },
+        };
+    }
+    const commandArg = extractCommandArg(args);
+    if (commandArg === null) {
+        return {
+            matched: false,
+            step: {
+                layer: 'policy',
+                check: `prefix-rule:${rule.id}`,
+                matched: false,
+                detail: 'no string argument found to match prefix against',
+            },
+        };
+    }
+    const normalized = commandArg.trim().toLowerCase();
+    const matchedPrefix = rule.commandPrefixes.find((prefix) => normalized.startsWith(prefix.toLowerCase()));
+    if (matchedPrefix !== undefined) {
+        return {
+            matched: true,
+            step: {
+                layer: 'policy',
+                check: `prefix-rule:${rule.id}`,
+                matched: true,
+                detail: `command starts with prefix "${matchedPrefix}"`,
+            },
+        };
+    }
+    return {
+        matched: false,
+        step: {
+            layer: 'policy',
+            check: `prefix-rule:${rule.id}`,
+            matched: false,
+            detail: `command does not start with any of [${rule.commandPrefixes.join(', ')}]`,
+        },
+    };
+}

package/dist/_internal/platform/runtime/permissions/safety-checks.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Runtime permissions safety checks.
+ *
+ * These checks run first and always, regardless of mode, session overrides,
+ * or policy rules. They cannot be disabled by configuration.
+ */
+import type { CommandClassification, DecisionReason, EvaluationStep } from './types.js';
+export interface SafetyCheckResult {
+    /** Whether the call is blocked by a safety check. */
+    blocked: boolean;
+    /** Reason code if blocked (always a SAFETY_* code). */
+    reason?: DecisionReason;
+    /** Human-readable explanation for the evaluation trace. */
+    detail?: string;
+    /** Steps added to the trace during evaluation (one per check run). */
+    steps: EvaluationStep[];
+    /** Semantic classification if determined by the safety layer. */
+    classification?: CommandClassification;
+}
+/**
+ * runSafetyChecks — Executes all bypass-immune safety checks for a tool call.
+ *
+ * Returns a SafetyCheckResult with `blocked: false` if all checks pass,
+ * or `blocked: true` with a SAFETY_* reason code and trace step if any check fires.
+ *
+ * These checks cannot be bypassed by any policy rule, mode, or session override.
+ *
+ * @param toolName  — The tool being called.
+ * @param args      — Arguments passed to the tool.
+ */
+export declare function runSafetyChecks(toolName: string, args: Record<string, unknown>): SafetyCheckResult;
+//# sourceMappingURL=safety-checks.d.ts.map

package/dist/_internal/platform/runtime/permissions/safety-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety-checks.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/permissions/safety-checks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,cAAc,EACf,MAAM,YAAY,CAAC;AA2EpB,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,iEAAiE;IACjE,cAAc,CAAC,EAAE,qBAAqB,CAAC;CACxC;AAoID;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,iBAAiB,CA6EnB"}

package/dist/_internal/platform/runtime/permissions/safety-checks.js

@@ -0,0 +1,263 @@
+/**
+ * Runtime permissions safety checks.
+ *
+ * These checks run first and always, regardless of mode, session overrides,
+ * or policy rules. They cannot be disabled by configuration.
+ */
+// ── Dangerous prefix patterns ────────────────────────────────────────────────
+/**
+ * Shell command prefixes that are unconditionally dangerous.
+ * Matched against the first string argument of exec-class tools.
+ */
+const DESTRUCTIVE_PREFIXES = [
+    // Recursive root deletion
+    'rm -rf /',
+    'rm -fr /',
+    'rm --no-preserve-root',
+    // Disk destruction
+    'dd if=/dev/',
+    'mkfs',
+    'shred',
+    'wipefs',
+    // Privileged escalation
+    'chmod 777 /',
+    'chmod -R 777 /',
+    // Fork bomb patterns
+    ':(){ :|:&};:',
+    // /dev/null / disk overwrite
+    '> /dev/sda',
+    '> /dev/hda',
+];
+/**
+ * SQL DML patterns that are unconditionally dangerous.
+ * Matched case-insensitively against the first string argument of db-class tools.
+ */
+const DESTRUCTIVE_SQL_PATTERNS = [
+    /^\s*DROP\s+TABLE\b/i,
+    /^\s*DROP\s+DATABASE\b/i,
+    /^\s*TRUNCATE\b/i,
+    /^\s*DELETE\s+FROM\s+\w+\s*;?\s*$/i, // DELETE without WHERE
+];
+/**
+ * Known dangerous command patterns matched against the full command string.
+ */
+const DANGEROUS_PATTERNS = [
+    // Writing to /etc/passwd or /etc/shadow
+    /\/etc\/(passwd|shadow|sudoers)/,
+    // Cron injection
+    /\/etc\/cron/,
+    // SSH key manipulation
+    /\.ssh\/(authorized_keys|known_hosts)/,
+    // Bash history clear
+    /history\s+-[cw]/,
+    // iptables flush
+    /iptables\s+-F/,
+    // Base64-encoded shell
+    /base64\s+.*\|.*sh/,
+    // Curl-pipe-bash
+    /curl\s+.*\|\s*(ba)?sh/,
+    // Wget-pipe-bash
+    /wget\s+.*\|\s*(ba)?sh/,
+];
+/**
+ * Path segments that indicate a path escape attempt.
+ * Checked against normalized path arguments.
+ */
+const PATH_ESCAPE_INDICATORS = [
+    // Traversal to root or parent-of-root
+    '/../../../',
+    '/../../',
+    // Null byte injection
+    '\0',
+];
+// ── Exec-class tool detection ──────────────────────────────────────────────────
+/** Tool names that accept shell commands as their primary argument. */
+const EXEC_CLASS_TOOLS = new Set([
+    'exec',
+    'bash',
+    'sh',
+    'run',
+]);
+/** Tool names that accept file paths as their primary argument. */
+const PATH_CLASS_TOOLS = new Set([
+    'read',
+    'write',
+    'edit',
+    'find',
+]);
+/** Tool names that accept SQL as their primary argument. */
+const DB_CLASS_TOOLS = new Set([
+    'db',
+    'query',
+    'sql',
+]);
+// ── Argument extraction helpers ─────────────────────────────────────────────────
+/** Extracts the primary string argument (command, path, query, etc.) from args. */
+function extractPrimaryArg(args) {
+    const candidates = ['command', 'cmd', 'path', 'query', 'sql', 'script'];
+    for (const key of candidates) {
+        if (typeof args[key] === 'string')
+            return args[key];
+    }
+    // Fallback: first string value
+    for (const value of Object.values(args)) {
+        if (typeof value === 'string' && value.length > 0)
+            return value;
+    }
+    return null;
+}
+// ── Individual safety checks ──────────────────────────────────────────────────
+/**
+ * Checks whether the command string starts with a known destructive prefix.
+ * Only applied to exec-class tools.
+ */
+function checkDestructivePrefix(toolName, primaryArg) {
+    if (!EXEC_CLASS_TOOLS.has(toolName) || primaryArg === null) {
+        return { blocked: false };
+    }
+    const normalized = primaryArg.trim().toLowerCase();
+    for (const prefix of DESTRUCTIVE_PREFIXES) {
+        if (normalized.startsWith(prefix.toLowerCase())) {
+            return { blocked: true, detail: `Command starts with destructive prefix: "${prefix}"` };
+        }
+    }
+    return { blocked: false };
+}
+/**
+ * Checks whether the command matches known dangerous shell patterns.
+ * Applied to exec-class tools.
+ */
+function checkDangerousPattern(toolName, primaryArg) {
+    if (!EXEC_CLASS_TOOLS.has(toolName) || primaryArg === null) {
+        return { blocked: false };
+    }
+    for (const pattern of DANGEROUS_PATTERNS) {
+        if (pattern.test(primaryArg)) {
+            return { blocked: true, detail: `Command matches dangerous pattern: ${pattern.source}` };
+        }
+    }
+    return { blocked: false };
+}
+/**
+ * Checks whether a path argument attempts to escape safe boundaries.
+ * Applied to path-class tools.
+ */
+function checkPathEscape(toolName, args) {
+    if (!PATH_CLASS_TOOLS.has(toolName))
+        return { blocked: false };
+    const pathArgs = Object.entries(args)
+        .filter(([, v]) => typeof v === 'string')
+        .map(([, v]) => v);
+    for (const pathArg of pathArgs) {
+        for (const indicator of PATH_ESCAPE_INDICATORS) {
+            if (pathArg.includes(indicator)) {
+                return { blocked: true, detail: `Path argument contains escape indicator: "${indicator}"` };
+            }
+        }
+        // Null byte check applies to all strings
+        if (pathArg.includes('\0')) {
+            return { blocked: true, detail: 'Path argument contains null byte (injection attempt)' };
+        }
+    }
+    return { blocked: false };
+}
+/**
+ * Checks for destructive SQL patterns.
+ * Applied to db-class tools.
+ */
+function checkDestructiveSQL(toolName, primaryArg) {
+    if (!DB_CLASS_TOOLS.has(toolName) || primaryArg === null) {
+        return { blocked: false };
+    }
+    for (const pattern of DESTRUCTIVE_SQL_PATTERNS) {
+        if (pattern.test(primaryArg)) {
+            return { blocked: true, detail: `SQL matches destructive pattern: ${pattern.source}` };
+        }
+    }
+    return { blocked: false };
+}
+// ── Public API ───────────────────────────────────────────────────────────────────
+/**
+ * runSafetyChecks — Executes all bypass-immune safety checks for a tool call.
+ *
+ * Returns a SafetyCheckResult with `blocked: false` if all checks pass,
+ * or `blocked: true` with a SAFETY_* reason code and trace step if any check fires.
+ *
+ * These checks cannot be bypassed by any policy rule, mode, or session override.
+ *
+ * @param toolName  — The tool being called.
+ * @param args      — Arguments passed to the tool.
+ */
+export function runSafetyChecks(toolName, args) {
+    const steps = [];
+    const primaryArg = extractPrimaryArg(args);
+    // — Check 1: Destructive prefix
+    const prefixResult = checkDestructivePrefix(toolName, primaryArg);
+    steps.push({
+        layer: 'safety',
+        check: 'destructive-prefix',
+        matched: prefixResult.blocked,
+        detail: prefixResult.detail,
+    });
+    if (prefixResult.blocked) {
+        return {
+            blocked: true,
+            reason: 'SAFETY_DENY_DESTRUCTIVE_PREFIX',
+            detail: prefixResult.detail,
+            steps,
+            classification: 'destructive',
+        };
+    }
+    // — Check 2: Dangerous shell pattern
+    const patternResult = checkDangerousPattern(toolName, primaryArg);
+    steps.push({
+        layer: 'safety',
+        check: 'dangerous-pattern',
+        matched: patternResult.blocked,
+        detail: patternResult.detail,
+    });
+    if (patternResult.blocked) {
+        return {
+            blocked: true,
+            reason: 'SAFETY_DENY_DANGEROUS_PATTERN',
+            detail: patternResult.detail,
+            steps,
+            classification: 'destructive',
+        };
+    }
+    // — Check 3: Path escape
+    const pathResult = checkPathEscape(toolName, args);
+    steps.push({
+        layer: 'safety',
+        check: 'path-escape',
+        matched: pathResult.blocked,
+        detail: pathResult.detail,
+    });
+    if (pathResult.blocked) {
+        return {
+            blocked: true,
+            reason: 'SAFETY_DENY_PATH_ESCAPE',
+            detail: pathResult.detail,
+            steps,
+            classification: 'escalation',
+        };
+    }
+    // — Check 4: Destructive SQL
+    const sqlResult = checkDestructiveSQL(toolName, primaryArg);
+    steps.push({
+        layer: 'safety',
+        check: 'destructive-sql',
+        matched: sqlResult.blocked,
+        detail: sqlResult.detail,
+    });
+    if (sqlResult.blocked) {
+        return {
+            blocked: true,
+            reason: 'SAFETY_DENY_DANGEROUS_SQL',
+            detail: sqlResult.detail,
+            steps,
+            classification: 'destructive',
+        };
+    }
+    return { blocked: false, steps };
+}

package/dist/_internal/platform/runtime/permissions/simulation-scenarios.d.ts

@@ -0,0 +1,28 @@
+import type { PermissionSimulator } from './simulation.js';
+import type { DivergenceType, PermissionDecision, SimulationMode } from './types.js';
+export interface PolicySimulationScenario {
+    id: string;
+    label: string;
+    toolName: string;
+    args: Record<string, unknown>;
+}
+export interface PolicySimulationScenarioResult {
+    scenario: PolicySimulationScenario;
+    actualDecision: PermissionDecision;
+    simulatedDecision: PermissionDecision;
+    authoritativeDecision: PermissionDecision;
+    diverged: boolean;
+    divergenceType?: DivergenceType;
+}
+export interface PolicySimulationSummary {
+    simulatedAt: string;
+    mode: SimulationMode;
+    totalScenarios: number;
+    divergentScenarios: number;
+    allowedByActual: number;
+    allowedBySimulated: number;
+    results: PolicySimulationScenarioResult[];
+}
+export declare function buildDefaultPolicySimulationScenarios(): PolicySimulationScenario[];
+export declare function runPolicySimulationScenarios(simulator: PermissionSimulator, scenarios?: PolicySimulationScenario[]): PolicySimulationSummary;
+//# sourceMappingURL=simulation-scenarios.d.ts.map

package/dist/_internal/platform/runtime/permissions/simulation-scenarios.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simulation-scenarios.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/permissions/simulation-scenarios.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAErF,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,wBAAwB,CAAC;IACnC,cAAc,EAAE,kBAAkB,CAAC;IACnC,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,qBAAqB,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,8BAA8B,EAAE,CAAC;CAC3C;AAED,wBAAgB,qCAAqC,IAAI,wBAAwB,EAAE,CAWlF;AAED,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,mBAAmB,EAC9B,SAAS,GAAE,wBAAwB,EAA4C,GAC9E,uBAAuB,CAsBzB"}