@probelabs/visor 0.1.129 → 0.1.130-ee

package/README.md

@@ -186,6 +186,7 @@ Visor is a general SDLC automation framework:
  - [Developer Experience Playbook](#-developer-experience-playbook)
  - [Tag-Based Check Filtering](#-tag-based-check-filtering)
  - [PR Comment Commands](#-pr-comment-commands)
+ - [Enterprise Policy Engine (EE)](#-enterprise-policy-engine-ee)
  - [Suppressing Warnings](#-suppressing-warnings)
  - [Troubleshooting](#-troubleshooting)
  - [Security Defaults](#-security-defaults)
@@ -307,6 +308,28 @@ steps:
 
 Learn more: [docs/author-permissions.md](docs/author-permissions.md)
 
+## 🏢 Enterprise Policy Engine (EE)
+
+> **Enterprise Edition feature.** Requires a Visor EE license. Contact **hello@probelabs.com**.
+
+Add OPA-based role-based access control to gate checks, MCP tools, and AI capabilities using [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/) policies.
+
+```yaml
+policy:
+  engine: local
+  rules: ./policies/
+  fallback: deny
+  roles:
+    admin:
+      author_association: [OWNER]
+    developer:
+      author_association: [MEMBER, COLLABORATOR]
+```
+
+Checks denied by policy are skipped with reason `policy_denied`. Without a valid license, the engine silently disables and all checks run normally.
+
+Learn more: [docs/enterprise-policy.md](docs/enterprise-policy.md) | [examples/enterprise-policy/](examples/enterprise-policy/)
+
 ## 🔇 Suppressing Warnings
 
 Suppress a specific issue by adding a nearby `visor-disable` comment.

package/dist/cli-main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"","sourceRoot":"","sources":["file:///home/runner/work/visor/visor/src/cli-main.ts"],"names":[],"mappings":"AA0oBA;;GAEG;AACH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CA+2C1C"}
+{"version":3,"file":"","sourceRoot":"","sources":["file:///home/runner/work/visor/visor/src/cli-main.ts"],"names":[],"mappings":"AAyxBA;;GAEG;AACH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAu1C1C"}

package/dist/config.d.ts

@@ -83,6 +83,10 @@ export declare class ConfigManager {
      * Validate individual check configuration
      */
     private validateCheckConfig;
+    /**
+     * Validate policy engine configuration
+     */
+    private validatePolicyConfig;
     /**
      * Validate MCP servers object shape and values (basic shape only)
      */

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"","sourceRoot":"","sources":["file:///home/runner/work/visor/visor/src/config.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,WAAW,EAGX,YAAY,EAIZ,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,YAAY,EAS9C,CAAC;AAEX;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,eAAe,CAgBrB;IACF,OAAO,CAAC,kBAAkB,CAA6C;IACvE,OAAO,CAAC,kBAAkB,CAAgE;IAC1F,OAAO,CAAC,mBAAmB,CAA2D;IAEtF;;OAEG;IACU,UAAU,CACrB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,WAAW,CAAC;IAqHvB;;;OAGG;IACU,oBAAoB,CAC/B,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,EACzB,OAAO,GAAE,iBAAiB,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACrD,OAAO,CAAC,WAAW,CAAC;IAkDvB;;OAEG;IACU,iBAAiB,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC;IA4CrF;;OAEG;YACW,qBAAqB;IAiBnC;;OAEG;IACU,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC;IAgBrD;;OAEG;IACI,wBAAwB,IAAI,WAAW,GAAG,IAAI;IA0FrD;;OAEG;IACH,OAAO,CAAC,eAAe;IAuBvB;;;OAGG;YACW,uBAAuB;IAkFrC;;OAEG;YACW,aAAa;IA6B3B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAgC/B;;OAEG;IACI,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,UAAU,GAAG,YAAY;IAqB9F;;OAEG;IACU,0BAA0B,IAAI,OAAO,CAAC;QACjD,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,oBAAoB,EAAE,oBAAoB,CAAC;KAC5C,CAAC;IA2BF;;;;OAIG;IACI,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,UAAQ,GAAG,IAAI;IAoOzE;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAoH7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA8T3B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA0DhC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAgG7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA6DzB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA6EhC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA+B5B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAY9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;CA6B1B"}
+{"version":3,"file":"","sourceRoot":"","sources":["file:///home/runner/work/visor/visor/src/config.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,WAAW,EAGX,YAAY,EAIZ,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,YAAY,EAS9C,CAAC;AAEX;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,eAAe,CAgBrB;IACF,OAAO,CAAC,kBAAkB,CAA6C;IACvE,OAAO,CAAC,kBAAkB,CAAgE;IAC1F,OAAO,CAAC,mBAAmB,CAA2D;IAEtF;;OAEG;IACU,UAAU,CACrB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,WAAW,CAAC;IAqHvB;;;OAGG;IACU,oBAAoB,CAC/B,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,EACzB,OAAO,GAAE,iBAAiB,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACrD,OAAO,CAAC,WAAW,CAAC;IAkDvB;;OAEG;IACU,iBAAiB,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC;IA4CrF;;OAEG;YACW,qBAAqB;IAiBnC;;OAEG;IACU,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC;IAgBrD;;OAEG;IACI,wBAAwB,IAAI,WAAW,GAAG,IAAI;IA0FrD;;OAEG;IACH,OAAO,CAAC,eAAe;IAuBvB;;;OAGG;YACW,uBAAuB;IAkFrC;;OAEG;YACW,aAAa;IA6B3B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAgC/B;;OAEG;IACI,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,UAAU,GAAG,YAAY;IAqB9F;;OAEG;IACU,0BAA0B,IAAI,OAAO,CAAC;QACjD,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,oBAAoB,EAAE,oBAAoB,CAAC;KAC5C,CAAC;IA2BF;;;;OAIG;IACI,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,UAAQ,GAAG,IAAI;IA+SzE;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAoH7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA8T3B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAmM5B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA0DhC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAiG7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA6DzB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA6EhC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA+B5B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAY9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;CA6B1B"}

package/dist/docs/author-permissions.md

@@ -602,8 +602,28 @@ steps:
        (outputs["tests-full"] && outputs["tests-full"].error === false))
 ```
 
+## Enterprise Policy Engine (EE)
+
+For organizations that need centralized, auditable policy enforcement beyond inline `if`/`fail_if` expressions, Visor's Enterprise Edition includes an [OPA-based policy engine](./enterprise-policy.md).
+
+| Feature | Author Permissions (OSS) | Policy Engine (EE) |
+|---------|--------------------------|-------------------|
+| **License** | None (OSS) | EE license required |
+| **Mechanism** | JavaScript expressions in `if`/`fail_if` | OPA Rego policies |
+| **Scope** | Per-step conditions | Pre-execution gating, tool filtering, capability restriction |
+| **Role system** | `hasMinPermission()`, `isMember()`, etc. | Custom roles via `policy.roles` config |
+
+**When to use Author Permissions**: Simple permission checks for small teams with straightforward rules.
+
+**When to use the Policy Engine**: Centralized, auditable enforcement for organizations needing compliance, separation of duties, or complex role hierarchies. The policy engine evaluates before `if` conditions, providing an additional layer of control.
+
+Both systems work together -- author permission functions remain available even when the policy engine is active.
+
+Learn more: [Enterprise Policy Engine documentation](./enterprise-policy.md)
+
 ## Related Documentation
 
+- [Enterprise Policy Engine](./enterprise-policy.md) - OPA-based role-based access control (EE)
 - [Liquid Templates](./liquid-templates.md) - Template syntax and variables
 - [Debugging Guide](./debugging.md) - Debugging JavaScript expressions
 - [Command Provider](./command-provider.md) - Command execution and transforms