@provos/ironcurtain 0.1.0

package/dist/pipeline/policy-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-verifier.js","sourceRoot":"","sources":["../../src/pipeline/policy-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAanE,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,SAAyB;IAEzB,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QAC9B,MAAM,OAAO,GAAoB;YAC/B,SAAS,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACxE,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;YACvC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ;YACnC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;YACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO;YACL,QAAQ;YACR,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,MAAM,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,gBAAgB;SACpD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAA0B;IAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxC,OAAO;YACL,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE;YACjD,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE;YACzE,WAAW,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;YACzD,eAAe,CAAC,CAAC,QAAQ,CAAC,gBAAgB,EAAE;YAC5C,aAAa,CAAC,CAAC,cAAc,WAAW,CAAC,CAAC,YAAY,GAAG;YACzD,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE;SACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CACvB,gBAAwB,EACxB,cAAkC,EAClC,eAAoC,EACpC,cAAwB,EACxB,gBAAmC,EACnC,WAAmB,EACnB,gBAAyB,EACzB,cAA2D;IAE3D,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;SACnG,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,WAAW,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,gBAAgB;QACtC,CAAC,CAAC,mCAAmC,gBAAgB,IAAI;QACzD,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;EAIP,gBAAgB;;;;EAIhB,SAAS;;;;;;EAMT,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;8BAIlB,WAAW;EACvC,eAAe;EACf,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BX,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;qNAIsI,CAAC;AACtN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,gBAAwB,EACxB,cAAkC,EAClC,eAAoC,EACpC,cAAwB,EACxB,SAAyB,EACzB,GAAkB,EAClB,YAAoB,kBAAkB,EACtC,gBAAyB,EACzB,UAAsC;IAEtC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAEnG,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpF,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAA0B,CAAC;IACrG,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAA0B,CAAC;IACjG,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAErG,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC/C,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;SACtB,CAAC;QACF,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;SAC/B,CAAC;QACF,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;SAC/B,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACjB,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACpC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC/B,KAAK,EAAE,WAAW;SACnB,CAAC,CAAC;QACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;gBAChB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;gBACnC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;gBAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;aAC7C,CAAC;YACF,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;SACtB,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,kBAAkB,GAAsB,EAAE,CAAC;IACjD,IAAI,gBAAgB,GAAG,SAAS,CAAC;IACjC,IAAI,gBAAoC,CAAC;IAEzC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,4CAA4C;QAC5C,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvD,kBAAkB,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAErC,4BAA4B;QAC5B,MAAM,MAAM,GAAG,gBAAgB,CAC7B,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,KAAK,EACL,gBAAgB,EAChB,cAAc,CACf,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC1D,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,cAAc;YACtB,MAAM;YACN,UAAU;SACX,CAAC,CAAC;QAEH,MAAM,YAAY,GAAmB,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1E,GAAG,CAAC;YACJ,MAAM,EAAE,WAAoB;SAC7B,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,IAAI,CAAC;YACV,KAAK;YACL,gBAAgB;YAChB,WAAW,EAAE,QAAQ,CAAC,QAAQ;YAC9B,YAAY;YACZ,kBAAkB,EAAE,QAAQ,CAAC,mBAAmB;SACjD,CAAC,CAAC;QAEH,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAErC,uDAAuD;QACvD,IAAI,QAAQ,CAAC,IAAI,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM;gBACN,OAAO,EAAE,QAAQ,CAAC,QAAQ;gBAC1B,eAAe,EAAE,kBAAkB;aACpC,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QAErC,yCAAyC;QACzC,gBAAgB,GAAG,YAAY,CAAC;IAClC,CAAC;IAED,mDAAmD;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;IAElD,OAAO;QACL,IAAI,EAAE,CAAC,WAAW,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;QACtF,MAAM;QACN,OAAO,EAAE,SAAS,EAAE,WAAW,IAAI,+BAA+B;QAClE,eAAe,EAAE,kBAAkB;KACpC,CAAC;AACJ,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAoB,EACpB,SAAyB;IAEzB,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,SAAS,GAAwB,EAAE,CAAC;IAE1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACnE,IAAI,YAAY,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,cAAc;gBAC7B,IAAI,EAAE,MAAM,CAAC,YAAY;aAC1B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,kBAAuC,EACvC,SAAyB;IAEzB,MAAM,WAAW,GAAyB,EAAE,CAAC;IAC7C,MAAM,mBAAmB,GAAa,EAAE,CAAC;IAEzC,KAAK,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAEvC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACtC,mBAAmB,CAAC,IAAI,CACtB,0BAA0B,EAAE,CAAC,mBAAmB,kDAAkD,CACnG,CAAC;YACF,SAAS;QACX,CAAC;QAED,WAAW,CAAC,IAAI,CAAC;YACf,mBAAmB,EAAE,EAAE,CAAC,mBAAmB;YAC3C,iBAAiB,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB;YAC7C,kBAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,kBAAkB;SAChD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAyB,EACzB,WAAiC;IAEjC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhF,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACvB,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC;QAC1B,OAAO;YACL,GAAG,CAAC;YACJ,gBAAgB,EAAE,UAAU,CAAC,iBAAiB;YAC9C,SAAS,EAAE,UAAU,CAAC,kBAAkB;SACzC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/pipeline/scenario-generator.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Scenario Generator -- LLM-driven test scenario generation.
+ *
+ * Generates concrete test scenarios (tool call + expected decision) from
+ * the constitution and tool annotations. Always includes mandatory
+ * handwritten scenarios alongside LLM-generated ones.
+ */
+import type { LanguageModel } from 'ai';
+import type { ToolAnnotation, TestScenario } from './types.js';
+export declare function buildGeneratorPrompt(constitutionText: string, annotations: ToolAnnotation[], sandboxDirectory: string, protectedPaths: string[], permittedDirectories?: string[]): string;
+export declare function generateScenarios(constitutionText: string, annotations: ToolAnnotation[], handwrittenScenarios: TestScenario[], sandboxDirectory: string, protectedPaths: string[], llm: LanguageModel, permittedDirectories?: string[], onProgress?: (message: string) => void): Promise<TestScenario[]>;

package/dist/pipeline/scenario-generator.js

@@ -0,0 +1,128 @@
+/**
+ * Scenario Generator -- LLM-driven test scenario generation.
+ *
+ * Generates concrete test scenarios (tool call + expected decision) from
+ * the constitution and tool annotations. Always includes mandatory
+ * handwritten scenarios alongside LLM-generated ones.
+ */
+import { z } from 'zod';
+import { generateObjectWithRepair } from './generate-with-repair.js';
+function buildGeneratorResponseSchema(serverNames, toolNames) {
+    const scenarioSchema = z.object({
+        description: z.string(),
+        request: z.object({
+            serverName: z.enum(serverNames),
+            toolName: z.enum(toolNames),
+            arguments: z.record(z.string(), z.unknown()),
+        }),
+        expectedDecision: z.enum(['allow', 'deny', 'escalate']),
+        reasoning: z.string(),
+    });
+    return z.object({
+        scenarios: z.array(scenarioSchema),
+    });
+}
+export function buildGeneratorPrompt(constitutionText, annotations, sandboxDirectory, protectedPaths, permittedDirectories) {
+    const annotationsSummary = annotations.map(a => {
+        const argsDesc = Object.entries(a.args)
+            .map(([name, roles]) => `${name}: [${roles.join(', ')}]`)
+            .join(', ');
+        return `  ${a.serverName}/${a.toolName}: ${a.comment}, sideEffects=${a.sideEffects}, args={${argsDesc || 'none'}}`;
+    }).join('\n');
+    return `You are generating test scenarios for a security policy engine. Each scenario is a concrete tool call with an expected policy decision.
+
+## Constitution
+
+${constitutionText}
+
+## Tool Annotations
+
+${annotationsSummary}
+
+## System Configuration
+
+- Sandbox directory: ${sandboxDirectory}
+${permittedDirectories && permittedDirectories.length > 0 ? `
+## Permitted Directories (from compiled policy rules)
+
+The compiled rules reference these specific directories. Use these EXACT paths in your scenarios:
+
+${permittedDirectories.map(p => `- ${p}`).join('\n')}
+` : ''}
+## Protected Paths (Structural Invariants)
+
+The following paths are protected by hardcoded structural invariants in the engine. These checks run BEFORE any compiled rules and always result in \`deny\` for any write or delete operation targeting them:
+
+${protectedPaths.map(p => `- ${p}`).join('\n')}
+
+IMPORTANT:
+- These specific absolute paths are the ONLY protected paths. A file with a similar name inside the sandbox (e.g., "${sandboxDirectory}/constitution.md") is NOT protected -- it is a regular file governed by normal policy rules.
+- Scenarios testing protected path access should use the REAL paths listed above and expect \`deny\`.
+- Do NOT generate scenarios that assume files inside the sandbox are protected just because they share a name with a protected file.
+
+## Instructions
+
+Generate diverse test scenarios covering:
+1. **Positive cases**: operations that SHOULD be allowed (within sandbox or permitted directories per constitution)
+2. **Negative cases**: operations that SHOULD be denied (categorically forbidden by the constitution, e.g., deletes outside sandbox)
+3. **Escalation cases**: operations outside the sandbox and permitted directories that are NOT categorically forbidden — these require human approval
+4. **Edge cases**: path traversal attacks, boundary conditions
+5. **Side-effect-free tools**: tools with no path arguments (should be allowed)
+6. **Move operations**: all moves involve a delete-path role on the source argument
+7. **Domain-based operations**: if any tools have URL roles (fetch-url, git-remote-url), generate scenarios for allowed domains, disallowed domains, and named remote resolution
+
+The three possible decisions are:
+- "allow" — explicitly permitted by the constitution
+- "deny" — categorically forbidden by the constitution
+- "escalate" — not explicitly permitted and not forbidden; requires human approval
+
+For each scenario provide:
+- description: what the test checks
+- request: { serverName, toolName, arguments } with concrete paths
+- expectedDecision: "allow", "deny", or "escalate"
+- reasoning: why this decision follows from the constitution
+
+IMPORTANT:
+- Use the EXACT permitted directory paths listed above (not generic paths like "/home/user/Downloads").
+- Use concrete paths based on the sandbox directory "${sandboxDirectory}".
+- For paths outside all permitted areas, use paths like "/etc/passwd", "/var/log/syslog", etc.
+- Structural invariants (protected paths, unknown tools) are handled separately. Focus on the constitution's content rules.
+- Generate at least 10 scenarios with good coverage across all three decision types (allow, deny, escalate).
+
+Be concise in descriptions and reasoning -- one sentence each.`;
+}
+/**
+ * Checks if two scenarios are substantially similar (same tool + same arguments).
+ */
+function areSimilar(a, b) {
+    if (a.request.toolName !== b.request.toolName)
+        return false;
+    if (a.request.serverName !== b.request.serverName)
+        return false;
+    const aArgs = JSON.stringify(a.request.arguments);
+    const bArgs = JSON.stringify(b.request.arguments);
+    return aArgs === bArgs;
+}
+export async function generateScenarios(constitutionText, annotations, handwrittenScenarios, sandboxDirectory, protectedPaths, llm, permittedDirectories, onProgress) {
+    const serverNames = [...new Set(annotations.map(a => a.serverName))];
+    const toolNames = [...new Set(annotations.map(a => a.toolName))];
+    const schema = buildGeneratorResponseSchema(serverNames, toolNames);
+    const prompt = buildGeneratorPrompt(constitutionText, annotations, sandboxDirectory, protectedPaths, permittedDirectories);
+    const { output } = await generateObjectWithRepair({
+        model: llm,
+        schema,
+        prompt,
+        onProgress,
+    });
+    // Mark all LLM-generated scenarios with source: 'generated'
+    const generated = output.scenarios.map(s => ({
+        ...s,
+        source: 'generated',
+    }));
+    // Deduplicate: remove generated scenarios that are substantially
+    // similar to handwritten ones
+    const unique = generated.filter(g => !handwrittenScenarios.some(h => areSimilar(g, h)));
+    // Handwritten first, then generated
+    return [...handwrittenScenarios, ...unique];
+}
+//# sourceMappingURL=scenario-generator.js.map

package/dist/pipeline/scenario-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenario-generator.js","sourceRoot":"","sources":["../../src/pipeline/scenario-generator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAGrE,SAAS,4BAA4B,CACnC,WAAkC,EAClC,SAAgC;IAEhC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;YAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC7C,CAAC;QACF,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,gBAAwB,EACxB,WAA6B,EAC7B,gBAAwB,EACxB,cAAwB,EACxB,oBAA+B;IAE/B,MAAM,kBAAkB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aACxD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,iBAAiB,CAAC,CAAC,WAAW,WAAW,QAAQ,IAAI,MAAM,GAAG,CAAC;IACrH,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;EAIP,gBAAgB;;;;EAIhB,kBAAkB;;;;uBAIG,gBAAgB;EACrC,oBAAoB,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;;;;;EAK1D,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CACnD,CAAC,CAAC,CAAC,EAAE;;;;;EAKJ,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;sHAGwE,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;uDA4B/E,gBAAgB;;;;;+DAKR,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,CAAe,EAAE,CAAe;IAClD,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,OAAO,KAAK,KAAK,KAAK,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,gBAAwB,EACxB,WAA6B,EAC7B,oBAAoC,EACpC,gBAAwB,EACxB,cAAwB,EACxB,GAAkB,EAClB,oBAA+B,EAC/B,UAAsC;IAEtC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAA0B,CAAC;IAC9F,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAA0B,CAAC;IAC1F,MAAM,MAAM,GAAG,4BAA4B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC;IAE3H,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAChD,KAAK,EAAE,GAAG;QACV,MAAM;QACN,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IAEH,4DAA4D;IAC5D,MAAM,SAAS,GAAmB,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC;QACJ,MAAM,EAAE,WAAoB;KAC7B,CAAC,CAAC,CAAC;IAEJ,iEAAiE;IACjE,8BAA8B;IAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACvD,CAAC;IAEF,oCAAoC;IACpC,OAAO,CAAC,GAAG,oBAAoB,EAAE,GAAG,MAAM,CAAC,CAAC;AAC9C,CAAC"}

package/dist/pipeline/tool-annotator.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Tool Annotator -- LLM-driven classification of MCP tool capabilities.
+ *
+ * Given a set of MCP tool schemas from a server, the annotator uses an LLM
+ * to classify each tool's effect, side effects, and argument roles. A
+ * compile-time heuristic validator catches annotation gaps before they
+ * reach runtime.
+ */
+import type { LanguageModel } from 'ai';
+import type { ToolAnnotation } from './types.js';
+export interface MCPToolSchema {
+    name: string;
+    description?: string;
+    inputSchema: Record<string, unknown>;
+}
+/** Builds role description lines dynamically from the registry for the LLM prompt. */
+export declare function buildRoleDescriptions(serverName?: string): string;
+export declare function buildAnnotationPrompt(serverName: string, tools: MCPToolSchema[]): string;
+export declare function annotateTools(serverName: string, tools: MCPToolSchema[], llm: LanguageModel, onProgress?: (message: string) => void): Promise<ToolAnnotation[]>;
+export interface HeuristicValidationResult {
+    valid: boolean;
+    warnings: string[];
+}
+export declare function validateAnnotationsHeuristic(tools: MCPToolSchema[], annotations: ToolAnnotation[]): HeuristicValidationResult;

package/dist/pipeline/tool-annotator.js

@@ -0,0 +1,201 @@
+/**
+ * Tool Annotator -- LLM-driven classification of MCP tool capabilities.
+ *
+ * Given a set of MCP tool schemas from a server, the annotator uses an LLM
+ * to classify each tool's effect, side effects, and argument roles. A
+ * compile-time heuristic validator catches annotation gaps before they
+ * reach runtime.
+ */
+import { z } from 'zod';
+import { ARGUMENT_ROLE_REGISTRY, getRoleDefinition, getRolesForServer, } from '../types/argument-roles.js';
+import { generateObjectWithRepair } from './generate-with-repair.js';
+function buildAnnotationsResponseSchema(serverName, tools) {
+    const toolNames = tools.map(t => t.name);
+    // Build a per-server role enum so the schema rejects irrelevant roles
+    const roleValues = getRolesForServer(serverName).map(([role]) => role);
+    const argumentRoleSchema = z.enum(roleValues);
+    // LLMs sometimes return a bare string instead of a single-element array.
+    // Accept both formats and normalize to an array.
+    const rolesArraySchema = z.union([
+        z.array(argumentRoleSchema),
+        argumentRoleSchema.transform(r => [r]),
+    ]);
+    // Map tool name → expected argument names from input schemas
+    const toolArgNames = new Map();
+    for (const t of tools) {
+        const props = (t.inputSchema['properties'] ?? {});
+        toolArgNames.set(t.name, Object.keys(props));
+    }
+    const toolAnnotationSchema = z.object({
+        toolName: z.enum(toolNames),
+        comment: z.string(),
+        sideEffects: z.boolean(),
+        args: z.record(z.string(), rolesArraySchema),
+    });
+    return z.object({
+        annotations: z.array(toolAnnotationSchema).superRefine((annotations, ctx) => {
+            for (let i = 0; i < annotations.length; i++) {
+                const a = annotations[i];
+                const expectedArgs = toolArgNames.get(a.toolName) ?? [];
+                const missingArgs = expectedArgs.filter(name => !(name in a.args));
+                if (missingArgs.length > 0) {
+                    ctx.addIssue({
+                        code: z.ZodIssueCode.custom,
+                        path: [i, 'args'],
+                        message: `Tool "${a.toolName}" is missing role annotations for arguments: ${missingArgs.join(', ')}. Each argument must have a role array (e.g. ["read-path"] or ["none"]).`,
+                    });
+                }
+            }
+        }),
+    });
+}
+/** Builds role description lines dynamically from the registry for the LLM prompt. */
+export function buildRoleDescriptions(serverName) {
+    const entries = serverName
+        ? getRolesForServer(serverName)
+        : [...ARGUMENT_ROLE_REGISTRY.entries()];
+    const lines = [];
+    for (const [role, def] of entries) {
+        lines.push(`   - "${role}" -- ${def.description}. ${def.annotationGuidance}`);
+    }
+    return lines.join('\n');
+}
+export function buildAnnotationPrompt(serverName, tools) {
+    const toolDescriptions = tools.map(t => {
+        return [
+            `Tool: ${t.name}`,
+            t.description ? `Description: ${t.description}` : '',
+            `Input Schema: ${JSON.stringify(t.inputSchema, null, 2)}`,
+        ].filter(Boolean).join('\n');
+    }).join('\n\n---\n\n');
+    return `You are annotating MCP tools for a security policy engine. For each tool on the "${serverName}" server, classify:
+
+1. **comment**: A brief one-sentence description of what the tool does.
+
+2. **sideEffects**: Whether the tool has security-relevant side effects.
+   - true if the tool modifies state OR can disclose information from resource paths (information disclosure is a security-relevant side effect)
+   - false ONLY if the tool has NO path arguments AND makes no state changes (e.g., a pure configuration query tool)
+   - When in doubt, mark as true (conservative)
+
+3. **args**: For each argument in the tool's input schema, assign an ARRAY of one or more roles:
+${buildRoleDescriptions(serverName)}
+
+   IMPORTANT: Each value in the args object MUST be an ARRAY of roles, even for single roles.
+   Example: { "path": ["read-path"], "content": ["none"] }
+   NOT: { "path": "read-path", "content": "none" }
+
+   An argument can have MULTIPLE roles. For example, the "source" argument of a move operation has both "read-path" and "delete-path" roles because the source is read and then deleted.
+
+   Only include arguments that appear in the tool's input schema. If the tool has no arguments, use an empty object.
+
+Here is a complete example annotation for a move_file tool that shows multi-role arguments:
+
+{
+  "toolName": "move_file",
+  "comment": "Moves or renames a file or directory from a source path to a destination path in a single operation.",
+  "sideEffects": true,
+  "args": {
+    "source": ["read-path", "delete-path"],
+    "destination": ["write-path"]
+  }
+}
+
+Here are the tools to annotate:
+
+${toolDescriptions}
+
+Return annotations for ALL ${tools.length} tools. Use the exact tool names as provided.`;
+}
+export async function annotateTools(serverName, tools, llm, onProgress) {
+    if (tools.length === 0)
+        return [];
+    const schema = buildAnnotationsResponseSchema(serverName, tools);
+    const prompt = buildAnnotationPrompt(serverName, tools);
+    const { output } = await generateObjectWithRepair({
+        model: llm,
+        schema,
+        prompt,
+        onProgress,
+    });
+    const annotations = output.annotations.map(a => ({
+        ...a,
+        serverName,
+    }));
+    // Validate all input tools are represented in the output
+    const annotatedNames = new Set(annotations.map(a => a.toolName));
+    const missingTools = tools.filter(t => !annotatedNames.has(t.name));
+    if (missingTools.length > 0) {
+        const names = missingTools.map(t => t.name).join(', ');
+        throw new Error(`Annotation incomplete: missing tools: ${names}`);
+    }
+    return annotations;
+}
+// -----------------------------------------------------------------------
+// Compile-time heuristic validation
+// -----------------------------------------------------------------------
+/** Argument names that strongly suggest filesystem path arguments. */
+const PATH_INDICATOR_NAMES = ['path', 'file', 'dir', 'directory', 'source', 'destination'];
+function looksLikePathArgument(argName) {
+    const lower = argName.toLowerCase();
+    return PATH_INDICATOR_NAMES.some(indicator => lower.includes(indicator));
+}
+function hasPathLikeValues(schema) {
+    const properties = schema['properties'];
+    if (!properties)
+        return false;
+    for (const prop of Object.values(properties)) {
+        const defaultVal = prop['default'];
+        if (typeof defaultVal === 'string' && (defaultVal.startsWith('/') || defaultVal.startsWith('.'))) {
+            return true;
+        }
+        const examples = prop['examples'];
+        if (Array.isArray(examples)) {
+            for (const ex of examples) {
+                if (typeof ex === 'string' && (ex.startsWith('/') || ex.startsWith('.'))) {
+                    return true;
+                }
+            }
+        }
+    }
+    return false;
+}
+export function validateAnnotationsHeuristic(tools, annotations) {
+    const annotationsByName = new Map();
+    for (const a of annotations) {
+        annotationsByName.set(a.toolName, a);
+    }
+    const warnings = [];
+    for (const tool of tools) {
+        const annotation = annotationsByName.get(tool.name);
+        if (!annotation) {
+            warnings.push(`Tool "${tool.name}" has no annotation`);
+            continue;
+        }
+        const properties = (tool.inputSchema['properties'] ?? {});
+        for (const [argName, argSchema] of Object.entries(properties)) {
+            if (!looksLikePathArgument(argName))
+                continue;
+            // Skip non-string arguments (booleans, enums, numbers named "directories" etc.)
+            const argType = argSchema?.['type'];
+            if (argType === 'boolean' || argType === 'number' || argType === 'integer')
+                continue;
+            const roles = annotation.args[argName];
+            const hasPathRole = roles && roles.some(r => getRoleDefinition(r).isResourceIdentifier);
+            if (!hasPathRole) {
+                warnings.push(`Tool "${tool.name}" argument "${argName}" looks like a path but has no path role in annotation`);
+            }
+        }
+        // Check for path-like default values or examples
+        if (hasPathLikeValues(tool.inputSchema)) {
+            const hasAnyPathRole = Object.values(annotation.args).some(roles => roles.some(r => getRoleDefinition(r).isResourceIdentifier));
+            if (!hasAnyPathRole) {
+                warnings.push(`Tool "${tool.name}" schema has path-like defaults/examples but no path roles in annotation`);
+            }
+        }
+    }
+    return {
+        valid: warnings.length === 0,
+        warnings,
+    };
+}
+//# sourceMappingURL=tool-annotator.js.map

package/dist/pipeline/tool-annotator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-annotator.js","sourceRoot":"","sources":["../../src/pipeline/tool-annotator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAUrE,SAAS,8BAA8B,CAAC,UAAkB,EAAE,KAAsB;IAChF,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAA0B,CAAC;IAElE,sEAAsE;IACtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAsC,CAAC;IAC5G,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE9C,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC;QAC/B,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAC3B,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;KACvC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC7E,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;QACxB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC;KAC7C,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE;YAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBACzB,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxD,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;wBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;wBACjB,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,gDAAgD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,0EAA0E;qBAC7K,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,UAAmB;IACvD,MAAM,OAAO,GAAG,UAAU;QACxB,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC;QAC/B,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,KAAsB;IAC9E,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACrC,OAAO;YACL,SAAS,CAAC,CAAC,IAAI,EAAE;YACjB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;YACpD,iBAAiB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;SAC1D,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAEvB,OAAO,oFAAoF,UAAU;;;;;;;;;;EAUrG,qBAAqB,CAAC,UAAU,CAAC;;;;;;;;;;;;;;;;;;;;;;;;EAwBjC,gBAAgB;;6BAEW,KAAK,CAAC,MAAM,+CAA+C,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,KAAsB,EACtB,GAAkB,EAClB,UAAsC;IAEtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAExD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAChD,KAAK,EAAE,GAAG;QACV,MAAM;QACN,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,WAAW,GAAqB,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,GAAG,CAAC;QACJ,UAAU;KACX,CAAC,CAAC,CAAC;IAEJ,yDAAyD;IACzD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,0EAA0E;AAC1E,oCAAoC;AACpC,0EAA0E;AAE1E,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAE3F,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA+B;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAwD,CAAC;IAC/F,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC1B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACzE,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,MAAM,UAAU,4BAA4B,CAC1C,KAAsB,EACtB,WAA6B;IAE7B,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE,CAA4C,CAAC;QAErG,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBAAE,SAAS;YAE9C,gFAAgF;YAChF,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YAErF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,WAAW,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAExF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,eAAe,OAAO,wDAAwD,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CACxD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CACpE,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,CAAC,IAAI,0EAA0E,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC5B,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/pipeline/types.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Shared types for the policy compilation pipeline.
+ *
+ * These types define the structure of the three persistent artifacts
+ * produced by `compile-policy`: tool annotations, compiled policy rules,
+ * and test scenarios. They are also used by the refactored PolicyEngine
+ * at runtime.
+ */
+import type { ArgumentRole } from '../types/argument-roles.js';
+export type { ArgumentRole };
+export { isArgumentRole, getArgumentRoleValues } from '../types/argument-roles.js';
+import type { PolicyDecisionStatus } from '../types/mcp.js';
+export type Decision = PolicyDecisionStatus;
+export interface ToolAnnotation {
+    toolName: string;
+    serverName: string;
+    comment: string;
+    sideEffects: boolean;
+    args: Record<string, ArgumentRole[]>;
+}
+export interface ToolAnnotationsFile {
+    generatedAt: string;
+    servers: Record<string, {
+        inputHash: string;
+        tools: ToolAnnotation[];
+    }>;
+}
+export interface PathCondition {
+    roles: ArgumentRole[];
+    within: string;
+}
+export interface DomainCondition {
+    roles: ArgumentRole[];
+    allowed: string[];
+}
+export interface CompiledRuleCondition {
+    roles?: ArgumentRole[];
+    server?: string[];
+    tool?: string[];
+    sideEffects?: boolean;
+    paths?: PathCondition;
+    domains?: DomainCondition;
+}
+export interface CompiledRule {
+    name: string;
+    description: string;
+    principle: string;
+    if: CompiledRuleCondition;
+    then: Decision;
+    reason: string;
+}
+export interface CompiledPolicyFile {
+    generatedAt: string;
+    constitutionHash: string;
+    inputHash: string;
+    rules: CompiledRule[];
+}
+export interface TestScenario {
+    description: string;
+    request: {
+        serverName: string;
+        toolName: string;
+        arguments: Record<string, unknown>;
+    };
+    expectedDecision: Decision;
+    reasoning: string;
+    source: 'generated' | 'handwritten';
+}
+export interface TestScenariosFile {
+    generatedAt: string;
+    constitutionHash: string;
+    inputHash: string;
+    scenarios: TestScenario[];
+}
+export interface ExecutionResult {
+    scenario: TestScenario;
+    actualDecision: Decision;
+    matchingRule: string;
+    pass: boolean;
+}
+export interface VerifierRound {
+    round: number;
+    executionResults: ExecutionResult[];
+    llmAnalysis: string;
+    newScenarios: TestScenario[];
+    attributedFailures?: AttributedFailure[];
+}
+export interface VerificationResult {
+    pass: boolean;
+    rounds: VerifierRound[];
+    summary: string;
+    failedScenarios: ExecutionResult[];
+}
+export type FailureBlame = {
+    kind: 'rule';
+    reasoning: string;
+} | {
+    kind: 'scenario';
+    reasoning: string;
+    correctedDecision: Decision;
+    correctedReasoning: string;
+} | {
+    kind: 'both';
+    reasoning: string;
+    correctedDecision: Decision;
+    correctedReasoning: string;
+};
+export interface AttributedFailure {
+    scenarioDescription: string;
+    blame: FailureBlame;
+}
+export interface ScenarioCorrection {
+    scenarioDescription: string;
+    correctedDecision: Decision;
+    correctedReasoning: string;
+}
+export interface RepairContext {
+    previousRules: CompiledRule[];
+    failedScenarios: ExecutionResult[];
+    judgeAnalysis: string;
+    attemptNumber: number;
+}

package/dist/pipeline/types.js

@@ -0,0 +1,10 @@
+/**
+ * Shared types for the policy compilation pipeline.
+ *
+ * These types define the structure of the three persistent artifacts
+ * produced by `compile-policy`: tool annotations, compiled policy rules,
+ * and test scenarios. They are also used by the refactored PolicyEngine
+ * at runtime.
+ */
+export { isArgumentRole, getArgumentRoleValues } from '../types/argument-roles.js';
+//# sourceMappingURL=types.js.map

package/dist/pipeline/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/pipeline/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/sandbox/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Sandbox -- Sets up UTCP Code Mode with the MCP proxy server.
+ *
+ * Code Mode creates a sandboxed TypeScript execution environment where
+ * LLM-generated code runs with no direct access to the network, filesystem,
+ * or credentials. Instead of connecting to real MCP servers, it connects
+ * to our MCP proxy server which evaluates policy on every tool call.
+ */
+import '@utcp/mcp';
+import type { IronCurtainConfig } from '../config/types.js';
+/**
+ * Transforms a UTCP tool name (dotted) into the actual callable function name
+ * in the sandbox. Mirrors UTCP Code Mode's sanitizeIdentifier() behavior:
+ * split on first dot (manual name), join remaining parts with underscores.
+ *
+ * Example: "filesystem.filesystem.list_directory" → "filesystem.filesystem_list_directory"
+ */
+export declare function toCallableName(toolName: string): string;
+export interface CodeExecutionResult {
+    result: unknown;
+    logs: string[];
+}
+export declare class Sandbox {
+    private client;
+    private toolCatalog;
+    private interfacePatchSnippet;
+    initialize(config: IronCurtainConfig): Promise<void>;
+    /**
+     * Builds the tool catalog and the __getToolInterface patch in one pass.
+     *
+     * The catalog is a compact one-line-per-tool listing using callable names.
+     * The patch snippet maps callable names back to raw UTCP names so that
+     * __getToolInterface works with either naming convention.
+     */
+    private buildToolCatalogAndPatch;
+    getToolInterfaces(): string;
+    executeCode(code: string, timeoutMs?: number): Promise<CodeExecutionResult>;
+    shutdown(): Promise<void>;
+}