@provos/ironcurtain 0.10.0 → 0.11.0

package/dist/trusted-process/control-server.d.ts

@@ -0,0 +1,101 @@
+/**
+ * HTTP control server for `ToolCallCoordinator`.
+ *
+ * Exposes a small JSON-over-HTTP API that the workflow orchestrator uses
+ * to hot-swap the coordinator's policy between state transitions. The
+ * server follows the same shape as the MITM proxy's control server:
+ * HTTP/1.1 over a Unix domain socket (preferred) or loopback TCP
+ * (fallback for platforms where UDS in bind mounts is not viable --
+ * typically macOS with Docker Desktop).
+ *
+ * Routing convention: endpoints live under `/__ironcurtain/<noun>/<verb>`.
+ * This prefix is shared with the MITM control server but each server
+ * routes a disjoint set of nouns (MITM owns `domains/*`; the coordinator
+ * owns `policy/*`). The two services are deliberately separate --
+ * they run in different processes and serve different concerns.
+ *
+ * Transport selection rules:
+ *   - If `socketPath` is supplied, bind UDS. The parent directory is
+ *     assumed to carry `0o700` mode (same pattern as MITM); this is
+ *     how access control is enforced.
+ *   - Otherwise if `port` is supplied, bind TCP on 127.0.0.1.
+ *   - Callers must supply exactly one of the two.
+ *
+ * The server is silent when no workflow is wired up: `start()` is only
+ * called when the coordinator was constructed with a control-socket
+ * path, so the single-session CLI / daemon / cron paths are unaffected.
+ */
+/**
+ * HTTP path for the policy hot-swap RPC. Exported so clients (the
+ * workflow orchestrator) can target it without stringly-typed paths.
+ */
+export declare const POLICY_LOAD_PATH = "/__ironcurtain/policy/load";
+/**
+ * Request body for `POST {POLICY_LOAD_PATH}`.
+ * Matches `ToolCallCoordinator.loadPolicy`'s argument shape exactly so
+ * the server is a thin HTTP adapter.
+ *
+ * Audit entries are written to the coordinator's single long-lived
+ * audit file (fixed at construction time); each entry carries a
+ * `persona` field so consumers can reconstruct per-persona slices
+ * without per-state file rotation.
+ */
+export interface LoadPolicyRequest {
+    readonly persona: string;
+    readonly policyDir: string;
+}
+/** Handler invoked when `POST /__ironcurtain/policy/load` arrives. */
+export type LoadPolicyHandler = (req: LoadPolicyRequest) => Promise<void>;
+/** Listen options. Exactly one of `socketPath` / `port` must be set. */
+export interface ControlServerListenOptions {
+    /** Absolute UDS path. Mutually exclusive with `port`. */
+    readonly socketPath?: string;
+    /** TCP port (0 for OS-assigned). Mutually exclusive with `socketPath`. */
+    readonly port?: number;
+}
+/** Address the server actually bound to (TCP port is filled in if 0 was passed). */
+export interface ControlServerAddress {
+    readonly socketPath?: string;
+    readonly port?: number;
+}
+/**
+ * Constructor dependencies for `ControlServer`. The handler is injected
+ * so the server has no direct coupling to `ToolCallCoordinator`; this
+ * keeps the server unit-testable without a full coordinator.
+ */
+export interface ControlServerDeps {
+    readonly onLoadPolicy: LoadPolicyHandler;
+}
+/**
+ * HTTP server that routes control requests to the coordinator.
+ *
+ * Lifecycle: call `start(options)` to bind the server and `stop()` to
+ * unbind it. After `stop()` completes, the same instance may be started
+ * again with new listen options.
+ */
+export declare class ControlServer {
+    private readonly server;
+    private boundAddress;
+    constructor(deps: ControlServerDeps);
+    /** Dispatches a single request. One method, one route, for now. */
+    private route;
+    /**
+     * Parses a `POST /__ironcurtain/policy/load` request and invokes the
+     * handler. 400 on malformed input; 500 on handler failure; 200 on
+     * success with `{ ok: true, loadedAt: <ISO> }`.
+     */
+    private handleLoadPolicy;
+    /**
+     * Begins accepting connections. Resolves once the socket is bound;
+     * rejects with the server's `'error'` event on bind failure.
+     */
+    start(options: ControlServerListenOptions): Promise<ControlServerAddress>;
+    /** Returns the bound address, or null if `start()` has not completed. */
+    getAddress(): ControlServerAddress | null;
+    /**
+     * Shuts down the server. Closes all in-flight connections, removes
+     * the socket file (UDS mode), and resolves once the listener has
+     * fully stopped.
+     */
+    stop(): Promise<void>;
+}

package/dist/trusted-process/control-server.js

@@ -0,0 +1,282 @@
+/**
+ * HTTP control server for `ToolCallCoordinator`.
+ *
+ * Exposes a small JSON-over-HTTP API that the workflow orchestrator uses
+ * to hot-swap the coordinator's policy between state transitions. The
+ * server follows the same shape as the MITM proxy's control server:
+ * HTTP/1.1 over a Unix domain socket (preferred) or loopback TCP
+ * (fallback for platforms where UDS in bind mounts is not viable --
+ * typically macOS with Docker Desktop).
+ *
+ * Routing convention: endpoints live under `/__ironcurtain/<noun>/<verb>`.
+ * This prefix is shared with the MITM control server but each server
+ * routes a disjoint set of nouns (MITM owns `domains/*`; the coordinator
+ * owns `policy/*`). The two services are deliberately separate --
+ * they run in different processes and serve different concerns.
+ *
+ * Transport selection rules:
+ *   - If `socketPath` is supplied, bind UDS. The parent directory is
+ *     assumed to carry `0o700` mode (same pattern as MITM); this is
+ *     how access control is enforced.
+ *   - Otherwise if `port` is supplied, bind TCP on 127.0.0.1.
+ *   - Callers must supply exactly one of the two.
+ *
+ * The server is silent when no workflow is wired up: `start()` is only
+ * called when the coordinator was constructed with a control-socket
+ * path, so the single-session CLI / daemon / cron paths are unaffected.
+ */
+import { existsSync, unlinkSync } from 'node:fs';
+import * as http from 'node:http';
+import * as logger from '../logger.js';
+import { PolicyDirValidationError } from '../config/validate-policy-dir.js';
+// ---------------------------------------------------------------------------
+// Public types
+// ---------------------------------------------------------------------------
+/**
+ * HTTP path for the policy hot-swap RPC. Exported so clients (the
+ * workflow orchestrator) can target it without stringly-typed paths.
+ */
+export const POLICY_LOAD_PATH = '/__ironcurtain/policy/load';
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+/** Cap on control-request body size (4 KiB). Load requests are tiny; anything larger is hostile or buggy. */
+const MAX_BODY_BYTES = 4096;
+/** Buffers an HTTP request body up to `maxBytes`; rejects if the limit is exceeded. */
+function bufferRequestBody(req, maxBytes) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > maxBytes) {
+                req.destroy();
+                reject(new Error(`Request body exceeds ${maxBytes} bytes`));
+            }
+            else {
+                chunks.push(chunk);
+            }
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks)));
+        req.on('error', reject);
+    });
+}
+/** Writes a JSON response with the given status code and body. */
+function writeJson(res, status, body) {
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(body));
+}
+/**
+ * Formats an unknown thrown value for server-side logging. Includes the
+ * stack trace when available -- this is server-side only, so full
+ * internals are appropriate. Never pass this output to an HTTP response:
+ * error messages in Node commonly embed filesystem paths and other
+ * internal details that should not cross the trust boundary.
+ */
+function formatErrorForLog(err) {
+    if (err instanceof Error) {
+        return err.stack ?? `${err.name}: ${err.message}`;
+    }
+    return String(err);
+}
+/**
+ * Validates the decoded body of a load-policy request. Returns the
+ * validated shape or a string describing the first validation failure.
+ */
+function parseLoadPolicyBody(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return 'body must be a JSON object';
+    const obj = raw;
+    if (typeof obj.persona !== 'string' || obj.persona.length === 0) {
+        return 'persona must be a non-empty string';
+    }
+    if (typeof obj.policyDir !== 'string' || obj.policyDir.length === 0) {
+        return 'policyDir must be a non-empty string';
+    }
+    return {
+        persona: obj.persona,
+        policyDir: obj.policyDir,
+    };
+}
+/**
+ * HTTP server that routes control requests to the coordinator.
+ *
+ * Lifecycle: call `start(options)` to bind the server and `stop()` to
+ * unbind it. After `stop()` completes, the same instance may be started
+ * again with new listen options.
+ */
+export class ControlServer {
+    server;
+    boundAddress = null;
+    constructor(deps) {
+        this.server = http.createServer((req, res) => {
+            this.route(req, res, deps).catch((err) => {
+                // The per-handler try/catch should absorb all errors; this is
+                // a belt-and-braces guard against a handler that leaks a
+                // rejection. Log the full error server-side (including stack)
+                // and return an opaque 500 to the client -- raw error text
+                // from Node commonly embeds absolute paths and internal
+                // details that should not cross the trust boundary.
+                logger.warn(`[control-server] unhandled handler error: ${formatErrorForLog(err)}`);
+                if (!res.headersSent) {
+                    writeJson(res, 500, { error: 'Internal error' });
+                }
+                else {
+                    res.end();
+                }
+            });
+        });
+    }
+    /** Dispatches a single request. One method, one route, for now. */
+    async route(req, res, deps) {
+        const url = req.url ?? '';
+        if (url === POLICY_LOAD_PATH && req.method === 'POST') {
+            await this.handleLoadPolicy(req, res, deps.onLoadPolicy);
+            return;
+        }
+        writeJson(res, 404, { error: 'Not Found' });
+    }
+    /**
+     * Parses a `POST /__ironcurtain/policy/load` request and invokes the
+     * handler. 400 on malformed input; 500 on handler failure; 200 on
+     * success with `{ ok: true, loadedAt: <ISO> }`.
+     */
+    async handleLoadPolicy(req, res, onLoadPolicy) {
+        let body;
+        try {
+            body = await bufferRequestBody(req, MAX_BODY_BYTES);
+        }
+        catch (err) {
+            // bufferRequestBody rejects on (a) oversized body — our controlled
+            // message — or (b) Node-level req 'error' events, whose messages
+            // may embed filesystem paths or other internals. Generic response
+            // either way; details go to the server log.
+            logger.warn(`ControlServer bufferRequestBody failed: ${formatErrorForLog(err)}`);
+            writeJson(res, 400, { error: 'Bad request' });
+            return;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(body.toString('utf-8'));
+        }
+        catch {
+            // JSON.parse's error text embeds parser internals (byte offsets
+            // and the surrounding characters of the input). The caller knows
+            // what they sent; a generic message is sufficient and avoids
+            // echoing any fragment of the request back.
+            writeJson(res, 400, { error: 'Invalid JSON' });
+            return;
+        }
+        const validated = parseLoadPolicyBody(parsed);
+        if (typeof validated === 'string') {
+            writeJson(res, 400, { error: validated });
+            return;
+        }
+        try {
+            await onLoadPolicy(validated);
+        }
+        catch (err) {
+            // PolicyDirValidationError is a caller-fault case (the RPC
+            // supplied a policyDir that escapes the trusted roots). Its
+            // message is built by our own code and references only paths
+            // the caller already knows, so surfacing it as 400 helps the
+            // orchestrator log the real cause instead of a blind "Internal
+            // error". Any other throw is an unexpected server-side failure
+            // whose error text may embed filesystem internals; log it
+            // server-side and return a generic 500.
+            if (err instanceof PolicyDirValidationError) {
+                writeJson(res, 400, { error: err.message });
+                return;
+            }
+            logger.warn(`[control-server] loadPolicy failed: ${formatErrorForLog(err)}`);
+            writeJson(res, 500, { error: 'Internal error' });
+            return;
+        }
+        writeJson(res, 200, { ok: true, loadedAt: new Date().toISOString() });
+    }
+    /**
+     * Begins accepting connections. Resolves once the socket is bound;
+     * rejects with the server's `'error'` event on bind failure.
+     */
+    async start(options) {
+        if (this.boundAddress !== null) {
+            throw new Error(`ControlServer.start() called twice (already listening at ${JSON.stringify(this.boundAddress)})`);
+        }
+        const { socketPath, port } = options;
+        const hasSocket = socketPath !== undefined;
+        const hasPort = port !== undefined;
+        if (hasSocket === hasPort) {
+            throw new Error('ControlServer.start: exactly one of socketPath or port must be provided');
+        }
+        if (socketPath !== undefined) {
+            // If a stale socket exists from a previous run, clear it. Matches
+            // MITM's behavior at mitm-proxy.ts:1600.
+            if (existsSync(socketPath)) {
+                unlinkSync(socketPath);
+            }
+            this.boundAddress = await listen(this.server, socketPath);
+            return this.boundAddress;
+        }
+        // Narrowing: port must be defined here (we rejected the both-undefined
+        // and both-defined cases above).
+        this.boundAddress = await listenTcp(this.server, port ?? 0);
+        return this.boundAddress;
+    }
+    /** Returns the bound address, or null if `start()` has not completed. */
+    getAddress() {
+        return this.boundAddress;
+    }
+    /**
+     * Shuts down the server. Closes all in-flight connections, removes
+     * the socket file (UDS mode), and resolves once the listener has
+     * fully stopped.
+     */
+    async stop() {
+        // closeAllConnections() cancels any in-flight requests so close()
+        // doesn't hang waiting for keep-alive connections to end.
+        this.server.closeAllConnections();
+        await new Promise((resolve) => {
+            this.server.close(() => resolve());
+        });
+        const socketPath = this.boundAddress?.socketPath;
+        if (socketPath) {
+            try {
+                if (existsSync(socketPath)) {
+                    unlinkSync(socketPath);
+                }
+            }
+            catch {
+                // best-effort cleanup
+            }
+        }
+        // Clear the bound address so `getAddress()` correctly reports the
+        // listener as gone and a subsequent `start()` is permitted (the
+        // double-start guard in `start()` keys off `boundAddress`).
+        this.boundAddress = null;
+    }
+}
+/** Listens on a UDS and resolves with the bound address. */
+function listen(server, socketPath) {
+    return new Promise((resolve, reject) => {
+        const onError = (err) => reject(err);
+        server.once('error', onError);
+        server.listen(socketPath, () => {
+            server.removeListener('error', onError);
+            resolve({ socketPath });
+        });
+    });
+}
+/** Listens on loopback TCP and resolves with the OS-assigned port. */
+function listenTcp(server, port) {
+    return new Promise((resolve, reject) => {
+        const onError = (err) => reject(err);
+        server.once('error', onError);
+        server.listen(port, '127.0.0.1', () => {
+            server.removeListener('error', onError);
+            const addr = server.address();
+            const boundPort = addr && typeof addr === 'object' ? addr.port : port;
+            resolve({ port: boundPort });
+        });
+    });
+}
+//# sourceMappingURL=control-server.js.map

package/dist/trusted-process/control-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-server.js","sourceRoot":"","sources":["../../src/trusted-process/control-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AA2C7D,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,6GAA6G;AAC7G,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,uFAAuF;AACvF,SAAS,iBAAiB,CAAC,GAAyB,EAAE,QAAgB;IACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,QAAQ,QAAQ,CAAC,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kEAAkE;AAClE,SAAS,SAAS,CAAC,GAAwB,EAAE,MAAc,EAAE,IAAa;IACxE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,KAAK,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,4BAA4B,CAAC;IACjF,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACP,MAAM,CAAc;IAC7B,YAAY,GAAgC,IAAI,CAAC;IAEzD,YAAY,IAAuB;QACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC3C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAChD,8DAA8D;gBAC9D,yDAAyD;gBACzD,8DAA8D;gBAC9D,2DAA2D;gBAC3D,wDAAwD;gBACxD,oDAAoD;gBACpD,MAAM,CAAC,IAAI,CAAC,6CAA6C,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,mEAAmE;IAC3D,KAAK,CAAC,KAAK,CAAC,GAAyB,EAAE,GAAwB,EAAE,IAAuB;QAC9F,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QAE1B,IAAI,GAAG,KAAK,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAC5B,GAAyB,EACzB,GAAwB,EACxB,YAA+B;QAE/B,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,4CAA4C;YAC5C,MAAM,CAAC,IAAI,CAAC,2CAA2C,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjF,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;YAChE,iEAAiE;YACjE,6DAA6D;YAC7D,4CAA4C;YAC5C,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2DAA2D;YAC3D,4DAA4D;YAC5D,6DAA6D;YAC7D,6DAA6D;YAC7D,+DAA+D;YAC/D,+DAA+D;YAC/D,0DAA0D;YAC1D,wCAAwC;YACxC,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,uCAAuC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7E,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,OAAmC;QAC7C,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACpH,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACrC,MAAM,SAAS,GAAG,UAAU,KAAK,SAAS,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC;QACnC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,kEAAkE;YAClE,yCAAyC;YACzC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3B,UAAU,CAAC,UAAU,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,CAAC,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,uEAAuE;QACvE,iCAAiC;QACjC,IAAI,CAAC,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,UAAU;QACR,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,kEAAkE;QAClE,0DAA0D;QAC1D,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAClC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC;QACjD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC3B,UAAU,CAAC,UAAU,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,gEAAgE;QAChE,4DAA4D;QAC5D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,4DAA4D;AAC5D,SAAS,MAAM,CAAC,MAAmB,EAAE,UAAkB;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;YAC7B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,SAAS,SAAS,CAAC,MAAmB,EAAE,IAAY;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACpC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACtE,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/trusted-process/domain-utils.d.ts

@@ -4,9 +4,13 @@
  * Domain matching (domainMatchesAllowlist, isIpAddress) shared by the
  * PolicyEngine and the list type registry (dynamic-list-types.ts).
  *
- * URL normalization and domain extraction (normalizeUrl, extractDomain,
- * normalizeGitUrl, extractGitDomain, resolveGitRemote) used by the
+ * Domain extraction (extractDomain, extractGitDomain) and git remote
+ * resolution (resolveGitRemote, resolveDefaultGitRemote) used by the
  * policy engine's domain check pipeline and the auto-approver.
+ *
+ * URL canonicalizers (normalizeUrl, normalizeGitUrl) live in
+ * `../types/url-normalize.js` so the ArgumentRole registry can use them
+ * without forming a runtime cycle through this module.
  */
 import type { ArgumentRole } from '../types/argument-roles.js';
 /**
@@ -29,12 +33,8 @@ export declare function isIpAddress(domain: string): boolean;
  * For plain hostname domains (e.g., from `fetch-url`), behavior is unchanged.
  */
 export declare function domainMatchesAllowlist(domain: string, allowedDomains: readonly string[]): boolean;
-/** Normalizes an HTTP(S) URL to a canonical form. Returns value as-is on parse failure. */
-export declare function normalizeUrl(value: string): string;
 /** Extracts the hostname from an HTTP(S) URL. Returns value as-is on parse failure. */
 export declare function extractDomain(value: string): string;
-/** Normalizes a git URL (HTTP or SSH format). SSH URLs are returned as-is. */
-export declare function normalizeGitUrl(value: string): string;
 /**
  * Extracts the domain from a URL value, dispatching to the correct
  * extractor based on role. Use this instead of calling extractDomain

package/dist/trusted-process/domain-utils.js

@@ -4,9 +4,13 @@
  * Domain matching (domainMatchesAllowlist, isIpAddress) shared by the
  * PolicyEngine and the list type registry (dynamic-list-types.ts).
  *
- * URL normalization and domain extraction (normalizeUrl, extractDomain,
- * normalizeGitUrl, extractGitDomain, resolveGitRemote) used by the
+ * Domain extraction (extractDomain, extractGitDomain) and git remote
+ * resolution (resolveGitRemote, resolveDefaultGitRemote) used by the
  * policy engine's domain check pipeline and the auto-approver.
+ *
+ * URL canonicalizers (normalizeUrl, normalizeGitUrl) live in
+ * `../types/url-normalize.js` so the ArgumentRole registry can use them
+ * without forming a runtime cycle through this module.
  */
 import { execFileSync } from 'node:child_process';
 import { resolve } from 'node:path';
@@ -52,20 +56,8 @@ export function domainMatchesAllowlist(domain, allowedDomains) {
     });
 }
 // ---------------------------------------------------------------------------
-// URL normalization and domain extraction
+// Domain extraction
 // ---------------------------------------------------------------------------
-/** Normalizes an HTTP(S) URL to a canonical form. Returns value as-is on parse failure. */
-export function normalizeUrl(value) {
-    try {
-        const url = new URL(value);
-        if (url.pathname === '/')
-            url.pathname = '';
-        return url.toString().replace(/\/$/, '');
-    }
-    catch {
-        return value;
-    }
-}
 /** Extracts the hostname from an HTTP(S) URL. Returns value as-is on parse failure. */
 export function extractDomain(value) {
     try {
@@ -75,14 +67,6 @@ export function extractDomain(value) {
         return value;
     }
 }
-/** Normalizes a git URL (HTTP or SSH format). SSH URLs are returned as-is. */
-export function normalizeGitUrl(value) {
-    // SSH format: git@host:path -- no further normalization needed
-    const sshMatch = value.match(/^(?:[\w.+-]+@)?([^:]+):/);
-    if (sshMatch && !value.includes('://'))
-        return value;
-    return normalizeUrl(value);
-}
 /**
  * Extracts the domain from a URL value, dispatching to the correct
  * extractor based on role. Use this instead of calling extractDomain

package/dist/trusted-process/domain-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-utils.js","sourceRoot":"","sources":["../../src/trusted-process/domain-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,cAAiC;IACtF,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAEpE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACrC,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB;YACjD,OAAO,QAAQ,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,2CAA2C;QAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,KAAK,OAAO,CAAC;QACrD,gDAAgD;QAChD,OAAO,QAAQ,KAAK,OAAO,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,2FAA2F;AAC3F,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG;YAAE,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACxD,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,IAAkB;IACpE,OAAO,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,IAAI,CAAC,GAAG,QAAQ,CAAC;IACjB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC5D,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAgC;IAC9E,gCAAgC;IAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gEAAgE;IAChE,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE;YACvD,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,gDAAgD;IAChE,CAAC;AACH,CAAC;AAKD;;GAEG;AACH,SAAS,gBAAgB,CAAC,IAAiB;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvF,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,MAAc,EAAE,IAAiB;IACxD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,MAAM,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,UAAkB,EAAE,IAAiB;IACzD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAgB;QAC5B,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC;IAEF,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC/C,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,OAAO,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"domain-utils.js","sourceRoot":"","sources":["../../src/trusted-process/domain-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,cAAiC;IACtF,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAEpE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACrC,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB;YACjD,OAAO,QAAQ,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,2CAA2C;QAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,KAAK,OAAO,CAAC;QACrD,gDAAgD;QAChD,OAAO,QAAQ,KAAK,OAAO,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,IAAkB;IACpE,OAAO,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,IAAI,CAAC,GAAG,QAAQ,CAAC;IACjB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC5D,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAgC;IAC9E,gCAAgC;IAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gEAAgE;IAChE,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE;YACvD,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,gDAAgD;IAChE,CAAC;AACH,CAAC;AAKD;;GAEG;AACH,SAAS,gBAAgB,CAAC,IAAiB;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvF,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,MAAc,EAAE,IAAiB;IACxD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,MAAM,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,UAAkB,EAAE,IAAiB;IACzD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAgB;QAC5B,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC;IAEF,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC/C,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,OAAO,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC"}

package/dist/trusted-process/error-prefixes.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Shared error-message prefixes used by the pipeline to tag error
+ * responses with a recognizable category. Consumers (logs, UI, user
+ * messages) can pattern-match on these to identify the error category
+ * without relying on internal decision fields.
+ *
+ * The coordinator itself classifies tool-call outcomes via the
+ * `_policyDecision.status` field stamped on every response, not by
+ * matching these prefixes.
+ */
+export declare const ERROR_PREFIX_DENIED = "DENIED:";
+export declare const ERROR_PREFIX_ESCALATION_REQUIRED = "ESCALATION REQUIRED:";
+export declare const ERROR_PREFIX_ESCALATION_DENIED = "ESCALATION DENIED:";
+export declare const ERROR_PREFIX_CIRCUIT_BREAKER = "CIRCUIT BREAKER:";
+export declare const ERROR_PREFIX_UNKNOWN_ARGS = "Unknown argument(s):";
+export declare const ERROR_PREFIX_MISSING_ANNOTATION = "Missing annotation for tool:";

package/dist/trusted-process/error-prefixes.js

@@ -0,0 +1,17 @@
+/**
+ * Shared error-message prefixes used by the pipeline to tag error
+ * responses with a recognizable category. Consumers (logs, UI, user
+ * messages) can pattern-match on these to identify the error category
+ * without relying on internal decision fields.
+ *
+ * The coordinator itself classifies tool-call outcomes via the
+ * `_policyDecision.status` field stamped on every response, not by
+ * matching these prefixes.
+ */
+export const ERROR_PREFIX_DENIED = 'DENIED:';
+export const ERROR_PREFIX_ESCALATION_REQUIRED = 'ESCALATION REQUIRED:';
+export const ERROR_PREFIX_ESCALATION_DENIED = 'ESCALATION DENIED:';
+export const ERROR_PREFIX_CIRCUIT_BREAKER = 'CIRCUIT BREAKER:';
+export const ERROR_PREFIX_UNKNOWN_ARGS = 'Unknown argument(s):';
+export const ERROR_PREFIX_MISSING_ANNOTATION = 'Missing annotation for tool:';
+//# sourceMappingURL=error-prefixes.js.map

package/dist/trusted-process/error-prefixes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-prefixes.js","sourceRoot":"","sources":["../../src/trusted-process/error-prefixes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAC7C,MAAM,CAAC,MAAM,gCAAgC,GAAG,sBAAsB,CAAC;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,oBAAoB,CAAC;AACnE,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAC/D,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAChE,MAAM,CAAC,MAAM,+BAA+B,GAAG,8BAA8B,CAAC"}

package/dist/trusted-process/index.d.ts

@@ -1,49 +1,66 @@
 import type { IronCurtainConfig } from '../config/types.js';
 import type { ToolCallRequest, ToolCallResult } from '../types/mcp.js';
-import { type WhitelistCandidateIpc } from './approval-whitelist.js';
-/** Result from an escalation callback, optionally including whitelist selection. */
-export interface EscalationResult {
-    readonly decision: 'approved' | 'denied';
-    /** Index into whitelistCandidates to whitelist. Absent = no whitelisting. */
-    readonly whitelistSelection?: number;
-}
-export type EscalationPromptFn = (request: ToolCallRequest, reason: string, context?: Readonly<Record<string, string>>, 
-/** Whitelist candidates for display to the user. */
-whitelistCandidates?: readonly WhitelistCandidateIpc[]) => Promise<EscalationResult>;
+import { type EscalationPromptFn } from './tool-call-coordinator.js';
+/** Re-export for backward compatibility with callers that import from here. */
+export type { EscalationPromptFn };
+export type { EscalationResult } from './tool-call-coordinator.js';
 export interface TrustedProcessOptions {
+    /**
+     * In-process escalation callback used by direct-tool-call code paths
+     * (integration tests). When set, the coordinator invokes this
+     * instead of consulting the file-IPC escalation directory.
+     */
     onEscalation?: EscalationPromptFn;
 }
+/**
+ * In-process trusted process. Wraps `ToolCallCoordinator` for callers
+ * (integration tests, fallback direct-tool-call mode) that want a
+ * pre-wired object with a single `handleToolCall` entry point.
+ *
+ * After Step 1, both in-process and Code Mode paths share the same
+ * coordinator implementation for policy evaluation and audit logging.
+ *
+ * Lifecycle: `new TrustedProcess(config)` + `await initialize()`. The
+ * coordinator is constructed during `initialize()` (not the constructor)
+ * so the auto-approve model can be built first and threaded into
+ * construction-time invariants, rather than being attached after the
+ * fact.
+ */
 export declare class TrustedProcess {
     private config;
-    private policyEngine;
+    private coordinator;
     private mcpManager;
     private mcpRoots;
-    private auditLog;
     private escalation;
-    private onEscalation?;
-    private readonly whitelist;
-    private autoApproveModel;
-    private lastUserMessage;
-    private serverContextMap;
+    private readonly options;
     constructor(config: IronCurtainConfig, options?: TrustedProcessOptions);
+    /** Internal accessor: throws if used before `initialize()`. */
+    private requireCoordinator;
     /**
      * Sets the most recent user message for auto-approval context.
      * Called by the session layer before each agent turn.
      */
     setLastUserMessage(message: string): void;
     initialize(): Promise<void>;
+    /**
+     * Creates the auto-approve language model when enabled in user config.
+     * Returns `null` when auto-approve is disabled or model construction
+     * fails (non-fatal: the session continues with manual escalation).
+     */
+    private buildAutoApproveModel;
+    /**
+     * Connects to every configured MCP server and registers its tools
+     * with the coordinator. Unavailable servers are logged and skipped.
+     */
+    private connectMcpServers;
     listTools(serverName: string): Promise<{
         name: string;
         description?: string;
         inputSchema: unknown;
     }[]>;
     /**
-     * Handles a tool call request through the full trusted process lifecycle:
-     *   1. Evaluate policy (allow / deny / escalate)
-     *   2. If escalated, prompt the human for approval
-     *   3. If allowed, forward to the real MCP server
-     *   4. Log the complete decision trace to the audit log
-     *   5. Return the result to the caller
+     * Handles a tool call through the coordinator's policy pipeline.
+     * Mirrors the legacy TrustedProcess.handleToolCall signature.
      */
     handleToolCall(request: ToolCallRequest): Promise<ToolCallResult>;
     shutdown(): Promise<void>;