@rigour-labs/core 5.5.4 → 6.1.0-beta.1

package/dist/firewall/policy-hash.js

@@ -0,0 +1,5 @@
+import { createHash } from 'crypto';
+export function hashPolicy(input) {
+    const payload = typeof input === 'string' ? input : JSON.stringify(input);
+    return createHash('sha256').update(payload).digest('hex').slice(0, 16);
+}

package/dist/firewall/scope-enforcement.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Enforce agent file ownership against claimed globs.
+ * Fail-closed: when scopes exist, writer agentId is required (no union-allow).
+ */
+import type { PolicyEvaluation } from './types.js';
+export interface AgentScopeRecord {
+    agentId: string;
+    taskScope: string[];
+}
+export declare function normalizeRelPath(cwd: string, filePath: string): string;
+export declare function isPathInScope(relPath: string, globs: string[]): boolean;
+export declare function validateAgentClaimedScope(taskScope: string[]): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Operator-controlled allowlist: `.rigour/operator-scopes.json`
+ * `{ "agents": { "agent-id": ["packages/foo/**"] } }`
+ */
+export declare function loadOperatorScopes(cwd: string): Promise<Record<string, string[]> | null>;
+export declare function isScopeSubset(claimed: string[], allowed: string[]): boolean;
+export declare function evaluateWriteScope(cwd: string, filePath: string, agentScopes: AgentScopeRecord[], agentId?: string): PolicyEvaluation;
+export declare function loadAgentScopesFromDisk(cwd: string): Promise<AgentScopeRecord[]>;
+export declare function assertWritesInScope(cwd: string, files: string[], agentId?: string): Promise<PolicyEvaluation>;

package/dist/firewall/scope-enforcement.js

@@ -0,0 +1,155 @@
+/**
+ * Enforce agent file ownership against claimed globs.
+ * Fail-closed: when scopes exist, writer agentId is required (no union-allow).
+ */
+import path from 'path';
+import micromatch from 'micromatch';
+import fs from 'fs-extra';
+import { hashPolicy } from './policy-hash.js';
+/** Globs agents may not self-claim without operator authority. */
+const FORBIDDEN_AGENT_SCOPES = new Set(['*', '**', '**/*', '**/**', '/*', '/']);
+const SENSITIVE_SCOPE_PATTERNS = [
+    /^\.github(\/|$|\*\*)/i,
+    /(^|\/)\.env/i,
+    /(^|\/)secrets?(\/|$|\*\*)/i,
+    /^\*\*\/\.github/,
+];
+export function normalizeRelPath(cwd, filePath) {
+    const abs = path.isAbsolute(filePath) ? filePath : path.join(cwd, filePath);
+    return path.relative(cwd, abs).replace(/\\/g, '/');
+}
+export function isPathInScope(relPath, globs) {
+    if (!globs || globs.length === 0)
+        return false;
+    const normalized = relPath.replace(/\\/g, '/');
+    return micromatch.isMatch(normalized, globs, { dot: true });
+}
+export function validateAgentClaimedScope(taskScope) {
+    if (!taskScope.length) {
+        return { ok: false, reason: 'taskScope must be a non-empty list of path globs' };
+    }
+    for (const raw of taskScope) {
+        const s = raw.replace(/\\/g, '/').trim();
+        if (!s) {
+            return { ok: false, reason: 'Empty scope glob is not allowed' };
+        }
+        if (FORBIDDEN_AGENT_SCOPES.has(s)) {
+            return {
+                ok: false,
+                reason: `Scope "${s}" is too broad for agent self-registration (operator authority required)`,
+            };
+        }
+        if (SENSITIVE_SCOPE_PATTERNS.some(re => re.test(s))) {
+            return {
+                ok: false,
+                reason: `Scope "${s}" covers sensitive paths; set operator scopes or RIGOUR_ALLOW_AGENT_SCOPE_AUTHORITY=1`,
+            };
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Operator-controlled allowlist: `.rigour/operator-scopes.json`
+ * `{ "agents": { "agent-id": ["packages/foo/**"] } }`
+ */
+export async function loadOperatorScopes(cwd) {
+    const p = path.join(cwd, '.rigour', 'operator-scopes.json');
+    if (!(await fs.pathExists(p)))
+        return null;
+    try {
+        const raw = await fs.readJson(p);
+        if (raw?.agents && typeof raw.agents === 'object') {
+            return raw.agents;
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+export function isScopeSubset(claimed, allowed) {
+    // Each claimed glob must be matched/covered by an allowed glob (exact or nested under allowed prefix)
+    return claimed.every(c => allowed.some(a => c === a || c.startsWith(a.replace(/\*\*$/, '').replace(/\*$/, '')) || micromatch.isMatch(c, a, { dot: true })));
+}
+export function evaluateWriteScope(cwd, filePath, agentScopes, agentId) {
+    const policyHash = hashPolicy({ agentScopes, agentId });
+    const rel = normalizeRelPath(cwd, filePath);
+    const timestamp = new Date().toISOString();
+    if (!agentScopes.length) {
+        return {
+            decision: 'allow',
+            reason: 'No agent scopes registered; scope enforcement inactive',
+            ruleId: 'scope.inactive',
+            policyHash,
+            timestamp,
+        };
+    }
+    if (!agentId) {
+        return {
+            decision: 'scope-violation',
+            reason: 'Writer agentId is required when agent scopes are registered (fail-closed; no union-allow)',
+            ruleId: 'scope.unbound',
+            policyHash,
+            timestamp,
+        };
+    }
+    const agents = agentScopes.filter(a => a.agentId === agentId);
+    if (agents.length === 0) {
+        return {
+            decision: 'scope-violation',
+            reason: `Agent "${agentId}" is not registered`,
+            ruleId: 'scope.unregistered',
+            policyHash,
+            timestamp,
+        };
+    }
+    const allowed = agents.some(a => isPathInScope(rel, a.taskScope));
+    if (!allowed) {
+        const scopes = agents.map(a => `${a.agentId}:[${a.taskScope.join(', ')}]`).join('; ');
+        return {
+            decision: 'scope-violation',
+            reason: `Write to "${rel}" is outside assigned scope (${scopes})`,
+            ruleId: 'scope.out-of-bounds',
+            policyHash,
+            timestamp,
+        };
+    }
+    return {
+        decision: 'allow',
+        reason: `Path "${rel}" is within assigned agent scope`,
+        ruleId: 'scope.allow',
+        policyHash,
+        timestamp,
+    };
+}
+export async function loadAgentScopesFromDisk(cwd) {
+    const sessionPath = path.join(cwd, '.rigour', 'agent-session.json');
+    if (!(await fs.pathExists(sessionPath)))
+        return [];
+    try {
+        const raw = await fs.readJson(sessionPath);
+        const agents = Array.isArray(raw?.agents) ? raw.agents : [];
+        return agents.map((a) => ({
+            agentId: String(a.agentId),
+            taskScope: Array.isArray(a.taskScope) ? a.taskScope.map(String) : [],
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+export async function assertWritesInScope(cwd, files, agentId) {
+    const scopes = await loadAgentScopesFromDisk(cwd);
+    for (const file of files) {
+        const ev = evaluateWriteScope(cwd, file, scopes, agentId);
+        if (ev.decision !== 'allow')
+            return ev;
+    }
+    return {
+        decision: 'allow',
+        reason: 'All files within scope',
+        ruleId: 'scope.batch-allow',
+        policyHash: hashPolicy({ files, agentId }),
+        timestamp: new Date().toISOString(),
+    };
+}

package/dist/firewall/transaction.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Transactional execution — worktree START → verify → COMMIT | DISCARD.
+ */
+import type { PolicyEvaluation, TransactionBudgets, TransactionRecord } from './types.js';
+export declare class TransactionRunner {
+    private readonly cwd;
+    private record;
+    constructor(cwd: string, opts: {
+        agentId?: string;
+        scope: string[];
+        budgets?: Partial<TransactionBudgets>;
+        policyHash?: string;
+    });
+    static fromRecord(cwd: string, record: TransactionRecord): TransactionRunner;
+    getRecord(): TransactionRecord;
+    private setStatus;
+    addDecision(ev: PolicyEvaluation): void;
+    /**
+     * Create an ephemeral git worktree for isolated writes.
+     */
+    start(): Promise<TransactionRecord>;
+    noteFileChange(relPath: string): Promise<PolicyEvaluation>;
+    syncWorktreeChanges(): Promise<string[]>;
+    getWorktreePath(): string | undefined;
+    verify(runGates: () => Promise<{
+        status: string;
+        failedGates: string[];
+        score?: number;
+    }>): Promise<{
+        ok: boolean;
+        gateResults: {
+            status: string;
+            failedGates: string[];
+            score?: number;
+        };
+    }>;
+    commit(): Promise<TransactionRecord>;
+    discard(): Promise<TransactionRecord>;
+    private persist;
+}
+export declare function listChangedFiles(dir: string): Promise<string[]>;
+export declare function loadCurrentTransaction(cwd: string): Promise<TransactionRecord | null>;
+export declare function listTransactions(cwd: string): Promise<TransactionRecord[]>;

package/dist/firewall/transaction.js

@@ -0,0 +1,216 @@
+/**
+ * Transactional execution — worktree START → verify → COMMIT | DISCARD.
+ */
+import { randomUUID } from 'crypto';
+import fs from 'fs-extra';
+import path from 'path';
+import { execa } from 'execa';
+import { hashPolicy } from './policy-hash.js';
+import { assertWritesInScope } from './scope-enforcement.js';
+const DEFAULT_BUDGETS = {
+    maxFiles: 20,
+    maxRetries: 3,
+    maxDurationMs: 30 * 60 * 1000,
+};
+export class TransactionRunner {
+    cwd;
+    record;
+    constructor(cwd, opts) {
+        this.cwd = cwd;
+        const budgets = { ...DEFAULT_BUDGETS, ...opts.budgets };
+        this.record = {
+            id: randomUUID(),
+            agentId: opts.agentId,
+            scope: opts.scope,
+            status: 'START',
+            budgets,
+            filesChanged: [],
+            capabilitiesIssued: [],
+            decisions: [],
+            startedAt: new Date().toISOString(),
+            policyHash: opts.policyHash ?? hashPolicy({ scope: opts.scope, budgets }),
+        };
+    }
+    static fromRecord(cwd, record) {
+        const runner = new TransactionRunner(cwd, {
+            agentId: record.agentId,
+            scope: record.scope,
+            budgets: record.budgets,
+            policyHash: record.policyHash,
+        });
+        runner.record = { ...record, decisions: [...record.decisions], filesChanged: [...record.filesChanged] };
+        return runner;
+    }
+    getRecord() {
+        return { ...this.record, decisions: [...this.record.decisions], filesChanged: [...this.record.filesChanged] };
+    }
+    setStatus(status) {
+        this.record.status = status;
+    }
+    addDecision(ev) {
+        this.record.decisions.push(ev);
+    }
+    /**
+     * Create an ephemeral git worktree for isolated writes.
+     */
+    async start() {
+        const worktreesRoot = path.join(this.cwd, '.rigour', 'worktrees');
+        await fs.ensureDir(worktreesRoot);
+        const worktreePath = path.join(worktreesRoot, this.record.id);
+        const branch = `rigour-tx-${this.record.id.slice(0, 8)}`;
+        try {
+            await execa('git', ['rev-parse', '--is-inside-work-tree'], { cwd: this.cwd });
+            await execa('git', ['worktree', 'add', '-b', branch, worktreePath, 'HEAD'], {
+                cwd: this.cwd,
+                shell: false,
+            });
+            this.record.worktreePath = worktreePath;
+        }
+        catch {
+            // Fallback: copy-less sandbox dir (no git) — still tracks commit/discard via marker
+            await fs.ensureDir(worktreePath);
+            this.record.worktreePath = worktreePath;
+            await fs.writeJson(path.join(worktreePath, '.rigour-tx.json'), {
+                id: this.record.id,
+                base: this.cwd,
+            });
+        }
+        this.setStatus('RUNNING');
+        await this.persist();
+        return this.getRecord();
+    }
+    async noteFileChange(relPath) {
+        const scopeEv = await assertWritesInScope(this.cwd, [relPath], this.record.agentId);
+        this.addDecision(scopeEv);
+        if (scopeEv.decision !== 'allow') {
+            return scopeEv;
+        }
+        if (!this.record.filesChanged.includes(relPath)) {
+            this.record.filesChanged.push(relPath);
+        }
+        if (this.record.filesChanged.length > this.record.budgets.maxFiles) {
+            const deny = {
+                decision: 'deny',
+                reason: `File budget exceeded (${this.record.budgets.maxFiles})`,
+                ruleId: 'budget.files',
+                policyHash: this.record.policyHash,
+                timestamp: new Date().toISOString(),
+            };
+            this.addDecision(deny);
+            return deny;
+        }
+        const elapsed = Date.now() - Date.parse(this.record.startedAt);
+        if (elapsed > this.record.budgets.maxDurationMs) {
+            const deny = {
+                decision: 'deny',
+                reason: 'Time budget exceeded',
+                ruleId: 'budget.time',
+                policyHash: this.record.policyHash,
+                timestamp: new Date().toISOString(),
+            };
+            this.addDecision(deny);
+            return deny;
+        }
+        await this.persist();
+        return scopeEv;
+    }
+    async syncWorktreeChanges() {
+        const root = this.record.worktreePath || this.cwd;
+        const files = await listChangedFiles(root);
+        for (const f of files) {
+            const ev = await this.noteFileChange(f);
+            if (ev.decision !== 'allow') {
+                throw Object.assign(new Error(ev.reason), { evaluation: ev, code: 'FIREWALL_DENY' });
+            }
+        }
+        return [...this.record.filesChanged];
+    }
+    getWorktreePath() {
+        return this.record.worktreePath;
+    }
+    async verify(runGates) {
+        this.setStatus('VERIFYING');
+        const gateResults = await runGates();
+        await this.persist();
+        return { ok: gateResults.status === 'PASS', gateResults };
+    }
+    async commit() {
+        this.setStatus('COMMIT');
+        this.record.finishedAt = new Date().toISOString();
+        // Worktree branch is left for operator merge; attestation binds treeDigest/commitSha
+        await this.persist();
+        return this.getRecord();
+    }
+    async discard() {
+        this.setStatus('DISCARD');
+        this.record.finishedAt = new Date().toISOString();
+        const wt = this.record.worktreePath;
+        if (wt && await fs.pathExists(wt)) {
+            try {
+                await execa('git', ['worktree', 'remove', '--force', wt], { cwd: this.cwd, shell: false });
+            }
+            catch {
+                await fs.remove(wt);
+            }
+            try {
+                const branch = `rigour-tx-${this.record.id.slice(0, 8)}`;
+                await execa('git', ['branch', '-D', branch], { cwd: this.cwd, shell: false, reject: false });
+            }
+            catch {
+                // ignore
+            }
+        }
+        await this.persist();
+        return this.getRecord();
+    }
+    async persist() {
+        const dir = path.join(this.cwd, '.rigour', 'transactions');
+        await fs.ensureDir(dir);
+        await fs.writeJson(path.join(dir, `${this.record.id}.json`), this.record, { spaces: 2 });
+        await fs.writeJson(path.join(this.cwd, '.rigour', 'transaction-current.json'), this.record, { spaces: 2 });
+    }
+}
+export async function listChangedFiles(dir) {
+    try {
+        const { stdout: diffOut } = await execa('git', ['diff', '--name-only', 'HEAD'], {
+            cwd: dir,
+            shell: false,
+        });
+        const { stdout: untrackedOut } = await execa('git', ['ls-files', '--others', '--exclude-standard'], { cwd: dir, shell: false });
+        const files = [
+            ...diffOut.split('\n'),
+            ...untrackedOut.split('\n'),
+        ].map(s => s.trim()).filter(Boolean);
+        return [...new Set(files)];
+    }
+    catch {
+        return [];
+    }
+}
+export async function loadCurrentTransaction(cwd) {
+    const p = path.join(cwd, '.rigour', 'transaction-current.json');
+    if (!(await fs.pathExists(p)))
+        return null;
+    try {
+        return await fs.readJson(p);
+    }
+    catch {
+        return null;
+    }
+}
+export async function listTransactions(cwd) {
+    const dir = path.join(cwd, '.rigour', 'transactions');
+    if (!(await fs.pathExists(dir)))
+        return [];
+    const files = (await fs.readdir(dir)).filter(f => f.endsWith('.json'));
+    const out = [];
+    for (const f of files) {
+        try {
+            out.push(await fs.readJson(path.join(dir, f)));
+        }
+        catch {
+            // skip
+        }
+    }
+    return out.sort((a, b) => b.startedAt.localeCompare(a.startedAt));
+}

package/dist/firewall/typed-command.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Typed / argv-allowlisted command runner.
+ * Replaces unrestricted shell:true for agent-facing execution.
+ */
+import type { PolicyEvaluation, TypedCommand } from './types.js';
+/**
+ * Conservative allowlist — no general interpreters (node/python/npx) that accept -e/-c.
+ */
+export declare const DEFAULT_ALLOWED_BINS: Set<string>;
+export declare function parseCommandLine(command: string): TypedCommand | null;
+export declare function evaluateTypedCommand(command: string, allowedBins?: Set<string>): PolicyEvaluation;
+export declare function runTypedCommand(command: string, cwd: string, allowedBins?: Set<string>): Promise<{
+    stdout: string;
+    stderr: string;
+    evaluation: PolicyEvaluation;
+}>;

package/dist/firewall/typed-command.js

@@ -0,0 +1,129 @@
+/**
+ * Typed / argv-allowlisted command runner.
+ * Replaces unrestricted shell:true for agent-facing execution.
+ */
+import { execa } from 'execa';
+import { hashPolicy } from './policy-hash.js';
+/**
+ * Conservative allowlist — no general interpreters (node/python/npx) that accept -e/-c.
+ */
+export const DEFAULT_ALLOWED_BINS = new Set([
+    'npm',
+    'pnpm',
+    'yarn',
+    'tsc',
+    'vitest',
+    'jest',
+    'pytest',
+    'go',
+    'cargo',
+    'git',
+    'rigour',
+    'echo',
+    'cat',
+    'ls',
+    'pwd',
+    'true',
+    'false',
+]);
+const DENY_ARG_PATTERNS = [
+    /rm\s+-rf/i,
+    /--force/i,
+    /push\s+--force/i,
+    /force-with-lease/i,
+    /curl.*(-d|--data)/i,
+    /wget\s/i,
+    /(^|\s)-e(\s|=|$)/,
+    /(^|\s)--eval(\s|=|$)/,
+    /\bnpm\s+exec\b/i,
+    /\bnpx\b/i,
+    /\byarn\s+dlx\b/i,
+    /\bpnpm\s+dlx\b/i,
+];
+const GIT_DENY_SUBCOMMANDS = new Set(['push', 'reset', 'clean', 'rebase', 'filter-branch']);
+export function parseCommandLine(command) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return null;
+    if (/[;|&`$<>]/.test(trimmed) || trimmed.includes('\n')) {
+        return null;
+    }
+    const parts = trimmed.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g);
+    if (!parts || parts.length === 0)
+        return null;
+    const unquote = (s) => {
+        if ((s.startsWith('"') && s.endsWith('"')) || (s.startsWith("'") && s.endsWith("'"))) {
+            return s.slice(1, -1);
+        }
+        return s;
+    };
+    const [bin, ...args] = parts.map(unquote);
+    return { bin, args };
+}
+export function evaluateTypedCommand(command, allowedBins = DEFAULT_ALLOWED_BINS) {
+    const policyHash = hashPolicy({ allowedBins: [...allowedBins].sort() });
+    const parsed = parseCommandLine(command);
+    if (!parsed) {
+        return {
+            decision: 'deny',
+            reason: 'Command contains shell metacharacters or could not be parsed as argv',
+            ruleId: 'shell.no-meta',
+            policyHash,
+            timestamp: new Date().toISOString(),
+        };
+    }
+    const binBase = parsed.bin.split(/[/\\]/).pop() || parsed.bin;
+    if (!allowedBins.has(binBase) && !allowedBins.has(parsed.bin)) {
+        return {
+            decision: 'deny',
+            reason: `Binary "${binBase}" is not on the allowlist`,
+            ruleId: 'shell.allowlist',
+            policyHash,
+            timestamp: new Date().toISOString(),
+        };
+    }
+    const full = `${parsed.bin} ${parsed.args.join(' ')}`;
+    for (const re of DENY_ARG_PATTERNS) {
+        if (re.test(full)) {
+            return {
+                decision: 'deny',
+                reason: `Command matched deny pattern: ${re}`,
+                ruleId: 'shell.deny-pattern',
+                policyHash,
+                timestamp: new Date().toISOString(),
+            };
+        }
+    }
+    if (binBase === 'git') {
+        const sub = parsed.args.find(a => !a.startsWith('-'));
+        if (sub && GIT_DENY_SUBCOMMANDS.has(sub)) {
+            return {
+                decision: 'deny',
+                reason: `git ${sub} requires explicit capability (destructive git mutation)`,
+                ruleId: 'git.destructive',
+                policyHash,
+                timestamp: new Date().toISOString(),
+            };
+        }
+    }
+    return {
+        decision: 'allow',
+        reason: `Allowlisted binary ${binBase}`,
+        ruleId: 'shell.allow',
+        policyHash,
+        timestamp: new Date().toISOString(),
+    };
+}
+export async function runTypedCommand(command, cwd, allowedBins) {
+    const evaluation = evaluateTypedCommand(command, allowedBins);
+    if (evaluation.decision !== 'allow') {
+        throw Object.assign(new Error(evaluation.reason), { evaluation, code: 'FIREWALL_DENY' });
+    }
+    const parsed = parseCommandLine(command);
+    const { stdout, stderr } = await execa(parsed.bin, parsed.args, {
+        cwd,
+        shell: false,
+        reject: false,
+    });
+    return { stdout: stdout ?? '', stderr: stderr ?? '', evaluation };
+}

package/dist/firewall/types.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Agent Transaction Firewall — shared types.
+ * Deterministic allow/deny decisions; no LLM on the hot path.
+ */
+export type FirewallDecision = 'allow' | 'deny' | 'timeout-deny' | 'scope-violation';
+export type CapabilityAction = 'filesystem.write' | 'filesystem.read' | 'shell.exec' | 'mcp.call' | 'git.mutate' | 'secret.lease' | 'network.egress' | 'deploy';
+export interface CapabilityGrant {
+    id: string;
+    action: CapabilityAction;
+    resource: string;
+    constraints?: Record<string, unknown>;
+    expiresAt: number;
+    agentId?: string;
+    taskId?: string;
+    policyHash: string;
+    used: boolean;
+}
+export interface PolicyEvaluation {
+    decision: FirewallDecision;
+    reason: string;
+    ruleId?: string;
+    capabilityId?: string;
+    policyHash: string;
+    timestamp: string;
+}
+export interface TypedCommand {
+    bin: string;
+    args: string[];
+    cwd?: string;
+}
+export interface TransactionBudgets {
+    maxFiles: number;
+    maxRetries: number;
+    maxDurationMs: number;
+    maxCostUsd?: number;
+}
+export type TransactionStatus = 'START' | 'RUNNING' | 'VERIFYING' | 'COMMIT' | 'DISCARD';
+export interface TransactionRecord {
+    id: string;
+    agentId?: string;
+    scope: string[];
+    status: TransactionStatus;
+    worktreePath?: string;
+    budgets: TransactionBudgets;
+    filesChanged: string[];
+    capabilitiesIssued: string[];
+    decisions: PolicyEvaluation[];
+    startedAt: string;
+    finishedAt?: string;
+    policyHash: string;
+}
+export interface AttestationBundle {
+    version: 1;
+    transactionId: string;
+    agentId?: string;
+    userId?: string;
+    scope: string[];
+    policyHash: string;
+    capabilities: string[];
+    filesUsed: string[];
+    toolsUsed: string[];
+    gateResults: {
+        status: string;
+        score?: number;
+        failedGates: string[];
+    };
+    overrides: string[];
+    artifactDigest: string;
+    /** git commit SHA at attestation time */
+    commitSha?: string;
+    /** git tree object id (HEAD^{tree}) */
+    treeDigest?: string;
+    signedAt: string;
+    signature: string;
+}
+export interface AdversarialCase {
+    id: string;
+    description: string;
+    proposedAction: {
+        action: CapabilityAction;
+        resource: string;
+        args?: Record<string, unknown>;
+        command?: string;
+    };
+    expectedDecision: FirewallDecision;
+    agentScope?: string[];
+    allowlist?: string[];
+}
+export interface AdversarialCaseResult {
+    caseId: string;
+    expected: FirewallDecision;
+    actual: FirewallDecision;
+    passed: boolean;
+    reason: string;
+    suggestedRule?: string;
+}

package/dist/firewall/types.js

@@ -0,0 +1,5 @@
+/**
+ * Agent Transaction Firewall — shared types.
+ * Deterministic allow/deny decisions; no LLM on the hot path.
+ */
+export {};