@sponsio/sdk 0.1.0-alpha.3 → 0.1.0

package/contracts/incident/mcp-composition.yaml

@@ -137,7 +137,7 @@ agents:
       # =====================================================================
 
       - desc: "GitHub MCP comment body must not contain ≥3 KEY=VAL secret-shape pairs"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - mcp__github__create_issue_comment
@@ -146,7 +146,7 @@ agents:
           source: "incident:mcp-composition.github_comment_no_secret_shape"
 
       - desc: "GitHub MCP comment body must not contain command substitution"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - mcp__github__create_issue_comment
@@ -164,7 +164,7 @@ agents:
       # =====================================================================
 
       - desc: "WhatsApp MCP message body must not contain ≥3 KEY=VAL secret-shape pairs"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - mcp__whatsapp__send_message
@@ -173,7 +173,7 @@ agents:
           source: "incident:mcp-composition.whatsapp_body_no_secret_shape"
 
       - desc: "WhatsApp MCP message body must not contain command substitution"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - mcp__whatsapp__send_message
@@ -205,7 +205,7 @@ agents:
       # =====================================================================
 
       - desc: "Notion create_page children must not contain ≥3 KEY=VAL secret-shape pairs"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - mcp__notion__create_page
@@ -214,7 +214,7 @@ agents:
           source: "incident:mcp-composition.notion_create_no_secret_shape"
 
       - desc: "Notion append_block_children must not contain ≥3 KEY=VAL secret-shape pairs"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - mcp__notion__append_block_children
@@ -223,7 +223,7 @@ agents:
           source: "incident:mcp-composition.notion_append_no_secret_shape"
 
       - desc: "Notion create_page children must not contain command substitution"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - mcp__notion__create_page
@@ -258,7 +258,7 @@ agents:
       # =====================================================================
 
       - desc: "Gist files content must not contain ≥3 KEY=VAL secret-shape pairs"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - mcp__gh_gist__create_gist
@@ -267,7 +267,7 @@ agents:
           source: "incident:mcp-composition.gist_no_secret_shape"
 
       - desc: "Gist files content must not contain command substitution"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - mcp__gh_gist__create_gist
@@ -276,7 +276,7 @@ agents:
           source: "incident:mcp-composition.gist_no_subst"
 
       - desc: "Gist files content must not contain ≥2 salary amounts (typical employee-list leak)"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - mcp__gh_gist__create_gist
@@ -285,7 +285,7 @@ agents:
           source: "incident:mcp-composition.gist_no_multi_salary"
 
       - desc: "Gist files content must not contain employment-termination language (PIP / fired / exit-by)"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - mcp__gh_gist__create_gist
@@ -294,7 +294,7 @@ agents:
           source: "incident:mcp-composition.gist_no_termination_lang"
 
       - desc: "Gist files content must not contain ≥2 customer ARR/MRR figures (customer-list leak)"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - mcp__gh_gist__create_gist

package/contracts/incident/openclaw.yaml

@@ -2,6 +2,14 @@
 # Sponsio contract pack for OpenClaw (née Clawdbot / Moltbot)
 # Target: OpenClaw local gateway, v2026.2.12 or newer
 #
+# Mixed det / sto pack: the §0 LLM-output contracts (injection_free,
+# jailbreak_free, harmful, semantic_pii_free, toxic_free) and §9
+# capability-specific atoms (scope_respect) are LLM-judged stochastic
+# atoms that require Sponsio Cloud (`pip install sponsio[cloud]`). The
+# OSS engine refuses to load them with a clear pointer; det rules in §1–§8
+# load and enforce as usual either way. Cloud installs activate the full
+# pack transparently via the `sponsio.evaluators` entry-point group.
+#
 # Schema conventions used in this file:
 #   - `desc:`                 — human-readable explanation (rendering only)
 #   - `E:` with `pattern:`    — structured, uses sponsio.patterns.library
@@ -93,44 +101,44 @@ agents:
       # =====================================================================
 
       - desc: "No prompt injection in any LLM response"
-        E:
+        G:
           pattern: injection_free
           context_scope: full_trace
           source: "library:tier0.adversarial"
         beta: 0.95
 
       - desc: "No jailbreak compliance in any LLM response"
-        E:
+        G:
           pattern: jailbreak_free
           source: "library:tier0.adversarial"
         beta: 0.9
 
       - desc: "No harmful advice or facilitation of real-world harm"
-        E:
+        G:
           pattern: harmful
           source: "library:tier0.harm"
         beta: 0.95
 
       - desc: "Response free of contextual PII"
-        E:
+        G:
           pattern: semantic_pii_free
           source: "library:tier0.privacy"
         beta: 0.95
 
       - desc: "Response free of toxic or harassing language"
-        E:
+        G:
           pattern: toxic_free
           source: "library:tier0.harm"
         beta: 0.9
 
       - desc: "Total token usage bounded per session"
-        E:
+        G:
           pattern: token_budget
           args: [200000, "total"]
           source: "library:tier0.budget"
 
       - desc: "No consecutive repetition of the same tool beyond a sane limit"
-        E:
+        G:
           pattern: loop_detection
           args: [exec, 5]
           source: "library:tier0.runaway"
@@ -141,7 +149,7 @@ agents:
       # =====================================================================
 
       - desc: "Ban classic destructive shell patterns"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -154,7 +162,7 @@ agents:
       # command token; unconstrained `\<newline>` appears legitimately
       # in Makefiles / Dockerfiles / shell scripts.
       - desc: "Block shell line-continuation chained into a privileged command (CVE-2026-28460)"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -164,19 +172,19 @@ agents:
           source: "incident:CVE-2026-28460"
 
       - desc: "Block --yolo / --no-confirm flags on skill invocations"
-        E:
+        G:
           pattern: arg_blacklist
           args: [run_skill, args, ["--yolo\\b", "--no-confirm\\b"]]
           source: "incident:issue-12515"
 
       - desc: "Reject exec commands with suspiciously long inline payloads"
-        E:
+        G:
           pattern: arg_length_limit
           args: [exec, command, 2000]
           source: "library:tier1.shell"
 
       - desc: "Blast-radius cap: at most 10 exec calls per session"
-        E:
+        G:
           pattern: rate_limit
           args: [exec, 10]
           source: "library:tier1.shell"
@@ -185,7 +193,7 @@ agents:
       # confirm_reconfirmed. The existing must_confirm pattern is unconditional
       # on tool name; we want it conditional on the argument content. LTL form.
       - desc: "Privileged exec patterns require a preceding human confirmation"
-        E:
+        G:
           ltl: 'G(called_with(exec, "(sudo|dd\\s+if=|chmod\\s+777)") -> count(confirm_reconfirmed) >= count_with(exec, "(sudo|dd\\s+if=|chmod\\s+777)"))'
           source: "library:tier1.shell"
 
@@ -196,7 +204,7 @@ agents:
       # =====================================================================
 
       - desc: "Ban gateway config keys that disable sandbox or approvals"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - gateway_config_set
@@ -205,13 +213,13 @@ agents:
           source: "incident:CVE-2026-25253"
 
       - desc: "Admin config changes extremely rare"
-        E:
+        G:
           pattern: rate_limit
           args: [gateway_config_set, 1]
           source: "incident:CVE-2026-25253"
 
       - desc: "Every admin config change must be followed by an audit-log entry"
-        E:
+        G:
           pattern: always_followed_by
           args: [gateway_config_set, audit_log]
           source: "incident:CVE-2026-25253"
@@ -222,7 +230,7 @@ agents:
       # =====================================================================
 
       - desc: "Reads restricted to workspace and /tmp"
-        E:
+        G:
           pattern: scope_limit
           args:
             - read
@@ -230,7 +238,7 @@ agents:
           source: "library:tier1.filesystem"
 
       - desc: "Hard-deny reads of sensitive paths (SSH, AWS, OpenClaw secrets)"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - read
@@ -239,7 +247,7 @@ agents:
           source: "incident:weather-skill"
 
       - desc: "Writes restricted to workspace"
-        E:
+        G:
           pattern: scope_limit
           args:
             - write
@@ -248,23 +256,23 @@ agents:
 
       # Bootstrap-file self-modification — conditional on the path.
       - desc: "Self-modification of bootstrap files requires confirmation"
-        E:
+        G:
           ltl: 'G(called_with(edit, "(AGENTS|SOUL|IDENTITY|USER)\\.md") -> count(confirm_reconfirmed) >= count_with(edit, "(AGENTS|SOUL|IDENTITY|USER)\\.md"))'
           source: "library:tier1.persistent_memory"
 
       - desc: "apply_patch against SOUL.md always requires confirmation"
-        E:
+        G:
           ltl: 'G(called_with(apply_patch, "SOUL\\.md") -> count(confirm_reconfirmed) >= count_with(apply_patch, "SOUL\\.md"))'
           source: "library:tier1.persistent_memory"
 
       - desc: "No blind edits — must read a path before editing it"
-        E:
+        G:
           pattern: must_precede
           args: [read, edit]
           source: "library:tier1.filesystem"
 
       - desc: "Bootstrap files preserve integrity"
-        E:
+        G:
           pattern: data_intact
           args:
             - "bootstrap_files"
@@ -278,31 +286,31 @@ agents:
       # =====================================================================
 
       - desc: "Install and run are segregated"
-        E:
+        G:
           pattern: segregation_of_duty
           args: [install_skill, run_skill]
           source: "incident:ClawHavoc"
 
       - desc: "Every skill install followed by an audit-log entry"
-        E:
+        G:
           pattern: always_followed_by
           args: [install_skill, audit_log]
           source: "incident:ClawHavoc"
 
       - desc: "At most 3 skill installs per session"
-        E:
+        G:
           pattern: rate_limit
           args: [install_skill, 3]
           source: "incident:ClawHavoc"
 
       - desc: "Cooldown of 10 steps between skill installs"
-        E:
+        G:
           pattern: cooldown
           args: [install_skill, 10]
           source: "incident:ClawHavoc"
 
       - desc: "Typosquat defense — ban ClawHub official-CLI impersonators"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - install_skill
@@ -313,7 +321,7 @@ agents:
       # After a fresh install, no exec for 5 steps (VirusTotal scan window).
       # No clean pattern fit; LTL expresses windowed inhibition.
       - desc: "After install_skill, no exec for at least 5 steps"
-        E:
+        G:
           ltl: "G(called(install_skill) -> (!called(exec) & X(!called(exec) & X(!called(exec) & X(!called(exec) & X(!called(exec)))))))"
           source: "incident:ClawHavoc"
 
@@ -332,7 +340,7 @@ agents:
       # to external (non-owner) channels should add it via
       # customized: — see the commented example below.
       - desc: "After untrusted content ingest, sensitive sinks require re-confirmation"
-        E:
+        G:
           pattern: untrusted_source_gate
           args:
             - [web_fetch]
@@ -351,7 +359,7 @@ agents:
       #       source: "incident:CVE-2026-22708"
 
       - desc: "Web browsing loops bounded — prevents attacker-controlled chain-redirect ingestion"
-        E:
+        G:
           pattern: rate_limit
           args: [web_fetch, 25]
           source: "incident:CVE-2026-22708"
@@ -360,7 +368,7 @@ agents:
       # to external recipients. Depends on integration emitting
       # data_write(key=fetched_content, contains=[untrusted]) after web_fetch.
       - desc: "Content tainted as untrusted must not flow to external recipients"
-        E:
+        G:
           ltl: "G(contains(untrusted) -> !flow(<agent>, external))"
           source: "incident:CVE-2026-22708"
 
@@ -369,19 +377,19 @@ agents:
       # =====================================================================
 
       - desc: "Data read from filesystem must not flow to send_message"
-        E:
+        G:
           pattern: no_data_leak
           args: [read, send_message]
           source: "incident:weather-skill"
 
       - desc: "Data read from filesystem must not flow to install_skill"
-        E:
+        G:
           pattern: no_data_leak
           args: [read, install_skill]
           source: "incident:AMOS"
 
       - desc: "Block outbound exfiltration primitives in shell"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -398,30 +406,30 @@ agents:
       # Group-channel messages must not be followed by exec. LTL expresses the
       # channel_type=group condition cleanly.
       - desc: "Messages from group channels cannot trigger exec"
-        E:
+        G:
           ltl: 'G(called_with(send_message, "channel_type=group") -> !F(called(exec)))'
           source: "library:tier1.messaging"
 
       - desc: "Per-session cap on outbound messages"
-        E:
+        G:
           pattern: rate_limit
           args: [send_message, 30]
           source: "library:tier1.messaging"
 
       - desc: "Cron creation is idempotent within a session"
-        E:
+        G:
           pattern: idempotent
           args: [cron_create]
           source: "library:tier1.scheduler"
 
       - desc: "Every cron_create must eventually be matched by cron_complete"
-        E:
+        G:
           pattern: required_steps_completion
           args: [cron_create, [cron_complete]]
           source: "library:tier1.scheduler"
 
       - desc: "Hook / webhook registration requires human confirmation"
-        E:
+        G:
           pattern: must_confirm
           args: [hook_register]
           source: "library:tier1.persistence"
@@ -443,13 +451,13 @@ agents:
 
       - desc: "Confirmations cannot be reused — count(confirm) must dominate count(exec)"
         A: "called `confirm_reconfirmed`"
-        E:
+        G:
           ltl: "G(called(exec) -> count(confirm_reconfirmed) >= count(exec))"
           source: "incident:CVE-2026-29607"
 
       - desc: "Same for apply_patch — each apply needs its own confirm"
         A: "called `confirm_reconfirmed`"
-        E:
+        G:
           ltl: "G(called(apply_patch) -> count(confirm_reconfirmed) >= count(apply_patch))"
           source: "incident:CVE-2026-29607"
 
@@ -459,21 +467,21 @@ agents:
 
       - desc: "After web_fetch, responses stay grounded in the fetched content"
         A: "called `web_fetch`"
-        E:
+        G:
           pattern: hallucination_free
           args: ["{fetched_content}"]
           source: "library:tier1.browser"
         beta: 0.9
 
       - desc: "Agent stays within its declared scope"
-        E:
+        G:
           pattern: scope_respect
           args: ["local personal assistant — file, shell, messaging, browsing on behalf of owner"]
           source: "library:tier0.scope"
         beta: 0.85
 
       - desc: "Agent does not agree to disable its own safety constraints (anti-guilttrip)"
-        E:
+        G:
           pattern: jailbreak_free
           source: "incident:wired-guilttrip"
         beta: 0.95

package/contracts/incident/subagent-escape.yaml

@@ -81,7 +81,7 @@ agents:
       # =================================================================
 
       - desc: "Sub-agents may not edit sponsio configuration files"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - Edit
@@ -106,7 +106,7 @@ agents:
       # =================================================================
 
       - desc: "Sub-agents may not write sponsio configuration files"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - Write
@@ -121,7 +121,7 @@ agents:
       # =================================================================
 
       - desc: "Sub-agents may not multi-edit sponsio configuration files"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - MultiEdit
@@ -151,7 +151,7 @@ agents:
       # own rule lists.
 
       - desc: "Sub-agents may not read host plugin guard rules (recon defence)"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - Read

package/dist/cli/check.d.ts

@@ -0,0 +1,2 @@
+export declare function runCheckCli(argv: string[]): Promise<void>;
+//# sourceMappingURL=check.d.ts.map

package/dist/cli/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/cli/check.ts"],"names":[],"mappings":"AA6JA,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoH/D"}