@squadrant-ai/auto-gate 0.1.0

package/dist/cli/doctor.js

@@ -0,0 +1,26 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { resolveConfig } from "../config/resolve.js";
+import { resolveApiKey } from "../config/keys.js";
+import { foreignOwnerOf } from "../adapters/claude/settings.js";
+export function doctor() {
+    const cfg = resolveConfig();
+    const p = join(homedir(), ".claude", "settings.json");
+    let owner = null;
+    let ours = false;
+    try {
+        const s = JSON.parse(readFileSync(p, "utf8"));
+        owner = foreignOwnerOf(s);
+        ours = JSON.stringify(s).includes("auto-gate-managed");
+    }
+    catch { /* missing/unreadable settings is reported below */ }
+    const key = resolveApiKey({ apiKeyEnv: cfg.classifier.jev.apiKeyEnv });
+    return { lines: [
+            `mode: ${cfg.mode}`,
+            `classifier: ${cfg.classifier.kind} (${cfg.classifier.jev.model})`,
+            `api key: ${key ? "present" : "MISSING — the gate will ask (fail-open)"}`,
+            `claude PermissionRequest: ${owner ? `owned by ${owner} (we defer)` : ours ? "owned by auto-gate" : "not installed"}`,
+            `settings file: ${existsSync(p) ? p : "(none)"}`,
+        ] };
+}

package/dist/cli/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli/index.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+const [, , cmd, arg3, arg4] = process.argv;
+if (cmd === "decide" && arg3 === "--agent" && arg4 === "claude") {
+    const { runClaudeDecide } = await import("./claude.js");
+    const { buildRuntime, readLastHumanMessage } = await import("./runtime.js");
+    const { createBlockedSignal } = await import("../adapters/claude/blocked-signal.js");
+    const { resolveConfig } = await import("../config/resolve.js");
+    const { exec } = await import("node:child_process");
+    const { promisify } = await import("node:util");
+    const execAsync = promisify(exec);
+    await runClaudeDecide({
+        stdin: { read: async () => readFileSync(0, "utf8") },
+        stdout: process.stdout, stderr: process.stderr,
+        decide: (req) => buildRuntime().then((rt) => rt.decide(req)),
+        readIntent: readLastHumanMessage,
+        blockedSignal: createBlockedSignal({
+            command: resolveConfig().ask.onAsk,
+            exec: async (command, env) => { await execAsync(command, { env: { ...process.env, ...env } }); },
+            log: (m) => process.stderr.write(m + "\n"),
+        }),
+        log: (m) => process.stderr.write(m + "\n"),
+    });
+}
+else if (cmd === "decide") {
+    const { runDecide } = await import("./decide.js");
+    const { buildRuntime } = await import("./runtime.js");
+    await runDecide({
+        stdin: { read: async () => readFileSync(0, "utf8") },
+        stdout: process.stdout, stderr: process.stderr,
+        decide: (req) => buildRuntime().then((rt) => rt.decide(req)),
+        log: (m) => process.stderr.write(m + "\n"),
+    });
+}
+else if (cmd === "install") {
+    const { installClaude } = await import("../adapters/claude/install.js");
+    const r = installClaude();
+    if (r.installed)
+        process.stdout.write("auto-gate: installed claude PermissionRequest hook\n");
+    else if (r.deferredTo)
+        process.stdout.write(`auto-gate: deferred — ${r.deferredTo} already owns the claude PermissionRequest hook\n`);
+    else
+        process.stdout.write(`auto-gate: not installed — ${r.reason ?? "unknown reason"}\n`);
+}
+else if (cmd === "uninstall") {
+    const { uninstallClaude } = await import("../adapters/claude/install.js");
+    const r = uninstallClaude();
+    process.stdout.write(r.installed
+        ? "auto-gate: removed claude PermissionRequest hook\n"
+        : `auto-gate: nothing to uninstall — ${r.reason ?? "no settings"}\n`);
+}
+else if (cmd === "doctor") {
+    const { doctor } = await import("./doctor.js");
+    for (const line of doctor().lines)
+        process.stdout.write(line + "\n");
+}
+else if (cmd === "opencode" && arg3 === "run") {
+    const { buildRunPlan, supervise } = await import("../adapters/opencode/run.js");
+    const plan = await buildRunPlan({ args: process.argv.slice(4) });
+    const code = await supervise(plan, { log: (m) => process.stderr.write(m + "\n") });
+    process.exit(code);
+}
+else if (cmd === "opencode" && arg3 === "watch") {
+    const { resolvePort } = await import("../adapters/opencode/port.js");
+    const { acquireLock } = await import("../adapters/opencode/lock.js");
+    const { createWatcher, subscribeSse, answerPermission } = await import("../adapters/opencode/watch.js");
+    const { buildRuntime } = await import("./runtime.js");
+    const at = process.argv.indexOf("--port", 4);
+    const flag = at >= 0 ? Number(process.argv[at + 1]) : undefined;
+    const resolved = resolvePort({ flag, env: process.env });
+    if ("error" in resolved) {
+        process.stderr.write(`auto-gate opencode: ${resolved.error}\n`);
+        process.exit(4);
+    }
+    const host = "127.0.0.1";
+    const rt = await buildRuntime();
+    const watcher = createWatcher({
+        host, port: resolved.port,
+        acquire: () => acquireLock({ host, port: resolved.port }),
+        subscribe: subscribeSse,
+        decide: rt.decide,
+        answer: (a) => answerPermission({ host, port: resolved.port, ...a }),
+        log: (m) => process.stderr.write(m + "\n"),
+    });
+    const outcome = await watcher.start();
+    if (outcome === "yielded")
+        process.exit(0);
+    if (outcome === "unrecoverable")
+        process.exit(1);
+    await watcher.stopped;
+}
+else if (cmd === "test") {
+    const { runTest } = await import("./test.js");
+    process.stdout.write(await runTest(readFileSync(0, "utf8")) + "\n");
+}
+else if (cmd === "stats") {
+    const { summarizeAudit } = await import("./stats.js");
+    const { resolveConfig } = await import("../config/resolve.js");
+    const s = summarizeAudit(resolveConfig().audit.path);
+    process.stdout.write(`auto-gate stats — ${s.total} decisions\n`);
+    for (const [decision, n] of Object.entries(s.byDecision).sort())
+        process.stdout.write(`  ${decision}: ${n}\n`);
+    process.stdout.write(`  cacheHits: ${s.cacheHits}\n`);
+    process.stdout.write(`  redactionClasses: ${s.redactionClasses.join(", ") || "(none)"}\n`);
+}
+else {
+    process.stderr.write(`auto-gate: unknown command '${cmd}'\n`);
+    process.exit(2);
+}

package/dist/cli/runtime.d.ts

@@ -0,0 +1,19 @@
+import { GateCache } from "../core/cache.js";
+import type { GateRequest } from "../core/types.js";
+/** The claude transcript's most recent real human prompt (§11). Best-effort: a
+ *  missing/unreadable path, malformed lines, or a transcript with no human
+ *  turns all yield undefined and NEVER throw. Scans JSONL from the last line
+ *  backwards, skipping assistant turns and tool-result-only user entries. */
+export declare function readLastHumanMessage(transcriptPath: string | undefined): string | undefined;
+/** Assembles config + classifier + cache, and exposes the resolved model id so the
+ *  decision cache key invalidates when the model changes (§9). */
+export declare function buildRuntime(): Promise<{
+    config: import("../index.js").AutoGateConfig;
+    classifier: {
+        id: "generative" | "jev";
+        model: string;
+        classify: (r: GateRequest) => Promise<import("../core/types.js").GateAssessment>;
+    };
+    cache: GateCache;
+    decide: (req: GateRequest) => Promise<import("../core/types.js").GateOutcome>;
+}>;

package/dist/cli/runtime.js

@@ -0,0 +1,86 @@
+import { resolveConfig } from "../config/resolve.js";
+import { resolveApiKey } from "../config/keys.js";
+import { createJevClassifier } from "../classifiers/jev.js";
+import { createGenerativeClassifier } from "../classifiers/generative.js";
+import { classify } from "../classifiers/classify.js";
+import { GateCache } from "../core/cache.js";
+import { decideRequest } from "../core/decide.js";
+import { homedir } from "node:os";
+import { readFileSync } from "node:fs";
+/** Pull the human-readable text out of a transcript `message.content`: a bare
+ *  string, or the joined `.text` of blocks whose `type === "text"`. Anything
+ *  else (notably `tool_result`) contributes nothing, so a tool-result-only turn
+ *  yields undefined and is treated as not-a-human-message. */
+function textFromContent(content) {
+    if (typeof content === "string") {
+        const t = content.trim();
+        return t || undefined;
+    }
+    if (Array.isArray(content)) {
+        const parts = content
+            .filter((b) => !!b && typeof b === "object" && b.type === "text" && typeof b.text === "string")
+            .map((b) => b.text);
+        const joined = parts.join("\n").trim();
+        return joined || undefined;
+    }
+    return undefined;
+}
+/** The claude transcript's most recent real human prompt (§11). Best-effort: a
+ *  missing/unreadable path, malformed lines, or a transcript with no human
+ *  turns all yield undefined and NEVER throw. Scans JSONL from the last line
+ *  backwards, skipping assistant turns and tool-result-only user entries. */
+export function readLastHumanMessage(transcriptPath) {
+    if (!transcriptPath)
+        return undefined;
+    let raw;
+    try {
+        raw = readFileSync(transcriptPath, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    const lines = raw.split(/\r?\n/);
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i].trim();
+        if (!line)
+            continue;
+        let entry;
+        try {
+            const parsed = JSON.parse(line);
+            if (!parsed || typeof parsed !== "object")
+                continue;
+            entry = parsed;
+        }
+        catch {
+            continue;
+        }
+        if (entry.type !== "user")
+            continue;
+        const message = entry.message;
+        if (message && message.role && message.role !== "user")
+            continue;
+        const text = textFromContent(message?.content);
+        if (text)
+            return text;
+    }
+    return undefined;
+}
+/** Assembles config + classifier + cache, and exposes the resolved model id so the
+ *  decision cache key invalidates when the model changes (§9). */
+export async function buildRuntime() {
+    const config = resolveConfig();
+    const jev = createJevClassifier({
+        apiKey: resolveApiKey({ apiKeyEnv: config.classifier.jev.apiKeyEnv }) ?? "",
+        model: config.classifier.jev.model, baseUrl: config.classifier.jev.baseUrl,
+        timeoutMs: config.classifier.jev.timeoutMs, log: (m) => process.stderr.write(m + "\n"),
+    });
+    const generative = createGenerativeClassifier({ ...config.classifier.generative });
+    const primary = config.classifier.kind === "jev" ? jev : generative;
+    const model = config.classifier.kind === "jev" ? config.classifier.jev.model : config.classifier.generative.model;
+    const classifier = {
+        id: config.classifier.kind, model,
+        classify: (r) => classify(r, { kind: config.classifier.kind, primary, fallback: config.classifier.kind === "jev" ? generative : undefined }),
+    };
+    const cache = new GateCache(`${homedir()}/.auto-gate/gate-cache.json`);
+    return { config, classifier, cache, decide: (req) => decideRequest(req, { config, classifier, cache }) };
+}

package/dist/cli/stats.d.ts

@@ -0,0 +1,7 @@
+export interface AuditSummary {
+    total: number;
+    byDecision: Record<string, number>;
+    cacheHits: number;
+    redactionClasses: string[];
+}
+export declare function summarizeAudit(path: string): AuditSummary;

package/dist/cli/stats.js

@@ -0,0 +1,29 @@
+import { readFileSync } from "node:fs";
+export function summarizeAudit(path) {
+    const s = { total: 0, byDecision: {}, cacheHits: 0, redactionClasses: [] };
+    let raw = "";
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch {
+        return s;
+    }
+    const redactions = new Set();
+    for (const line of raw.split("\n")) {
+        if (!line.trim())
+            continue;
+        try {
+            const e = JSON.parse(line);
+            s.total++;
+            if (e.decision)
+                s.byDecision[e.decision] = (s.byDecision[e.decision] ?? 0) + 1;
+            if (e.cacheHit)
+                s.cacheHits++;
+            for (const r of e.redactions ?? [])
+                redactions.add(r);
+        }
+        catch { /* skip a corrupt line rather than failing the whole report */ }
+    }
+    s.redactionClasses = [...redactions].sort();
+    return s;
+}

package/dist/cli/test.d.ts

@@ -0,0 +1,2 @@
+/** Dry run: same pipeline, cache bypassed (config.cache=false), human-readable output. */
+export declare function runTest(reqJson: string): Promise<string>;

package/dist/cli/test.js

@@ -0,0 +1,9 @@
+import { decideRequest } from "../core/decide.js";
+import { buildRuntime } from "./runtime.js";
+/** Dry run: same pipeline, cache bypassed (config.cache=false), human-readable output. */
+export async function runTest(reqJson) {
+    const { config, classifier, cache } = await buildRuntime();
+    const req = JSON.parse(reqJson);
+    const o = await decideRequest(req, { config: { ...config, cache: false }, classifier, cache });
+    return `${o.decision}  (tier ${o.tier})  ${o.reason}`;
+}

package/dist/config/keys.d.ts

@@ -0,0 +1,8 @@
+export interface KeyInput {
+    env?: Record<string, string | undefined>;
+    home?: string;
+    apiKeyEnv?: string;
+    keyFile?: string;
+}
+/** env → key file (§12). Never logged. Absent ⇒ undefined (caller asks). */
+export declare function resolveApiKey(i?: KeyInput): string | undefined;

package/dist/config/keys.js

@@ -0,0 +1,17 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+/** env → key file (§12). Never logged. Absent ⇒ undefined (caller asks). */
+export function resolveApiKey(i = {}) {
+    const env = i.env ?? process.env;
+    const fromEnv = env[i.apiKeyEnv ?? "TYPESAFE_API_KEY"];
+    if (fromEnv)
+        return fromEnv;
+    const file = i.keyFile ?? `${i.home ?? homedir()}/.auto-gate-key`;
+    try {
+        const v = readFileSync(file, "utf8").trim();
+        return v || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/config/resolve.d.ts

@@ -0,0 +1,17 @@
+import { type AutoGateConfig } from "./schema.js";
+export interface ResolveInput {
+    home?: string;
+    cwd?: string;
+    env?: Record<string, string | undefined>;
+    explicitPath?: string;
+}
+export type DeepPartial<T> = {
+    [K in keyof T]?: T[K] extends readonly (infer U)[] ? U[] : T[K] extends object ? DeepPartial<T[K]> : T[K];
+};
+/** Shallow-merge per section, with policy resolved against its named preset so
+ *  a preset change plus a per-key override compose predictably (§12). Exported
+ *  so the §3 host API (integration/host.ts) can compose squadrant's projected
+ *  config with the same tested precedence (D-A2). */
+export declare function mergeConfig(base: AutoGateConfig, over: DeepPartial<AutoGateConfig>): AutoGateConfig;
+/** Precedence (low → high): defaults ← user ← repo ← explicit/--config/env. */
+export declare function resolveConfig(input?: ResolveInput): AutoGateConfig;

package/dist/config/resolve.js

@@ -0,0 +1,52 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { DEFAULT_CONFIG } from "./schema.js";
+import { PRESETS } from "../core/presets.js";
+/** Shallow-merge per section, with policy resolved against its named preset so
+ *  a preset change plus a per-key override compose predictably (§12). Exported
+ *  so the §3 host API (integration/host.ts) can compose squadrant's projected
+ *  config with the same tested precedence (D-A2). */
+export function mergeConfig(base, over) {
+    const policyName = (over.policy?.name ?? base.policy.name);
+    const preset = PRESETS[policyName] ?? PRESETS.strict;
+    return {
+        ...base,
+        ...over,
+        classifier: { ...base.classifier, ...over.classifier,
+            jev: { ...base.classifier.jev, ...over.classifier?.jev },
+            generative: { ...base.classifier.generative, ...over.classifier?.generative } },
+        // Re-resolve the preset ONLY when this layer touches policy; otherwise keep the
+        // already-composed base (re-expanding on every layer would reset per-key overrides).
+        policy: (over.policy
+            ? { ...preset, ...over.policy, name: policyName, hazards: { ...preset.hazards, ...over.policy.hazards } }
+            : base.policy),
+        agents: { ...base.agents, ...over.agents },
+        ask: { ...base.ask, ...over.ask },
+        tools: over.tools ?? base.tools,
+        toolAliases: (over.toolAliases ?? base.toolAliases),
+        audit: { ...base.audit, ...over.audit },
+    };
+}
+function readJsonLayer(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        return parsed && typeof parsed === "object" ? parsed : {};
+    }
+    catch {
+        return {}; // missing or malformed ⇒ this layer contributes nothing (never throws)
+    }
+}
+/** Precedence (low → high): defaults ← user ← repo ← explicit/--config/env. */
+export function resolveConfig(input = {}) {
+    const home = input.home ?? homedir();
+    const cwd = input.cwd ?? process.cwd();
+    const env = input.env ?? process.env;
+    const explicit = input.explicitPath ?? env.AUTO_GATE_CONFIG;
+    let cfg = mergeConfig({ ...DEFAULT_CONFIG, policy: PRESETS.strict }, {});
+    cfg = mergeConfig(cfg, readJsonLayer(join(home, ".config", "auto-gate", "config.json")));
+    cfg = mergeConfig(cfg, readJsonLayer(join(cwd, ".auto-gate.json")));
+    if (explicit)
+        cfg = mergeConfig(cfg, readJsonLayer(explicit));
+    return cfg;
+}

package/dist/config/schema.d.ts

@@ -0,0 +1,38 @@
+import type { PolicyConfig, ToolAliases } from "../core/types.js";
+export interface AutoGateConfig {
+    mode: "on" | "off" | "auto";
+    agents: Record<string, {
+        enabled?: boolean;
+    }>;
+    classifier: {
+        kind: "jev" | "generative";
+        jev: {
+            model: string;
+            baseUrl: string;
+            apiKeyEnv: string;
+            timeoutMs: number;
+        };
+        generative: {
+            baseUrl: string;
+            model: string;
+            apiKeyEnv?: string;
+            timeoutMs: number;
+        };
+    };
+    policy: PolicyConfig;
+    tools: string[];
+    toolAliasesVersion: number;
+    toolAliases: ToolAliases;
+    deny?: string[];
+    ask: {
+        onAsk: string | null;
+        timeoutMs: number;
+    };
+    cache: boolean;
+    audit: {
+        path: string;
+    };
+}
+/** Standalone default is ON (a user who installs a gate wants it on). This
+ *  differs from squadrant's `defaults.gate.mode` default of "auto" (§12). */
+export declare const DEFAULT_CONFIG: AutoGateConfig;

package/dist/config/schema.js

@@ -0,0 +1,19 @@
+/** Standalone default is ON (a user who installs a gate wants it on). This
+ *  differs from squadrant's `defaults.gate.mode` default of "auto" (§12). */
+export const DEFAULT_CONFIG = {
+    mode: "on",
+    agents: { claude: { enabled: true }, opencode: { enabled: true } },
+    classifier: {
+        kind: "jev",
+        jev: { model: "jev-latest", baseUrl: "https://api.typesafe.ai", apiKeyEnv: "TYPESAFE_API_KEY", timeoutMs: 4000 },
+        generative: { baseUrl: "", model: "", timeoutMs: 3000 },
+    },
+    // policy defaults come from presets.ts so there is exactly one source of truth
+    policy: {}, // replaced in resolve.ts with PRESETS.strict
+    tools: ["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit"],
+    toolAliasesVersion: 1,
+    toolAliases: { opencode: { bash: ["Bash"], edit: ["Edit", "Write", "MultiEdit"] } },
+    ask: { onAsk: null, timeoutMs: 120000 },
+    cache: true,
+    audit: { path: "~/.auto-gate/decisions.jsonl" },
+};

package/dist/core/audit.d.ts

@@ -0,0 +1,21 @@
+export interface AuditEntry {
+    ts: string;
+    agent: string;
+    tool: string;
+    cwd: string;
+    decision: string;
+    verdict: string;
+    classifier: string;
+    tier: 1 | 2;
+    cacheHit: boolean;
+    latencyMs: number;
+    probabilities?: Record<string, number>;
+    hazards?: Record<string, number>;
+    severity?: number;
+    confidence?: number;
+    inputTokens?: number;
+    redactions: string[];
+}
+/** Append-only JSONL, 0600. NEVER logs raw payloads/secrets — only the redaction
+ *  ids that fired (§9/§12). Best-effort: an audit write never breaks a decision. */
+export declare function appendAudit(path: string, entry: AuditEntry): void;

package/dist/core/audit.js

@@ -0,0 +1,12 @@
+import { appendFileSync, chmodSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+/** Append-only JSONL, 0600. NEVER logs raw payloads/secrets — only the redaction
+ *  ids that fired (§9/§12). Best-effort: an audit write never breaks a decision. */
+export function appendAudit(path, entry) {
+    try {
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        appendFileSync(path, JSON.stringify(entry) + "\n", { mode: 0o600 });
+        chmodSync(path, 0o600);
+    }
+    catch { /* best-effort */ }
+}

package/dist/core/cache.d.ts

@@ -0,0 +1,22 @@
+import type { GateOutcome } from "./types.js";
+export interface CacheKeyParts {
+    agent: string;
+    toolName: string;
+    cwd: string;
+    redactedPayload: string;
+    redactedUserIntent: string | null;
+    policyVersion: string;
+    toolAliasesVersion: number;
+    classifierId: string;
+    model: string;
+}
+export declare function cacheKey(k: CacheKeyParts): string;
+export declare class GateCache {
+    private file;
+    private entries;
+    constructor(file: string);
+    get(key: string): GateOutcome | undefined;
+    set(key: string, outcome: GateOutcome): void;
+    private load;
+    private save;
+}

package/dist/core/cache.js

@@ -0,0 +1,59 @@
+import { createHash } from "node:crypto";
+import { readFileSync, writeFileSync, renameSync, chmodSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+export function cacheKey(k) {
+    const intentHash = createHash("sha256").update(k.redactedUserIntent ?? "").digest("hex");
+    return createHash("sha256")
+        .update([k.agent, k.toolName, k.cwd, k.redactedPayload, intentHash, k.policyVersion,
+        String(k.toolAliasesVersion), k.classifierId, k.model].join("\n"))
+        .digest("hex");
+}
+const TTL_MS = 10 * 60_000;
+const MAX = 500;
+export class GateCache {
+    file;
+    entries = new Map();
+    constructor(file) {
+        this.file = file;
+        this.load();
+    }
+    get(key) {
+        const e = this.entries.get(key);
+        if (!e)
+            return undefined;
+        if (Date.now() - e.at > TTL_MS) {
+            this.entries.delete(key);
+            return undefined;
+        }
+        return { ...e.outcome, cached: true };
+    }
+    set(key, outcome) {
+        if (outcome.decision !== "allow" && outcome.decision !== "deny")
+            return; // never cache ask
+        this.entries.set(key, { at: Date.now(), outcome: { ...outcome, cached: undefined } });
+        if (this.entries.size > MAX) {
+            const oldest = [...this.entries.entries()].sort((a, b) => a[1].at - b[1].at)[0];
+            if (oldest)
+                this.entries.delete(oldest[0]);
+        }
+        this.save();
+    }
+    load() {
+        try {
+            const raw = JSON.parse(readFileSync(this.file, "utf8"));
+            for (const [k, v] of Object.entries(raw))
+                this.entries.set(k, v);
+        }
+        catch { /* missing/corrupt cache is not an error */ }
+    }
+    save() {
+        try {
+            mkdirSync(dirname(this.file), { recursive: true, mode: 0o700 });
+            const tmp = `${this.file}.${process.pid}.tmp`;
+            writeFileSync(tmp, JSON.stringify(Object.fromEntries(this.entries)), { mode: 0o600 });
+            renameSync(tmp, this.file);
+            chmodSync(this.file, 0o600);
+        }
+        catch { /* cache write failure must never break a decision */ }
+    }
+}

package/dist/core/decide.d.ts

@@ -0,0 +1,26 @@
+import type { GateAssessment, GateOutcome, GateRequest } from "./types.js";
+import { GateCache } from "./cache.js";
+export interface DecideContext {
+    config: {
+        mode: "on" | "off" | "auto";
+        policy: import("./types.js").PolicyConfig;
+        tools: string[];
+        toolAliasesVersion: number;
+        toolAliases: import("./types.js").ToolAliases;
+        deny?: string[];
+        cache: boolean;
+        audit: {
+            path: string;
+        };
+    };
+    classifier: {
+        id: string;
+        model?: string;
+        classify(req: GateRequest): Promise<GateAssessment>;
+    };
+    cache: GateCache;
+    env?: Record<string, string | undefined>;
+    now?: () => number;
+}
+/** The one pipeline (§4): scope → redact → cache → Tier-1 → classify → policy → audit. */
+export declare function decideRequest(req: GateRequest, ctx: DecideContext): Promise<GateOutcome>;