@squadrant-ai/auto-gate 0.1.0

package/dist/core/decide.js

@@ -0,0 +1,75 @@
+import { decide } from "./policy.js";
+import { matchesTier1Deny, DEFAULT_TIER1_DENY } from "./tier1.js";
+import { policyVersion } from "./policy-version.js";
+import { redact } from "./redact.js";
+import { cacheKey } from "./cache.js";
+import { appendAudit } from "./audit.js";
+import { isGateSession } from "./scope.js";
+const YIELD = (reason) => ({ decision: "yield", tier: 2, reason });
+/** The one pipeline (§4): scope → redact → cache → Tier-1 → classify → policy → audit. */
+export async function decideRequest(req, ctx) {
+    const started = (ctx.now ?? Date.now)();
+    const env = ctx.env ?? process.env;
+    // 1. Scope — never gate the operator's own session (§10)
+    const markers = env.AUTO_GATE_SESSION === "1" || req.sessionKind !== "standalone";
+    if (ctx.config.mode === "off" || !isGateSession(env) && !markers)
+        return YIELD("out of scope");
+    if (req.permissionMode === "auto")
+        return YIELD("agent permission mode is auto");
+    // 2. Redact BEFORE anything leaves the process (§6.2)
+    const payload = redact(req.toolPayload);
+    const intent = req.userIntent ? redact(req.userIntent) : undefined;
+    // 3. Cache (only conclusive outcomes are cached — §9)
+    const pv = policyVersion(ctx.config.policy);
+    const key = cacheKeyOf(req, payload.text, intent?.text ?? null, pv, ctx);
+    if (ctx.config.cache) {
+        const hit = ctx.cache.get(key);
+        if (hit) {
+            // A hit bypasses the classifier, but it MUST still be audited — otherwise
+            // the cache-hit rate (§9) is structurally unmeasurable.
+            appendAudit(ctx.config.audit.path, {
+                ts: new Date(started).toISOString(),
+                agent: req.agent, tool: req.toolName, cwd: req.cwd,
+                decision: hit.decision, verdict: "cached", classifier: "cache", tier: hit.tier,
+                cacheHit: true, latencyMs: (ctx.now ?? Date.now)() - started,
+                redactions: [...payload.fired, ...(intent?.fired ?? [])],
+            });
+            return hit;
+        }
+    }
+    // 4. Tier-1 static deny — model-free, ~0 ms
+    const tier1 = matchesTier1Deny(payload.text, ctx.config.deny?.map((s) => new RegExp(s)) ?? DEFAULT_TIER1_DENY);
+    // 5. Tier-2 classify (never throws) → 6. policy
+    let assessment;
+    if (!tier1)
+        assessment = await ctx.classifier.classify(req);
+    const outcome = assessment
+        ? decide(req, assessment, ctx.config.policy, tier1)
+        : decide(req, { verdict: "ask", classifier: "skipped", tier: 2 }, ctx.config.policy, tier1);
+    // 7. Persist + audit
+    if (ctx.config.cache)
+        ctx.cache.set(key, outcome);
+    appendAudit(ctx.config.audit.path, {
+        ts: new Date(started).toISOString(),
+        agent: req.agent, tool: req.toolName, cwd: req.cwd,
+        decision: outcome.decision, verdict: assessment?.verdict ?? "n/a",
+        classifier: assessment?.classifier ?? "tier1", tier: outcome.tier,
+        cacheHit: false, latencyMs: (ctx.now ?? Date.now)() - started,
+        ...(assessment?.probabilities ? { probabilities: assessment.probabilities } : {}),
+        ...(assessment?.hazards ? { hazards: assessment.hazards } : {}),
+        ...(assessment?.severity !== undefined ? { severity: assessment.severity } : {}),
+        ...(assessment?.confidence !== undefined ? { confidence: assessment.confidence } : {}),
+        ...(assessment?.usage?.inputTokens !== undefined ? { inputTokens: assessment.usage.inputTokens } : {}),
+        redactions: [...payload.fired, ...(intent?.fired ?? [])],
+    });
+    return outcome;
+}
+function cacheKeyOf(req, redactedPayload, redactedIntent, pv, ctx) {
+    // Reuse P1's cacheKey by constructing its parts (single source of truth).
+    return cacheKey({
+        agent: req.agent, toolName: req.toolName, cwd: req.cwd, redactedPayload,
+        redactedUserIntent: redactedIntent, policyVersion: pv,
+        toolAliasesVersion: ctx.config.toolAliasesVersion,
+        classifierId: ctx.classifier.id, model: ctx.classifier.model ?? "",
+    });
+}

package/dist/core/policy-version.d.ts

@@ -0,0 +1,2 @@
+import type { PolicyConfig } from "./types.js";
+export declare function policyVersion(p: PolicyConfig): string;

package/dist/core/policy-version.js

@@ -0,0 +1,14 @@
+import { createHash } from "node:crypto";
+/** Deterministic (sorted-key) JSON, so key order can never change the hash. */
+function canonical(v) {
+    if (Array.isArray(v))
+        return `[${v.map(canonical).join(",")}]`;
+    if (v && typeof v === "object") {
+        const o = v;
+        return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${canonical(o[k])}`).join(",")}}`;
+    }
+    return JSON.stringify(v);
+}
+export function policyVersion(p) {
+    return createHash("sha256").update(canonical(p)).digest("hex");
+}

package/dist/core/policy.d.ts

@@ -0,0 +1,2 @@
+import type { GateAssessment, GateRequest, GateOutcome, PolicyConfig } from "./types.js";
+export declare function decide(req: GateRequest, a: GateAssessment, p: PolicyConfig, tier1Matched: boolean): GateOutcome;

package/dist/core/policy.js

@@ -0,0 +1,36 @@
+const GENERATIVE = new Set(["generative", "router"]);
+export function decide(req, a, p, tier1Matched) {
+    const P = (k) => a.probabilities?.[k];
+    const H = (k) => a.hazards?.[k];
+    const sev = a.severity;
+    // 1. DENY
+    if (tier1Matched)
+        return { decision: "deny", tier: 1, reason: "tier-1 static deny" };
+    if ((P("deny") ?? 0) >= p.denyThreshold)
+        return { decision: "deny", tier: 2, reason: "P(deny) ≥ denyThreshold" };
+    if ((H("destructive") ?? 0) >= p.actionThreshold && (sev ?? 0) >= p.severityBlock)
+        return { decision: "deny", tier: 2, reason: "destructive ≥ action ∧ severity ≥ block" };
+    if ((H("secrets") ?? 0) >= p.actionThreshold && (H("scope_escape") ?? 0) >= p.actionThreshold)
+        return { decision: "deny", tier: 2, reason: "secrets ≥ action ∧ scope_escape ≥ action" };
+    if ((H("scope_escape") ?? 0) >= p.actionThreshold && (sev ?? 0) >= p.severityBlock)
+        return { decision: "deny", tier: 2, reason: "scope_escape ≥ action ∧ severity ≥ block" };
+    // 2. GENERATIVE FALLBACK (only if explicitly opted in)
+    const isGenerative = [...GENERATIVE].some((g) => a.classifier.startsWith(g));
+    if (p.fallbackAcceptsVerdict && isGenerative && (a.verdict === "allow" || a.verdict === "deny"))
+        return { decision: a.verdict, tier: 2, reason: "generative verdict (fallbackAcceptsVerdict)" };
+    // 3. ALLOW — every condition must hold
+    const confidenceOk = a.confidence !== undefined && a.confidence >= p.minConfidence;
+    const intentOk = req.intentSupport === "unsupported" ? true
+        : req.intentSupport === "pending" ? false
+            : (H("intent_match") ?? 0) >= p.intentThreshold;
+    if ((P("allow") ?? 0) >= p.allowThreshold &&
+        confidenceOk &&
+        (H("destructive") ?? 1) < p.reviewThreshold &&
+        (H("secrets") ?? 1) < p.reviewThreshold &&
+        (H("scope_escape") ?? 1) < p.reviewThreshold &&
+        intentOk &&
+        (sev ?? 1) < p.reviewSeverity)
+        return { decision: "allow", tier: 2, reason: "allow conditions satisfied" };
+    // 4. ASK — catch-all
+    return { decision: "ask", tier: 2, reason: "catch-all ask" };
+}

package/dist/core/presets.d.ts

@@ -0,0 +1,9 @@
+import type { PolicyConfig } from "./types.js";
+export declare const STRICT: PolicyConfig;
+export declare const BALANCED: PolicyConfig;
+export declare const PERMISSIVE: PolicyConfig;
+export declare const PRESETS: {
+    readonly strict: PolicyConfig;
+    readonly balanced: PolicyConfig;
+    readonly permissive: PolicyConfig;
+};

package/dist/core/presets.js

@@ -0,0 +1,15 @@
+const hazards = {
+    destructive: { review: 0.35, action: 0.8, vetoesAllow: true },
+    secrets: { review: 0.35, action: 0.8, vetoesAllow: true },
+    scope_escape: { review: 0.35, action: 0.8, vetoesAllow: true },
+    intent_match: { allowFloor: 0.5, vetoesAllow: false },
+};
+export const STRICT = {
+    name: "strict", reviewThreshold: 0.35, actionThreshold: 0.8, allowThreshold: 0.8,
+    denyThreshold: 0.75, minConfidence: 0.75, intentThreshold: 0.5, reviewSeverity: 1.0,
+    severityBlock: 2.0, fallbackAcceptsVerdict: false, hazards,
+    tools: ["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit"],
+};
+export const BALANCED = { ...STRICT, name: "balanced", allowThreshold: 0.75, denyThreshold: 0.8, minConfidence: 0.65, intentThreshold: 0.4 };
+export const PERMISSIVE = { ...STRICT, name: "permissive", allowThreshold: 0.7, denyThreshold: 0.85, minConfidence: 0.55, intentThreshold: 0.3, actionThreshold: 0.85 };
+export const PRESETS = { strict: STRICT, balanced: BALANCED, permissive: PERMISSIVE };

package/dist/core/redact.d.ts

@@ -0,0 +1,7 @@
+export declare const REDACTION_PATTERNS_VERSION = "v1";
+export interface RedactResult {
+    text: string;
+    fired: string[];
+}
+/** Redact secret patterns. Pure; `fired` names the rules that matched (never the secret). */
+export declare function redact(input: string): RedactResult;

package/dist/core/redact.js

@@ -0,0 +1,26 @@
+export const REDACTION_PATTERNS_VERSION = "v1";
+// Order matters: the more specific token shapes run before the generic KEY=value rule.
+const RULES = [
+    { id: "bearer", re: /\b(Bearer)\s+[A-Za-z0-9._~+/=-]{8,}/gi, replace: "$1 [REDACTED]" },
+    { id: "gh-token", re: /\bgh[pousr]_[A-Za-z0-9]{20,}/g, replace: "[REDACTED]" },
+    { id: "openai-key", re: /\bsk-[A-Za-z0-9_-]{16,}/g, replace: "[REDACTED]" },
+    { id: "aws-id", re: /\b(AKIA|ASIA)[A-Z0-9]{16}\b/g, replace: "[REDACTED]" },
+    { id: "private-key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, replace: "[REDACTED PRIVATE KEY]" },
+    { id: "pem-body", re: /MII[A-Za-z0-9+/=]{40,}/g, replace: "[REDACTED]" },
+    { id: "env-assign", re: /\b([A-Z][A-Z0-9_]{2,})=(["']?)([^\s"']{6,})\2/g, replace: "$1=[REDACTED]" },
+];
+/** Redact secret patterns. Pure; `fired` names the rules that matched (never the secret). */
+export function redact(input) {
+    if (typeof input !== "string" || input.length === 0)
+        return { text: "", fired: [] };
+    let text = input;
+    const fired = [];
+    for (const rule of RULES) {
+        if (rule.re.test(text)) {
+            fired.push(rule.id);
+            text = text.replace(rule.re, rule.replace);
+        }
+        rule.re.lastIndex = 0; // /g regexes are stateful — reset between calls
+    }
+    return { text, fired };
+}

package/dist/core/scope.d.ts

@@ -0,0 +1,2 @@
+/** Positive session markers only — never scope the operator's own session (§10). */
+export declare function isGateSession(env: Record<string, string | undefined>): boolean;

package/dist/core/scope.js

@@ -0,0 +1,7 @@
+/** Positive session markers only — never scope the operator's own session (§10). */
+export function isGateSession(env) {
+    return Boolean(env.SQUADRANT_CREW_TASK_ID ||
+        env.SQUADRANT_SIDE_SESSION === "1" ||
+        env.SQUADRANT_ROLE === "captain" ||
+        env.AUTO_GATE_SESSION === "1");
+}

package/dist/core/tier1.d.ts

@@ -0,0 +1,3 @@
+/** ~0 ms, model-free first pass. The ONLY independent backstop (spec §12). */
+export declare const DEFAULT_TIER1_DENY: RegExp[];
+export declare function matchesTier1Deny(payload: string, deny?: RegExp[]): boolean;

package/dist/core/tier1.js

@@ -0,0 +1,16 @@
+/** ~0 ms, model-free first pass. The ONLY independent backstop (spec §12). */
+export const DEFAULT_TIER1_DENY = [
+    /(^|[;&|]\s*)sudo\b/,
+    // rm with recursive+force in any flag order, targeting / or a system path
+    /\brm\s+(-[a-z]*[rf][a-z]*\s+)+(-[a-z]*[rf][a-z]*\s+)*\/(\s|$)/i,
+    /\brm\s+--(recursive|force)\b[^\n]*\/(\s|$)/i,
+    /\b(mkfs(\.\w+)?|dd\s+[^\n]*of=\/dev\/)\b/,
+    /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/, // fork bomb
+    /\bchmod\s+(-R\s+)?0?777\s+\/(\s|$)/,
+    /\b(curl|wget)\b[^\n|]*\|\s*(sudo\s+)?(ba|z|da)?sh\b/,
+];
+export function matchesTier1Deny(payload, deny = DEFAULT_TIER1_DENY) {
+    if (typeof payload !== "string" || payload.length === 0)
+        return false;
+    return deny.some((re) => re.test(payload));
+}

package/dist/core/tools.d.ts

@@ -0,0 +1,5 @@
+import type { ToolAliases } from "./types.js";
+/** Canonical names for a native tool name. Empty ⇒ unmapped ⇒ out of scope. */
+export declare function canonicalNames(agent: string, nativeName: string, aliases: ToolAliases): string[];
+/** Scope match: ANY canonical name in the set is in scope (§15#6, any-of). */
+export declare function isInScope(agent: string, nativeName: string, aliases: ToolAliases, tools: string[]): boolean;

package/dist/core/tools.js

@@ -0,0 +1,21 @@
+const CLAUDE_CANONICAL = new Set(["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit"]);
+/** Canonical names for a native tool name. Empty ⇒ unmapped ⇒ out of scope. */
+export function canonicalNames(agent, nativeName, aliases) {
+    const perAgent = aliases[agent];
+    if (perAgent) {
+        const mapped = perAgent[nativeName];
+        if (mapped)
+            return mapped;
+        // A claude-shaped name passed through an aliased agent still matches.
+        if (CLAUDE_CANONICAL.has(nativeName))
+            return [nativeName];
+        return [];
+    }
+    // No alias table for this agent: claude-shaped names are canonical; others out of scope.
+    return CLAUDE_CANONICAL.has(nativeName) ? [nativeName] : [];
+}
+/** Scope match: ANY canonical name in the set is in scope (§15#6, any-of). */
+export function isInScope(agent, nativeName, aliases, tools) {
+    const canon = canonicalNames(agent, nativeName, aliases);
+    return canon.some((c) => tools.includes(c));
+}

package/dist/core/types.d.ts

@@ -0,0 +1,68 @@
+export type ClassifierVerdict = "allow" | "deny" | "ask";
+export type GateOutcomeDecision = "allow" | "deny" | "ask" | "yield";
+export type IntentSupport = "available" | "pending" | "unsupported";
+/** native tool name → set of canonical (claude-shaped) names */
+export type ToolAliases = Record<string, Record<string, string[]>>;
+export interface GateRequest {
+    agent: string;
+    toolName: string;
+    toolPayload: string;
+    cwd: string;
+    userIntent?: string | null;
+    intentSupport: IntentSupport;
+    permissionMode?: string;
+    sessionKind: "crew" | "side" | "captain" | "standalone";
+    raw?: unknown;
+}
+export interface GateAssessment {
+    verdict: ClassifierVerdict;
+    confidence?: number;
+    probabilities?: Record<string, number>;
+    hazards?: Record<string, number>;
+    severity?: number;
+    classifier: string;
+    tier: 2;
+    usage?: {
+        inputTokens?: number;
+    };
+}
+export interface GateOutcome {
+    decision: GateOutcomeDecision;
+    tier: 1 | 2;
+    reason: string;
+    cached?: boolean;
+}
+export interface PolicyConfig {
+    name: "strict" | "balanced" | "permissive";
+    reviewThreshold: number;
+    actionThreshold: number;
+    allowThreshold: number;
+    denyThreshold: number;
+    minConfidence: number;
+    intentThreshold: number;
+    reviewSeverity: number;
+    severityBlock: number;
+    fallbackAcceptsVerdict: boolean;
+    hazards: {
+        destructive: {
+            review: number;
+            action: number;
+            vetoesAllow: boolean;
+        };
+        secrets: {
+            review: number;
+            action: number;
+            vetoesAllow: boolean;
+        };
+        scope_escape: {
+            review: number;
+            action: number;
+            vetoesAllow: boolean;
+        };
+        intent_match: {
+            allowFloor: number;
+            vetoesAllow: boolean;
+        };
+    };
+    tools: string[];
+}

package/dist/core/types.js

@@ -0,0 +1 @@
+export {};

package/dist/index.d.ts

@@ -0,0 +1,30 @@
+export * from "./core/types.js";
+export * from "./core/tools.js";
+export * from "./core/tier1.js";
+export * from "./core/policy.js";
+export * from "./core/presets.js";
+export * from "./core/policy-version.js";
+export * from "./core/cache.js";
+export * from "./core/scope.js";
+export * from "./core/redact.js";
+export * from "./classifiers/classify.js";
+export * from "./classifiers/jev.js";
+export * from "./classifiers/generative.js";
+export * from "./classifiers/null.js";
+export * from "./config/schema.js";
+export * from "./config/resolve.js";
+export * from "./config/keys.js";
+export * from "./core/audit.js";
+export * from "./core/decide.js";
+export * from "./adapters/claude/payload.js";
+export * from "./adapters/claude/output.js";
+export * from "./adapters/claude/settings.js";
+export * from "./adapters/claude/blocked-signal.js";
+export * from "./adapters/opencode/lock.js";
+export * from "./adapters/opencode/port.js";
+export * from "./adapters/opencode/sse.js";
+export * from "./adapters/opencode/intent.js";
+export * from "./adapters/opencode/answer.js";
+export * from "./adapters/opencode/install.js";
+export * from "./integration/project.js";
+export * from "./integration/host.js";

package/dist/index.js

@@ -0,0 +1,30 @@
+export * from "./core/types.js";
+export * from "./core/tools.js";
+export * from "./core/tier1.js";
+export * from "./core/policy.js";
+export * from "./core/presets.js";
+export * from "./core/policy-version.js";
+export * from "./core/cache.js";
+export * from "./core/scope.js";
+export * from "./core/redact.js";
+export * from "./classifiers/classify.js";
+export * from "./classifiers/jev.js";
+export * from "./classifiers/generative.js";
+export * from "./classifiers/null.js";
+export * from "./config/schema.js";
+export * from "./config/resolve.js";
+export * from "./config/keys.js";
+export * from "./core/audit.js";
+export * from "./core/decide.js";
+export * from "./adapters/claude/payload.js";
+export * from "./adapters/claude/output.js";
+export * from "./adapters/claude/settings.js";
+export * from "./adapters/claude/blocked-signal.js";
+export * from "./adapters/opencode/lock.js";
+export * from "./adapters/opencode/port.js";
+export * from "./adapters/opencode/sse.js";
+export * from "./adapters/opencode/intent.js";
+export * from "./adapters/opencode/answer.js";
+export * from "./adapters/opencode/install.js";
+export * from "./integration/project.js";
+export * from "./integration/host.js";

package/dist/integration/host.d.ts

@@ -0,0 +1,28 @@
+import type { GateOutcome } from "../core/types.js";
+import type { AutoGateConfig } from "../config/schema.js";
+export interface BlockedSignalCtx {
+    agent: string;
+    tool: string;
+    reason: string;
+    project?: string;
+    gateId?: string;
+}
+export interface AutoGateHost {
+    /** Interface 1 — a partial projection of squadrant's defaults.gate, or a full config. */
+    config?: Partial<AutoGateConfig>;
+    /** Interface 2 — supplied by the host; the package never reads a transcript itself. */
+    readIntent: (transcriptPath: string | undefined) => string | undefined;
+    /** Interface 3 — the ask/yield callback. squadrant maps this to #560 task.blocked. */
+    blockedSignal?: (ctx: BlockedSignalCtx) => Promise<void>;
+    /** Injectable for tests; defaults to the real P3 runtime. */
+    decide?: (req: unknown) => Promise<GateOutcome>;
+    project?: string;
+    env?: Record<string, string | undefined>;
+    log?: (m: string) => void;
+}
+/** The single entry squadrant consumes (§3). It owns NOTHING of squadrant's config:
+ *  the host injects the resolved config, the intent reader, and the blocked signal. */
+export declare function createAutoGate(host: AutoGateHost): {
+    config: AutoGateConfig;
+    decideClaudeHookPayload(raw: string): Promise<string | undefined>;
+};

package/dist/integration/host.js

@@ -0,0 +1,37 @@
+import { mapClaudeHookPayload } from "../adapters/claude/payload.js";
+import { formatClaudeHookOutput } from "../adapters/claude/output.js";
+import { resolveConfig, mergeConfig } from "../config/resolve.js";
+import { buildRuntime } from "../cli/runtime.js";
+/** The single entry squadrant consumes (§3). It owns NOTHING of squadrant's config:
+ *  the host injects the resolved config, the intent reader, and the blocked signal. */
+export function createAutoGate(host) {
+    // D-A2: compose through the same tested precedence as resolveConfig, so a
+    // partial projected section (notably a named `policy` preset) re-expands
+    // instead of replacing the base section.
+    const config = mergeConfig(resolveConfig(), host.config ?? {});
+    async function decide(req) {
+        if (host.decide)
+            return host.decide(req);
+        const rt = await buildRuntime();
+        return rt.decide(req);
+    }
+    return {
+        config,
+        async decideClaudeHookPayload(raw) {
+            try {
+                const payload = JSON.parse(raw);
+                const req = mapClaudeHookPayload(payload, host.env ?? process.env, host.readIntent);
+                const outcome = await decide(req);
+                const out = formatClaudeHookOutput(outcome);
+                if (out)
+                    return out;
+                await host.blockedSignal?.({ agent: "claude", tool: req.toolName, reason: outcome.reason, ...(host.project ? { project: host.project } : {}) });
+                return undefined;
+            }
+            catch (e) {
+                host.log?.(`auto-gate host: decide failed — ${e.message}`); // print nothing ⇒ dialog appears
+                return undefined;
+            }
+        },
+    };
+}

package/dist/integration/project.d.ts

@@ -0,0 +1,24 @@
+import type { AutoGateConfig } from "../config/schema.js";
+/** The subset of squadrant's `defaults.gate` this projection understands. */
+export interface SquadrantGateShape {
+    mode?: "on" | "off" | "auto";
+    policy?: {
+        name?: string;
+        [k: string]: unknown;
+    };
+    ask?: {
+        onAsk?: string | null;
+        timeoutMs?: number;
+    };
+    tools?: string[];
+    deny?: string[];
+}
+export interface SquadrantConfigShape {
+    gate?: SquadrantGateShape;
+}
+type Projected = Partial<AutoGateConfig>;
+/** §3 bridge interface 1. The package NEVER reads squadrant's config file — the
+ *  host hands it a projected object. `auto` is squadrant's documented no-op, so
+ *  it maps to the package's `off`; only an explicit `on` enables the gate. */
+export declare function projectGateConfig(squadrant: SquadrantConfigShape): Projected;
+export {};

package/dist/integration/project.js

@@ -0,0 +1,19 @@
+/** §3 bridge interface 1. The package NEVER reads squadrant's config file — the
+ *  host hands it a projected object. `auto` is squadrant's documented no-op, so
+ *  it maps to the package's `off`; only an explicit `on` enables the gate. */
+export function projectGateConfig(squadrant) {
+    const g = squadrant.gate;
+    if (!g)
+        return { mode: "off" };
+    const mode = g.mode === "on" ? "on" : "off"; // "auto" and undefined are no-ops
+    const out = { mode };
+    if (g.policy)
+        out.policy = g.policy;
+    if (g.ask)
+        out.ask = { onAsk: g.ask.onAsk ?? null, timeoutMs: g.ask.timeoutMs ?? 120000 };
+    if (g.tools)
+        out.tools = g.tools;
+    if (g.deny)
+        out.deny = g.deny;
+    return out;
+}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@squadrant-ai/auto-gate",
+  "version": "0.1.0",
+  "description": "Provider-agnostic auto permission gate",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "auto-gate": "dist/cli/index.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "packageManager": "pnpm@10.33.4",
+  "devDependencies": {
+    "@types/node": "^26.6.2",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.1"
+  }
+}