@su-record/vibe 2.6.35 → 2.6.42

package/dist/infra/lib/autonomy/RiskClassifier.js

@@ -0,0 +1,147 @@
+import { z } from 'zod';
+const CONTROL_CHAR_RE = /[\u0000-\u001F]/g;
+const SECURITY_FILE_PATTERNS = [
+    /[/\\]auth[/\\]/i,
+    /[/\\]security[/\\]/i,
+    /[/\\]\.env/i,
+    /[/\\]secrets/i,
+];
+const SENTINEL_PROTECTED_RE = /^src[\\/]lib[\\/]autonomy[\\/]/;
+const DANGEROUS_BASH_RE = /\b(rm\s+-rf|kill\s+-9|drop\s+table|truncate|shutdown|reboot|mkfs|dd\s+if=)\b/i;
+const AUTH_CREDENTIAL_RE = /\b(api[_-]?key|secret|token|password|auth|bearer)\b/i;
+const SCORE_DEFAULTS = {
+    LOW: 15,
+    MEDIUM: 50,
+    HIGH: 80,
+};
+const CustomRiskRuleSchema = z.object({
+    actionType: z.string().min(1),
+    targetPattern: z.string().optional(),
+    riskLevel: z.enum(['LOW', 'MEDIUM', 'HIGH']),
+    condition: z.string().optional(),
+});
+export class RiskClassifier {
+    customRules;
+    constructor(customRules) {
+        this.customRules = (customRules ?? []).filter((rule) => {
+            try {
+                CustomRiskRuleSchema.parse(rule);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    classify(action, context) {
+        const sanitized = this.sanitizeAction(action);
+        const customResult = this.evaluateCustomRules(sanitized);
+        if (customResult)
+            return customResult;
+        return this.evaluateDefaultRules(sanitized, context);
+    }
+    sanitizeAction(action) {
+        return {
+            ...action,
+            agentId: action.agentId.replace(CONTROL_CHAR_RE, ''),
+            target: action.target.replace(CONTROL_CHAR_RE, ''),
+        };
+    }
+    evaluateCustomRules(action) {
+        for (const rule of this.customRules) {
+            if (rule.actionType !== action.actionType)
+                continue;
+            if (rule.targetPattern) {
+                try {
+                    if (!new RegExp(rule.targetPattern, 'i').test(action.target))
+                        continue;
+                }
+                catch {
+                    continue;
+                }
+            }
+            return this.makeAssessment(rule.riskLevel, [`Custom rule matched: ${rule.actionType}`], `Custom rule override for ${rule.actionType}`);
+        }
+        return null;
+    }
+    evaluateDefaultRules(action, context) {
+        const handlers = {
+            file_write: () => this.classifyFileWrite(action),
+            file_delete: () => this.classifyFileDelete(action, context),
+            bash_exec: () => this.classifyBashExec(action),
+            git_push: () => this.classifyGitPush(action),
+            skill_generate: () => this.classifySkillGenerate(action),
+            config_modify: () => this.classifyConfigModify(action),
+            dependency_install: () => this.classifyDependencyInstall(),
+            external_api_call: () => this.classifyExternalApiCall(action),
+        };
+        const handler = handlers[action.actionType];
+        if (handler)
+            return handler();
+        return this.makeAssessment('LOW', [], `Unknown action type: ${action.actionType}`);
+    }
+    classifyFileWrite(action) {
+        const normalized = action.target.replace(/\\/g, '/').replace(/^\.\//, '');
+        if (SENTINEL_PROTECTED_RE.test(normalized)) {
+            return {
+                riskLevel: 'HIGH',
+                score: 100,
+                factors: ['Sentinel protected file modification attempted'],
+                reasoning: 'Modifying files in src/lib/autonomy/ is blocked',
+                blocked: true,
+            };
+        }
+        for (const pattern of SECURITY_FILE_PATTERNS) {
+            if (pattern.test(action.target)) {
+                return this.makeAssessment('HIGH', [`Security-sensitive file: ${action.target}`], 'Security file modification requires elevated risk level');
+            }
+        }
+        return this.makeAssessment('LOW', [], 'Standard file write operation');
+    }
+    classifyFileDelete(action, context) {
+        if (context?.recentDeleteCount !== undefined && context.recentDeleteCount >= 5) {
+            return this.makeAssessment('HIGH', [`Mass delete detected: ${context.recentDeleteCount} files in last 60s`], 'Mass file deletion detected');
+        }
+        return this.makeAssessment('MEDIUM', [], 'File deletion operation');
+    }
+    classifyBashExec(action) {
+        if (DANGEROUS_BASH_RE.test(action.target)) {
+            return this.makeAssessment('HIGH', [`Dangerous command detected in: ${action.target}`], 'Bash command contains dangerous patterns');
+        }
+        return this.makeAssessment('MEDIUM', [], 'Standard bash execution');
+    }
+    classifyGitPush(action) {
+        const paramsStr = JSON.stringify(action.params ?? {});
+        const combined = `${action.target} ${paramsStr}`;
+        if (/--force\b/.test(combined) || /["']?force["']?\s*:\s*true/.test(paramsStr)) {
+            return this.makeAssessment('HIGH', ['Force push detected'], 'Git force push requires elevated risk level');
+        }
+        return this.makeAssessment('HIGH', [], 'Git push operation');
+    }
+    classifySkillGenerate(action) {
+        if (/\brule\b/i.test(action.target)) {
+            return this.makeAssessment('MEDIUM', ['Rule generation detected'], 'Skill generation involving rules');
+        }
+        return this.makeAssessment('LOW', [], 'Standard skill generation');
+    }
+    classifyConfigModify(action) {
+        if (/\bsentinel\b/i.test(action.target)) {
+            return this.makeAssessment('HIGH', ['Sentinel configuration modification'], 'Modifying sentinel configuration requires elevated risk level');
+        }
+        return this.makeAssessment('MEDIUM', [], 'Configuration modification');
+    }
+    classifyDependencyInstall() {
+        return this.makeAssessment('MEDIUM', [], 'Dependency installation');
+    }
+    classifyExternalApiCall(action) {
+        const paramsStr = JSON.stringify(action.params ?? {});
+        if (AUTH_CREDENTIAL_RE.test(paramsStr)) {
+            return this.makeAssessment('HIGH', ['Authentication credentials detected in API call'], 'External API call with authentication');
+        }
+        return this.makeAssessment('LOW', [], 'Standard external API call');
+    }
+    makeAssessment(riskLevel, factors, reasoning) {
+        return { riskLevel, score: SCORE_DEFAULTS[riskLevel], factors, reasoning };
+    }
+}
+//# sourceMappingURL=RiskClassifier.js.map

package/dist/infra/lib/autonomy/RiskClassifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RiskClassifier.js","sourceRoot":"","sources":["../../../../src/infra/lib/autonomy/RiskClassifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAE3C,MAAM,sBAAsB,GAA0B;IACpD,iBAAiB;IACjB,qBAAqB;IACrB,aAAa;IACb,eAAe;CAChB,CAAC;AAEF,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAE/D,MAAM,iBAAiB,GACrB,+EAA+E,CAAC;AAElF,MAAM,kBAAkB,GAAG,sDAAsD,CAAC;AAElF,MAAM,cAAc,GAA8B;IAChD,GAAG,EAAE,EAAE;IACP,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,EAAE;CACT,CAAC;AAqBF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,OAAO,cAAc;IACR,WAAW,CAAmB;IAE/C,YAAY,WAA8B;QACxC,IAAI,CAAC,WAAW,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACrD,IAAI,CAAC;gBACH,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,MAAwB,EAAE,OAA+B;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QACtC,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAEO,cAAc,CAAC,MAAwB;QAC7C,OAAO;YACL,GAAG,MAAM;YACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;YACpD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SACnD,CAAC;IACJ,CAAC;IAEO,mBAAmB,CAAC,MAAwB;QAClD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;gBAAE,SAAS;YACpD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;wBAAE,SAAS;gBACzE,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC,cAAc,CACxB,IAAI,CAAC,SAAS,EACd,CAAC,wBAAwB,IAAI,CAAC,UAAU,EAAE,CAAC,EAC3C,4BAA4B,IAAI,CAAC,UAAU,EAAE,CAC9C,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,oBAAoB,CAC1B,MAAwB,EACxB,OAA+B;QAE/B,MAAM,QAAQ,GAAyC;YACrD,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAChD,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3D,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC9C,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAC5C,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;YACxD,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC;YACtD,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC1D,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;SAC9D,CAAC;QACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,OAAO;YAAE,OAAO,OAAO,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,wBAAwB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACrF,CAAC;IAEO,iBAAiB,CAAC,MAAwB;QAChD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,SAAS,EAAE,MAAM;gBACjB,KAAK,EAAE,GAAG;gBACV,OAAO,EAAE,CAAC,gDAAgD,CAAC;gBAC3D,SAAS,EAAE,iDAAiD;gBAC5D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,cAAc,CACxB,MAAM,EACN,CAAC,4BAA4B,MAAM,CAAC,MAAM,EAAE,CAAC,EAC7C,yDAAyD,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAEO,kBAAkB,CACxB,MAAwB,EACxB,OAA+B;QAE/B,IAAI,OAAO,EAAE,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,EAAE,CAAC;YAC/E,OAAO,IAAI,CAAC,cAAc,CACxB,MAAM,EACN,CAAC,yBAAyB,OAAO,CAAC,iBAAiB,oBAAoB,CAAC,EACxE,6BAA6B,CAC9B,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,yBAAyB,CAAC,CAAC;IACtE,CAAC;IAEO,gBAAgB,CAAC,MAAwB;QAC/C,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,cAAc,CACxB,MAAM,EACN,CAAC,kCAAkC,MAAM,CAAC,MAAM,EAAE,CAAC,EACnD,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,yBAAyB,CAAC,CAAC;IACtE,CAAC;IAEO,eAAe,CAAC,MAAwB;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QACjD,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/E,OAAO,IAAI,CAAC,cAAc,CACxB,MAAM,EACN,CAAC,qBAAqB,CAAC,EACvB,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC/D,CAAC;IAEO,qBAAqB,CAAC,MAAwB;QACpD,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,cAAc,CACxB,QAAQ,EACR,CAAC,0BAA0B,CAAC,EAC5B,kCAAkC,CACnC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACrE,CAAC;IAEO,oBAAoB,CAAC,MAAwB;QACnD,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,cAAc,CACxB,MAAM,EACN,CAAC,qCAAqC,CAAC,EACvC,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;IACzE,CAAC;IAEO,yBAAyB;QAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,yBAAyB,CAAC,CAAC;IACtE,CAAC;IAEO,uBAAuB,CAAC,MAAwB;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,cAAc,CACxB,MAAM,EACN,CAAC,iDAAiD,CAAC,EACnD,uCAAuC,CACxC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;IACtE,CAAC;IAEO,cAAc,CACpB,SAAoB,EACpB,OAAiB,EACjB,SAAiB;QAEjB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC7E,CAAC;CACF"}

package/dist/infra/lib/autonomy/SecuritySentinel.d.ts

@@ -0,0 +1,51 @@
+import type Database from 'better-sqlite3';
+import type { AgentActionEvent, RiskLevel } from './schemas.js';
+import type { EventBus } from './EventBus.js';
+import type { AuditStore } from './AuditStore.js';
+import { RiskClassifier } from './RiskClassifier.js';
+import type { CustomRiskRule } from './RiskClassifier.js';
+import { PolicyEngine } from './PolicyEngine.js';
+import type { PolicyDecision } from './PolicyEngine.js';
+export interface InterceptResult {
+    allowed: boolean;
+    riskLevel: RiskLevel;
+    policyDecision: PolicyDecision;
+    auditId: string;
+}
+interface StorageProvider {
+    getDatabase(): Database.Database;
+}
+export interface SentinelDeps {
+    storage: StorageProvider;
+    eventBus: EventBus;
+    auditStore: AuditStore;
+    projectRoot?: string;
+    customRules?: CustomRiskRule[];
+}
+export declare class SecuritySentinel {
+    private static instance;
+    private readonly classifier;
+    private readonly policyEngine;
+    private readonly eventBus;
+    private readonly auditStore;
+    private readonly db;
+    private readonly projectRoot;
+    private readonly recentDeleteStmt;
+    private constructor();
+    static getInstance(deps: SentinelDeps): SecuritySentinel;
+    static resetInstance(): void;
+    intercept(action: AgentActionEvent): InterceptResult;
+    isImmutable(): boolean;
+    getSentinelFiles(): ReadonlyArray<string>;
+    getClassifier(): RiskClassifier;
+    getPolicyEngine(): PolicyEngine;
+    private normalizeAction;
+    private normalizePath;
+    private buildContext;
+    private blockedDecision;
+    private emitPolicyCheck;
+    private recordAudit;
+}
+export declare function isSentinelProtectedPath(target: string): boolean;
+export {};
+//# sourceMappingURL=SecuritySentinel.d.ts.map

package/dist/infra/lib/autonomy/SecuritySentinel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecuritySentinel.d.ts","sourceRoot":"","sources":["../../../../src/infra/lib/autonomy/SecuritySentinel.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAkB,cAAc,EAAyB,MAAM,qBAAqB,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAiBxD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,eAAe;IACvB,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAiC;IAExD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IAEtD,OAAO;IAaP,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,gBAAgB;IAOxD,MAAM,CAAC,aAAa,IAAI,IAAI;IAI5B,SAAS,CAAC,MAAM,EAAE,gBAAgB,GAAG,eAAe;IAmCpD,WAAW,IAAI,OAAO;IAItB,gBAAgB,IAAI,aAAa,CAAC,MAAM,CAAC;IAIzC,aAAa,IAAI,cAAc;IAI/B,eAAe,IAAI,YAAY;IAI/B,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,aAAa;IAcrB,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,eAAe;IAuBvB,OAAO,CAAC,WAAW;CAsBpB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAG/D"}

package/dist/infra/lib/autonomy/SecuritySentinel.js

@@ -0,0 +1,162 @@
+import { resolve, relative } from 'path';
+import { realpathSync } from 'fs';
+import { RiskClassifier } from './RiskClassifier.js';
+import { PolicyEngine } from './PolicyEngine.js';
+const SENTINEL_PATH_PREFIX = 'src/lib/autonomy/';
+const SENTINEL_FILES = [
+    'src/lib/autonomy/RiskClassifier.ts',
+    'src/lib/autonomy/PolicyEngine.ts',
+    'src/lib/autonomy/SecuritySentinel.ts',
+    'src/lib/autonomy/EventBus.ts',
+    'src/lib/autonomy/AuditStore.ts',
+    'src/lib/autonomy/EventOutbox.ts',
+    'src/lib/autonomy/schemas.ts',
+    'src/lib/autonomy/index.ts',
+];
+const RECENT_DELETE_WINDOW_MS = 60_000;
+export class SecuritySentinel {
+    static instance = null;
+    classifier;
+    policyEngine;
+    eventBus;
+    auditStore;
+    db;
+    projectRoot;
+    recentDeleteStmt;
+    constructor(deps) {
+        this.classifier = new RiskClassifier(deps.customRules);
+        this.policyEngine = new PolicyEngine(deps.storage);
+        this.eventBus = deps.eventBus;
+        this.auditStore = deps.auditStore;
+        this.db = deps.storage.getDatabase();
+        this.projectRoot = deps.projectRoot ?? process.cwd();
+        this.recentDeleteStmt = this.db.prepare(`SELECT COUNT(*) as count FROM audit_events
+       WHERE agentId = ? AND actionType = 'file_delete' AND createdAt >= ?`);
+    }
+    static getInstance(deps) {
+        if (!SecuritySentinel.instance) {
+            SecuritySentinel.instance = new SecuritySentinel(deps);
+        }
+        return SecuritySentinel.instance;
+    }
+    static resetInstance() {
+        SecuritySentinel.instance = null;
+    }
+    intercept(action) {
+        const normalizedAction = this.normalizeAction(action);
+        // Block paths outside project root
+        if (normalizedAction.target.startsWith('..')) {
+            const outsideRisk = {
+                riskLevel: 'HIGH',
+                score: 100,
+                factors: ['Path resolves outside project root'],
+                reasoning: 'Path traversal outside project root is blocked',
+                blocked: true,
+            };
+            const decision = this.blockedDecision(outsideRisk);
+            this.emitPolicyCheck(normalizedAction, outsideRisk, decision);
+            const auditId = this.recordAudit(normalizedAction, outsideRisk, decision);
+            return { allowed: false, riskLevel: 'HIGH', policyDecision: decision, auditId };
+        }
+        const context = this.buildContext(normalizedAction);
+        const risk = this.classifier.classify(normalizedAction, context);
+        const policyDecision = risk.blocked
+            ? this.blockedDecision(risk)
+            : this.policyEngine.evaluate(normalizedAction, risk);
+        this.emitPolicyCheck(normalizedAction, risk, policyDecision);
+        const auditId = this.recordAudit(normalizedAction, risk, policyDecision);
+        return {
+            allowed: policyDecision.allowed,
+            riskLevel: risk.riskLevel,
+            policyDecision,
+            auditId,
+        };
+    }
+    isImmutable() {
+        return true;
+    }
+    getSentinelFiles() {
+        return SENTINEL_FILES;
+    }
+    getClassifier() {
+        return this.classifier;
+    }
+    getPolicyEngine() {
+        return this.policyEngine;
+    }
+    normalizeAction(action) {
+        const normalizedTarget = this.normalizePath(action.target);
+        return { ...action, target: normalizedTarget };
+    }
+    normalizePath(target) {
+        const resolved = resolve(this.projectRoot, target);
+        const rel = relative(this.projectRoot, resolved).replace(/\\/g, '/');
+        if (rel.startsWith('..'))
+            return rel;
+        try {
+            const real = realpathSync(resolved);
+            const realRel = relative(this.projectRoot, real).replace(/\\/g, '/');
+            return realRel.startsWith('..') ? realRel : realRel;
+        }
+        catch {
+            return rel;
+        }
+    }
+    buildContext(action) {
+        if (action.actionType !== 'file_delete')
+            return undefined;
+        const cutoff = new Date(Date.now() - RECENT_DELETE_WINDOW_MS).toISOString();
+        const row = this.recentDeleteStmt.get(action.agentId, cutoff);
+        return { recentDeleteCount: row.count };
+    }
+    blockedDecision(risk) {
+        return {
+            allowed: false,
+            reason: `Sentinel files are protected: ${risk.reasoning}`,
+            requiredAction: 'block',
+            matchedPolicies: ['sentinel-immutability'],
+        };
+    }
+    emitPolicyCheck(action, risk, decision) {
+        try {
+            this.eventBus.emit('policy_check', {
+                actionEvent: {
+                    agentId: action.agentId,
+                    actionType: action.actionType,
+                    target: action.target,
+                    params: action.params,
+                    riskLevel: risk.riskLevel,
+                },
+                policies: decision.matchedPolicies,
+                result: decision.allowed ? 'allowed' : (decision.requiredAction === 'confirm' ? 'needs_confirmation' : 'blocked'),
+                duration: 0,
+            });
+        }
+        catch {
+            // Policy check event emission failure should not break intercept
+        }
+    }
+    recordAudit(action, risk, decision) {
+        const outcome = decision.allowed ? 'allowed' : 'blocked';
+        return this.auditStore.record({
+            correlationId: action.correlationId ?? `sentinel-${Date.now()}`,
+            eventType: 'policy_check',
+            agentId: action.agentId,
+            actionType: action.actionType,
+            riskLevel: risk.riskLevel,
+            payload: {
+                target: action.target,
+                riskScore: risk.score,
+                factors: risk.factors,
+                matchedPolicies: decision.matchedPolicies,
+                reason: decision.reason,
+            },
+            outcome,
+        });
+    }
+}
+export function isSentinelProtectedPath(target) {
+    const normalized = target.replace(/\\/g, '/').replace(/^\.\//, '');
+    return normalized.startsWith(SENTINEL_PATH_PREFIX);
+}
+//# sourceMappingURL=SecuritySentinel.js.map

package/dist/infra/lib/autonomy/SecuritySentinel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecuritySentinel.js","sourceRoot":"","sources":["../../../../src/infra/lib/autonomy/SecuritySentinel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAKlC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,MAAM,cAAc,GAA0B;IAC5C,oCAAoC;IACpC,kCAAkC;IAClC,sCAAsC;IACtC,8BAA8B;IAC9B,gCAAgC;IAChC,iCAAiC;IACjC,6BAA6B;IAC7B,2BAA2B;CAC5B,CAAC;AAEF,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAqBvC,MAAM,OAAO,gBAAgB;IACnB,MAAM,CAAC,QAAQ,GAA4B,IAAI,CAAC;IAEvC,UAAU,CAAiB;IAC3B,YAAY,CAAe;IAC3B,QAAQ,CAAW;IACnB,UAAU,CAAa;IACvB,EAAE,CAAoB;IACtB,WAAW,CAAS;IACpB,gBAAgB,CAAqB;IAEtD,YAAoB,IAAkB;QACpC,IAAI,CAAC,UAAU,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACrC;2EACqE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,IAAkB;QACnC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;YAC/B,gBAAgB,CAAC,QAAQ,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,gBAAgB,CAAC,QAAQ,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,aAAa;QAClB,gBAAgB,CAAC,QAAQ,GAAG,IAAI,CAAC;IACnC,CAAC;IAED,SAAS,CAAC,MAAwB;QAChC,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAEtD,mCAAmC;QACnC,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAmB;gBAClC,SAAS,EAAE,MAAM;gBACjB,KAAK,EAAE,GAAG;gBACV,OAAO,EAAE,CAAC,oCAAoC,CAAC;gBAC/C,SAAS,EAAE,gDAAgD;gBAC3D,OAAO,EAAE,IAAI;aACd,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,CAAC,eAAe,CAAC,gBAAgB,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC1E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAClF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO;YACjC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC5B,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAEvD,IAAI,CAAC,eAAe,CAAC,gBAAgB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAEzE,OAAO;YACL,OAAO,EAAE,cAAc,CAAC,OAAO;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc;YACd,OAAO;SACR,CAAC;IACJ,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gBAAgB;QACd,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,eAAe,CAAC,MAAwB;QAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAEO,aAAa,CAAC,MAAc;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACrE,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,MAAwB;QAC3C,IAAI,MAAM,CAAC,UAAU,KAAK,aAAa;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAsB,CAAC;QACnF,OAAO,EAAE,iBAAiB,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAEO,eAAe,CAAC,IAAoB;QAC1C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,iCAAiC,IAAI,CAAC,SAAS,EAAE;YACzD,cAAc,EAAE,OAAO;YACvB,eAAe,EAAE,CAAC,uBAAuB,CAAC;SAC3C,CAAC;IACJ,CAAC;IAEO,eAAe,CACrB,MAAwB,EACxB,IAAoB,EACpB,QAAwB;QAExB,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE;gBACjC,WAAW,EAAE;oBACX,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,QAAQ,CAAC,eAAe;gBAClC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjH,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAEO,WAAW,CACjB,MAAwB,EACxB,IAAoB,EACpB,QAAwB;QAExB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC5B,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE;YAC/D,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE;gBACP,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,IAAI,CAAC,KAAK;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB;YACD,OAAO;SACR,CAAC,CAAC;IACL,CAAC;;AAGH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AACrD,CAAC"}

package/dist/infra/lib/autonomy/SuggestionStore.d.ts

@@ -0,0 +1,54 @@
+import type Database from 'better-sqlite3';
+export type SuggestionType = 'security' | 'performance' | 'quality' | 'dependency' | 'pattern';
+type SuggestionStatus = 'pending' | 'accepted' | 'dismissed' | 'auto_applied';
+export interface SuggestionRow {
+    id: string;
+    type: string;
+    title: string;
+    description: string;
+    priority: number;
+    evidence: string;
+    suggestedAction: string | null;
+    status: string;
+    riskLevel: string;
+    sourceModule: string;
+    createdAt: string;
+    resolvedAt: string | null;
+}
+export interface CreateSuggestionInput {
+    type: SuggestionType;
+    title: string;
+    description: string;
+    priority: number;
+    evidence: Record<string, unknown>;
+    suggestedAction?: string;
+    riskLevel?: string;
+    sourceModule: string;
+}
+export interface SuggestionStats {
+    total: number;
+    byType: Record<string, number>;
+    byStatus: Record<string, number>;
+    pendingCount: number;
+}
+interface StorageProvider {
+    getDatabase(): Database.Database;
+}
+export declare class SuggestionStore {
+    private readonly db;
+    private readonly insertStmt;
+    private fts5Available;
+    constructor(storage: StorageProvider);
+    private initTables;
+    create(input: CreateSuggestionInput): SuggestionRow;
+    resolve(id: string, status: SuggestionStatus): SuggestionRow;
+    getById(id: string): SuggestionRow | null;
+    getPending(limit?: number): SuggestionRow[];
+    getHighPriority(maxPriority?: number): SuggestionRow[];
+    getStats(): SuggestionStats;
+    search(query: string, limit?: number): SuggestionRow[];
+    private findDuplicate;
+    private enforceMaxSuggestions;
+}
+export {};
+//# sourceMappingURL=SuggestionStore.d.ts.map

package/dist/infra/lib/autonomy/SuggestionStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SuggestionStore.d.ts","sourceRoot":"","sources":["../../../../src/infra/lib/autonomy/SuggestionStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAM3C,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAC/F,KAAK,gBAAgB,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,cAAc,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,UAAU,eAAe;IACvB,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC;CAClC;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,aAAa,CAAS;gBAElB,OAAO,EAAE,eAAe;IAUpC,OAAO,CAAC,UAAU;IAqClB,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,aAAa;IAmBnD,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,aAAa;IAQ5D,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAMzC,UAAU,CAAC,KAAK,SAAK,GAAG,aAAa,EAAE;IAQvC,eAAe,CAAC,WAAW,SAAI,GAAG,aAAa,EAAE;IAQjD,QAAQ,IAAI,eAAe;IA4B3B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,aAAa,EAAE;IAkBlD,OAAO,CAAC,aAAa;IAcrB,OAAO,CAAC,qBAAqB;CAkB9B"}

package/dist/infra/lib/autonomy/SuggestionStore.js

@@ -0,0 +1,144 @@
+import { uuidv7 } from 'uuidv7';
+const MAX_SUGGESTIONS = 1000;
+const DEDUP_WINDOW_MS = 86_400_000; // 24 hours
+export class SuggestionStore {
+    db;
+    insertStmt;
+    fts5Available = false;
+    constructor(storage) {
+        this.db = storage.getDatabase();
+        this.initTables();
+        this.insertStmt = this.db.prepare(`
+      INSERT INTO suggestions
+        (id, type, title, description, priority, evidence, suggestedAction, status, riskLevel, sourceModule, createdAt)
+      VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?)
+    `);
+    }
+    initTables() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS suggestions (
+        id TEXT PRIMARY KEY,
+        type TEXT NOT NULL CHECK(type IN ('security','performance','quality','dependency','pattern')),
+        title TEXT NOT NULL,
+        description TEXT NOT NULL,
+        priority INTEGER NOT NULL CHECK(priority BETWEEN 1 AND 5),
+        evidence TEXT NOT NULL,
+        suggestedAction TEXT,
+        status TEXT DEFAULT 'pending' CHECK(status IN ('pending','accepted','dismissed','auto_applied')),
+        riskLevel TEXT DEFAULT 'LOW',
+        sourceModule TEXT NOT NULL,
+        createdAt TEXT NOT NULL,
+        resolvedAt TEXT
+      );
+      CREATE INDEX IF NOT EXISTS idx_suggestion_status_priority ON suggestions(status, priority);
+      CREATE INDEX IF NOT EXISTS idx_suggestion_type_created ON suggestions(type, createdAt);
+    `);
+        try {
+            this.db.exec(`
+        CREATE VIRTUAL TABLE IF NOT EXISTS suggestions_fts USING fts5(
+          title, description,
+          content='suggestions', content_rowid='rowid'
+        );
+        CREATE TRIGGER IF NOT EXISTS suggestions_fts_ai AFTER INSERT ON suggestions BEGIN
+          INSERT INTO suggestions_fts(rowid, title, description)
+          VALUES (new.rowid, new.title, new.description);
+        END;
+      `);
+            this.fts5Available = true;
+        }
+        catch {
+            this.fts5Available = false;
+        }
+    }
+    create(input) {
+        const existing = this.findDuplicate(input.title, input.type);
+        if (existing)
+            return existing;
+        this.enforceMaxSuggestions();
+        const id = uuidv7();
+        const now = new Date().toISOString();
+        const priority = Math.max(1, Math.min(5, input.priority));
+        this.insertStmt.run(id, input.type, input.title, input.description, priority, JSON.stringify(input.evidence), input.suggestedAction ?? null, input.riskLevel ?? 'LOW', input.sourceModule, now);
+        return this.getById(id);
+    }
+    resolve(id, status) {
+        const now = new Date().toISOString();
+        this.db
+            .prepare('UPDATE suggestions SET status = ?, resolvedAt = ? WHERE id = ?')
+            .run(status, now, id);
+        return this.getById(id);
+    }
+    getById(id) {
+        return this.db.prepare('SELECT * FROM suggestions WHERE id = ?').get(id) ?? null;
+    }
+    getPending(limit = 50) {
+        return this.db
+            .prepare("SELECT * FROM suggestions WHERE status = 'pending' ORDER BY priority ASC, createdAt ASC LIMIT ?")
+            .all(limit);
+    }
+    getHighPriority(maxPriority = 2) {
+        return this.db
+            .prepare("SELECT * FROM suggestions WHERE status = 'pending' AND priority <= ? ORDER BY priority ASC, createdAt ASC")
+            .all(maxPriority);
+    }
+    getStats() {
+        const total = this.db.prepare('SELECT COUNT(*) as count FROM suggestions').get().count;
+        const byType = Object.fromEntries(this.db
+            .prepare('SELECT type, COUNT(*) as count FROM suggestions GROUP BY type')
+            .all().map((r) => [r.type, r.count]));
+        const byStatus = Object.fromEntries(this.db
+            .prepare('SELECT status, COUNT(*) as count FROM suggestions GROUP BY status')
+            .all().map((r) => [r.status, r.count]));
+        const pendingCount = this.db
+            .prepare("SELECT COUNT(*) as count FROM suggestions WHERE status = 'pending'")
+            .get().count;
+        return { total, byType, byStatus, pendingCount };
+    }
+    search(query, limit = 50) {
+        if (!this.fts5Available)
+            return [];
+        const sanitized = query.replace(/[*"()\-]/g, ' ').trim();
+        if (!sanitized)
+            return [];
+        try {
+            return this.db
+                .prepare(`SELECT s.* FROM suggestions s
+           JOIN suggestions_fts f ON s.rowid = f.rowid
+           WHERE suggestions_fts MATCH ?
+           ORDER BY rank LIMIT ?`)
+                .all(sanitized, limit);
+        }
+        catch {
+            return [];
+        }
+    }
+    findDuplicate(title, type) {
+        const normalized = title.toLowerCase().replace(/\s+/g, ' ').trim();
+        const cutoff = new Date(Date.now() - DEDUP_WINDOW_MS).toISOString();
+        const rows = this.db
+            .prepare('SELECT * FROM suggestions WHERE type = ? AND createdAt >= ? ORDER BY createdAt DESC')
+            .all(type, cutoff);
+        for (const row of rows) {
+            const rowNormalized = row.title.toLowerCase().replace(/\s+/g, ' ').trim();
+            if (rowNormalized === normalized)
+                return row;
+        }
+        return null;
+    }
+    enforceMaxSuggestions() {
+        const total = this.db.prepare('SELECT COUNT(*) as count FROM suggestions').get().count;
+        if (total < MAX_SUGGESTIONS)
+            return;
+        const deleteOrder = ['dismissed', 'auto_applied', 'accepted'];
+        for (const status of deleteOrder) {
+            const oldest = this.db
+                .prepare('SELECT id FROM suggestions WHERE status = ? ORDER BY createdAt ASC LIMIT 1')
+                .get(status);
+            if (oldest) {
+                this.db.prepare('DELETE FROM suggestions WHERE id = ?').run(oldest.id);
+                return;
+            }
+        }
+    }
+}
+//# sourceMappingURL=SuggestionStore.js.map

package/dist/infra/lib/autonomy/SuggestionStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SuggestionStore.js","sourceRoot":"","sources":["../../../../src/infra/lib/autonomy/SuggestionStore.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,eAAe,GAAG,UAAU,CAAC,CAAC,WAAW;AA0C/C,MAAM,OAAO,eAAe;IACT,EAAE,CAAoB;IACtB,UAAU,CAAqB;IACxC,aAAa,GAAG,KAAK,CAAC;IAE9B,YAAY,OAAwB;QAClC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;KAIjC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;KAiBZ,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;OASZ,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAA4B;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAE7B,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE1D,IAAI,CAAC,UAAU,CAAC,GAAG,CACjB,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EACxD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI,EAC7D,KAAK,CAAC,SAAS,IAAI,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,CAClD,CAAC;QAEF,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAE,CAAC;IAC3B,CAAC;IAED,OAAO,CAAC,EAAU,EAAE,MAAwB;QAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,gEAAgE,CAAC;aACzE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAE,CAAC;IAC3B,CAAC;IAED,OAAO,CAAC,EAAU;QAChB,OACE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,EAAE,CACjE,IAAI,IAAI,CAAC;IACZ,CAAC;IAED,UAAU,CAAC,KAAK,GAAG,EAAE;QACnB,OAAO,IAAI,CAAC,EAAE;aACX,OAAO,CACN,iGAAiG,CAClG;aACA,GAAG,CAAC,KAAK,CAAoB,CAAC;IACnC,CAAC;IAED,eAAe,CAAC,WAAW,GAAG,CAAC;QAC7B,OAAO,IAAI,CAAC,EAAE;aACX,OAAO,CACN,2GAA2G,CAC5G;aACA,GAAG,CAAC,WAAW,CAAoB,CAAC;IACzC,CAAC;IAED,QAAQ;QACN,MAAM,KAAK,GACT,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,EACjE,CAAC,KAAK,CAAC;QAER,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC9B,IAAI,CAAC,EAAE;aACL,OAAO,CAAC,+DAA+D,CAAC;aACxE,GAAG,EACL,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAChC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAChC,IAAI,CAAC,EAAE;aACL,OAAO,CAAC,mEAAmE,CAAC;aAC5E,GAAG,EACL,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAClC,CAAC;QAEF,MAAM,YAAY,GAChB,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,oEAAoE,CAAC;aAC7E,GAAG,EACP,CAAC,KAAK,CAAC;QAER,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,KAAK,GAAG,EAAE;QAC9B,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,EAAE;iBACX,OAAO,CACN;;;iCAGuB,CACxB;iBACA,GAAG,CAAC,SAAS,EAAE,KAAK,CAAoB,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,KAAa,EAAE,IAAY;QAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,qFAAqF,CAAC;aAC9F,GAAG,CAAC,IAAI,EAAE,MAAM,CAAoB,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1E,IAAI,aAAa,KAAK,UAAU;gBAAE,OAAO,GAAG,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,qBAAqB;QAC3B,MAAM,KAAK,GACT,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,EACjE,CAAC,KAAK,CAAC;QAER,IAAI,KAAK,GAAG,eAAe;YAAE,OAAO;QAEpC,MAAM,WAAW,GAAuB,CAAC,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QAClF,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;iBACnB,OAAO,CAAC,4EAA4E,CAAC;iBACrF,GAAG,CAAC,MAAM,CAA+B,CAAC;YAC7C,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/infra/lib/autonomy/TaskDecomposer.d.ts

@@ -0,0 +1,38 @@
+import type { RiskLevel } from './schemas.js';
+export type StepType = 'spec' | 'review' | 'implement' | 'test' | 'deploy';
+export type StepStatus = 'pending' | 'in_progress' | 'completed' | 'failed' | 'skipped';
+export type Complexity = 'low' | 'medium' | 'high';
+export interface TaskStep {
+    id: string;
+    order: number;
+    type: StepType;
+    description: string;
+    dependencies: string[];
+    estimatedFiles: number;
+    riskLevel: RiskLevel;
+    status: StepStatus;
+}
+export interface DecomposedTask {
+    id: string;
+    originalPrompt: string;
+    steps: TaskStep[];
+    estimatedComplexity: Complexity;
+    requiresConfirmation: boolean;
+    createdAt: string;
+}
+export declare class CircularDependencyError extends Error {
+    constructor(cycle: string[]);
+}
+export declare class TaskDecomposer {
+    decompose(userPrompt: string): DecomposedTask;
+    private analyzeKeywordComplexity;
+    private estimateFileCount;
+    private fileCountToComplexity;
+    private resolveComplexity;
+    private determineStepTypes;
+    private buildSteps;
+    private assessStepRisk;
+    private generateDescription;
+    validateDAG(steps: TaskStep[]): void;
+}
+//# sourceMappingURL=TaskDecomposer.d.ts.map

package/dist/infra/lib/autonomy/TaskDecomposer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TaskDecomposer.d.ts","sourceRoot":"","sources":["../../../../src/infra/lib/autonomy/TaskDecomposer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM9C,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC;AAC3E,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;AACxF,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,mBAAmB,EAAE,UAAU,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,KAAK,EAAE,MAAM,EAAE;CAI5B;AAuCD,qBAAa,cAAc;IACzB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc;IA4B7C,OAAO,CAAC,wBAAwB;IAehC,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,qBAAqB;IAM7B,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,UAAU;IA4BlB,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,mBAAmB;IAY3B,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI;CAiCrC"}