@su-record/vibe 2.7.2 → 2.7.5

package/dist/infra/policy/Evidence.js

@@ -0,0 +1,134 @@
+/**
+ * EvidenceStore - Record all policy evaluations and decisions
+ * Phase 3: Policy Engine
+ *
+ * SQLite storage with auto-masking of sensitive data
+ */
+import Database from 'better-sqlite3';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as fs from 'node:fs';
+const VIBE_DIR = path.join(os.homedir(), '.vibe');
+const DEFAULT_DB_PATH = path.join(VIBE_DIR, 'evidence.db');
+/** Patterns for sensitive data masking */
+const SENSITIVE_PATTERNS = [
+    /sk-[a-zA-Z0-9]{20,}/g,
+    /AIza[a-zA-Z0-9_-]{35}/g,
+    /ya29\.[a-zA-Z0-9_-]+/g,
+    /eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+/g,
+    /nvapi-[a-zA-Z0-9_-]{20,}/g,
+    /ghp_[a-zA-Z0-9]{36}/g,
+    /gho_[a-zA-Z0-9]{36}/g,
+];
+export class EvidenceStore {
+    db;
+    logger;
+    constructor(logger, dbPath) {
+        this.logger = logger;
+        const resolvedPath = dbPath || DEFAULT_DB_PATH;
+        const dir = path.dirname(resolvedPath);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
+        this.db = new Database(resolvedPath);
+        this.db.pragma('journal_mode = WAL');
+        this.db.pragma('busy_timeout = 5000');
+        this.initTables();
+    }
+    /** Record a generic evidence entry */
+    record(entry) {
+        const payload = this.maskSensitive(entry.payload);
+        const result = this.db.prepare(`
+      INSERT INTO evidence (job_id, event_type, decision, payload, actor, source, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `).run(entry.jobId, entry.eventType, entry.decision, JSON.stringify(payload), entry.actor, entry.source, new Date().toISOString());
+        return Number(result.lastInsertRowid);
+    }
+    /** Record a policy evaluation */
+    recordEvaluation(jobId, result) {
+        return this.record({
+            jobId,
+            eventType: 'policy_evaluation',
+            decision: result.decision,
+            payload: {
+                riskLevel: result.riskLevel,
+                requiresApproval: result.requiresApproval,
+                reasons: result.reasons,
+            },
+            actor: 'policy_engine',
+            source: 'system',
+        });
+    }
+    /** Get evidence for a job */
+    getByJob(jobId) {
+        const rows = this.db.prepare('SELECT * FROM evidence WHERE job_id = ? ORDER BY created_at ASC').all(jobId);
+        return rows.map(this.rowToRecord);
+    }
+    /** Get evidence by event type */
+    getByType(eventType, limit = 50) {
+        const rows = this.db.prepare('SELECT * FROM evidence WHERE event_type = ? ORDER BY created_at DESC LIMIT ?').all(eventType, limit);
+        return rows.map(this.rowToRecord);
+    }
+    /** Get recent evidence */
+    getRecent(limit = 20) {
+        const rows = this.db.prepare('SELECT * FROM evidence ORDER BY created_at DESC LIMIT ?').all(limit);
+        return rows.map(this.rowToRecord);
+    }
+    /** Cleanup old evidence */
+    cleanup(maxAgeDays = 30) {
+        const cutoff = new Date();
+        cutoff.setDate(cutoff.getDate() - maxAgeDays);
+        const result = this.db.prepare('DELETE FROM evidence WHERE created_at < ?').run(cutoff.toISOString());
+        return result.changes;
+    }
+    close() {
+        this.db.close();
+    }
+    // ========================================================================
+    // Private
+    // ========================================================================
+    initTables() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS evidence (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        job_id TEXT NOT NULL,
+        event_type TEXT NOT NULL,
+        decision TEXT NOT NULL,
+        payload TEXT,
+        actor TEXT NOT NULL,
+        source TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_evidence_job ON evidence(job_id);
+      CREATE INDEX IF NOT EXISTS idx_evidence_type ON evidence(event_type);
+      CREATE INDEX IF NOT EXISTS idx_evidence_created ON evidence(created_at);
+    `);
+    }
+    maskSensitive(payload) {
+        const json = JSON.stringify(payload);
+        let masked = json;
+        for (const pattern of SENSITIVE_PATTERNS) {
+            masked = masked.replace(pattern, '***REDACTED***');
+        }
+        try {
+            return JSON.parse(masked);
+        }
+        catch {
+            return payload;
+        }
+    }
+    rowToRecord(row) {
+        return {
+            id: row.id,
+            jobId: row.job_id,
+            eventType: row.event_type,
+            decision: row.decision,
+            payload: row.payload ? JSON.parse(row.payload) : {},
+            actor: row.actor,
+            source: row.source,
+            createdAt: row.created_at,
+        };
+    }
+}
+//# sourceMappingURL=Evidence.js.map

package/dist/infra/policy/Evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Evidence.js","sourceRoot":"","sources":["../../../src/infra/policy/Evidence.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAI9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAClD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAE3D,0CAA0C;AAC1C,MAAM,kBAAkB,GAAG;IACzB,sBAAsB;IACtB,wBAAwB;IACxB,uBAAuB;IACvB,uCAAuC;IACvC,2BAA2B;IAC3B,sBAAsB;IACtB,sBAAsB;CACvB,CAAC;AAEF,MAAM,OAAO,aAAa;IAChB,EAAE,CAAoB;IACtB,MAAM,CAA6D;IAE3E,YACE,MAAkE,EAClE,MAAe;QAEf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,YAAY,GAAG,MAAM,IAAI,eAAe,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED,sCAAsC;IACtC,MAAM,CAAC,KAA+C;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAG9B,CAAC,CAAC,GAAG,CACJ,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,QAAQ,EACd,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACvB,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,MAAM,EACZ,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CACzB,CAAC;QAEF,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACxC,CAAC;IAED,iCAAiC;IACjC,gBAAgB,CAAC,KAAa,EAAE,MAAwB;QACtD,OAAO,IAAI,CAAC,MAAM,CAAC;YACjB,KAAK;YACL,SAAS,EAAE,mBAAmB;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE;gBACP,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB;YACD,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;IAED,6BAA6B;IAC7B,QAAQ,CAAC,KAAa;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,iEAAiE,CAClE,CAAC,GAAG,CAAC,KAAK,CAA8B,CAAC;QAE1C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAED,iCAAiC;IACjC,SAAS,CAAC,SAA4B,EAAE,QAAgB,EAAE;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,8EAA8E,CAC/E,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAA8B,CAAC;QAErD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAED,0BAA0B;IAC1B,SAAS,CAAC,QAAgB,EAAE;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,yDAAyD,CAC1D,CAAC,GAAG,CAAC,KAAK,CAA8B,CAAC;QAE1C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAED,2BAA2B;IAC3B,OAAO,CAAC,aAAqB,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,2CAA2C,CAC5C,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAE5B,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;IAED,2EAA2E;IAC3E,UAAU;IACV,2EAA2E;IAEnE,UAAU;QAChB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;KAeZ,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,OAAgC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,IAAI,CAAC;QAElB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,GAA4B;QAC9C,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAY;YACpB,KAAK,EAAE,GAAG,CAAC,MAAgB;YAC3B,SAAS,EAAE,GAAG,CAAC,UAA+B;YAC9C,QAAQ,EAAE,GAAG,CAAC,QAAkB;YAChC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAiB,CAAC,CAAC,CAAC,CAAC,EAAE;YAC7D,KAAK,EAAE,GAAG,CAAC,KAAe;YAC1B,MAAM,EAAE,GAAG,CAAC,MAAgB;YAC5B,SAAS,EAAE,GAAG,CAAC,UAAoB;SACpC,CAAC;IACJ,CAAC;CACF"}

package/dist/infra/policy/PolicyEngine.d.ts

@@ -0,0 +1,34 @@
+/**
+ * PolicyEngine - Evaluate ActionPlans against policies
+ * Phase 3: Policy Engine
+ *
+ * Two-stage evaluation:
+ * 1. Safety policies (built-in): reject = immediate block
+ * 2. Configuration policies: project > user > built-in
+ */
+import { EvalContext, EvaluationResult } from './types.js';
+import { PolicyStore } from './PolicyStore.js';
+import { EvidenceStore } from './Evidence.js';
+import { LogLevel } from '../../daemon/types.js';
+export declare class PolicyEngine {
+    private store;
+    private calculator;
+    private evidence;
+    private logger;
+    constructor(store: PolicyStore, evidence: EvidenceStore, logger: (level: LogLevel, message: string, data?: unknown) => void);
+    /** Load policies */
+    loadPolicies(projectPath?: string): void;
+    /** Evaluate an action plan against all active policies */
+    evaluate(context: EvalContext, jobId?: string): EvaluationResult;
+    /** Get the policy store */
+    getPolicyStore(): PolicyStore;
+    /** Evaluate a single rule against context */
+    private evaluateRule;
+    /** Match a condition against context */
+    private matchCondition;
+    /** Match a value against an expected pattern */
+    private matchValue;
+    /** Get a value from the evaluation context by dotted path */
+    private getContextValue;
+}
+//# sourceMappingURL=PolicyEngine.d.ts.map

package/dist/infra/policy/PolicyEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PolicyEngine.d.ts","sourceRoot":"","sources":["../../../src/infra/policy/PolicyEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAIL,WAAW,EACX,gBAAgB,EAOjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAKjD,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,UAAU,CAAiB;IACnC,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,MAAM,CAA6D;gBAGzE,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI;IAQpE,oBAAoB;IACpB,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAIxC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,gBAAgB;IAiFhE,2BAA2B;IAC3B,cAAc,IAAI,WAAW;IAQ7B,6CAA6C;IAC7C,OAAO,CAAC,YAAY;IAoBpB,wCAAwC;IACxC,OAAO,CAAC,cAAc;IA4CtB,gDAAgD;IAChD,OAAO,CAAC,UAAU;IAwClB,6DAA6D;IAC7D,OAAO,CAAC,eAAe;CAexB"}

package/dist/infra/policy/PolicyEngine.js

@@ -0,0 +1,219 @@
+/**
+ * PolicyEngine - Evaluate ActionPlans against policies
+ * Phase 3: Policy Engine
+ *
+ * Two-stage evaluation:
+ * 1. Safety policies (built-in): reject = immediate block
+ * 2. Configuration policies: project > user > built-in
+ */
+import { maxRisk, } from './types.js';
+import { RiskCalculator } from './RiskCalculator.js';
+const MAX_REGEX_LENGTH = 100;
+const REGEX_TIMEOUT_MS = 10;
+export class PolicyEngine {
+    store;
+    calculator;
+    evidence;
+    logger;
+    constructor(store, evidence, logger) {
+        this.store = store;
+        this.calculator = new RiskCalculator();
+        this.evidence = evidence;
+        this.logger = logger;
+    }
+    /** Load policies */
+    loadPolicies(projectPath) {
+        this.store.loadAll(projectPath);
+    }
+    /** Evaluate an action plan against all active policies */
+    evaluate(context, jobId) {
+        const reasons = [];
+        const suggestions = [];
+        let overallRisk = 'none';
+        let decision = 'approve';
+        // Stage 1: Safety policies (Deny-Override)
+        const safetyPolicies = this.store.getSafetyPolicies();
+        for (const policy of safetyPolicies) {
+            for (const rule of policy.rules) {
+                const matched = this.evaluateRule(rule, context, policy.type);
+                if (matched) {
+                    reasons.push(matched);
+                    overallRisk = maxRisk(overallRisk, matched.severity);
+                    if (matched.effect === 'reject') {
+                        decision = 'reject'; // Safety reject cannot be overridden
+                    }
+                    else if (matched.effect === 'warn' && decision !== 'reject') {
+                        decision = 'warn';
+                    }
+                }
+            }
+        }
+        // Stage 2: Configuration policies (project > user > built-in)
+        if (decision !== 'reject') {
+            const configPolicies = this.store.getConfigPolicies();
+            for (const policy of configPolicies) {
+                for (const rule of policy.rules) {
+                    const matched = this.evaluateRule(rule, context, policy.type);
+                    if (matched) {
+                        reasons.push(matched);
+                        overallRisk = maxRisk(overallRisk, matched.severity);
+                        if (matched.effect === 'reject' && decision !== 'reject') {
+                            decision = 'reject';
+                        }
+                        else if (matched.effect === 'warn' && decision === 'approve') {
+                            decision = 'warn';
+                        }
+                    }
+                }
+            }
+        }
+        // Calculate risk from actions
+        const calculatedRisk = this.calculator.calculate({
+            actions: context.actions,
+            estimatedFiles: context.metadata?.estimatedFiles,
+        });
+        overallRisk = maxRisk(overallRisk, calculatedRisk);
+        // Critical risk always requires approval
+        const requiresApproval = decision === 'warn' ||
+            overallRisk === 'critical' ||
+            overallRisk === 'high';
+        if (reasons.length > 0) {
+            suggestions.push('Review the policy evaluation reasons before proceeding');
+        }
+        const result = {
+            decision,
+            riskLevel: overallRisk,
+            reasons,
+            requiresApproval,
+            suggestions,
+        };
+        // Record evidence
+        if (jobId) {
+            this.evidence.recordEvaluation(jobId, result);
+        }
+        this.logger('info', `Policy evaluation: ${decision} (risk: ${overallRisk})`, {
+            reasons: reasons.length,
+            requiresApproval,
+        });
+        return result;
+    }
+    /** Get the policy store */
+    getPolicyStore() {
+        return this.store;
+    }
+    // ========================================================================
+    // Private
+    // ========================================================================
+    /** Evaluate a single rule against context */
+    evaluateRule(rule, context, policyType) {
+        const matched = this.matchCondition(rule.condition, context, policyType);
+        if (matched) {
+            return {
+                rule: rule.description,
+                ruleId: rule.id,
+                message: rule.message,
+                severity: rule.severity || 'medium',
+                effect: rule.effect,
+            };
+        }
+        return null;
+    }
+    /** Match a condition against context */
+    matchCondition(condition, context, policyType) {
+        // Handle $or
+        if (condition.$or) {
+            return condition.$or.some((c) => this.matchCondition(c, context, policyType));
+        }
+        // Handle $not
+        if (condition.$not) {
+            return !this.matchCondition(condition.$not, context, policyType);
+        }
+        // All other fields are implicit AND
+        for (const [field, expected] of Object.entries(condition)) {
+            if (field.startsWith('$'))
+                continue;
+            // For action-level fields, check against each action
+            if (field.startsWith('action.')) {
+                const actionField = field.slice(7); // Remove 'action.' prefix
+                const anyMatch = context.actions.some((action) => {
+                    const value = action[actionField];
+                    if (value === undefined) {
+                        // Action-level: missing field = no match (pattern checks need a value)
+                        return false;
+                    }
+                    return this.matchValue(String(value), expected);
+                });
+                if (!anyMatch)
+                    return false;
+            }
+            else {
+                // Top-level field
+                const value = this.getContextValue(context, field);
+                if (value === undefined) {
+                    return policyType === 'safety'; // Missing = fail-closed for safety
+                }
+                if (!this.matchValue(String(value), expected))
+                    return false;
+            }
+        }
+        return true;
+    }
+    /** Match a value against an expected pattern */
+    matchValue(value, expected) {
+        if (typeof expected === 'string') {
+            return value === expected;
+        }
+        if (typeof expected === 'number') {
+            return Number(value) === expected;
+        }
+        if (typeof expected === 'object' && expected !== null) {
+            const ops = expected;
+            if (ops.equals !== undefined)
+                return value === String(ops.equals);
+            if (ops.contains !== undefined)
+                return value.includes(String(ops.contains));
+            if (ops.gt !== undefined)
+                return Number(value) > Number(ops.gt);
+            if (ops.lt !== undefined)
+                return Number(value) < Number(ops.lt);
+            if (ops.in !== undefined && Array.isArray(ops.in)) {
+                return ops.in.map(String).includes(value);
+            }
+            if (ops.not !== undefined)
+                return !this.matchValue(value, ops.not);
+            if (ops.regex !== undefined) {
+                const pattern = String(ops.regex);
+                if (pattern.length > MAX_REGEX_LENGTH) {
+                    this.logger('warn', `Regex too long (${pattern.length} > ${MAX_REGEX_LENGTH})`);
+                    return false;
+                }
+                try {
+                    const regex = new RegExp(pattern, 'i');
+                    return regex.test(value);
+                }
+                catch {
+                    this.logger('warn', `Invalid regex: ${pattern}`);
+                    return false;
+                }
+            }
+        }
+        return false;
+    }
+    /** Get a value from the evaluation context by dotted path */
+    getContextValue(context, field) {
+        const parts = field.split('.');
+        let current = context;
+        for (const part of parts) {
+            if (current === null || current === undefined)
+                return undefined;
+            if (typeof current === 'object') {
+                current = current[part];
+            }
+            else {
+                return undefined;
+            }
+        }
+        return current;
+    }
+}
+//# sourceMappingURL=PolicyEngine.js.map

package/dist/infra/policy/PolicyEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PolicyEngine.js","sourceRoot":"","sources":["../../../src/infra/policy/PolicyEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAWL,OAAO,GACR,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,MAAM,OAAO,YAAY;IACf,KAAK,CAAc;IACnB,UAAU,CAAiB;IAC3B,QAAQ,CAAgB;IACxB,MAAM,CAA6D;IAE3E,YACE,KAAkB,EAClB,QAAuB,EACvB,MAAkE;QAElE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,IAAI,cAAc,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,oBAAoB;IACpB,YAAY,CAAC,WAAoB;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IAED,0DAA0D;IAC1D,QAAQ,CAAC,OAAoB,EAAE,KAAc;QAC3C,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,IAAI,WAAW,GAAc,MAAM,CAAC;QACpC,IAAI,QAAQ,GAAmB,SAAS,CAAC;QAEzC,2CAA2C;QAC3C,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACtD,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC9D,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACtB,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;oBAErD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;wBAChC,QAAQ,GAAG,QAAQ,CAAC,CAAC,qCAAqC;oBAC5D,CAAC;yBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBAC9D,QAAQ,GAAG,MAAM,CAAC;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACtD,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;gBACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;oBAC9D,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBACtB,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;wBAErD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACzD,QAAQ,GAAG,QAAQ,CAAC;wBACtB,CAAC;6BAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;4BAC/D,QAAQ,GAAG,MAAM,CAAC;wBACpB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAC/C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,cAAoC;SACvE,CAAC,CAAC;QACH,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAEnD,yCAAyC;QACzC,MAAM,gBAAgB,GAAG,QAAQ,KAAK,MAAM;YAC1C,WAAW,KAAK,UAAU;YAC1B,WAAW,KAAK,MAAM,CAAC;QAEzB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,WAAW,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAqB;YAC/B,QAAQ;YACR,SAAS,EAAE,WAAW;YACtB,OAAO;YACP,gBAAgB;YAChB,WAAW;SACZ,CAAC;QAEF,kBAAkB;QAClB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,QAAQ,WAAW,WAAW,GAAG,EAAE;YAC3E,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,gBAAgB;SACjB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2BAA2B;IAC3B,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,2EAA2E;IAC3E,UAAU;IACV,2EAA2E;IAE3E,6CAA6C;IACrC,YAAY,CAClB,IAAgB,EAChB,OAAoB,EACpB,UAAsC;QAEtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAEzE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,WAAW;gBACtB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wCAAwC;IAChC,cAAc,CACpB,SAA0B,EAC1B,OAAoB,EACpB,UAAsC;QAEtC,aAAa;QACb,IAAI,SAAS,CAAC,GAAG,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAChF,CAAC;QAED,cAAc;QACd,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACnE,CAAC;QAED,oCAAoC;QACpC,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAEpC,qDAAqD;YACrD,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;gBAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;oBAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,uEAAuE;wBACvE,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAClD,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ;oBAAE,OAAO,KAAK,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,kBAAkB;gBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,mCAAmC;gBACrE,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;oBAAE,OAAO,KAAK,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gDAAgD;IACxC,UAAU,CAAC,KAAa,EAAE,QAAiB;QACjD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC;QACpC,CAAC;QAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,QAAmC,CAAC;YAEhD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClE,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5E,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChE,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChE,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClD,OAAO,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAEnE,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAClC,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;oBACtC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,OAAO,CAAC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC;oBAChF,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBACvC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,OAAO,EAAE,CAAC,CAAC;oBACjD,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6DAA6D;IACrD,eAAe,CAAC,OAAoB,EAAE,KAAa;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,OAAO,GAAY,OAAO,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAChE,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/infra/policy/PolicyStore.d.ts

@@ -0,0 +1,36 @@
+/**
+ * PolicyStore - Load and manage policies
+ * Phase 3: Policy Engine
+ *
+ * Priority: project > user > built-in
+ */
+import { PolicyFile } from './types.js';
+import { LogLevel } from '../../daemon/types.js';
+export declare class PolicyStore {
+    private policies;
+    private disabledPolicies;
+    private logger;
+    constructor(logger: (level: LogLevel, message: string, data?: unknown) => void);
+    /** Load all policies in order: builtin → user → project */
+    loadAll(projectPath?: string): void;
+    /** Get all loaded policies */
+    getAll(): PolicyFile[];
+    /** Get active policies (enabled + not disabled by user) */
+    getActive(): PolicyFile[];
+    /** Get safety policies (cannot be disabled) */
+    getSafetyPolicies(): PolicyFile[];
+    /** Get configuration policies */
+    getConfigPolicies(): PolicyFile[];
+    /** Get policy by name */
+    getPolicy(name: string): PolicyFile | undefined;
+    /** Disable a policy (config only, safety cannot be disabled) */
+    disablePolicy(name: string): boolean;
+    /** Enable a previously disabled policy */
+    enablePolicy(name: string): boolean;
+    /** Check if a policy is enabled */
+    isEnabled(name: string): boolean;
+    private loadBuiltinPolicies;
+    private loadPoliciesFromDir;
+    private validatePolicy;
+}
+//# sourceMappingURL=PolicyStore.d.ts.map

package/dist/infra/policy/PolicyStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PolicyStore.d.ts","sourceRoot":"","sources":["../../../src/infra/policy/PolicyStore.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAAU,UAAU,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAKjD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,gBAAgB,CAA0B;IAClD,OAAO,CAAC,MAAM,CAA6D;gBAE/D,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI;IAI9E,2DAA2D;IAC3D,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAkBnC,8BAA8B;IAC9B,MAAM,IAAI,UAAU,EAAE;IAItB,2DAA2D;IAC3D,SAAS,IAAI,UAAU,EAAE;IAMzB,+CAA+C;IAC/C,iBAAiB,IAAI,UAAU,EAAE;IAIjC,iCAAiC;IACjC,iBAAiB,IAAI,UAAU,EAAE;IAIjC,yBAAyB;IACzB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAI/C,gEAAgE;IAChE,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAWpC,0CAA0C;IAC1C,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAInC,mCAAmC;IACnC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAWhC,OAAO,CAAC,mBAAmB;IAkB3B,OAAO,CAAC,mBAAmB;IAsC3B,OAAO,CAAC,cAAc;CAgCvB"}

package/dist/infra/policy/PolicyStore.js

@@ -0,0 +1,160 @@
+/**
+ * PolicyStore - Load and manage policies
+ * Phase 3: Policy Engine
+ *
+ * Priority: project > user > built-in
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as url from 'node:url';
+const VIBE_DIR = path.join(os.homedir(), '.vibe');
+const USER_POLICIES_DIR = path.join(VIBE_DIR, 'policies');
+export class PolicyStore {
+    policies = new Map();
+    disabledPolicies = new Set();
+    logger;
+    constructor(logger) {
+        this.logger = logger;
+    }
+    /** Load all policies in order: builtin → user → project */
+    loadAll(projectPath) {
+        this.policies.clear();
+        // 1. Built-in policies
+        this.loadBuiltinPolicies();
+        // 2. User policies (~/.vibe/policies/)
+        this.loadPoliciesFromDir(USER_POLICIES_DIR, 'user');
+        // 3. Project policies (.vibe/policies/)
+        if (projectPath) {
+            const projectPoliciesDir = path.join(projectPath, '.vibe', 'policies');
+            this.loadPoliciesFromDir(projectPoliciesDir, 'project');
+        }
+        this.logger('info', `Loaded ${this.policies.size} policies`);
+    }
+    /** Get all loaded policies */
+    getAll() {
+        return Array.from(this.policies.values());
+    }
+    /** Get active policies (enabled + not disabled by user) */
+    getActive() {
+        return Array.from(this.policies.values()).filter((p) => p.enabled && !this.disabledPolicies.has(p.name));
+    }
+    /** Get safety policies (cannot be disabled) */
+    getSafetyPolicies() {
+        return Array.from(this.policies.values()).filter((p) => p.type === 'safety');
+    }
+    /** Get configuration policies */
+    getConfigPolicies() {
+        return this.getActive().filter((p) => p.type === 'configuration');
+    }
+    /** Get policy by name */
+    getPolicy(name) {
+        return this.policies.get(name);
+    }
+    /** Disable a policy (config only, safety cannot be disabled) */
+    disablePolicy(name) {
+        const policy = this.policies.get(name);
+        if (!policy)
+            return false;
+        if (policy.type === 'safety') {
+            this.logger('warn', `Cannot disable safety policy: ${name}`);
+            return false;
+        }
+        this.disabledPolicies.add(name);
+        return true;
+    }
+    /** Enable a previously disabled policy */
+    enablePolicy(name) {
+        return this.disabledPolicies.delete(name);
+    }
+    /** Check if a policy is enabled */
+    isEnabled(name) {
+        const policy = this.policies.get(name);
+        if (!policy)
+            return false;
+        if (policy.type === 'safety')
+            return true; // Always enabled
+        return policy.enabled && !this.disabledPolicies.has(name);
+    }
+    // ========================================================================
+    // Private
+    // ========================================================================
+    loadBuiltinPolicies() {
+        const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
+        const builtinDir = path.join(__dirname, 'builtin');
+        if (!fs.existsSync(builtinDir)) {
+            // In dist/: look relative to compiled location
+            const altDir = path.join(__dirname, '..', '..', 'src', 'policy', 'builtin');
+            if (fs.existsSync(altDir)) {
+                this.loadPoliciesFromDir(altDir, 'builtin');
+                return;
+            }
+            this.logger('warn', 'Built-in policies directory not found');
+            return;
+        }
+        this.loadPoliciesFromDir(builtinDir, 'builtin');
+    }
+    loadPoliciesFromDir(dir, source) {
+        if (!fs.existsSync(dir))
+            return;
+        try {
+            const files = fs.readdirSync(dir).filter((f) => f.endsWith('.json'));
+            for (const file of files) {
+                const filePath = path.join(dir, file);
+                try {
+                    const content = fs.readFileSync(filePath, 'utf-8');
+                    const policy = JSON.parse(content);
+                    if (!this.validatePolicy(policy, filePath)) {
+                        continue;
+                    }
+                    const policyFile = {
+                        ...policy,
+                        filePath,
+                        source,
+                    };
+                    // Higher priority source overwrites lower
+                    this.policies.set(policy.name, policyFile);
+                    this.logger('debug', `Loaded policy: ${policy.name} (${source})`);
+                }
+                catch (err) {
+                    this.logger('warn', `Failed to load policy file: ${filePath}`, {
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
+            }
+        }
+        catch (err) {
+            this.logger('warn', `Failed to read policy directory: ${dir}`, {
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    validatePolicy(policy, filePath) {
+        if (!policy || typeof policy !== 'object') {
+            this.logger('warn', `Invalid policy format: ${filePath}`);
+            return false;
+        }
+        const p = policy;
+        if (typeof p.name !== 'string' || !p.name) {
+            this.logger('warn', `Policy missing name: ${filePath}`);
+            return false;
+        }
+        if (!Array.isArray(p.rules)) {
+            this.logger('warn', `Policy missing rules array: ${filePath}`);
+            return false;
+        }
+        const validEffects = ['approve', 'warn', 'reject', 'ignore'];
+        for (const rule of p.rules) {
+            if (typeof rule.id !== 'string') {
+                this.logger('warn', `Rule missing id in ${filePath}`);
+                return false;
+            }
+            if (typeof rule.effect !== 'string' || !validEffects.includes(rule.effect)) {
+                this.logger('warn', `Invalid effect "${rule.effect}" in rule ${rule.id} of ${filePath}`);
+                return false;
+            }
+        }
+        return true;
+    }
+}
+//# sourceMappingURL=PolicyStore.js.map

package/dist/infra/policy/PolicyStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PolicyStore.js","sourceRoot":"","sources":["../../../src/infra/policy/PolicyStore.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAIhC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAClD,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAE1D,MAAM,OAAO,WAAW;IACd,QAAQ,GAA4B,IAAI,GAAG,EAAE,CAAC;IAC9C,gBAAgB,GAAgB,IAAI,GAAG,EAAE,CAAC;IAC1C,MAAM,CAA6D;IAE3E,YAAY,MAAkE;QAC5E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,2DAA2D;IAC3D,OAAO,CAAC,WAAoB;QAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAEtB,uBAAuB;QACvB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE3B,uCAAuC;QACvC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAEpD,wCAAwC;QACxC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACvE,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,CAAC;IAC/D,CAAC;IAED,8BAA8B;IAC9B,MAAM;QACJ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,2DAA2D;IAC3D,SAAS;QACP,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CACvD,CAAC;IACJ,CAAC;IAED,+CAA+C;IAC/C,iBAAiB;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC/E,CAAC;IAED,iCAAiC;IACjC,iBAAiB;QACf,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,yBAAyB;IACzB,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,gEAAgE;IAChE,aAAa,CAAC,IAAY;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,iCAAiC,IAAI,EAAE,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0CAA0C;IAC1C,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,mCAAmC;IACnC,SAAS,CAAC,IAAY;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB;QAC5D,OAAO,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,2EAA2E;IAC3E,UAAU;IACV,2EAA2E;IAEnE,mBAAmB;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAEnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,+CAA+C;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC5E,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;IAEO,mBAAmB,CAAC,GAAW,EAAE,MAA4B;QACnE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAEhC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAErE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACtC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAW,CAAC;oBAE7C,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;wBAC3C,SAAS;oBACX,CAAC;oBAED,MAAM,UAAU,GAAe;wBAC7B,GAAG,MAAM;wBACT,QAAQ;wBACR,MAAM;qBACP,CAAC;oBAEF,0CAA0C;oBAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;oBAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,kBAAkB,MAAM,CAAC,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC;gBACpE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,+BAA+B,QAAQ,EAAE,EAAE;wBAC7D,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,oCAAoC,GAAG,EAAE,EAAE;gBAC7D,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAAe,EAAE,QAAgB;QACtD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,QAAQ,EAAE,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,CAAC,GAAG,MAAiC,CAAC;QAE5C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,QAAQ,EAAE,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,+BAA+B,QAAQ,EAAE,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7D,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAuC,EAAE,CAAC;YAC7D,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,QAAQ,EAAE,CAAC,CAAC;gBACtD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAgB,CAAC,EAAE,CAAC;gBACrF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,IAAI,CAAC,MAAM,aAAa,IAAI,CAAC,EAAE,OAAO,QAAQ,EAAE,CAAC,CAAC;gBACzF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/infra/policy/RiskCalculator.d.ts

@@ -0,0 +1,20 @@
+/**
+ * RiskCalculator - Analyze ActionPlan risk
+ * Phase 3: Policy Engine
+ */
+import { RiskLevel } from './types.js';
+export interface RiskInput {
+    actions: Array<{
+        type: string;
+        target: string;
+        command?: string;
+    }>;
+    estimatedFiles?: number;
+}
+export declare class RiskCalculator {
+    /** Calculate overall risk from actions */
+    calculate(input: RiskInput): RiskLevel;
+    private assessTargetRisk;
+    private assessCommandRisk;
+}
+//# sourceMappingURL=RiskCalculator.d.ts.map

package/dist/infra/policy/RiskCalculator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RiskCalculator.d.ts","sourceRoot":"","sources":["../../../src/infra/policy/RiskCalculator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAuB,MAAM,YAAY,CAAC;AAE5D,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAcD,qBAAa,cAAc;IACzB,0CAA0C;IAC1C,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS;IA0BtC,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,iBAAiB;CAQ1B"}