@twinsearth/dsh-master 0.0.0-stage → 3.2.8

package/src/superagent/stream-adapter.ts

@@ -0,0 +1,184 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (c) 2026 dsh-Master contributors — see LICENSE-CORE.
+// @ts-nocheck — host JS→TS 迁移阶段：运行时行为优先，类型注解逐步补齐（worker/ 仍严格检查）。
+
+/**
+ * 流式传输 adapter 层（v3.2.5）。
+ *
+ * Router 只负责“产生事件”，**怎么送到浏览器由宿主决定**：
+ *   * 内置 adapter：Node `http.ServerResponse`（SSE，默认）；
+ *   * 宿主 adapter：宿主注入 `dshMasterStreamAdapter` 服务（WS / 自有 SSE / IPC 皆可），
+ *     实现 `{ publish(event), clientCount?() }` 即可，Router 不关心底层协议。
+ *
+ * 这样 DSH 宿主可以按自己的传输栈接入真实 SSE/WS，而不需要改房主插件。
+ */
+
+/** 单条事件的传输目标（一条 SSE 连接 / 一个 WS 连接）。 */
+export const STREAM_ADAPTER_SERVICE = 'dshMasterStreamAdapter'
+
+/**
+ * 把 Node ServerResponse 包装成传输目标。
+ * @param {object} res http.ServerResponse 或测试替身（writeHead/write/end/on）
+ */
+export function createNodeStreamTransport(res) {
+  let closed = false
+  const closeHandlers = []
+  const markClosed = () => {
+    if (closed) return
+    closed = true
+    for (const handler of closeHandlers) {
+      try { handler() } catch { /* ignore */ }
+    }
+  }
+  try { res?.on?.('close', markClosed) } catch { /* fake res */ }
+  return {
+    kind: 'sse',
+    get closed() { return closed },
+    write(text) {
+      if (closed) return false
+      try {
+        res?.write?.(text)
+        return true
+      } catch {
+        markClosed()
+        return false
+      }
+    },
+    end() {
+      if (closed) return
+      try { res?.end?.() } catch { /* ignore */ }
+      markClosed()
+    },
+    onClose(handler) {
+      if (typeof handler === 'function') closeHandlers.push(handler)
+    },
+  }
+}
+
+/**
+ * 把“宿主提供的发送函数”包装成传输目标（WS / 自有 SSE / IPC）。
+ * @param {{ send: (text: string) => boolean|void, close?: () => void, kind?: string }} options
+ */
+export function createHostStreamTransport(options) {
+  let closed = false
+  const closeHandlers = []
+  return {
+    kind: String(options?.kind ?? 'host'),
+    get closed() { return closed },
+    write(text) {
+      if (closed) return false
+      try {
+        const ok = options?.send?.(text)
+        return ok !== false
+      } catch {
+        return false
+      }
+    },
+    end() {
+      if (closed) return
+      closed = true
+      try { options?.close?.() } catch { /* ignore */ }
+      for (const handler of closeHandlers) {
+        try { handler() } catch { /* ignore */ }
+      }
+    },
+    onClose(handler) {
+      if (typeof handler === 'function') closeHandlers.push(handler)
+    },
+  }
+}
+
+/**
+ * 解析宿主 adapter：ctx 里注册了 `dshMasterStreamAdapter` 就用它，否则返回 null。
+ * 宿主 adapter 契约：`{ publish(event, text), clientCount?() }`。
+ * @param {object} ctx Cordis context
+ */
+export function resolveHostStreamAdapter(ctx) {
+  try {
+    const found = typeof ctx?.get === 'function' ? ctx.get(STREAM_ADAPTER_SERVICE) : ctx?.[STREAM_ADAPTER_SERVICE]
+    if (!found || typeof found !== 'object') return null
+    if (typeof found.publish !== 'function') return null
+    return found
+  } catch {
+    return null
+  }
+}
+
+/**
+ * 事件广播器：管理本进程内 SSE 连接 + 可选宿主 adapter。
+ *
+ * @param {{ ringSize?: number, formatter?: (event: object) => string }} [options]
+ */
+export function createStreamBroadcaster(options = {}) {
+  const ringSize = Math.max(1, Number(options.ringSize ?? 300) || 300)
+  const formatter = typeof options.formatter === 'function'
+    ? options.formatter
+    : (event) => `event: worker-event\ndata: ${JSON.stringify(event)}\n\n`
+  /** @type {Set<any>} */
+  const clients = new Set()
+  const ring = []
+  let hostAdapter = null
+  let hostEvents = 0
+
+  const publish = (event) => {
+    ring.push(event)
+    if (ring.length > ringSize) ring.splice(0, ring.length - ringSize)
+    const text = formatter(event)
+    for (const client of [...clients]) {
+      let ok = false
+      try { ok = client.write(text) !== false } catch { ok = false }
+      if (!ok) clients.delete(client)
+    }
+    if (hostAdapter) {
+      try { hostAdapter.publish(event, text) } catch { /* 宿主 adapter 失败不影响本机 SSE */ }
+      hostEvents += 1
+    }
+  }
+
+  return {
+    publish,
+    /** 新连接：先回放环形缓冲，再开始实时接收。 */
+    attach(client, { replay = true, retryMs = 3000 } = {}) {
+      if (!client) return false
+      clients.add(client)
+      try { client.write(`retry: ${retryMs}\n\n`) } catch { /* ignore */ }
+      if (replay) {
+        for (const event of ring) {
+          try { client.write(formatter(event)) } catch { /* ignore */ }
+        }
+      }
+      try { client.onClose?.(() => clients.delete(client)) } catch { /* ignore */ }
+      return true
+    },
+    detach(client) { clients.delete(client) },
+    useHostAdapter(adapter) {
+      hostAdapter = adapter && typeof adapter.publish === 'function' ? adapter : null
+      return hostAdapter !== null
+    },
+    describe() {
+      return {
+        clients: clients.size,
+        ring: ring.length,
+        hostAdapter: Boolean(hostAdapter),
+        hostAdapterName: hostAdapter?.name ?? null,
+        hostEvents,
+      }
+    },
+    /** 心跳：给所有连接写注释行，探测死连接。 */
+    heartbeat(text = ': ping\n\n') {
+      for (const client of [...clients]) {
+        let ok = false
+        try { ok = client.write(text) !== false } catch { ok = false }
+        if (!ok) clients.delete(client)
+      }
+      try { hostAdapter?.heartbeat?.(text) } catch { /* ignore */ }
+    },
+    closeAll() {
+      for (const client of clients) {
+        try { client.end?.() } catch { /* ignore */ }
+      }
+      clients.clear()
+      try { hostAdapter?.close?.() } catch { /* ignore */ }
+    },
+  }
+}

package/src/superagent/stream-tokens.ts

@@ -0,0 +1,142 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (c) 2026 dsh-Master contributors — see LICENSE-CORE.
+// @ts-nocheck — host JS→TS 迁移阶段：运行时行为优先，类型注解逐步补齐（worker/ 仍严格检查）。
+
+/**
+ * 流式 token 管理（v3.2.5）：签发 / 校验 / 轮换 / 撤销 / TTL / 审计。
+ *
+ * 两类 token：
+ *   * worker：Router 派发时注入 Worker（DSH_MASTER_STREAM_TOKEN），用于 worker-events 回传；
+ *   * ui：浏览器订阅 SSE 时使用（短 TTL、可轮换，避免把 worker token 暴露给页面）。
+ *
+ * 审计只记录动作与元数据，不记录 token 本身；所有校验都走常量时间比较。
+ */
+
+import crypto from 'node:crypto'
+
+const AUDIT_LIMIT = 500
+
+function nowOf(clock) { return typeof clock === 'function' ? clock() : Date.now() }
+
+function safeEqual(a, b) {
+  const left = Buffer.from(String(a ?? ''), 'utf8')
+  const right = Buffer.from(String(b ?? ''), 'utf8')
+  if (left.length === 0 || left.length !== right.length) return false
+  return crypto.timingSafeEqual(left, right)
+}
+
+/**
+ * @param {{workerTtlMs?:number, uiTtlMs?:number, auditLimit?:number, clock?:()=>number}} [options]
+ */
+export function createStreamTokenManager(options = {}) {
+  /**
+   * @param {object} [options]
+   * @param {(record:object)=>void} [options.auditSink] 审计外送（例如落盘 JSONL）；不含明文 token
+   */
+  const workerTtlMs = Math.max(1_000, Number(options.workerTtlMs ?? 6 * 60 * 60_000))
+  const uiTtlMs = Math.max(1_000, Number(options.uiTtlMs ?? 10 * 60_000))
+  const auditLimit = Math.max(10, Number(options.auditLimit ?? AUDIT_LIMIT))
+  const clock = typeof options.clock === 'function' ? options.clock : () => Date.now()
+  const tokens = new Map()
+  const auditLog = []
+  const counters = { issued: 0, verified: 0, rejected: 0, rotated: 0, revoked: 0, expired: 0 }
+
+  const auditSink = typeof options.auditSink === 'function' ? options.auditSink : null
+  const audit = (action, detail = {}) => {
+    const record = Object.freeze({ at: nowOf(clock), scope: 'stream', action, ...detail })
+    try { auditSink?.(record) } catch { /* 审计外送失败不影响鉴权 */ }
+    auditLog.push(record)
+    if (auditLog.length > auditLimit) auditLog.splice(0, auditLog.length - auditLimit)
+  }
+  const issue = ({ kind = 'worker', ticketId = '', ttlMs, meta = {} } = {}) => {
+    const token = crypto.randomBytes(24).toString('hex')
+    const ttl = Math.max(1_000, Number(ttlMs ?? (kind === 'ui' ? uiTtlMs : workerTtlMs)))
+    const entry = Object.freeze({
+      kind: String(kind),
+      ticketId: String(ticketId ?? ''),
+      issuedAt: nowOf(clock),
+      expiresAt: nowOf(clock) + ttl,
+      meta: meta && typeof meta === 'object' ? { ...meta } : {},
+    })
+    tokens.set(token, entry)
+    counters.issued += 1
+    audit('issue', { kind: entry.kind, ticketId: entry.ticketId, expiresAt: entry.expiresAt })
+    return { token, kind: entry.kind, ticketId: entry.ticketId, expiresAt: entry.expiresAt }
+  }
+  const find = (token) => tokens.get(String(token ?? ''))
+  const verify = (token, { kind = null, ticketId = null } = {}) => {
+    const value = String(token ?? '')
+    if (!value) {
+      counters.rejected += 1
+      audit('verify-fail', { reason: 'missing', kind, ticketId })
+      return { ok: false, reason: 'token-missing' }
+    }
+    const entry = find(value)
+    if (!entry) {
+      counters.rejected += 1
+      audit('verify-fail', { reason: 'unknown', kind, ticketId })
+      return { ok: false, reason: 'token-unknown' }
+    }
+    if (nowOf(clock) > entry.expiresAt) {
+      tokens.delete(value)
+      counters.expired += 1
+      audit('expire', { kind: entry.kind, ticketId: entry.ticketId })
+      return { ok: false, reason: 'token-expired' }
+    }
+    if (kind && entry.kind !== kind) {
+      counters.rejected += 1
+      audit('verify-fail', { reason: 'kind-mismatch', kind, ticketId })
+      return { ok: false, reason: 'token-kind-mismatch' }
+    }
+    if (ticketId !== null && entry.kind !== 'ui' && entry.ticketId !== String(ticketId)) {
+      counters.rejected += 1
+      audit('verify-fail', { reason: 'ticket-mismatch', kind: entry.kind, ticketId })
+      return { ok: false, reason: 'token-ticket-mismatch' }
+    }
+    counters.verified += 1
+    audit('verify-ok', { kind: entry.kind, ticketId: entry.ticketId })
+    return { ok: true, entry }
+  }
+  const revoke = (token, reason = 'manual') => {
+    const value = String(token ?? '')
+    const entry = tokens.get(value)
+    if (!entry) return { ok: false, reason: 'token-unknown' }
+    tokens.delete(value)
+    counters.revoked += 1
+    audit('revoke', { kind: entry.kind, ticketId: entry.ticketId, reason: String(reason) })
+    return { ok: true, entry }
+  }
+  const rotate = (oldToken, { kind = 'ui', ticketId = '' } = {}) => {
+    const old = String(oldToken ?? '')
+    // 轮换不是“凭空签发”：旧 token 必须存在、未过期且类型匹配。
+    // 否则任意拿到本机端口的人都能用任意字符串换出一张有效 UI token。
+    const verified = verify(old, { kind })
+    if (!verified.ok) return { token: '', error: verified.reason, ok: false }
+    revoke(old, 'rotate')
+    const issued = issue({ kind, ticketId: kind === 'ui' ? '' : ticketId })
+    counters.rotated += 1
+    audit('rotate', { kind: issued.kind, ticketId: issued.ticketId, expiresAt: issued.expiresAt })
+    return { ...issued, ok: true }
+  }
+  const sweep = () => {
+    const now = nowOf(clock)
+    let removed = 0
+    for (const [token, entry] of tokens.entries()) {
+      if (now > entry.expiresAt) {
+        tokens.delete(token)
+        removed += 1
+        counters.expired += 1
+        audit('expire', { kind: entry.kind, ticketId: entry.ticketId })
+      }
+    }
+    return removed
+  }
+  return {
+    issue, verify, revoke, rotate, sweep,
+    audit(limit = 20) { return auditLog.slice(-Math.max(1, Math.floor(Number(limit) || 20))) },
+    counts() { return { ...counters, active: tokens.size } },
+    describe() { return { workerTtlMs, uiTtlMs, active: tokens.size, counters: { ...counters } } },
+  }
+}
+
+export { safeEqual }

package/src/superagent/ticket-store.ts

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (c) 2026 dsh-Master contributors — see LICENSE-CORE.
+// @ts-nocheck — host JS→TS 迁移阶段：运行时行为优先，类型注解逐步补齐（worker/ 仍严格检查）。
+
+/**
+ * Ticket 持久化（v3.2.1）。
+ *
+ * 目标：Router 重启后 Task/Ticket 可追溯（对应瓮城“持久化状态 → 会话仓”的映射）。
+ * 实现保持最小：`<dataDir>/superagent-tickets.json`，原子写（tmp + rename）。
+ * dataDir 为空时降级为内存存储（测试/开发默认），并在状态里标记 persistence=false。
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+const FILE_NAME = 'superagent-tickets.json'
+const VERSION = 1
+
+function safeLoad(file) {
+  try {
+    if (!fs.existsSync(file)) return []
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'))
+    if (!parsed || parsed.version !== VERSION || !Array.isArray(parsed.records)) return []
+    return parsed.records.filter((record) => record && record.ticket && typeof record.ticket.id === 'string')
+  } catch {
+    return []
+  }
+}
+
+/**
+ * @param {{dataDir?:string, maxTickets?:number, logger?:{warn?:Function}}} [options]
+ */
+export function createTicketStore(options = {}) {
+  const dataDir = String(options.dataDir ?? '').trim()
+  const maxTickets = Math.max(1, Math.floor(Number(options.maxTickets ?? 500)) || 500)
+  const logger = options.logger ?? null
+  const file = dataDir ? path.join(dataDir, FILE_NAME) : ''
+  const records = new Map()
+
+  for (const record of safeLoad(file)) records.set(record.ticket.id, record)
+
+  const persist = () => {
+    if (!file) return { ok: true, persisted: false }
+    try {
+      fs.mkdirSync(dataDir, { recursive: true })
+      const payload = {
+        version: VERSION,
+        updatedAt: Date.now(),
+        records: [...records.values()],
+      }
+      const tmp = file + '.tmp'
+      fs.writeFileSync(tmp, JSON.stringify(payload, null, 2), 'utf8')
+      fs.renameSync(tmp, file)
+      return { ok: true, persisted: true }
+    } catch (error) {
+      try { logger?.warn?.(`[superagent] ticket persistence failed: ${String(error?.message ?? error)}`) } catch { /* ignore */ }
+      return { ok: false, persisted: false, error: String(error?.message ?? error) }
+    }
+  }
+
+  const trim = () => {
+    if (records.size <= maxTickets) return
+    const overflow = records.size - maxTickets
+    const ids = [...records.keys()].slice(0, overflow)
+    for (const id of ids) records.delete(id)
+  }
+
+  const store = {
+    persistence: () => ({ enabled: Boolean(file), file: file || null }),
+    add(ticket, status = 'pending', detail = null) {
+      if (!ticket || typeof ticket.id !== 'string') throw new Error('ticket with id is required')
+      const record = Object.freeze({ ticket, status: String(status), updatedAt: Date.now(), detail })
+      records.set(ticket.id, record)
+      trim()
+      const write = persist()
+      return { ...record, persisted: write.persisted }
+    },
+    get(id) {
+      return records.get(String(id ?? '')) ?? null
+    },
+    setStatus(id, status, detail = null) {
+      const record = records.get(String(id ?? ''))
+      if (!record) return null
+      const next = Object.freeze({ ...record, status: String(status), updatedAt: Date.now(), detail })
+      records.set(record.ticket.id, next)
+      persist()
+      return next
+    },
+    list({ status = null, limit = 50 } = {}) {
+      const all = [...records.values()].sort((a, b) => b.updatedAt - a.updatedAt)
+      const filtered = status ? all.filter((record) => record.status === status) : all
+      return filtered.slice(0, Math.max(1, Math.floor(Number(limit)) || 50))
+    },
+    counts() {
+      const counts = {}
+      for (const record of records.values()) counts[record.status] = (counts[record.status] ?? 0) + 1
+      return counts
+    },
+    size() { return records.size },
+  }
+  return store
+}
+
+export { FILE_NAME }

package/src/superagent/trust.ts

@@ -0,0 +1,139 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (c) 2026 dsh-Master contributors — see LICENSE-CORE.
+// @ts-nocheck — host JS→TS 迁移阶段：运行时行为优先，类型注解逐步补齐（worker/ 仍严格检查）。
+
+/**
+ * SuperAgent 渐进式信任与 Ticket 生成（v3.2.1）。
+ *
+ * 纯函数：不读环境、不做 IO；Router 插件负责配置注入与持久化。
+ * 关键语义：
+ *   * off     —— 完全关闭，事件全部忽略；
+ *   * observe —— 记录“本该执行的工单”（status=observed），不派发、不改代码；
+ *   * auto    —— 通过确定性 Gate 后派发 Worker 分身；缺派发能力时 unavailable。
+ * 默认 observe（用户要求：原型先观察，不先自动接单）。
+ */
+
+import { normalizeTrustMode, validateSourceEvent } from './types.ts'
+
+export const DEFAULT_POLICY = Object.freeze({
+  trustMode: 'observe',
+  allowlistedActors: Object.freeze([]),
+  requireMention: true,
+  allowedSources: Object.freeze(['github', 'feishu']),
+  repoAllowlist: Object.freeze([]),
+  policyVersion: 'v1.0',
+})
+
+let ticketSeq = 0
+
+/** 策略规范化；非法信任模式 fail-closed 到 observe（并记录 requested 值供状态页展示）。 */
+export function normalizePolicy(input = {}) {
+  const raw = input && typeof input === 'object' ? input : {}
+  const list = (value, fallback) => {
+    if (!Array.isArray(value)) return [...fallback]
+    const out = value.map((item) => String(item ?? '').trim()).filter(Boolean)
+    return out.length > 0 ? out : [...fallback]
+  }
+  const actors = Array.isArray(raw.allowedActors) ? raw.allowedActors.map((item) => String(item ?? '').trim()).filter(Boolean) : []
+  const sources = Array.isArray(raw.allowedSources)
+    ? raw.allowedSources.map((item) => String(item ?? '').trim().toLowerCase()).filter(Boolean)
+    : ['github', 'feishu']
+  const repos = Array.isArray(raw.repoAllowlist)
+    ? raw.repoAllowlist.map((item) => String(item ?? '').trim()).filter(Boolean)
+    : []
+  return Object.freeze({
+    trustMode: normalizeTrustMode(raw.trustMode, 'observe'),
+    requestedTrustMode: String(raw.trustMode ?? '').trim() || 'observe',
+    allowlistedActors: Object.freeze(actors),
+    requireMention: raw.requireMention !== false,
+    allowedSources: Object.freeze(sources.length > 0 ? sources : ['github', 'feishu']),
+    repoAllowlist: Object.freeze(repos),
+    policyVersion: String(raw.policyVersion ?? DEFAULT_POLICY.policyVersion).trim() || DEFAULT_POLICY.policyVersion,
+  })
+}
+
+/** 从 sourceId 提取仓库：github:owner/repo → owner/repo；其他返回 ''。 */
+export function repoFromSourceId(sourceId) {
+  const text = String(sourceId ?? '')
+  if (!text.startsWith('github:')) return ''
+  return text.slice('github:'.length)
+}
+
+/** 仓库允许列表：精确、`*`、前缀 `owner/*` 或任意 `prefix*`。空列表表示不限制。 */
+export function repoAllowed(repo, patterns) {
+  if (!Array.isArray(patterns) || patterns.length === 0) return true
+  const target = String(repo ?? '')
+  return patterns.some((pattern) => {
+    if (pattern === '*') return true
+    if (pattern === target) return true
+    if (pattern.endsWith('*')) return target.startsWith(pattern.slice(0, -1))
+    return false
+  })
+}
+
+/**
+ * 生成不可变 Ticket（Mandate 快照）。
+ * @param {object} event 已校验的 SourceEvent
+ * @param {object} policy normalizePolicy 的返回值
+ */
+export function createTicket(event, policy) {
+  ticketSeq += 1
+  const now = Date.now()
+  const mandate = Object.freeze({
+    scope: String(event.threadId),
+    policyVersion: String(policy.policyVersion),
+    strength: event.isMention ? 'explicit' : 'inferred',
+    allowedSources: Object.freeze([event.sourceId.split(':')[0]]),
+    createdAt: now,
+  })
+  return Object.freeze({
+    id: `ticket-${now.toString(36)}-${ticketSeq.toString(36)}`,
+    sourceId: String(event.sourceId),
+    requester: String(event.actor),
+    payload: String(event.content),
+    eventType: String(event.eventType),
+    createdAt: now,
+    mandate,
+  })
+}
+
+/**
+ * 确定性信任评估（不调用模型、不做 IO）。
+ * @param {{event:object, policy:object, dispatchAvailable:boolean}} input
+ * @returns {{decision:'accept'|'ignore'|'observe'|'unavailable', reasons:string[], ticket?:object, reason?:string}}
+ */
+export function evaluateEvent({ event, policy, dispatchAvailable = false } = {}) {
+  const validated = validateSourceEvent(event)
+  if (!validated.ok) return { decision: 'ignore', reasons: validated.errors, reason: validated.errors[0] }
+  const source = validated.event
+  const reasons = []
+  if (policy.trustMode === 'off') reasons.push('trust-mode-off')
+  if (!policy.allowedSources.includes(source.sourceId.split(':')[0])) reasons.push(`source-not-allowed:${source.sourceId.split(':')[0]}`)
+  if (source.actorIsBot) reasons.push('actor-is-bot')
+  if (policy.allowlistedActors.length === 0) reasons.push('actor-allowlist-empty')
+  else if (!policy.allowlistedActors.includes(source.actor)) reasons.push(`actor-not-allowlisted:${source.actor}`)
+  if (policy.requireMention && !source.isMention) reasons.push('mention-required')
+  if (source.repo && !repoAllowed(source.repo, policy.repoAllowlist)) reasons.push(`repo-not-allowlisted:${source.repo}`)
+  if (reasons.length > 0) return { decision: 'ignore', reasons, reason: reasons[0] }
+
+  const ticket = createTicket(source, policy)
+  if (policy.trustMode === 'observe') return { decision: 'observe', reasons: [], ticket }
+  if (policy.trustMode === 'auto') {
+    if (!dispatchAvailable) return { decision: 'unavailable', reasons: ['dispatch-unavailable'], reason: 'dispatch-unavailable', ticket }
+    return { decision: 'accept', reasons: [], ticket }
+  }
+  return { decision: 'ignore', reasons: [`trust-mode-unknown:${policy.trustMode}`], reason: 'trust-mode-unknown' }
+}
+
+/** 状态页展示用：策略摘要（无 secret）。 */
+export function describePolicy(policy) {
+  return {
+    trustMode: policy.trustMode,
+    requestedTrustMode: policy.requestedTrustMode,
+    allowlistedActors: [...policy.allowlistedActors],
+    requireMention: policy.requireMention,
+    allowedSources: [...policy.allowedSources],
+    repoAllowlist: [...policy.repoAllowlist],
+    policyVersion: policy.policyVersion,
+  }
+}