@vellumai/assistant 0.11.4 → 0.11.5-staging.2

package/src/permissions/ipc-risk-types.ts

@@ -1,143 +0,0 @@
-/**
- * Types for gateway IPC risk classification.
- *
- * These types mirror the gateway's classify_risk IPC response shape
- * (gateway/src/ipc/risk-classification-handlers.ts) and request parameters.
- * Keep in sync when the gateway response evolves.
- */
-
-import type { DirectoryScopeOption, ScopeOption } from "./risk-types.js";
-import type { AllowlistOption } from "./types.js";
-
-// ── Dangerous pattern (mirrors gateway wire format) ─────────────────────────
-
-export interface DangerousPattern {
-  type: string;
-  description: string;
-  text: string;
-}
-
-// ── Gateway response type ───────────────────────────────────────────────────
-
-/**
- * The response returned by the gateway's `classify_risk` IPC method.
- *
- * Mirrors the `ClassificationResult` in
- * `gateway/src/ipc/risk-classification-handlers.ts`.
- */
-export interface ClassificationResult {
-  risk: "low" | "medium" | "high" | "unknown";
-  reason: string;
-  matchType: "user_rule" | "registry" | "unknown";
-  scopeOptions: ScopeOption[];
-  allowlistOptions?: AllowlistOption[];
-  directoryScopeOptions?: DirectoryScopeOption[];
-  resolvedPaths?: string[];
-  actionKeys?: string[];
-  commandCandidates?: string[];
-  dangerousPatterns?: DangerousPattern[];
-  opaqueConstructs?: boolean;
-  isComplexSyntax?: boolean;
-  sandboxAutoApprove?: boolean;
-  /**
-   * Lexically-resolved path arguments from sandbox-auto-approve-eligible
-   * bash segments. The daemon resolves these through symlinks (via
-   * {@link isPathWithinWorkspaceRoot}) and overrides sandboxAutoApprove to
-   * false if any resolves outside the workspace. Closes the symlink-escape
-   * gap: the gateway's lexical check passes a path like
-   * `/workspace/escape/passwd` (symlink → `/etc/passwd`) because it cannot
-   * follow symlinks, but the daemon can.
-   */
-  sandboxPathArgs?: string[];
-}
-
-// ── Gateway request type ────────────────────────────────────────────────────
-
-/**
- * File classifier context pre-resolved by the assistant and forwarded
- * to the gateway so it can run file-risk classification without importing
- * assistant-specific path helpers.
- */
-export interface FileContext {
-  protectedDir: string;
-  deprecatedDir: string;
-  hooksDir: string;
-  pluginsDir: string;
-  toolsDir: string;
-  routesDir: string;
-  workflowsDir: string;
-  /** Monitoring data dir — sentinel lives here, writes are code-injection risk. */
-  monitoringDir: string;
-  actorTokenSigningKeyPath: string;
-  skillSourceDirs: string[];
-}
-
-/**
- * Skill metadata pre-resolved by the assistant and forwarded to the
- * gateway for skill-load risk classification.
- */
-export interface SkillMetadata {
-  skillId: string;
-  selector: string;
-  versionHash: string;
-  transitiveHash?: string;
-  hasInlineExpansions: boolean;
-  isDynamic: boolean;
-}
-
-/**
- * Parameters for the `classify_risk` IPC request.
- *
- * Mirrors the Zod schema in
- * `gateway/src/ipc/risk-classification-handlers.ts`.
- */
-export interface ClassifyRiskParams {
-  tool: string;
-  command?: string;
-  url?: string;
-  path?: string;
-  /**
-   * The file tool's target path with symlinks resolved (canonicalized by the
-   * daemon, which owns the workspace filesystem). The gateway uses this for its
-   * security escalation prefix checks so a symlink cannot mask a write into a
-   * protected directory. Falls back to lexical `path` resolution when absent.
-   */
-  resolvedPath?: string;
-  /**
-   * The sandbox file tool's working directory with symlinks resolved
-   * (canonicalized by the daemon). Paired with `resolvedPath` for the
-   * workspace-boundary check so a symlinked workspace prefix (e.g. macOS
-   * /var → /private/var) does not read as an escape. Absent for host tools;
-   * the gateway falls back to a lexical-vs-lexical comparison when unset.
-   */
-  resolvedWorkingDir?: string;
-  skill?: string;
-  mode?: string;
-  script?: string;
-  workingDir?: string;
-  workspaceRoot?: string;
-  allowPrivateNetwork?: boolean;
-  networkMode?: string;
-  isContainerized?: boolean;
-  fileContext?: FileContext;
-  skillMetadata?: SkillMetadata;
-  /** Tool registry default risk level for unknown tools. */
-  registryDefaultRisk?: string;
-  /** Number of credential references attached to this tool invocation. */
-  credentialRefCount?: number;
-  /**
-   * For host_file_transfer with `direction: "to_sandbox"`: the workspace-side
-   * destination path and the sandbox working directory it resolves against, so
-   * the gateway can escalate transfers that install an executable file in a
-   * code-injection sink (tools/routes/hooks/plugins/skills).
-   */
-  transferSandboxDestPath?: string;
-  transferSandboxWorkingDir?: string;
-  /**
-   * The `to_sandbox` workspace destination with symlinks resolved
-   * (canonicalized by the daemon). Used for the code-injection-sink check so a
-   * symlinked destination cannot mask the real target. Falls back to lexical
-   * resolution of `transferSandboxDestPath` when absent.
-   */
-  resolvedTransferDestPath?: string;
-}

package/src/permissions/risk-types.ts

@@ -1,76 +0,0 @@
-/**
- * Shared risk assessment types used by the permission checker.
- *
- * Classifier-internal types (CommandRiskSpec, ArgRule, ArgSchema, etc.) have
- * been migrated to the gateway and removed from the assistant.
- */
-
-import type { AllowlistOption } from "./types.js";
-
-// ── Risk levels ──────────────────────────────────────────────────────────────
-
-/**
- * Risk level for a classified command or tool invocation.
- *
- * - `"low"`: Read-only, no side effects (auto-allow in most policies)
- * - `"medium"`: Writes to filesystem, network access, state changes (confirm)
- * - `"high"`: Destructive, privilege escalation, force ops, arbitrary code exec
- * - `"unknown"`: Not in registry, unrecognized command or arg pattern
- */
-export type Risk = "low" | "medium" | "high" | "unknown";
-
-// ── Risk assessment output ───────────────────────────────────────────────────
-
-/** A scope option presented to the user when classifying an unknown command. */
-export interface ScopeOption {
-  /** Stored in DB if user saves (always regex internally). */
-  pattern: string;
-  /** Human-readable description shown in UI. */
-  label: string;
-}
-
-/**
- * A directory scope option emitted by the gateway for filesystem operations.
- * Mirrors `DirectoryScopeOption` in `gateway/src/risk/risk-types.ts`.
- */
-export interface DirectoryScopeOption {
-  /** Path glob (e.g. "/workspace/scratch/*") or the sentinel "everywhere". */
-  scope: string;
-  /** Human-readable label (e.g. "In scratch/"). */
-  label: string;
-}
-
-/**
- * The output of a risk classifier. Tool-agnostic — every classifier
- * (bash, file_write, web_fetch, etc.) produces this same shape.
- */
-export interface RiskAssessment {
-  /** Computed risk level. */
-  riskLevel: Risk;
-  /** Human-readable explanation of why this risk level was assigned. */
-  reason: string;
-  /** Scope options for the "save this classification" UI, narrowest to broadest. */
-  scopeOptions: ScopeOption[];
-  /** How the risk was determined. */
-  matchType: "user_rule" | "registry" | "unknown";
-  /**
-   * Allowlist options for the permission prompt "always allow" scope ladder.
-   * Populated by classifiers that unify risk classification and scope option
-   * generation. When present, `generateAllowlistOptions()` returns these
-   * directly instead of calling the per-tool strategy function.
-   */
-  allowlistOptions?: AllowlistOption[];
-  /**
-   * Directory scope options emitted by the gateway for filesystem operations.
-   * Mirrors `directoryScopeOptions` in the gateway's ClassificationResult.
-   * Present when the gateway's classifier identified one or more filesystem
-   * path arguments and generated a directory-scope ladder for them.
-   */
-  directoryScopeOptions?: DirectoryScopeOption[];
-  /**
-   * Fully resolved filesystem path arguments from the gateway classifier.
-   * Threaded into `findHighestPriorityRule` so directory-scoped trust rules
-   * match against actual target paths, not just the working directory.
-   */
-  resolvedPaths?: string[];
-}