@vellumai/assistant 0.6.6 → 0.7.0

package/src/permissions/skill-risk-classifier.ts

@@ -1,214 +0,0 @@
-/**
- * Skill risk classifier — classifies skill tool invocations by risk level.
- *
- * Implements RiskClassifier<SkillClassifierInput> with constant risk levels
- * for each skill tool type:
- * - skill_load: Low (read-only skill loading)
- * - scaffold_managed_skill: High (writes persistent skill source code)
- * - delete_managed_skill: High (removes persistent skill source code)
- */
-
-import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
-import { getConfig } from "../config/loader.js";
-import { loadSkillCatalog, resolveSkillSelector } from "../config/skills.js";
-import { indexCatalogById } from "../skills/include-graph.js";
-import { computeTransitiveSkillVersionHash } from "../skills/transitive-version-hash.js";
-import { computeSkillVersionHash } from "../skills/version-hash.js";
-import type { RiskAssessment, RiskClassifier } from "./risk-types.js";
-import type { AllowlistOption } from "./types.js";
-
-// ── Input type ───────────────────────────────────────────────────────────────
-
-/** Input to the skill risk classifier. */
-export interface SkillClassifierInput {
-  /** Which skill tool is being invoked. */
-  toolName: "skill_load" | "scaffold_managed_skill" | "delete_managed_skill";
-  /** Optional skill selector (e.g. skill name or path). */
-  skillSelector?: string;
-}
-
-// ── Allowlist option helpers ─────────────────────────────────────────────────
-
-/**
- * Resolve a skill selector to its id and version hash. The version hash
- * is always computed from disk so that untrusted input cannot spoof a
- * pre-approved hash.
- */
-function resolveSkillIdAndHash(
-  selector: string,
-): { id: string; versionHash?: string } | null {
-  const resolved = resolveSkillSelector(selector);
-  if (!resolved.skill) return null;
-
-  try {
-    const hash = computeSkillVersionHash(resolved.skill.directoryPath);
-    return { id: resolved.skill.id, versionHash: hash };
-  } catch {
-    return { id: resolved.skill.id };
-  }
-}
-
-/**
- * Check whether a skill (by id) has parsed inline command expansions.
- */
-function hasInlineExpansions(skillId: string): boolean {
-  const catalog = loadSkillCatalog();
-  const skill = catalog.find((s) => s.id === skillId);
-  return (
-    skill?.inlineCommandExpansions != null &&
-    skill.inlineCommandExpansions.length > 0
-  );
-}
-
-/**
- * Compute the transitive version hash for a skill, returning `undefined`
- * when computation fails (missing includes, cycle, etc.).
- */
-function computeTransitiveHashSafe(skillId: string): string | undefined {
-  try {
-    const catalog = loadSkillCatalog();
-    const index = indexCatalogById(catalog);
-    return computeTransitiveSkillVersionHash(skillId, index);
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * Build allowlist options for a skill_load invocation, mirroring the logic
- * in checker.ts `skillLoadAllowlistStrategy()`.
- */
-function buildSkillLoadAllowlistOptions(
-  rawSelector?: string,
-): AllowlistOption[] {
-  if (!rawSelector) {
-    return [
-      {
-        label: "skill_load:*",
-        description: "All skill loads",
-        pattern: "skill_load:*",
-      },
-    ];
-  }
-
-  const resolved = resolveSkillIdAndHash(rawSelector);
-
-  // Check whether this is a dynamic (inline-command) skill load
-  const config = getConfig();
-  const inlineEnabled = isAssistantFeatureFlagEnabled(
-    "inline-skill-commands",
-    config,
-  );
-
-  if (resolved && inlineEnabled && hasInlineExpansions(resolved.id)) {
-    const transitiveHash = computeTransitiveHashSafe(resolved.id);
-    const options: AllowlistOption[] = [];
-    if (transitiveHash) {
-      options.push({
-        label: `${resolved.id}@${transitiveHash}`,
-        description: "This exact version (pinned)",
-        pattern: `skill_load_dynamic:${resolved.id}@${transitiveHash}`,
-      });
-    }
-    options.push({
-      label: resolved.id,
-      description: "This skill (any version)",
-      pattern: `skill_load_dynamic:${resolved.id}`,
-    });
-    return options;
-  }
-
-  if (resolved && resolved.versionHash) {
-    return [
-      {
-        label: `${resolved.id}@${resolved.versionHash}`,
-        description: "This exact version",
-        pattern: `skill_load:${resolved.id}@${resolved.versionHash}`,
-      },
-    ];
-  }
-  return [
-    {
-      label: rawSelector,
-      description: "This skill",
-      pattern: `skill_load:${rawSelector}`,
-    },
-  ];
-}
-
-/**
- * Build allowlist options for scaffold/delete managed skill tools,
- * mirroring the logic in checker.ts `managedSkillAllowlistStrategy()`.
- */
-function buildManagedSkillAllowlistOptions(
-  toolName: string,
-  skillId?: string,
-): AllowlistOption[] {
-  const toolLabel =
-    toolName === "scaffold_managed_skill" ? "scaffold" : "delete";
-  const options: AllowlistOption[] = [];
-  if (skillId) {
-    options.push({
-      label: skillId,
-      description: "This skill only",
-      pattern: `${toolName}:${skillId}`,
-    });
-  }
-  options.push({
-    label: `${toolName}:*`,
-    description: `All managed skill ${toolLabel}s`,
-    pattern: `${toolName}:*`,
-  });
-  return options;
-}
-
-// ── Classifier ───────────────────────────────────────────────────────────────
-
-/**
- * Skill risk classifier implementation.
- *
- * Classifies skill tool invocations with constant risk levels per tool type.
- * checker.ts delegates to the singleton `skillLoadRiskClassifier` instance
- * for all skill tool risk classification.
- */
-export class SkillLoadRiskClassifier implements RiskClassifier<SkillClassifierInput> {
-  async classify(input: SkillClassifierInput): Promise<RiskAssessment> {
-    const { toolName, skillSelector } = input;
-
-    switch (toolName) {
-      case "skill_load":
-        return {
-          riskLevel: "low",
-          reason: "Skill load (default)",
-          scopeOptions: [],
-          matchType: "registry",
-          allowlistOptions: buildSkillLoadAllowlistOptions(skillSelector),
-        };
-      case "scaffold_managed_skill":
-        return {
-          riskLevel: "high",
-          reason: "Skill scaffold — writes persistent skill source code",
-          scopeOptions: [],
-          matchType: "registry",
-          allowlistOptions: buildManagedSkillAllowlistOptions(
-            toolName,
-            skillSelector,
-          ),
-        };
-      case "delete_managed_skill":
-        return {
-          riskLevel: "high",
-          reason: "Skill delete — removes persistent skill source code",
-          scopeOptions: [],
-          matchType: "registry",
-          allowlistOptions: buildManagedSkillAllowlistOptions(
-            toolName,
-            skillSelector,
-          ),
-        };
-    }
-  }
-}
-
-/** Singleton classifier instance. */
-export const skillLoadRiskClassifier = new SkillLoadRiskClassifier();

package/src/permissions/trust-client.ts

@@ -1,359 +0,0 @@
-/**
- * HTTP client for the gateway's trust rule endpoints.
- *
- * Provides CRUD operations over trust rules stored in the gateway,
- * replacing direct filesystem access to trust.json when the assistant
- * runs in a containerized environment.
- *
- * Both async and synchronous variants are exported. The sync variants
- * use `Bun.spawnSync` + `curl` to make blocking HTTP calls — acceptable
- * for user-initiated write operations that are infrequent.
- *
- * All rule-returning endpoints parse response payloads through the shared
- * `parseTrustRule` canonical parser so the client never returns unparsed
- * or untyped raw rule objects.
- */
-
-import type { TrustRule } from "@vellumai/ces-contracts";
-import { parseTrustRule } from "@vellumai/ces-contracts";
-
-import { getGatewayInternalBaseUrl } from "../config/env.js";
-import { mintEdgeRelayToken } from "../runtime/auth/token-service.js";
-import { getLogger } from "../util/logger.js";
-
-const log = getLogger("trust-client");
-
-const REQUEST_TIMEOUT_MS = 10_000;
-
-// ---------------------------------------------------------------------------
-// Result types (not in ces-contracts — local to the client)
-// ---------------------------------------------------------------------------
-
-export interface AcceptStarterBundleResult {
-  accepted: boolean;
-  rulesAdded: number;
-}
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-function authHeaders(): Record<string, string> {
-  return {
-    Authorization: `Bearer ${mintEdgeRelayToken()}`,
-    "Content-Type": "application/json",
-  };
-}
-
-/**
- * Execute a fetch request with standard timeout and error handling.
- * Throws a descriptive error on non-OK responses or network failures.
- */
-async function request<T>(
-  method: string,
-  path: string,
-  body?: unknown,
-): Promise<T> {
-  const url = `${getGatewayInternalBaseUrl()}${path}`;
-  const options: RequestInit = {
-    method,
-    headers: authHeaders(),
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-  };
-  if (body !== undefined) {
-    options.body = JSON.stringify(body);
-  }
-
-  let response: Response;
-  try {
-    response = await fetch(url, options);
-  } catch (err) {
-    log.error({ err, method, path }, "Trust rule request failed (network)");
-    throw new Error(
-      `Trust rule request failed: ${method} ${path}: ${err instanceof Error ? err.message : String(err)}`,
-    );
-  }
-
-  if (!response.ok) {
-    const text = await response.text().catch(() => "<unreadable>");
-    log.error(
-      { status: response.status, body: text, method, path },
-      "Trust rule request failed",
-    );
-    throw new Error(
-      `Trust rule request failed (${response.status}): ${method} ${path}: ${text}`,
-    );
-  }
-
-  return (await response.json()) as T;
-}
-
-/**
- * Synchronous HTTP request via `Bun.spawnSync` + `curl`.
- *
- * Used by the gateway trust store adapter for write operations that must
- * return synchronously to satisfy the `TrustStoreBackend` interface.
- * Write operations are user-initiated and infrequent, so blocking is acceptable.
- */
-function requestSync<T>(method: string, path: string, body?: unknown): T {
-  const url = `${getGatewayInternalBaseUrl()}${path}`;
-  const headers = authHeaders();
-  const args: string[] = [
-    "curl",
-    "-s",
-    "-S",
-    "-X",
-    method,
-    "--max-time",
-    String(Math.ceil(REQUEST_TIMEOUT_MS / 1000)),
-    "-H",
-    `Authorization: ${headers.Authorization}`,
-    "-H",
-    "Content-Type: application/json",
-    "-w",
-    "\n%{http_code}",
-  ];
-  if (body !== undefined) {
-    args.push("-d", JSON.stringify(body));
-  }
-  args.push(url);
-
-  const proc = Bun.spawnSync(args, {
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-
-  if (proc.exitCode !== 0) {
-    const stderr = proc.stderr.toString().trim();
-    log.error(
-      { exitCode: proc.exitCode, stderr, method, path },
-      "Trust rule sync request failed (curl)",
-    );
-    throw new Error(
-      `Trust rule sync request failed: ${method} ${path}: curl exit ${proc.exitCode}: ${stderr}`,
-    );
-  }
-
-  const output = proc.stdout.toString().trim();
-  // curl -w "\n%{http_code}" appends the HTTP status code on the last line
-  const lastNewline = output.lastIndexOf("\n");
-  const responseBody = lastNewline >= 0 ? output.slice(0, lastNewline) : "";
-  const statusCode = parseInt(
-    lastNewline >= 0 ? output.slice(lastNewline + 1) : output,
-    10,
-  );
-
-  if (statusCode < 200 || statusCode >= 300) {
-    log.error(
-      { status: statusCode, body: responseBody, method, path },
-      "Trust rule sync request failed",
-    );
-    throw new Error(
-      `Trust rule sync request failed (${statusCode}): ${method} ${path}: ${responseBody}`,
-    );
-  }
-
-  if (!responseBody) {
-    return {} as T;
-  }
-
-  try {
-    return JSON.parse(responseBody) as T;
-  } catch (err) {
-    log.error(
-      { err, responseBody, method, path },
-      "Failed to parse sync response JSON",
-    );
-    throw new Error(
-      `Trust rule sync request: failed to parse response: ${method} ${path}`,
-    );
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Response parsing helpers
-// ---------------------------------------------------------------------------
-
-/**
- * Parse a raw rule object from a gateway response through the shared
- * canonical parser. Ensures the trust client never returns unparsed or
- * untyped rule objects, regardless of what the gateway sends back.
- */
-function parseRuleResponse(raw: unknown): TrustRule {
-  if (raw == null || typeof raw !== "object" || Array.isArray(raw)) {
-    throw new Error("Trust rule response is not a valid object");
-  }
-  const { rule } = parseTrustRule(raw as Record<string, unknown>);
-  return rule as TrustRule;
-}
-
-/**
- * Parse an array of raw rule objects from a gateway response.
- */
-function parseRulesResponse(raw: unknown[]): TrustRule[] {
-  return raw.map((r) => parseRuleResponse(r));
-}
-
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-
-/** Fetch all trust rules from the gateway. */
-export async function getAllRules(): Promise<TrustRule[]> {
-  const data = await request<{ rules: unknown[] }>("GET", "/v1/trust-rules");
-  return parseRulesResponse(data.rules);
-}
-
-/** Create a new trust rule. */
-export async function addRule(params: {
-  tool: string;
-  pattern: string;
-  scope?: string;
-  decision?: TrustRule["decision"];
-  priority?: number;
-  executionTarget?: string;
-}): Promise<TrustRule> {
-  // Only include scope in the request body if provided.
-  const { scope, ...rest } = params;
-  const body = scope != null ? { ...rest, scope } : rest;
-  const data = await request<{ rule: unknown }>(
-    "POST",
-    "/v1/trust-rules",
-    body,
-  );
-  return parseRuleResponse(data.rule);
-}
-
-/** Update an existing trust rule by ID. */
-export async function updateRule(
-  id: string,
-  updates: {
-    tool?: string;
-    pattern?: string;
-    scope?: string;
-    decision?: TrustRule["decision"];
-    priority?: number;
-    executionTarget?: string;
-  },
-): Promise<TrustRule> {
-  const data = await request<{ rule: unknown }>(
-    "PATCH",
-    `/v1/trust-rules/${encodeURIComponent(id)}`,
-    updates,
-  );
-  return parseRuleResponse(data.rule);
-}
-
-/** Remove a trust rule by ID. Returns true if the rule was found and deleted. */
-export async function removeRule(id: string): Promise<boolean> {
-  const data = await request<{ success: boolean }>(
-    "DELETE",
-    `/v1/trust-rules/${encodeURIComponent(id)}`,
-  );
-  return data.success;
-}
-
-/** Clear all user trust rules (default rules are preserved by the gateway). */
-export async function clearRules(): Promise<void> {
-  await request<{ success: boolean }>("POST", "/v1/trust-rules/clear");
-}
-
-/**
- * Find the highest-priority matching rule for a tool invocation.
- *
- * @param tool      Tool name (e.g. "host_bash")
- * @param candidates  Command candidates to match against rule patterns
- * @param scope     Working directory scope
- */
-export async function findMatchingRule(
-  tool: string,
-  candidates: string[],
-  scope: string,
-): Promise<TrustRule | null> {
-  const params = new URLSearchParams({
-    tool,
-    commands: candidates.join(","),
-    scope,
-  });
-  const data = await request<{ rule: unknown | null }>(
-    "GET",
-    `/v1/trust-rules/match?${params.toString()}`,
-  );
-  return data.rule != null ? parseRuleResponse(data.rule) : null;
-}
-
-/** Accept the starter approval bundle, seeding common low-risk allow rules. */
-export async function acceptStarterBundle(): Promise<AcceptStarterBundleResult> {
-  return request<AcceptStarterBundleResult>(
-    "POST",
-    "/v1/trust-rules/starter-bundle",
-  );
-}
-
-// ---------------------------------------------------------------------------
-// Synchronous API — used by the gateway trust store adapter
-// ---------------------------------------------------------------------------
-
-/** Fetch all trust rules from the gateway (synchronous). */
-export function getAllRulesSync(): TrustRule[] {
-  const data = requestSync<{ rules: unknown[] }>("GET", "/v1/trust-rules");
-  return parseRulesResponse(data.rules);
-}
-
-/** Create a new trust rule (synchronous). */
-export function addRuleSync(params: {
-  tool: string;
-  pattern: string;
-  scope?: string;
-  decision?: TrustRule["decision"];
-  priority?: number;
-  executionTarget?: string;
-}): TrustRule {
-  // Only include scope in the request body if provided.
-  const { scope, ...rest } = params;
-  const body = scope != null ? { ...rest, scope } : rest;
-  const data = requestSync<{ rule: unknown }>("POST", "/v1/trust-rules", body);
-  return parseRuleResponse(data.rule);
-}
-
-/** Update an existing trust rule by ID (synchronous). */
-export function updateRuleSync(
-  id: string,
-  updates: {
-    tool?: string;
-    pattern?: string;
-    scope?: string;
-    decision?: TrustRule["decision"];
-    priority?: number;
-    executionTarget?: string;
-  },
-): TrustRule {
-  const data = requestSync<{ rule: unknown }>(
-    "PATCH",
-    `/v1/trust-rules/${encodeURIComponent(id)}`,
-    updates,
-  );
-  return parseRuleResponse(data.rule);
-}
-
-/** Remove a trust rule by ID (synchronous). Returns true if deleted. */
-export function removeRuleSync(id: string): boolean {
-  const data = requestSync<{ success: boolean }>(
-    "DELETE",
-    `/v1/trust-rules/${encodeURIComponent(id)}`,
-  );
-  return data.success;
-}
-
-/** Clear all user trust rules (synchronous). */
-export function clearRulesSync(): void {
-  requestSync<{ success: boolean }>("POST", "/v1/trust-rules/clear");
-}
-
-/** Accept the starter approval bundle (synchronous). */
-export function acceptStarterBundleSync(): AcceptStarterBundleResult {
-  return requestSync<AcceptStarterBundleResult>(
-    "POST",
-    "/v1/trust-rules/starter-bundle",
-  );
-}

package/src/permissions/trust-store-interface.ts

@@ -1,100 +0,0 @@
-import type { PolicyContext, TrustRule } from "./types.js";
-
-export interface StarterBundleRule {
-  id: string;
-  tool: string;
-  pattern: string;
-  scope: string;
-  decision: "allow";
-  priority: number;
-}
-
-export interface AcceptStarterBundleResult {
-  accepted: boolean;
-  rulesAdded: number;
-  alreadyAccepted: boolean;
-}
-
-/**
- * Backend interface for trust rule storage and retrieval.
- *
- * The file-based implementation reads/writes `~/.vellum/protected/trust.json`.
- * A future gateway-backed implementation will proxy these operations through
- * the gateway HTTP API for containerized deployments.
- */
-export interface TrustStoreBackend {
-  /** Return a copy of all trust rules (file-based rules + defaults). */
-  getAllRules(): TrustRule[];
-
-  /**
-   * Find the highest-priority rule that matches any of the command candidates.
-   * Rules are pre-sorted by priority descending, so the first match wins.
-   */
-  findHighestPriorityRule(
-    tool: string,
-    commands: string[],
-    scope: string,
-    ctx?: PolicyContext,
-  ): TrustRule | null;
-
-  /** Find the first matching allow rule for a tool/command/scope. */
-  findMatchingRule(
-    tool: string,
-    command: string,
-    scope: string,
-  ): TrustRule | null;
-
-  /** Find the first matching deny rule for a tool/command/scope. */
-  findDenyRule(tool: string, command: string, scope: string): TrustRule | null;
-
-  /** Add a new trust rule and persist it. */
-  addRule(
-    tool: string,
-    pattern: string,
-    scope: string,
-    decision?: "allow" | "deny" | "ask",
-    priority?: number,
-    options?: {
-      executionTarget?: string;
-    },
-  ): TrustRule;
-
-  /** Update an existing trust rule by ID and persist it. */
-  updateRule(
-    id: string,
-    updates: {
-      tool?: string;
-      pattern?: string;
-      scope?: string;
-      decision?: "allow" | "deny" | "ask";
-      priority?: number;
-    },
-  ): TrustRule;
-
-  /** Remove a trust rule by ID. Returns true if the rule existed. */
-  removeRule(id: string): boolean;
-
-  /** Clear all user-created rules (default rules are re-backfilled). */
-  clearAllRules(): void;
-
-  /** Accept the starter approval bundle, seeding low-risk allow rules. */
-  acceptStarterBundle(): AcceptStarterBundleResult;
-
-  /** Whether the user has previously accepted the starter bundle. */
-  isStarterBundleAccepted(): boolean;
-
-  /** Register a callback to be invoked whenever trust rules change. */
-  onRulesChanged(listener: () => void): void;
-
-  /** Invalidate in-memory caches, forcing a re-read from the backing store. */
-  clearCache(): void;
-
-  /**
-   * Check whether a minimatch pattern matches a candidate string.
-   * Reuses the compiled pattern cache from trust rule evaluation.
-   */
-  patternMatchesCandidate(pattern: string, candidate: string): boolean;
-
-  /** Returns the starter bundle rule definitions. */
-  getStarterBundleRules(): StarterBundleRule[];
-}