@vigil-guard/vge-cc-guard 0.9.0-beta.1

package/dist/shared/config-schema.d.ts

@@ -0,0 +1,467 @@
+import { z } from 'zod';
+declare const toolPolicySchema: z.ZodObject<{
+    gate: z.ZodEnum<["allow", "block", "ask"]>;
+    analyze_output: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    gate: "allow" | "ask" | "block";
+    analyze_output: boolean;
+}, {
+    gate: "allow" | "ask" | "block";
+    analyze_output: boolean;
+}>;
+export type ToolPolicy = z.infer<typeof toolPolicySchema>;
+export declare const configSchema: z.ZodObject<{
+    version: z.ZodLiteral<"1.0.0">;
+    vge: z.ZodObject<{
+        api_url: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>;
+        client_id: z.ZodPipeline<z.ZodEffects<z.ZodDefault<z.ZodString>, string, string | undefined>, z.ZodString>;
+        client_id_source: z.ZodDefault<z.ZodEnum<["auto", "manual", "disabled"]>>;
+        api_key_input: z.ZodEffects<z.ZodString, string, string>;
+        api_key_output: z.ZodDefault<z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>>;
+        verified_at: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        verified_api_url: z.ZodDefault<z.ZodNullable<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>>>;
+        verified_input_key_fingerprint: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        verified_output_key_fingerprint: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        posttool_budget_ms: z.ZodDefault<z.ZodNumber>;
+        pretool_url_budget_ms: z.ZodDefault<z.ZodNumber>;
+        pretool_url_total_deadline_ms: z.ZodDefault<z.ZodNumber>;
+        userprompt_attachment_budget_ms: z.ZodDefault<z.ZodNumber>;
+        userprompt_text_budget_ms: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        api_url: string;
+        client_id: string;
+        client_id_source: "auto" | "manual" | "disabled";
+        api_key_input: string;
+        api_key_output: string | null;
+        verified_at: string | null;
+        verified_api_url: string | null;
+        verified_input_key_fingerprint: string | null;
+        verified_output_key_fingerprint: string | null;
+        posttool_budget_ms: number;
+        pretool_url_budget_ms: number;
+        pretool_url_total_deadline_ms: number;
+        userprompt_attachment_budget_ms: number;
+        userprompt_text_budget_ms: number;
+    }, {
+        api_url: string;
+        api_key_input: string;
+        client_id?: string | undefined;
+        client_id_source?: "auto" | "manual" | "disabled" | undefined;
+        api_key_output?: string | null | undefined;
+        verified_at?: string | null | undefined;
+        verified_api_url?: string | null | undefined;
+        verified_input_key_fingerprint?: string | null | undefined;
+        verified_output_key_fingerprint?: string | null | undefined;
+        posttool_budget_ms?: number | undefined;
+        pretool_url_budget_ms?: number | undefined;
+        pretool_url_total_deadline_ms?: number | undefined;
+        userprompt_attachment_budget_ms?: number | undefined;
+        userprompt_text_budget_ms?: number | undefined;
+    }>;
+    tools: z.ZodRecord<z.ZodString, z.ZodObject<{
+        gate: z.ZodEnum<["allow", "block", "ask"]>;
+        analyze_output: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        gate: "allow" | "ask" | "block";
+        analyze_output: boolean;
+    }, {
+        gate: "allow" | "ask" | "block";
+        analyze_output: boolean;
+    }>>;
+    policy: z.ZodObject<{
+        credential_protection: z.ZodDefault<z.ZodBoolean>;
+        prompt_text_analysis: z.ZodDefault<z.ZodEnum<["enforce", "off"]>>;
+        prompt_attachment_analysis: z.ZodDefault<z.ZodEnum<["enforce", "off"]>>;
+        subagent_output_analysis: z.ZodDefault<z.ZodEnum<["enforce", "off"]>>;
+        vge_failure_mode: z.ZodDefault<z.ZodObject<{
+            prompt_text: z.ZodDefault<z.ZodEnum<["fail_closed", "fail_open"]>>;
+            prompt_attachment: z.ZodDefault<z.ZodEnum<["fail_closed", "fail_open"]>>;
+            posttool_output: z.ZodDefault<z.ZodEnum<["fail_closed", "fail_open"]>>;
+        }, "strict", z.ZodTypeAny, {
+            posttool_output: "fail_closed" | "fail_open";
+            prompt_text: "fail_closed" | "fail_open";
+            prompt_attachment: "fail_closed" | "fail_open";
+        }, {
+            posttool_output?: "fail_closed" | "fail_open" | undefined;
+            prompt_text?: "fail_closed" | "fail_open" | undefined;
+            prompt_attachment?: "fail_closed" | "fail_open" | undefined;
+        }>>;
+        vge_overload_backpressure: z.ZodDefault<z.ZodObject<{
+            posttool_output: z.ZodDefault<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                base_cooldown_ms: z.ZodDefault<z.ZodNumber>;
+                max_cooldown_ms: z.ZodDefault<z.ZodNumber>;
+                half_open_jitter_min_ms: z.ZodDefault<z.ZodNumber>;
+                half_open_jitter_max_ms: z.ZodDefault<z.ZodNumber>;
+            }, "strict", z.ZodTypeAny, {
+                enabled: boolean;
+                base_cooldown_ms: number;
+                max_cooldown_ms: number;
+                half_open_jitter_min_ms: number;
+                half_open_jitter_max_ms: number;
+            }, {
+                enabled?: boolean | undefined;
+                base_cooldown_ms?: number | undefined;
+                max_cooldown_ms?: number | undefined;
+                half_open_jitter_min_ms?: number | undefined;
+                half_open_jitter_max_ms?: number | undefined;
+            }>, {
+                enabled: boolean;
+                base_cooldown_ms: number;
+                max_cooldown_ms: number;
+                half_open_jitter_min_ms: number;
+                half_open_jitter_max_ms: number;
+            }, {
+                enabled?: boolean | undefined;
+                base_cooldown_ms?: number | undefined;
+                max_cooldown_ms?: number | undefined;
+                half_open_jitter_min_ms?: number | undefined;
+                half_open_jitter_max_ms?: number | undefined;
+            }>, {
+                enabled: boolean;
+                base_cooldown_ms: number;
+                max_cooldown_ms: number;
+                half_open_jitter_min_ms: number;
+                half_open_jitter_max_ms: number;
+            }, {
+                enabled?: boolean | undefined;
+                base_cooldown_ms?: number | undefined;
+                max_cooldown_ms?: number | undefined;
+                half_open_jitter_min_ms?: number | undefined;
+                half_open_jitter_max_ms?: number | undefined;
+            }>>;
+        }, "strict", z.ZodTypeAny, {
+            posttool_output: {
+                enabled: boolean;
+                base_cooldown_ms: number;
+                max_cooldown_ms: number;
+                half_open_jitter_min_ms: number;
+                half_open_jitter_max_ms: number;
+            };
+        }, {
+            posttool_output?: {
+                enabled?: boolean | undefined;
+                base_cooldown_ms?: number | undefined;
+                max_cooldown_ms?: number | undefined;
+                half_open_jitter_min_ms?: number | undefined;
+                half_open_jitter_max_ms?: number | undefined;
+            } | undefined;
+        }>>;
+        cc_contract: z.ZodDefault<z.ZodObject<{
+            auto_probe_enabled: z.ZodDefault<z.ZodBoolean>;
+            auto_probe_timeout_ms: z.ZodDefault<z.ZodNumber>;
+        }, "strict", z.ZodTypeAny, {
+            auto_probe_enabled: boolean;
+            auto_probe_timeout_ms: number;
+        }, {
+            auto_probe_enabled?: boolean | undefined;
+            auto_probe_timeout_ms?: number | undefined;
+        }>>;
+        session_idle_ttl_hours: z.ZodDefault<z.ZodNumber>;
+        enable_l0_output_replacement: z.ZodDefault<z.ZodBoolean>;
+        url_allowlist: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, "many">>;
+        url_access_baseline: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            default_action: z.ZodDefault<z.ZodLiteral<"allow">>;
+            presets: z.ZodDefault<z.ZodObject<{
+                cloud_metadata: z.ZodDefault<z.ZodBoolean>;
+                unsafe_url_shapes: z.ZodDefault<z.ZodBoolean>;
+                oob_callback_collectors: z.ZodDefault<z.ZodBoolean>;
+                strict_internal_network: z.ZodDefault<z.ZodBoolean>;
+                public_paste_and_file_drops: z.ZodDefault<z.ZodBoolean>;
+            }, "strip", z.ZodTypeAny, {
+                cloud_metadata: boolean;
+                unsafe_url_shapes: boolean;
+                oob_callback_collectors: boolean;
+                strict_internal_network: boolean;
+                public_paste_and_file_drops: boolean;
+            }, {
+                cloud_metadata?: boolean | undefined;
+                unsafe_url_shapes?: boolean | undefined;
+                oob_callback_collectors?: boolean | undefined;
+                strict_internal_network?: boolean | undefined;
+                public_paste_and_file_drops?: boolean | undefined;
+            }>>;
+            custom_deny: z.ZodDefault<z.ZodObject<{
+                hosts: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, "many">>;
+                cidrs: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, "many">>;
+                schemes: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, "many">>;
+                url_patterns: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                hosts: string[];
+                cidrs: string[];
+                schemes: string[];
+                url_patterns: string[];
+            }, {
+                hosts?: string[] | undefined;
+                cidrs?: string[] | undefined;
+                schemes?: string[] | undefined;
+                url_patterns?: string[] | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            default_action: "allow";
+            presets: {
+                cloud_metadata: boolean;
+                unsafe_url_shapes: boolean;
+                oob_callback_collectors: boolean;
+                strict_internal_network: boolean;
+                public_paste_and_file_drops: boolean;
+            };
+            custom_deny: {
+                hosts: string[];
+                cidrs: string[];
+                schemes: string[];
+                url_patterns: string[];
+            };
+        }, {
+            enabled?: boolean | undefined;
+            default_action?: "allow" | undefined;
+            presets?: {
+                cloud_metadata?: boolean | undefined;
+                unsafe_url_shapes?: boolean | undefined;
+                oob_callback_collectors?: boolean | undefined;
+                strict_internal_network?: boolean | undefined;
+                public_paste_and_file_drops?: boolean | undefined;
+            } | undefined;
+            custom_deny?: {
+                hosts?: string[] | undefined;
+                cidrs?: string[] | undefined;
+                schemes?: string[] | undefined;
+                url_patterns?: string[] | undefined;
+            } | undefined;
+        }>>;
+        decision_timeout_ms: z.ZodDefault<z.ZodNumber>;
+        resolver_heartbeat_stale_ms: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        credential_protection: boolean;
+        prompt_text_analysis: "enforce" | "off";
+        prompt_attachment_analysis: "enforce" | "off";
+        subagent_output_analysis: "enforce" | "off";
+        vge_failure_mode: {
+            posttool_output: "fail_closed" | "fail_open";
+            prompt_text: "fail_closed" | "fail_open";
+            prompt_attachment: "fail_closed" | "fail_open";
+        };
+        vge_overload_backpressure: {
+            posttool_output: {
+                enabled: boolean;
+                base_cooldown_ms: number;
+                max_cooldown_ms: number;
+                half_open_jitter_min_ms: number;
+                half_open_jitter_max_ms: number;
+            };
+        };
+        cc_contract: {
+            auto_probe_enabled: boolean;
+            auto_probe_timeout_ms: number;
+        };
+        session_idle_ttl_hours: number;
+        enable_l0_output_replacement: boolean;
+        url_allowlist: string[];
+        url_access_baseline: {
+            enabled: boolean;
+            default_action: "allow";
+            presets: {
+                cloud_metadata: boolean;
+                unsafe_url_shapes: boolean;
+                oob_callback_collectors: boolean;
+                strict_internal_network: boolean;
+                public_paste_and_file_drops: boolean;
+            };
+            custom_deny: {
+                hosts: string[];
+                cidrs: string[];
+                schemes: string[];
+                url_patterns: string[];
+            };
+        };
+        decision_timeout_ms: number;
+        resolver_heartbeat_stale_ms: number;
+    }, {
+        credential_protection?: boolean | undefined;
+        prompt_text_analysis?: "enforce" | "off" | undefined;
+        prompt_attachment_analysis?: "enforce" | "off" | undefined;
+        subagent_output_analysis?: "enforce" | "off" | undefined;
+        vge_failure_mode?: {
+            posttool_output?: "fail_closed" | "fail_open" | undefined;
+            prompt_text?: "fail_closed" | "fail_open" | undefined;
+            prompt_attachment?: "fail_closed" | "fail_open" | undefined;
+        } | undefined;
+        vge_overload_backpressure?: {
+            posttool_output?: {
+                enabled?: boolean | undefined;
+                base_cooldown_ms?: number | undefined;
+                max_cooldown_ms?: number | undefined;
+                half_open_jitter_min_ms?: number | undefined;
+                half_open_jitter_max_ms?: number | undefined;
+            } | undefined;
+        } | undefined;
+        cc_contract?: {
+            auto_probe_enabled?: boolean | undefined;
+            auto_probe_timeout_ms?: number | undefined;
+        } | undefined;
+        session_idle_ttl_hours?: number | undefined;
+        enable_l0_output_replacement?: boolean | undefined;
+        url_allowlist?: string[] | undefined;
+        url_access_baseline?: {
+            enabled?: boolean | undefined;
+            default_action?: "allow" | undefined;
+            presets?: {
+                cloud_metadata?: boolean | undefined;
+                unsafe_url_shapes?: boolean | undefined;
+                oob_callback_collectors?: boolean | undefined;
+                strict_internal_network?: boolean | undefined;
+                public_paste_and_file_drops?: boolean | undefined;
+            } | undefined;
+            custom_deny?: {
+                hosts?: string[] | undefined;
+                cidrs?: string[] | undefined;
+                schemes?: string[] | undefined;
+                url_patterns?: string[] | undefined;
+            } | undefined;
+        } | undefined;
+        decision_timeout_ms?: number | undefined;
+        resolver_heartbeat_stale_ms?: number | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    vge: {
+        api_url: string;
+        client_id: string;
+        client_id_source: "auto" | "manual" | "disabled";
+        api_key_input: string;
+        api_key_output: string | null;
+        verified_at: string | null;
+        verified_api_url: string | null;
+        verified_input_key_fingerprint: string | null;
+        verified_output_key_fingerprint: string | null;
+        posttool_budget_ms: number;
+        pretool_url_budget_ms: number;
+        pretool_url_total_deadline_ms: number;
+        userprompt_attachment_budget_ms: number;
+        userprompt_text_budget_ms: number;
+    };
+    version: "1.0.0";
+    tools: Record<string, {
+        gate: "allow" | "ask" | "block";
+        analyze_output: boolean;
+    }>;
+    policy: {
+        credential_protection: boolean;
+        prompt_text_analysis: "enforce" | "off";
+        prompt_attachment_analysis: "enforce" | "off";
+        subagent_output_analysis: "enforce" | "off";
+        vge_failure_mode: {
+            posttool_output: "fail_closed" | "fail_open";
+            prompt_text: "fail_closed" | "fail_open";
+            prompt_attachment: "fail_closed" | "fail_open";
+        };
+        vge_overload_backpressure: {
+            posttool_output: {
+                enabled: boolean;
+                base_cooldown_ms: number;
+                max_cooldown_ms: number;
+                half_open_jitter_min_ms: number;
+                half_open_jitter_max_ms: number;
+            };
+        };
+        cc_contract: {
+            auto_probe_enabled: boolean;
+            auto_probe_timeout_ms: number;
+        };
+        session_idle_ttl_hours: number;
+        enable_l0_output_replacement: boolean;
+        url_allowlist: string[];
+        url_access_baseline: {
+            enabled: boolean;
+            default_action: "allow";
+            presets: {
+                cloud_metadata: boolean;
+                unsafe_url_shapes: boolean;
+                oob_callback_collectors: boolean;
+                strict_internal_network: boolean;
+                public_paste_and_file_drops: boolean;
+            };
+            custom_deny: {
+                hosts: string[];
+                cidrs: string[];
+                schemes: string[];
+                url_patterns: string[];
+            };
+        };
+        decision_timeout_ms: number;
+        resolver_heartbeat_stale_ms: number;
+    };
+}, {
+    vge: {
+        api_url: string;
+        api_key_input: string;
+        client_id?: string | undefined;
+        client_id_source?: "auto" | "manual" | "disabled" | undefined;
+        api_key_output?: string | null | undefined;
+        verified_at?: string | null | undefined;
+        verified_api_url?: string | null | undefined;
+        verified_input_key_fingerprint?: string | null | undefined;
+        verified_output_key_fingerprint?: string | null | undefined;
+        posttool_budget_ms?: number | undefined;
+        pretool_url_budget_ms?: number | undefined;
+        pretool_url_total_deadline_ms?: number | undefined;
+        userprompt_attachment_budget_ms?: number | undefined;
+        userprompt_text_budget_ms?: number | undefined;
+    };
+    version: "1.0.0";
+    tools: Record<string, {
+        gate: "allow" | "ask" | "block";
+        analyze_output: boolean;
+    }>;
+    policy: {
+        credential_protection?: boolean | undefined;
+        prompt_text_analysis?: "enforce" | "off" | undefined;
+        prompt_attachment_analysis?: "enforce" | "off" | undefined;
+        subagent_output_analysis?: "enforce" | "off" | undefined;
+        vge_failure_mode?: {
+            posttool_output?: "fail_closed" | "fail_open" | undefined;
+            prompt_text?: "fail_closed" | "fail_open" | undefined;
+            prompt_attachment?: "fail_closed" | "fail_open" | undefined;
+        } | undefined;
+        vge_overload_backpressure?: {
+            posttool_output?: {
+                enabled?: boolean | undefined;
+                base_cooldown_ms?: number | undefined;
+                max_cooldown_ms?: number | undefined;
+                half_open_jitter_min_ms?: number | undefined;
+                half_open_jitter_max_ms?: number | undefined;
+            } | undefined;
+        } | undefined;
+        cc_contract?: {
+            auto_probe_enabled?: boolean | undefined;
+            auto_probe_timeout_ms?: number | undefined;
+        } | undefined;
+        session_idle_ttl_hours?: number | undefined;
+        enable_l0_output_replacement?: boolean | undefined;
+        url_allowlist?: string[] | undefined;
+        url_access_baseline?: {
+            enabled?: boolean | undefined;
+            default_action?: "allow" | undefined;
+            presets?: {
+                cloud_metadata?: boolean | undefined;
+                unsafe_url_shapes?: boolean | undefined;
+                oob_callback_collectors?: boolean | undefined;
+                strict_internal_network?: boolean | undefined;
+                public_paste_and_file_drops?: boolean | undefined;
+            } | undefined;
+            custom_deny?: {
+                hosts?: string[] | undefined;
+                cidrs?: string[] | undefined;
+                schemes?: string[] | undefined;
+                url_patterns?: string[] | undefined;
+            } | undefined;
+        } | undefined;
+        decision_timeout_ms?: number | undefined;
+        resolver_heartbeat_stale_ms?: number | undefined;
+    };
+}>;
+export type Config = z.infer<typeof configSchema>;
+export declare const DEFAULT_CONFIG: Config;
+export {};
+//# sourceMappingURL=config-schema.d.ts.map

package/dist/shared/config-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-schema.d.ts","sourceRoot":"","sources":["../../src/shared/config-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB,QAAA,MAAM,gBAAgB;;;;;;;;;EAGpB,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AA6O1D,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKvB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,eAAO,MAAM,cAAc,EAAE,MAiE5B,CAAC"}