@vigil-guard/vge-cc-guard 0.9.0-beta.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (527) hide show
  1. package/LICENSE.md +37 -0
  2. package/README.md +441 -0
  3. package/dist/cli.d.ts +3 -0
  4. package/dist/cli.d.ts.map +1 -0
  5. package/dist/cli.js +61 -0
  6. package/dist/cli.js.map +1 -0
  7. package/dist/commands/_lib/install-paths.d.ts +16 -0
  8. package/dist/commands/_lib/install-paths.d.ts.map +1 -0
  9. package/dist/commands/_lib/install-paths.js +46 -0
  10. package/dist/commands/_lib/install-paths.js.map +1 -0
  11. package/dist/commands/_lib/parse-install-flags.d.ts +8 -0
  12. package/dist/commands/_lib/parse-install-flags.d.ts.map +1 -0
  13. package/dist/commands/_lib/parse-install-flags.js +15 -0
  14. package/dist/commands/_lib/parse-install-flags.js.map +1 -0
  15. package/dist/commands/config.d.ts +2 -0
  16. package/dist/commands/config.d.ts.map +1 -0
  17. package/dist/commands/config.js +41 -0
  18. package/dist/commands/config.js.map +1 -0
  19. package/dist/commands/daemon.d.ts +2 -0
  20. package/dist/commands/daemon.d.ts.map +1 -0
  21. package/dist/commands/daemon.js +116 -0
  22. package/dist/commands/daemon.js.map +1 -0
  23. package/dist/commands/doctor.d.ts +2 -0
  24. package/dist/commands/doctor.d.ts.map +1 -0
  25. package/dist/commands/doctor.js +53 -0
  26. package/dist/commands/doctor.js.map +1 -0
  27. package/dist/commands/install-wizard.d.ts +2 -0
  28. package/dist/commands/install-wizard.d.ts.map +1 -0
  29. package/dist/commands/install-wizard.js +85 -0
  30. package/dist/commands/install-wizard.js.map +1 -0
  31. package/dist/commands/install.d.ts +15 -0
  32. package/dist/commands/install.d.ts.map +1 -0
  33. package/dist/commands/install.js +136 -0
  34. package/dist/commands/install.js.map +1 -0
  35. package/dist/commands/reset-session.d.ts +2 -0
  36. package/dist/commands/reset-session.d.ts.map +1 -0
  37. package/dist/commands/reset-session.js +113 -0
  38. package/dist/commands/reset-session.js.map +1 -0
  39. package/dist/commands/uninstall.d.ts +2 -0
  40. package/dist/commands/uninstall.d.ts.map +1 -0
  41. package/dist/commands/uninstall.js +277 -0
  42. package/dist/commands/uninstall.js.map +1 -0
  43. package/dist/daemon/active-conversation-decisions.d.ts +9 -0
  44. package/dist/daemon/active-conversation-decisions.d.ts.map +1 -0
  45. package/dist/daemon/active-conversation-decisions.js +58 -0
  46. package/dist/daemon/active-conversation-decisions.js.map +1 -0
  47. package/dist/daemon/allowlist.d.ts +2 -0
  48. package/dist/daemon/allowlist.d.ts.map +1 -0
  49. package/dist/daemon/allowlist.js +118 -0
  50. package/dist/daemon/allowlist.js.map +1 -0
  51. package/dist/daemon/analysis-source.d.ts +17 -0
  52. package/dist/daemon/analysis-source.d.ts.map +1 -0
  53. package/dist/daemon/analysis-source.js +114 -0
  54. package/dist/daemon/analysis-source.js.map +1 -0
  55. package/dist/daemon/ask-dialog.d.ts +23 -0
  56. package/dist/daemon/ask-dialog.d.ts.map +1 -0
  57. package/dist/daemon/ask-dialog.js +114 -0
  58. package/dist/daemon/ask-dialog.js.map +1 -0
  59. package/dist/daemon/attachment-decision-escrow.d.ts +27 -0
  60. package/dist/daemon/attachment-decision-escrow.d.ts.map +1 -0
  61. package/dist/daemon/attachment-decision-escrow.js +34 -0
  62. package/dist/daemon/attachment-decision-escrow.js.map +1 -0
  63. package/dist/daemon/attachment-input-enforcement.d.ts +11 -0
  64. package/dist/daemon/attachment-input-enforcement.d.ts.map +1 -0
  65. package/dist/daemon/attachment-input-enforcement.js +434 -0
  66. package/dist/daemon/attachment-input-enforcement.js.map +1 -0
  67. package/dist/daemon/audit-decisions.d.ts +51 -0
  68. package/dist/daemon/audit-decisions.d.ts.map +1 -0
  69. package/dist/daemon/audit-decisions.js +178 -0
  70. package/dist/daemon/audit-decisions.js.map +1 -0
  71. package/dist/daemon/audit-logger.d.ts +6 -0
  72. package/dist/daemon/audit-logger.d.ts.map +1 -0
  73. package/dist/daemon/audit-logger.js +6 -0
  74. package/dist/daemon/audit-logger.js.map +1 -0
  75. package/dist/daemon/audit-posttool.d.ts +123 -0
  76. package/dist/daemon/audit-posttool.d.ts.map +1 -0
  77. package/dist/daemon/audit-posttool.js +173 -0
  78. package/dist/daemon/audit-posttool.js.map +1 -0
  79. package/dist/daemon/audit-pretool.d.ts +56 -0
  80. package/dist/daemon/audit-pretool.d.ts.map +1 -0
  81. package/dist/daemon/audit-pretool.js +77 -0
  82. package/dist/daemon/audit-pretool.js.map +1 -0
  83. package/dist/daemon/audit-userprompt.d.ts +113 -0
  84. package/dist/daemon/audit-userprompt.d.ts.map +1 -0
  85. package/dist/daemon/audit-userprompt.js +162 -0
  86. package/dist/daemon/audit-userprompt.js.map +1 -0
  87. package/dist/daemon/blocking-decision-triggers.d.ts +5 -0
  88. package/dist/daemon/blocking-decision-triggers.d.ts.map +1 -0
  89. package/dist/daemon/blocking-decision-triggers.js +40 -0
  90. package/dist/daemon/blocking-decision-triggers.js.map +1 -0
  91. package/dist/daemon/cc-contract-auto-probe.d.ts +40 -0
  92. package/dist/daemon/cc-contract-auto-probe.d.ts.map +1 -0
  93. package/dist/daemon/cc-contract-auto-probe.js +101 -0
  94. package/dist/daemon/cc-contract-auto-probe.js.map +1 -0
  95. package/dist/daemon/cc-contract-probe.d.ts +46 -0
  96. package/dist/daemon/cc-contract-probe.d.ts.map +1 -0
  97. package/dist/daemon/cc-contract-probe.js +138 -0
  98. package/dist/daemon/cc-contract-probe.js.map +1 -0
  99. package/dist/daemon/cc-contract-runtime.d.ts +8 -0
  100. package/dist/daemon/cc-contract-runtime.d.ts.map +1 -0
  101. package/dist/daemon/cc-contract-runtime.js +42 -0
  102. package/dist/daemon/cc-contract-runtime.js.map +1 -0
  103. package/dist/daemon/cc-contract-status.d.ts +40 -0
  104. package/dist/daemon/cc-contract-status.d.ts.map +1 -0
  105. package/dist/daemon/cc-contract-status.js +242 -0
  106. package/dist/daemon/cc-contract-status.js.map +1 -0
  107. package/dist/daemon/confidence-router.d.ts +3 -0
  108. package/dist/daemon/confidence-router.d.ts.map +1 -0
  109. package/dist/daemon/confidence-router.js +34 -0
  110. package/dist/daemon/confidence-router.js.map +1 -0
  111. package/dist/daemon/conversation-context.d.ts +28 -0
  112. package/dist/daemon/conversation-context.d.ts.map +1 -0
  113. package/dist/daemon/conversation-context.js +271 -0
  114. package/dist/daemon/conversation-context.js.map +1 -0
  115. package/dist/daemon/conversation-decision-cleanup.d.ts +2 -0
  116. package/dist/daemon/conversation-decision-cleanup.d.ts.map +1 -0
  117. package/dist/daemon/conversation-decision-cleanup.js +22 -0
  118. package/dist/daemon/conversation-decision-cleanup.js.map +1 -0
  119. package/dist/daemon/conversation-decision-escrow.d.ts +20 -0
  120. package/dist/daemon/conversation-decision-escrow.d.ts.map +1 -0
  121. package/dist/daemon/conversation-decision-escrow.js +78 -0
  122. package/dist/daemon/conversation-decision-escrow.js.map +1 -0
  123. package/dist/daemon/conversation-decision-prompt.d.ts +30 -0
  124. package/dist/daemon/conversation-decision-prompt.d.ts.map +1 -0
  125. package/dist/daemon/conversation-decision-prompt.js +250 -0
  126. package/dist/daemon/conversation-decision-prompt.js.map +1 -0
  127. package/dist/daemon/daemon-instance.d.ts +27 -0
  128. package/dist/daemon/daemon-instance.d.ts.map +1 -0
  129. package/dist/daemon/daemon-instance.js +41 -0
  130. package/dist/daemon/daemon-instance.js.map +1 -0
  131. package/dist/daemon/daemon-ipc.d.ts +29 -0
  132. package/dist/daemon/daemon-ipc.d.ts.map +1 -0
  133. package/dist/daemon/daemon-ipc.js +82 -0
  134. package/dist/daemon/daemon-ipc.js.map +1 -0
  135. package/dist/daemon/daemon-supersede.d.ts +3 -0
  136. package/dist/daemon/daemon-supersede.d.ts.map +1 -0
  137. package/dist/daemon/daemon-supersede.js +126 -0
  138. package/dist/daemon/daemon-supersede.js.map +1 -0
  139. package/dist/daemon/debug-logger.d.ts +5 -0
  140. package/dist/daemon/debug-logger.d.ts.map +1 -0
  141. package/dist/daemon/debug-logger.js +247 -0
  142. package/dist/daemon/debug-logger.js.map +1 -0
  143. package/dist/daemon/decision-broker.d.ts +58 -0
  144. package/dist/daemon/decision-broker.d.ts.map +1 -0
  145. package/dist/daemon/decision-broker.js +340 -0
  146. package/dist/daemon/decision-broker.js.map +1 -0
  147. package/dist/daemon/decision-metrics.d.ts +40 -0
  148. package/dist/daemon/decision-metrics.d.ts.map +1 -0
  149. package/dist/daemon/decision-metrics.js +116 -0
  150. package/dist/daemon/decision-metrics.js.map +1 -0
  151. package/dist/daemon/decision-owner.d.ts +10 -0
  152. package/dist/daemon/decision-owner.d.ts.map +1 -0
  153. package/dist/daemon/decision-owner.js +30 -0
  154. package/dist/daemon/decision-owner.js.map +1 -0
  155. package/dist/daemon/decision-routes.d.ts +7 -0
  156. package/dist/daemon/decision-routes.d.ts.map +1 -0
  157. package/dist/daemon/decision-routes.js +104 -0
  158. package/dist/daemon/decision-routes.js.map +1 -0
  159. package/dist/daemon/decision-timeout.d.ts +3 -0
  160. package/dist/daemon/decision-timeout.d.ts.map +1 -0
  161. package/dist/daemon/decision-timeout.js +5 -0
  162. package/dist/daemon/decision-timeout.js.map +1 -0
  163. package/dist/daemon/decision-transition.d.ts +12 -0
  164. package/dist/daemon/decision-transition.d.ts.map +1 -0
  165. package/dist/daemon/decision-transition.js +8 -0
  166. package/dist/daemon/decision-transition.js.map +1 -0
  167. package/dist/daemon/http-server.d.ts +4 -0
  168. package/dist/daemon/http-server.d.ts.map +1 -0
  169. package/dist/daemon/http-server.js +535 -0
  170. package/dist/daemon/http-server.js.map +1 -0
  171. package/dist/daemon/id-validation.d.ts +2 -0
  172. package/dist/daemon/id-validation.d.ts.map +1 -0
  173. package/dist/daemon/id-validation.js +5 -0
  174. package/dist/daemon/id-validation.js.map +1 -0
  175. package/dist/daemon/path-deny.d.ts +14 -0
  176. package/dist/daemon/path-deny.d.ts.map +1 -0
  177. package/dist/daemon/path-deny.js +88 -0
  178. package/dist/daemon/path-deny.js.map +1 -0
  179. package/dist/daemon/posttool-decision-escrow.d.ts +42 -0
  180. package/dist/daemon/posttool-decision-escrow.d.ts.map +1 -0
  181. package/dist/daemon/posttool-decision-escrow.js +349 -0
  182. package/dist/daemon/posttool-decision-escrow.js.map +1 -0
  183. package/dist/daemon/posttool-decision-state.d.ts +65 -0
  184. package/dist/daemon/posttool-decision-state.d.ts.map +1 -0
  185. package/dist/daemon/posttool-decision-state.js +223 -0
  186. package/dist/daemon/posttool-decision-state.js.map +1 -0
  187. package/dist/daemon/posttool-enforcement.d.ts +7 -0
  188. package/dist/daemon/posttool-enforcement.d.ts.map +1 -0
  189. package/dist/daemon/posttool-enforcement.js +511 -0
  190. package/dist/daemon/posttool-enforcement.js.map +1 -0
  191. package/dist/daemon/posttool-render.d.ts +48 -0
  192. package/dist/daemon/posttool-render.d.ts.map +1 -0
  193. package/dist/daemon/posttool-render.js +335 -0
  194. package/dist/daemon/posttool-render.js.map +1 -0
  195. package/dist/daemon/pretool-decision-escrow.d.ts +51 -0
  196. package/dist/daemon/pretool-decision-escrow.d.ts.map +1 -0
  197. package/dist/daemon/pretool-decision-escrow.js +295 -0
  198. package/dist/daemon/pretool-decision-escrow.js.map +1 -0
  199. package/dist/daemon/pretool-url-gate.d.ts +17 -0
  200. package/dist/daemon/pretool-url-gate.d.ts.map +1 -0
  201. package/dist/daemon/pretool-url-gate.js +60 -0
  202. package/dist/daemon/pretool-url-gate.js.map +1 -0
  203. package/dist/daemon/prompt-input-enforcement.d.ts +18 -0
  204. package/dist/daemon/prompt-input-enforcement.d.ts.map +1 -0
  205. package/dist/daemon/prompt-input-enforcement.js +248 -0
  206. package/dist/daemon/prompt-input-enforcement.js.map +1 -0
  207. package/dist/daemon/reply-parser.d.ts +10 -0
  208. package/dist/daemon/reply-parser.d.ts.map +1 -0
  209. package/dist/daemon/reply-parser.js +81 -0
  210. package/dist/daemon/reply-parser.js.map +1 -0
  211. package/dist/daemon/resolve-escalation-route.d.ts +5 -0
  212. package/dist/daemon/resolve-escalation-route.d.ts.map +1 -0
  213. package/dist/daemon/resolve-escalation-route.js +85 -0
  214. package/dist/daemon/resolve-escalation-route.js.map +1 -0
  215. package/dist/daemon/response-cache.d.ts +14 -0
  216. package/dist/daemon/response-cache.d.ts.map +1 -0
  217. package/dist/daemon/response-cache.js +38 -0
  218. package/dist/daemon/response-cache.js.map +1 -0
  219. package/dist/daemon/security-frame.d.ts +14 -0
  220. package/dist/daemon/security-frame.d.ts.map +1 -0
  221. package/dist/daemon/security-frame.js +96 -0
  222. package/dist/daemon/security-frame.js.map +1 -0
  223. package/dist/daemon/session-hook-routes.d.ts +3 -0
  224. package/dist/daemon/session-hook-routes.d.ts.map +1 -0
  225. package/dist/daemon/session-hook-routes.js +66 -0
  226. package/dist/daemon/session-hook-routes.js.map +1 -0
  227. package/dist/daemon/session-state.d.ts +52 -0
  228. package/dist/daemon/session-state.d.ts.map +1 -0
  229. package/dist/daemon/session-state.js +495 -0
  230. package/dist/daemon/session-state.js.map +1 -0
  231. package/dist/daemon/subagent-lifecycle.d.ts +8 -0
  232. package/dist/daemon/subagent-lifecycle.d.ts.map +1 -0
  233. package/dist/daemon/subagent-lifecycle.js +56 -0
  234. package/dist/daemon/subagent-lifecycle.js.map +1 -0
  235. package/dist/daemon/tool-output-redactor.d.ts +13 -0
  236. package/dist/daemon/tool-output-redactor.d.ts.map +1 -0
  237. package/dist/daemon/tool-output-redactor.js +82 -0
  238. package/dist/daemon/tool-output-redactor.js.map +1 -0
  239. package/dist/daemon/tool-policy.d.ts +16 -0
  240. package/dist/daemon/tool-policy.d.ts.map +1 -0
  241. package/dist/daemon/tool-policy.js +60 -0
  242. package/dist/daemon/tool-policy.js.map +1 -0
  243. package/dist/daemon/tool-response-normalizer.d.ts +11 -0
  244. package/dist/daemon/tool-response-normalizer.d.ts.map +1 -0
  245. package/dist/daemon/tool-response-normalizer.js +67 -0
  246. package/dist/daemon/tool-response-normalizer.js.map +1 -0
  247. package/dist/daemon/truncate.d.ts +3 -0
  248. package/dist/daemon/truncate.d.ts.map +1 -0
  249. package/dist/daemon/truncate.js +22 -0
  250. package/dist/daemon/truncate.js.map +1 -0
  251. package/dist/daemon/url-access-baseline.d.ts +46 -0
  252. package/dist/daemon/url-access-baseline.d.ts.map +1 -0
  253. package/dist/daemon/url-access-baseline.js +154 -0
  254. package/dist/daemon/url-access-baseline.js.map +1 -0
  255. package/dist/daemon/url-block-decisions.d.ts +27 -0
  256. package/dist/daemon/url-block-decisions.d.ts.map +1 -0
  257. package/dist/daemon/url-block-decisions.js +100 -0
  258. package/dist/daemon/url-block-decisions.js.map +1 -0
  259. package/dist/daemon/url-extractor.d.ts +7 -0
  260. package/dist/daemon/url-extractor.d.ts.map +1 -0
  261. package/dist/daemon/url-extractor.js +101 -0
  262. package/dist/daemon/url-extractor.js.map +1 -0
  263. package/dist/daemon/userprompt-decision-escrow.d.ts +45 -0
  264. package/dist/daemon/userprompt-decision-escrow.d.ts.map +1 -0
  265. package/dist/daemon/userprompt-decision-escrow.js +248 -0
  266. package/dist/daemon/userprompt-decision-escrow.js.map +1 -0
  267. package/dist/daemon/vge-client.d.ts +64 -0
  268. package/dist/daemon/vge-client.d.ts.map +1 -0
  269. package/dist/daemon/vge-client.js +453 -0
  270. package/dist/daemon/vge-client.js.map +1 -0
  271. package/dist/daemon/vge-connectivity.d.ts +27 -0
  272. package/dist/daemon/vge-connectivity.d.ts.map +1 -0
  273. package/dist/daemon/vge-connectivity.js +214 -0
  274. package/dist/daemon/vge-connectivity.js.map +1 -0
  275. package/dist/daemon/vge-health-route.d.ts +4 -0
  276. package/dist/daemon/vge-health-route.d.ts.map +1 -0
  277. package/dist/daemon/vge-health-route.js +107 -0
  278. package/dist/daemon/vge-health-route.js.map +1 -0
  279. package/dist/daemon/vge-overload-backpressure.d.ts +51 -0
  280. package/dist/daemon/vge-overload-backpressure.d.ts.map +1 -0
  281. package/dist/daemon/vge-overload-backpressure.js +79 -0
  282. package/dist/daemon/vge-overload-backpressure.js.map +1 -0
  283. package/dist/daemon/vge-scan-failure-policy.d.ts +8 -0
  284. package/dist/daemon/vge-scan-failure-policy.d.ts.map +1 -0
  285. package/dist/daemon/vge-scan-failure-policy.js +12 -0
  286. package/dist/daemon/vge-scan-failure-policy.js.map +1 -0
  287. package/dist/shared/audit-writer.d.ts +9 -0
  288. package/dist/shared/audit-writer.d.ts.map +1 -0
  289. package/dist/shared/audit-writer.js +72 -0
  290. package/dist/shared/audit-writer.js.map +1 -0
  291. package/dist/shared/blocking-decision-choices.d.ts +13 -0
  292. package/dist/shared/blocking-decision-choices.d.ts.map +1 -0
  293. package/dist/shared/blocking-decision-choices.js +40 -0
  294. package/dist/shared/blocking-decision-choices.js.map +1 -0
  295. package/dist/shared/blocking-decision-reply.d.ts +13 -0
  296. package/dist/shared/blocking-decision-reply.d.ts.map +1 -0
  297. package/dist/shared/blocking-decision-reply.js +78 -0
  298. package/dist/shared/blocking-decision-reply.js.map +1 -0
  299. package/dist/shared/build-stamp.d.ts +7 -0
  300. package/dist/shared/build-stamp.d.ts.map +1 -0
  301. package/dist/shared/build-stamp.js +23 -0
  302. package/dist/shared/build-stamp.js.map +1 -0
  303. package/dist/shared/config-io.d.ts +41 -0
  304. package/dist/shared/config-io.d.ts.map +1 -0
  305. package/dist/shared/config-io.js +105 -0
  306. package/dist/shared/config-io.js.map +1 -0
  307. package/dist/shared/config-schema.d.ts +467 -0
  308. package/dist/shared/config-schema.d.ts.map +1 -0
  309. package/dist/shared/config-schema.js +281 -0
  310. package/dist/shared/config-schema.js.map +1 -0
  311. package/dist/shared/daemon-token.d.ts +7 -0
  312. package/dist/shared/daemon-token.d.ts.map +1 -0
  313. package/dist/shared/daemon-token.js +45 -0
  314. package/dist/shared/daemon-token.js.map +1 -0
  315. package/dist/shared/detect-os-user.d.ts +8 -0
  316. package/dist/shared/detect-os-user.d.ts.map +1 -0
  317. package/dist/shared/detect-os-user.js +34 -0
  318. package/dist/shared/detect-os-user.js.map +1 -0
  319. package/dist/shared/effective-client-id.d.ts +6 -0
  320. package/dist/shared/effective-client-id.d.ts.map +1 -0
  321. package/dist/shared/effective-client-id.js +22 -0
  322. package/dist/shared/effective-client-id.js.map +1 -0
  323. package/dist/shared/ipc-address.d.ts +10 -0
  324. package/dist/shared/ipc-address.d.ts.map +1 -0
  325. package/dist/shared/ipc-address.js +33 -0
  326. package/dist/shared/ipc-address.js.map +1 -0
  327. package/dist/shared/ipc-protocol.d.ts +60 -0
  328. package/dist/shared/ipc-protocol.d.ts.map +1 -0
  329. package/dist/shared/ipc-protocol.js +2 -0
  330. package/dist/shared/ipc-protocol.js.map +1 -0
  331. package/dist/shared/path-match.d.ts +4 -0
  332. package/dist/shared/path-match.d.ts.map +1 -0
  333. package/dist/shared/path-match.js +15 -0
  334. package/dist/shared/path-match.js.map +1 -0
  335. package/dist/shared/private-file.d.ts +17 -0
  336. package/dist/shared/private-file.d.ts.map +1 -0
  337. package/dist/shared/private-file.js +144 -0
  338. package/dist/shared/private-file.js.map +1 -0
  339. package/dist/shared/runtime-lock.d.ts +30 -0
  340. package/dist/shared/runtime-lock.d.ts.map +1 -0
  341. package/dist/shared/runtime-lock.js +142 -0
  342. package/dist/shared/runtime-lock.js.map +1 -0
  343. package/dist/shared/system-ca.d.ts +2 -0
  344. package/dist/shared/system-ca.d.ts.map +1 -0
  345. package/dist/shared/system-ca.js +31 -0
  346. package/dist/shared/system-ca.js.map +1 -0
  347. package/dist/shared/types.d.ts +172 -0
  348. package/dist/shared/types.d.ts.map +1 -0
  349. package/dist/shared/types.js +2 -0
  350. package/dist/shared/types.js.map +1 -0
  351. package/dist/shared/url-allowlist.d.ts +4 -0
  352. package/dist/shared/url-allowlist.d.ts.map +1 -0
  353. package/dist/shared/url-allowlist.js +33 -0
  354. package/dist/shared/url-allowlist.js.map +1 -0
  355. package/dist/shared/url-patterns.d.ts +12 -0
  356. package/dist/shared/url-patterns.d.ts.map +1 -0
  357. package/dist/shared/url-patterns.js +165 -0
  358. package/dist/shared/url-patterns.js.map +1 -0
  359. package/dist/shared/vge-url.d.ts +16 -0
  360. package/dist/shared/vge-url.d.ts.map +1 -0
  361. package/dist/shared/vge-url.js +75 -0
  362. package/dist/shared/vge-url.js.map +1 -0
  363. package/dist/shared/vge-verification.d.ts +18 -0
  364. package/dist/shared/vge-verification.d.ts.map +1 -0
  365. package/dist/shared/vge-verification.js +24 -0
  366. package/dist/shared/vge-verification.js.map +1 -0
  367. package/dist/shim/daemon-start-lock.d.ts +13 -0
  368. package/dist/shim/daemon-start-lock.d.ts.map +1 -0
  369. package/dist/shim/daemon-start-lock.js +26 -0
  370. package/dist/shim/daemon-start-lock.js.map +1 -0
  371. package/dist/shim/index.d.ts +17 -0
  372. package/dist/shim/index.d.ts.map +1 -0
  373. package/dist/shim/index.js +180 -0
  374. package/dist/shim/index.js.map +1 -0
  375. package/dist/shim/inline-resolver-terminal.d.ts +12 -0
  376. package/dist/shim/inline-resolver-terminal.d.ts.map +1 -0
  377. package/dist/shim/inline-resolver-terminal.js +201 -0
  378. package/dist/shim/inline-resolver-terminal.js.map +1 -0
  379. package/dist/shim/inline-resolver-transport.d.ts +15 -0
  380. package/dist/shim/inline-resolver-transport.d.ts.map +1 -0
  381. package/dist/shim/inline-resolver-transport.js +68 -0
  382. package/dist/shim/inline-resolver-transport.js.map +1 -0
  383. package/dist/shim/inline-resolver.d.ts +18 -0
  384. package/dist/shim/inline-resolver.d.ts.map +1 -0
  385. package/dist/shim/inline-resolver.js +152 -0
  386. package/dist/shim/inline-resolver.js.map +1 -0
  387. package/dist/shim/lazy-start.d.ts +2 -0
  388. package/dist/shim/lazy-start.d.ts.map +1 -0
  389. package/dist/shim/lazy-start.js +68 -0
  390. package/dist/shim/lazy-start.js.map +1 -0
  391. package/dist/tui/App.d.ts +7 -0
  392. package/dist/tui/App.d.ts.map +1 -0
  393. package/dist/tui/App.js +62 -0
  394. package/dist/tui/App.js.map +1 -0
  395. package/dist/tui/components/Banner.d.ts +9 -0
  396. package/dist/tui/components/Banner.d.ts.map +1 -0
  397. package/dist/tui/components/Banner.js +29 -0
  398. package/dist/tui/components/Banner.js.map +1 -0
  399. package/dist/tui/components/BlockingDecisionModal.d.ts +11 -0
  400. package/dist/tui/components/BlockingDecisionModal.d.ts.map +1 -0
  401. package/dist/tui/components/BlockingDecisionModal.js +34 -0
  402. package/dist/tui/components/BlockingDecisionModal.js.map +1 -0
  403. package/dist/tui/components/ScreenChrome.d.ts +20 -0
  404. package/dist/tui/components/ScreenChrome.d.ts.map +1 -0
  405. package/dist/tui/components/ScreenChrome.js +30 -0
  406. package/dist/tui/components/ScreenChrome.js.map +1 -0
  407. package/dist/tui/components/SelectList.d.ts +14 -0
  408. package/dist/tui/components/SelectList.d.ts.map +1 -0
  409. package/dist/tui/components/SelectList.js +22 -0
  410. package/dist/tui/components/SelectList.js.map +1 -0
  411. package/dist/tui/components/TextField.d.ts +11 -0
  412. package/dist/tui/components/TextField.d.ts.map +1 -0
  413. package/dist/tui/components/TextField.js +34 -0
  414. package/dist/tui/components/TextField.js.map +1 -0
  415. package/dist/tui/lib/audit-log.d.ts +19 -0
  416. package/dist/tui/lib/audit-log.d.ts.map +1 -0
  417. package/dist/tui/lib/audit-log.js +49 -0
  418. package/dist/tui/lib/audit-log.js.map +1 -0
  419. package/dist/tui/lib/cc-permissions-audit.d.ts +24 -0
  420. package/dist/tui/lib/cc-permissions-audit.d.ts.map +1 -0
  421. package/dist/tui/lib/cc-permissions-audit.js +40 -0
  422. package/dist/tui/lib/cc-permissions-audit.js.map +1 -0
  423. package/dist/tui/lib/cc-permissions-defaults.d.ts +32 -0
  424. package/dist/tui/lib/cc-permissions-defaults.d.ts.map +1 -0
  425. package/dist/tui/lib/cc-permissions-defaults.js +171 -0
  426. package/dist/tui/lib/cc-permissions-defaults.js.map +1 -0
  427. package/dist/tui/lib/cc-permissions-io.d.ts +33 -0
  428. package/dist/tui/lib/cc-permissions-io.d.ts.map +1 -0
  429. package/dist/tui/lib/cc-permissions-io.js +165 -0
  430. package/dist/tui/lib/cc-permissions-io.js.map +1 -0
  431. package/dist/tui/lib/cc-permissions-ops.d.ts +19 -0
  432. package/dist/tui/lib/cc-permissions-ops.d.ts.map +1 -0
  433. package/dist/tui/lib/cc-permissions-ops.js +75 -0
  434. package/dist/tui/lib/cc-permissions-ops.js.map +1 -0
  435. package/dist/tui/lib/cc-permissions-scope.d.ts +15 -0
  436. package/dist/tui/lib/cc-permissions-scope.d.ts.map +1 -0
  437. package/dist/tui/lib/cc-permissions-scope.js +97 -0
  438. package/dist/tui/lib/cc-permissions-scope.js.map +1 -0
  439. package/dist/tui/lib/config-save.d.ts +14 -0
  440. package/dist/tui/lib/config-save.d.ts.map +1 -0
  441. package/dist/tui/lib/config-save.js +39 -0
  442. package/dist/tui/lib/config-save.js.map +1 -0
  443. package/dist/tui/lib/daemon-client.d.ts +67 -0
  444. package/dist/tui/lib/daemon-client.d.ts.map +1 -0
  445. package/dist/tui/lib/daemon-client.js +213 -0
  446. package/dist/tui/lib/daemon-client.js.map +1 -0
  447. package/dist/tui/lib/decision-stream.d.ts +29 -0
  448. package/dist/tui/lib/decision-stream.d.ts.map +1 -0
  449. package/dist/tui/lib/decision-stream.js +77 -0
  450. package/dist/tui/lib/decision-stream.js.map +1 -0
  451. package/dist/tui/lib/number-validate.d.ts +9 -0
  452. package/dist/tui/lib/number-validate.d.ts.map +1 -0
  453. package/dist/tui/lib/number-validate.js +12 -0
  454. package/dist/tui/lib/number-validate.js.map +1 -0
  455. package/dist/tui/lib/session-files.d.ts +9 -0
  456. package/dist/tui/lib/session-files.d.ts.map +1 -0
  457. package/dist/tui/lib/session-files.js +39 -0
  458. package/dist/tui/lib/session-files.js.map +1 -0
  459. package/dist/tui/lib/stats.d.ts +19 -0
  460. package/dist/tui/lib/stats.d.ts.map +1 -0
  461. package/dist/tui/lib/stats.js +72 -0
  462. package/dist/tui/lib/stats.js.map +1 -0
  463. package/dist/tui/lib/test-connection.d.ts +12 -0
  464. package/dist/tui/lib/test-connection.d.ts.map +1 -0
  465. package/dist/tui/lib/test-connection.js +59 -0
  466. package/dist/tui/lib/test-connection.js.map +1 -0
  467. package/dist/tui/lib/tools-policy-ops.d.ts +9 -0
  468. package/dist/tui/lib/tools-policy-ops.d.ts.map +1 -0
  469. package/dist/tui/lib/tools-policy-ops.js +30 -0
  470. package/dist/tui/lib/tools-policy-ops.js.map +1 -0
  471. package/dist/tui/lib/verified-at.d.ts +37 -0
  472. package/dist/tui/lib/verified-at.d.ts.map +1 -0
  473. package/dist/tui/lib/verified-at.js +47 -0
  474. package/dist/tui/lib/verified-at.js.map +1 -0
  475. package/dist/tui/screens/ApiKeys.d.ts +8 -0
  476. package/dist/tui/screens/ApiKeys.d.ts.map +1 -0
  477. package/dist/tui/screens/ApiKeys.js +250 -0
  478. package/dist/tui/screens/ApiKeys.js.map +1 -0
  479. package/dist/tui/screens/AuditViewer.d.ts +8 -0
  480. package/dist/tui/screens/AuditViewer.d.ts.map +1 -0
  481. package/dist/tui/screens/AuditViewer.js +56 -0
  482. package/dist/tui/screens/AuditViewer.js.map +1 -0
  483. package/dist/tui/screens/ContextIngressPolicy.d.ts +7 -0
  484. package/dist/tui/screens/ContextIngressPolicy.d.ts.map +1 -0
  485. package/dist/tui/screens/ContextIngressPolicy.js +145 -0
  486. package/dist/tui/screens/ContextIngressPolicy.js.map +1 -0
  487. package/dist/tui/screens/LiveEvents.d.ts +7 -0
  488. package/dist/tui/screens/LiveEvents.d.ts.map +1 -0
  489. package/dist/tui/screens/LiveEvents.js +72 -0
  490. package/dist/tui/screens/LiveEvents.js.map +1 -0
  491. package/dist/tui/screens/MainMenu.d.ts +11 -0
  492. package/dist/tui/screens/MainMenu.d.ts.map +1 -0
  493. package/dist/tui/screens/MainMenu.js +35 -0
  494. package/dist/tui/screens/MainMenu.js.map +1 -0
  495. package/dist/tui/screens/NativeCcPermissions.d.ts +7 -0
  496. package/dist/tui/screens/NativeCcPermissions.d.ts.map +1 -0
  497. package/dist/tui/screens/NativeCcPermissions.js +249 -0
  498. package/dist/tui/screens/NativeCcPermissions.js.map +1 -0
  499. package/dist/tui/screens/PendingEscalations.d.ts +7 -0
  500. package/dist/tui/screens/PendingEscalations.d.ts.map +1 -0
  501. package/dist/tui/screens/PendingEscalations.js +83 -0
  502. package/dist/tui/screens/PendingEscalations.js.map +1 -0
  503. package/dist/tui/screens/SecurityBaseline.d.ts +7 -0
  504. package/dist/tui/screens/SecurityBaseline.d.ts.map +1 -0
  505. package/dist/tui/screens/SecurityBaseline.js +272 -0
  506. package/dist/tui/screens/SecurityBaseline.js.map +1 -0
  507. package/dist/tui/screens/Stats.d.ts +7 -0
  508. package/dist/tui/screens/Stats.d.ts.map +1 -0
  509. package/dist/tui/screens/Stats.js +36 -0
  510. package/dist/tui/screens/Stats.js.map +1 -0
  511. package/dist/tui/screens/ToolsPolicy.d.ts +7 -0
  512. package/dist/tui/screens/ToolsPolicy.d.ts.map +1 -0
  513. package/dist/tui/screens/ToolsPolicy.js +87 -0
  514. package/dist/tui/screens/ToolsPolicy.js.map +1 -0
  515. package/dist/tui/screens/ViewConfig.d.ts +9 -0
  516. package/dist/tui/screens/ViewConfig.d.ts.map +1 -0
  517. package/dist/tui/screens/ViewConfig.js +117 -0
  518. package/dist/tui/screens/ViewConfig.js.map +1 -0
  519. package/dist/tui/strings.d.ts +97 -0
  520. package/dist/tui/strings.d.ts.map +1 -0
  521. package/dist/tui/strings.js +104 -0
  522. package/dist/tui/strings.js.map +1 -0
  523. package/dist/tui/types.d.ts +5 -0
  524. package/dist/tui/types.d.ts.map +1 -0
  525. package/dist/tui/types.js +2 -0
  526. package/dist/tui/types.js.map +1 -0
  527. package/package.json +74 -0
@@ -0,0 +1,434 @@
1
+ import * as crypto from 'crypto';
2
+ import * as fs from 'fs';
3
+ import * as os from 'os';
4
+ import * as path from 'path';
5
+ import { checkPath } from './path-deny.js';
6
+ import { buildConversationFromTranscript, extractFreshAttachments } from './conversation-context.js';
7
+ import { consumeAttachmentAllowOnce, createSession, getAttachmentScanState, getSession, isResourceAllowed, isResourceBlocked, recordAttachmentCursorOffset, recordAttachmentScanTerminalState, } from './session-state.js';
8
+ import { scanAttachmentInput } from './vge-client.js';
9
+ import { describeVgeBlockReason, isExplicitVgeBlock } from './blocking-decision-triggers.js';
10
+ import { blockUserPromptWithReason, branchScores } from './conversation-decision-prompt.js';
11
+ import { logAttachmentAllowOnceConsumed, logAttachmentInputAnalyzed, logAttachmentInputCredentialPathDenied, logAttachmentReferenceWithoutTranscriptRecord, logAttachmentInputScanFailedOpen, logAttachmentInputScanFailedToHitl, } from './audit-logger.js';
12
+ import { createAttachmentDecisionEscrow, renderAttachmentEscrowStopReason, } from './attachment-decision-escrow.js';
13
+ import { conversationDecisionTimeoutMs } from './decision-timeout.js';
14
+ import { recordVgeScanFailure } from './decision-metrics.js';
15
+ import { isFailOpenEligibleVgeFailure } from './vge-scan-failure-policy.js';
16
+ const MAX_ATTACHMENT_CHARS = 100_000;
17
+ const MAX_ATTACHMENT_BYTES = 200_000;
18
+ function syntheticBlock(reason) {
19
+ return {
20
+ decision: 'BLOCKED',
21
+ arbiterSignal: 'BLOCK',
22
+ ruleAction: 'BLOCK',
23
+ score: 0,
24
+ branches: {},
25
+ blockMessage: reason,
26
+ localFallbackReason: reason,
27
+ };
28
+ }
29
+ function failureReason(reason) {
30
+ if (reason === 'missing_api_key')
31
+ return 'attachment_scan_missing_api_key';
32
+ if (reason === 'timeout')
33
+ return 'attachment_scan_timeout';
34
+ return 'attachment_scan_failed';
35
+ }
36
+ function resourceLabel(attachment) {
37
+ return `File attachment: ${attachment.displayPath}`;
38
+ }
39
+ function sha256(value) {
40
+ return crypto.createHash('sha256').update(value).digest('hex');
41
+ }
42
+ function promptAuditMeta(prompt) {
43
+ return {
44
+ promptHash: sha256(prompt),
45
+ promptSizeBytes: Buffer.byteLength(prompt, 'utf8'),
46
+ };
47
+ }
48
+ function hasLikelyFileMention(prompt) {
49
+ return /(^|\s)@(?:~|\/|\.{1,2}\/|[A-Za-z0-9_.-]+(?:\/|\.[A-Za-z0-9_-]+))/.test(prompt);
50
+ }
51
+ function stripMentionSuffix(token) {
52
+ let cleaned = token.replace(/[),.;!?]+$/g, '');
53
+ const hashIndex = cleaned.lastIndexOf('#');
54
+ if (hashIndex > 0 && /^#(?:L?\d+)?(?:-L?\d+)?$/i.test(cleaned.slice(hashIndex))) {
55
+ cleaned = cleaned.slice(0, hashIndex);
56
+ }
57
+ return cleaned;
58
+ }
59
+ function promptFileMentions(prompt) {
60
+ const mentions = new Set();
61
+ const pattern = /(^|\s)@((?:~|\/|\.{1,2}\/|[A-Za-z0-9_.-]+\/|[A-Za-z0-9_.-]+\.[A-Za-z0-9_-]+)[^\s]*)/g;
62
+ let match;
63
+ while ((match = pattern.exec(prompt)) !== null) {
64
+ const token = match[2];
65
+ if (!token)
66
+ continue;
67
+ const cleaned = stripMentionSuffix(token);
68
+ if (cleaned)
69
+ mentions.add(cleaned);
70
+ }
71
+ return [...mentions];
72
+ }
73
+ function resolvePromptMentionPath(displayPath, cwd) {
74
+ if (displayPath === '~' || displayPath.startsWith('~/') || displayPath.startsWith('~\\')) {
75
+ return path.join(os.homedir(), displayPath.slice(1));
76
+ }
77
+ if (path.isAbsolute(displayPath))
78
+ return path.resolve(displayPath);
79
+ const base = typeof cwd === 'string' && cwd.trim() !== '' ? cwd : process.cwd();
80
+ return path.resolve(base, displayPath);
81
+ }
82
+ function attachmentFromPromptMention(params) {
83
+ const recordFingerprint = sha256(`${params.sessionId}\n${params.transcriptPath}\nprompt_reference\n${params.displayPath}\n${params.filePath}\n${params.contentHash}`);
84
+ return {
85
+ content: params.content,
86
+ contentBytes: params.contentBytes,
87
+ contentChars: params.content.length,
88
+ contentHash: params.contentHash,
89
+ displayPath: params.displayPath,
90
+ endOffset: 0,
91
+ filePath: params.filePath,
92
+ offset: 0,
93
+ recordFingerprint,
94
+ resourceId: `attachment:${sha256(`${params.sessionId}\n${params.displayPath}\n${params.contentHash}`)}`,
95
+ transcriptPath: params.transcriptPath,
96
+ };
97
+ }
98
+ function promptReferencedAttachments(payload, config, transcriptPath) {
99
+ const attachments = [];
100
+ for (const displayPath of promptFileMentions(payload.prompt)) {
101
+ const filePath = resolvePromptMentionPath(displayPath, payload.cwd);
102
+ let stat;
103
+ try {
104
+ stat = fs.statSync(filePath);
105
+ }
106
+ catch {
107
+ continue;
108
+ }
109
+ if (!stat.isFile())
110
+ continue;
111
+ const checked = config.policy.credential_protection ? checkPath(filePath) : null;
112
+ if (checked?.denied) {
113
+ attachments.push(attachmentFromPromptMention({
114
+ content: '',
115
+ contentBytes: 0,
116
+ contentHash: sha256(`credential_path_not_read\n${filePath}`),
117
+ displayPath,
118
+ filePath,
119
+ sessionId: payload.session_id,
120
+ transcriptPath,
121
+ }));
122
+ continue;
123
+ }
124
+ if (stat.size > MAX_ATTACHMENT_BYTES) {
125
+ attachments.push(attachmentFromPromptMention({
126
+ content: '',
127
+ contentBytes: stat.size,
128
+ contentHash: sha256(`oversized_prompt_file\n${filePath}\n${stat.size}\n${stat.mtimeMs}`),
129
+ displayPath,
130
+ filePath,
131
+ sessionId: payload.session_id,
132
+ transcriptPath,
133
+ }));
134
+ continue;
135
+ }
136
+ const content = fs.readFileSync(filePath, 'utf8');
137
+ attachments.push(attachmentFromPromptMention({
138
+ content,
139
+ contentBytes: Buffer.byteLength(content, 'utf8'),
140
+ contentHash: sha256(content),
141
+ displayPath,
142
+ filePath,
143
+ sessionId: payload.session_id,
144
+ transcriptPath,
145
+ }));
146
+ }
147
+ return attachments;
148
+ }
149
+ function createHitl(params) {
150
+ const decision = createAttachmentDecisionEscrow({
151
+ contentBytes: params.attachment.contentBytes,
152
+ contentHash: params.attachment.contentHash,
153
+ originalPrompt: params.originalPrompt,
154
+ reason: params.reason,
155
+ resourceId: params.attachment.resourceId,
156
+ resourceLabel: resourceLabel(params.attachment),
157
+ sessionId: params.sessionId,
158
+ timeoutMs: params.timeoutMs,
159
+ vgeResult: params.vgeResult,
160
+ });
161
+ if (decision.status === 'pending' && decision.resourceId === params.attachment.resourceId) {
162
+ recordAttachmentScanTerminalState(params.sessionId, {
163
+ fingerprint: params.attachment.recordFingerprint,
164
+ nextOffset: params.attachment.endOffset,
165
+ status: 'pending_decision',
166
+ transcriptPath: params.attachment.transcriptPath,
167
+ });
168
+ }
169
+ return {
170
+ blocked: true,
171
+ ccOutput: blockUserPromptWithReason(renderAttachmentEscrowStopReason(decision)),
172
+ };
173
+ }
174
+ function markAllowed(sessionId, attachment) {
175
+ recordAttachmentScanTerminalState(sessionId, {
176
+ fingerprint: attachment.recordFingerprint,
177
+ nextOffset: attachment.endOffset,
178
+ status: 'allowed',
179
+ transcriptPath: attachment.transcriptPath,
180
+ });
181
+ }
182
+ export async function enforcePromptAttachments(payload, config) {
183
+ const transcriptPath = typeof payload.transcript_path === 'string' ? payload.transcript_path : '';
184
+ if (!transcriptPath)
185
+ return { blocked: false };
186
+ const session = getSession(payload.session_id) ?? createSession(payload.session_id, null);
187
+ const state = getAttachmentScanState(payload.session_id, transcriptPath);
188
+ const extracted = extractFreshAttachments({
189
+ transcriptPath,
190
+ sessionId: payload.session_id,
191
+ cursorOffset: state.cursorOffset,
192
+ seenFingerprints: state.seenFingerprints,
193
+ });
194
+ if (extracted.attachments.length === 0) {
195
+ const promptAttachments = hasLikelyFileMention(payload.prompt)
196
+ ? promptReferencedAttachments(payload, config, transcriptPath)
197
+ : [];
198
+ if (promptAttachments.length > 0) {
199
+ extracted.attachments.push(...promptAttachments);
200
+ }
201
+ }
202
+ if (extracted.attachments.length === 0) {
203
+ recordAttachmentCursorOffset(payload.session_id, {
204
+ nextOffset: extracted.nextOffset,
205
+ transcriptPath,
206
+ });
207
+ if (hasLikelyFileMention(payload.prompt)) {
208
+ const promptMeta = promptAuditMeta(payload.prompt);
209
+ logAttachmentReferenceWithoutTranscriptRecord({
210
+ sessionId: payload.session_id,
211
+ promptHash: promptMeta.promptHash,
212
+ promptSizeBytes: promptMeta.promptSizeBytes,
213
+ transcriptPathHash: sha256(transcriptPath),
214
+ cursorOffset: state.cursorOffset,
215
+ nextOffset: extracted.nextOffset,
216
+ });
217
+ }
218
+ return { blocked: false };
219
+ }
220
+ const enforceDecisions = config.policy.prompt_attachment_analysis !== 'off';
221
+ const conversation = buildConversationFromTranscript(transcriptPath);
222
+ for (const attachment of extracted.attachments) {
223
+ if (isResourceBlocked(session, attachment.resourceId)) {
224
+ recordAttachmentScanTerminalState(payload.session_id, {
225
+ fingerprint: attachment.recordFingerprint,
226
+ nextOffset: attachment.endOffset,
227
+ status: 'blocked_by_user',
228
+ transcriptPath,
229
+ });
230
+ return {
231
+ blocked: true,
232
+ ccOutput: blockUserPromptWithReason('VGE Agent Guard: this file attachment was blocked by user decision.'),
233
+ };
234
+ }
235
+ if (consumeAttachmentAllowOnce(payload.session_id, attachment.resourceId)) {
236
+ logAttachmentAllowOnceConsumed({
237
+ sessionId: payload.session_id,
238
+ resourceId: attachment.resourceId,
239
+ contentHash: attachment.contentHash,
240
+ });
241
+ markAllowed(payload.session_id, attachment);
242
+ continue;
243
+ }
244
+ if (isResourceAllowed(session, attachment.resourceId)) {
245
+ markAllowed(payload.session_id, attachment);
246
+ continue;
247
+ }
248
+ if (config.policy.credential_protection) {
249
+ const checked = checkPath(attachment.filePath);
250
+ if (checked.denied) {
251
+ logAttachmentInputCredentialPathDenied({
252
+ sessionId: payload.session_id,
253
+ displayPath: attachment.displayPath,
254
+ resolvedPath: checked.resolvedPath,
255
+ contentHash: attachment.contentHash,
256
+ contentSizeBytes: attachment.contentBytes,
257
+ contentChars: attachment.contentChars,
258
+ });
259
+ return createHitl({
260
+ attachment,
261
+ originalPrompt: payload.prompt,
262
+ reason: 'attachment_credential_path_denied',
263
+ sessionId: payload.session_id,
264
+ timeoutMs: conversationDecisionTimeoutMs(config),
265
+ vgeResult: syntheticBlock('attachment_credential_path_denied'),
266
+ });
267
+ }
268
+ }
269
+ if (attachment.contentChars > MAX_ATTACHMENT_CHARS ||
270
+ attachment.contentBytes > MAX_ATTACHMENT_BYTES) {
271
+ if (!enforceDecisions) {
272
+ logAttachmentInputScanFailedOpen({
273
+ sessionId: payload.session_id,
274
+ displayPath: attachment.displayPath,
275
+ contentHash: attachment.contentHash,
276
+ contentSizeBytes: attachment.contentBytes,
277
+ contentChars: attachment.contentChars,
278
+ reason: 'attachment_too_large_for_full_scan',
279
+ });
280
+ markAllowed(payload.session_id, attachment);
281
+ continue;
282
+ }
283
+ logAttachmentInputScanFailedToHitl({
284
+ sessionId: payload.session_id,
285
+ displayPath: attachment.displayPath,
286
+ contentHash: attachment.contentHash,
287
+ contentSizeBytes: attachment.contentBytes,
288
+ contentChars: attachment.contentChars,
289
+ reason: 'attachment_too_large_for_full_scan',
290
+ });
291
+ return createHitl({
292
+ attachment,
293
+ originalPrompt: payload.prompt,
294
+ reason: 'attachment_too_large_for_full_scan',
295
+ sessionId: payload.session_id,
296
+ timeoutMs: conversationDecisionTimeoutMs(config),
297
+ vgeResult: syntheticBlock('attachment_too_large_for_full_scan'),
298
+ });
299
+ }
300
+ const scan = await scanAttachmentInput(attachment.content, {
301
+ sessionId: payload.session_id,
302
+ resourceId: attachment.resourceId,
303
+ displayPath: attachment.displayPath,
304
+ timeoutMs: config.vge.userprompt_attachment_budget_ms,
305
+ conversation,
306
+ });
307
+ if (!scan.result) {
308
+ const rawReason = scan.failureReason ?? 'vge_error';
309
+ const reason = failureReason(rawReason);
310
+ if (!enforceDecisions) {
311
+ recordVgeScanFailure({
312
+ stage: 'prompt_attachment',
313
+ failureReason: rawReason,
314
+ actionTaken: 'fail_open',
315
+ });
316
+ logAttachmentInputScanFailedOpen({
317
+ sessionId: payload.session_id,
318
+ displayPath: attachment.displayPath,
319
+ contentHash: attachment.contentHash,
320
+ contentSizeBytes: attachment.contentBytes,
321
+ contentChars: attachment.contentChars,
322
+ reason,
323
+ failureReason: rawReason,
324
+ httpStatus: scan.httpStatus,
325
+ elapsedMs: scan.elapsedMs,
326
+ localRequestId: scan.localRequestId,
327
+ attempt: scan.attempt,
328
+ retryAfterMs: scan.retryAfterMs,
329
+ });
330
+ markAllowed(payload.session_id, attachment);
331
+ continue;
332
+ }
333
+ if (config.policy.vge_failure_mode.prompt_attachment === 'fail_open' &&
334
+ isFailOpenEligibleVgeFailure({ failureReason: rawReason, httpStatus: scan.httpStatus })) {
335
+ recordVgeScanFailure({
336
+ stage: 'prompt_attachment',
337
+ failureReason: rawReason,
338
+ actionTaken: 'fail_open',
339
+ });
340
+ logAttachmentInputScanFailedOpen({
341
+ sessionId: payload.session_id,
342
+ displayPath: attachment.displayPath,
343
+ contentHash: attachment.contentHash,
344
+ contentSizeBytes: attachment.contentBytes,
345
+ contentChars: attachment.contentChars,
346
+ reason,
347
+ failureReason: rawReason,
348
+ httpStatus: scan.httpStatus,
349
+ elapsedMs: scan.elapsedMs,
350
+ localRequestId: scan.localRequestId,
351
+ attempt: scan.attempt,
352
+ retryAfterMs: scan.retryAfterMs,
353
+ });
354
+ markAllowed(payload.session_id, attachment);
355
+ continue;
356
+ }
357
+ recordVgeScanFailure({
358
+ stage: 'prompt_attachment',
359
+ failureReason: rawReason,
360
+ actionTaken: 'fail_closed',
361
+ });
362
+ logAttachmentInputScanFailedToHitl({
363
+ sessionId: payload.session_id,
364
+ displayPath: attachment.displayPath,
365
+ contentHash: attachment.contentHash,
366
+ contentSizeBytes: attachment.contentBytes,
367
+ contentChars: attachment.contentChars,
368
+ reason,
369
+ });
370
+ return createHitl({
371
+ attachment,
372
+ originalPrompt: payload.prompt,
373
+ reason,
374
+ sessionId: payload.session_id,
375
+ timeoutMs: conversationDecisionTimeoutMs(config),
376
+ vgeResult: syntheticBlock(reason),
377
+ });
378
+ }
379
+ const branches = branchScores(scan.result);
380
+ if (!enforceDecisions) {
381
+ logAttachmentInputAnalyzed({
382
+ sessionId: payload.session_id,
383
+ displayPath: attachment.displayPath,
384
+ contentHash: attachment.contentHash,
385
+ contentSizeBytes: attachment.contentBytes,
386
+ contentChars: attachment.contentChars,
387
+ vgeDecision: scan.result.decision,
388
+ vgeScore: scan.result.score,
389
+ vgeCategories: scan.result.categories,
390
+ branches,
391
+ enforcementTaken: 'none',
392
+ });
393
+ markAllowed(payload.session_id, attachment);
394
+ continue;
395
+ }
396
+ if (isExplicitVgeBlock(scan.result)) {
397
+ logAttachmentInputAnalyzed({
398
+ sessionId: payload.session_id,
399
+ displayPath: attachment.displayPath,
400
+ contentHash: attachment.contentHash,
401
+ contentSizeBytes: attachment.contentBytes,
402
+ contentChars: attachment.contentChars,
403
+ vgeDecision: scan.result.decision,
404
+ vgeScore: scan.result.score,
405
+ vgeCategories: scan.result.categories,
406
+ branches,
407
+ enforcementTaken: 'hitl',
408
+ });
409
+ return createHitl({
410
+ attachment,
411
+ originalPrompt: payload.prompt,
412
+ reason: describeVgeBlockReason(scan.result),
413
+ sessionId: payload.session_id,
414
+ timeoutMs: conversationDecisionTimeoutMs(config),
415
+ vgeResult: scan.result,
416
+ });
417
+ }
418
+ logAttachmentInputAnalyzed({
419
+ sessionId: payload.session_id,
420
+ displayPath: attachment.displayPath,
421
+ contentHash: attachment.contentHash,
422
+ contentSizeBytes: attachment.contentBytes,
423
+ contentChars: attachment.contentChars,
424
+ vgeDecision: scan.result.decision,
425
+ vgeScore: scan.result.score,
426
+ vgeCategories: scan.result.categories,
427
+ branches,
428
+ enforcementTaken: 'none',
429
+ });
430
+ markAllowed(payload.session_id, attachment);
431
+ }
432
+ return { blocked: false };
433
+ }
434
+ //# sourceMappingURL=attachment-input-enforcement.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"attachment-input-enforcement.js","sourceRoot":"","sources":["../../src/daemon/attachment-input-enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAG7B,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,+BAA+B,EAAE,uBAAuB,EAAwB,MAAM,2BAA2B,CAAC;AAC3H,OAAO,EACL,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAoC,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAA8B,MAAM,mCAAmC,CAAC;AACxH,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,sCAAsC,EACtC,6CAA6C,EAC7C,gCAAgC,EAChC,kCAAkC,GACnC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAE5E,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAMrC,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,aAAa,EAAE,OAAO;QACtB,UAAU,EAAE,OAAO;QACnB,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE,MAAM;QACpB,mBAAmB,EAAE,MAAM;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAmC;IACxD,IAAI,MAAM,KAAK,iBAAiB;QAAE,OAAO,iCAAiC,CAAC;IAC3E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,yBAAyB,CAAC;IAC3D,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,UAA2B;IAChD,OAAO,oBAAoB,UAAU,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO,kEAAkE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,SAAS,GAAG,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,OAAO,GAAG,sFAAsF,CAAC;IACvG,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,OAAO;YAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAmB,EAAE,GAAY;IACjE,IAAI,WAAW,KAAK,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAChF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,2BAA2B,CAAC,MAQpC;IACC,MAAM,iBAAiB,GAAG,MAAM,CAC9B,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,cAAc,uBAAuB,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,WAAW,EAAE,CACpI,CAAC;IACF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QACnC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,CAAC;QACT,iBAAiB;QACjB,UAAU,EAAE,cAAc,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE;QACvG,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,OAA4B,EAAE,MAAc,EAAE,cAAsB;IACvG,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,WAAW,IAAI,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,SAAS;QAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,WAAW,CAAC,IAAI,CAAC,2BAA2B,CAAC;gBAC3C,OAAO,EAAE,EAAE;gBACX,YAAY,EAAE,CAAC;gBACf,WAAW,EAAE,MAAM,CAAC,6BAA6B,QAAQ,EAAE,CAAC;gBAC5D,WAAW;gBACX,QAAQ;gBACR,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,cAAc;aACf,CAAC,CAAC,CAAC;YACJ,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;YACrC,WAAW,CAAC,IAAI,CAAC,2BAA2B,CAAC;gBAC3C,OAAO,EAAE,EAAE;gBACX,YAAY,EAAE,IAAI,CAAC,IAAI;gBACvB,WAAW,EAAE,MAAM,CAAC,0BAA0B,QAAQ,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxF,WAAW;gBACX,QAAQ;gBACR,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,cAAc;aACf,CAAC,CAAC,CAAC;YACJ,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,WAAW,CAAC,IAAI,CAAC,2BAA2B,CAAC;YAC3C,OAAO;YACP,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;YAChD,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC;YAC5B,WAAW;YACX,QAAQ;YACR,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,cAAc;SACf,CAAC,CAAC,CAAC;IACN,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,MAOnB;IACC,MAAM,QAAQ,GAAG,8BAA8B,CAAC;QAC9C,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY;QAC5C,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,WAAW;QAC1C,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU;QACxC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1F,iCAAiC,CAAC,MAAM,CAAC,SAAS,EAAE;YAClD,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,iBAAiB;YAChD,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS;YACvC,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;SACjD,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,yBAAyB,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,UAA2B;IACjE,iCAAiC,CAAC,SAAS,EAAE;QAC3C,WAAW,EAAE,UAAU,CAAC,iBAAiB;QACzC,UAAU,EAAE,UAAU,CAAC,SAAS;QAChC,MAAM,EAAE,SAAS;QACjB,cAAc,EAAE,UAAU,CAAC,cAAc;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAA4B,EAC5B,MAAc;IAEd,MAAM,cAAc,GAAG,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE/C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,uBAAuB,CAAC;QACxC,cAAc;QACd,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5D,CAAC,CAAC,2BAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC;YAC9D,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,4BAA4B,CAAC,OAAO,CAAC,UAAU,EAAE;YAC/C,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,cAAc;SACf,CAAC,CAAC;QACH,IAAI,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACnD,6CAA6C,CAAC;gBAC5C,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,kBAAkB,EAAE,MAAM,CAAC,cAAc,CAAC;gBAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,SAAS,CAAC,UAAU;aACjC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,0BAA0B,KAAK,KAAK,CAAC;IAC5E,MAAM,YAAY,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAC;IACrE,KAAK,MAAM,UAAU,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,iCAAiC,CAAC,OAAO,CAAC,UAAU,EAAE;gBACpD,WAAW,EAAE,UAAU,CAAC,iBAAiB;gBACzC,UAAU,EAAE,UAAU,CAAC,SAAS;gBAChC,MAAM,EAAE,iBAAiB;gBACzB,cAAc;aACf,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,yBAAyB,CAAC,qEAAqE,CAAC;aAC3G,CAAC;QACJ,CAAC;QAED,IAAI,0BAA0B,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,8BAA8B,CAAC;gBAC7B,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,WAAW,EAAE,UAAU,CAAC,WAAW;aACpC,CAAC,CAAC;YACH,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,sCAAsC,CAAC;oBACrC,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,gBAAgB,EAAE,UAAU,CAAC,YAAY;oBACzC,YAAY,EAAE,UAAU,CAAC,YAAY;iBACtC,CAAC,CAAC;gBACH,OAAO,UAAU,CAAC;oBAChB,UAAU;oBACV,cAAc,EAAE,OAAO,CAAC,MAAM;oBAC9B,MAAM,EAAE,mCAAmC;oBAC3C,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,SAAS,EAAE,6BAA6B,CAAC,MAAM,CAAC;oBAChD,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;iBAC/D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IACE,UAAU,CAAC,YAAY,GAAG,oBAAoB;YAC9C,UAAU,CAAC,YAAY,GAAG,oBAAoB,EAC9C,CAAC;YACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,gCAAgC,CAAC;oBAC/B,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,gBAAgB,EAAE,UAAU,CAAC,YAAY;oBACzC,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,MAAM,EAAE,oCAAoC;iBAC7C,CAAC,CAAC;gBACH,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,kCAAkC,CAAC;gBACjC,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,gBAAgB,EAAE,UAAU,CAAC,YAAY;gBACzC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,MAAM,EAAE,oCAAoC;aAC7C,CAAC,CAAC;YACH,OAAO,UAAU,CAAC;gBAChB,UAAU;gBACV,cAAc,EAAE,OAAO,CAAC,MAAM;gBAC9B,MAAM,EAAE,oCAAoC;gBAC5C,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,SAAS,EAAE,6BAA6B,CAAC,MAAM,CAAC;gBAChD,SAAS,EAAE,cAAc,CAAC,oCAAoC,CAAC;aAChE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,OAAO,EAAE;YACzD,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,+BAA+B;YACrD,YAAY;SACb,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,CAAC;YACpD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,oBAAoB,CAAC;oBACnB,KAAK,EAAE,mBAAmB;oBAC1B,aAAa,EAAE,SAAS;oBACxB,WAAW,EAAE,WAAW;iBACzB,CAAC,CAAC;gBACH,gCAAgC,CAAC;oBAC/B,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,gBAAgB,EAAE,UAAU,CAAC,YAAY;oBACzC,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,MAAM;oBACN,aAAa,EAAE,SAAS;oBACxB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC,CAAC,CAAC;gBACH,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,IACE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,iBAAiB,KAAK,WAAW;gBAChE,4BAA4B,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,EACvF,CAAC;gBACD,oBAAoB,CAAC;oBACnB,KAAK,EAAE,mBAAmB;oBAC1B,aAAa,EAAE,SAAS;oBACxB,WAAW,EAAE,WAAW;iBACzB,CAAC,CAAC;gBACH,gCAAgC,CAAC;oBAC/B,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,gBAAgB,EAAE,UAAU,CAAC,YAAY;oBACzC,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,MAAM;oBACN,aAAa,EAAE,SAAS;oBACxB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC,CAAC,CAAC;gBACH,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,oBAAoB,CAAC;gBACnB,KAAK,EAAE,mBAAmB;gBAC1B,aAAa,EAAE,SAAS;gBACxB,WAAW,EAAE,aAAa;aAC3B,CAAC,CAAC;YACH,kCAAkC,CAAC;gBACjC,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,gBAAgB,EAAE,UAAU,CAAC,YAAY;gBACzC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,MAAM;aACP,CAAC,CAAC;YACH,OAAO,UAAU,CAAC;gBAChB,UAAU;gBACV,cAAc,EAAE,OAAO,CAAC,MAAM;gBAC9B,MAAM;gBACN,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,SAAS,EAAE,6BAA6B,CAAC,MAAM,CAAC;gBAChD,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,0BAA0B,CAAC;gBACzB,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,gBAAgB,EAAE,UAAU,CAAC,YAAY;gBACzC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBACjC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;gBAC3B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBACrC,QAAQ;gBACR,gBAAgB,EAAE,MAAM;aACzB,CAAC,CAAC;YACH,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,0BAA0B,CAAC;gBACzB,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,gBAAgB,EAAE,UAAU,CAAC,YAAY;gBACzC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBACjC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;gBAC3B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBACrC,QAAQ;gBACR,gBAAgB,EAAE,MAAM;aACzB,CAAC,CAAC;YACH,OAAO,UAAU,CAAC;gBAChB,UAAU;gBACV,cAAc,EAAE,OAAO,CAAC,MAAM;gBAC9B,MAAM,EAAE,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC3C,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,SAAS,EAAE,6BAA6B,CAAC,MAAM,CAAC;gBAChD,SAAS,EAAE,IAAI,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAED,0BAA0B,CAAC;YACzB,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,gBAAgB,EAAE,UAAU,CAAC,YAAY;YACzC,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YACjC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YAC3B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YACrC,QAAQ;YACR,gBAAgB,EAAE,MAAM;SACzB,CAAC,CAAC;QACH,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}
@@ -0,0 +1,51 @@
1
+ import type { BlockingDecision, BlockingDecisionChoice, BlockingDecisionStatus, Escalation } from '../shared/types.js';
2
+ type ResolvedBy = 'inline_resolver' | 'conversation_prompt' | 'tui_modal' | 'session_cleanup' | 'daemon_restart' | 'capacity_eviction';
3
+ export declare function logBlockingDecisionCreated(decision: BlockingDecision, params?: {
4
+ resolverSurface?: 'userprompt_text' | 'resolver_stream';
5
+ }): void;
6
+ export declare function logBlockingDecisionDeduped(decision: BlockingDecision): void;
7
+ export declare function logBlockingDecisionReaskEmitted(decision: BlockingDecision): void;
8
+ export declare function logBlockingDecisionSessionLocked(decision: BlockingDecision): void;
9
+ export declare function logBlockingDecisionResolverMissing(decision: BlockingDecision): void;
10
+ export declare function logBlockingDecisionResolved(params: {
11
+ decision: BlockingDecision;
12
+ choice: BlockingDecisionChoice;
13
+ clientId: string;
14
+ elapsedMs: number;
15
+ contentHash?: string;
16
+ contentSizeBytes?: number;
17
+ oneShotConsumed?: boolean;
18
+ originHookEvent?: 'PostToolUse' | 'UserPromptSubmit' | 'PreToolUse';
19
+ readReplayRequired?: boolean;
20
+ resolverSurface?: 'userprompt_text' | 'resolver_stream';
21
+ }): void;
22
+ export declare function logBlockingDecisionCapacityEvicted(decision: BlockingDecision): void;
23
+ export declare function logBlockingDecisionDroppedOnRestart(decision: BlockingDecision): void;
24
+ export declare function logBlockingDecisionConflict(params: {
25
+ decision: BlockingDecision;
26
+ clientId: string;
27
+ currentStatus: BlockingDecisionStatus;
28
+ elapsedMs: number;
29
+ reason: string;
30
+ resolvedBy: ResolvedBy;
31
+ }): void;
32
+ export declare function logVgeLateResponseDropped(params: {
33
+ correlationId: string;
34
+ currentStatus: string;
35
+ elapsedMs: number;
36
+ lateVgeDecision: GuardResponseSummary;
37
+ localRequestId: string;
38
+ }): void;
39
+ interface GuardResponseSummary {
40
+ arbiterSignal?: string;
41
+ decision?: string;
42
+ id?: string | null;
43
+ ruleAction?: string;
44
+ score?: number;
45
+ }
46
+ export declare function logLegacyPendingEscalationDropped(params: {
47
+ sessionId: string;
48
+ escalation: Escalation;
49
+ }): void;
50
+ export {};
51
+ //# sourceMappingURL=audit-decisions.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"audit-decisions.d.ts","sourceRoot":"","sources":["../../src/daemon/audit-decisions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAOvH,KAAK,UAAU,GACX,iBAAiB,GACjB,qBAAqB,GACrB,WAAW,GACX,iBAAiB,GACjB,gBAAgB,GAChB,mBAAmB,CAAC;AA8CxB,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,GAAE;IAAE,eAAe,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAAA;CAAO,GACvE,IAAI,CASN;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAM3E;AAED,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAKhF;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAKjF;AAED,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAKnF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,aAAa,GAAG,kBAAkB,GAAG,YAAY,CAAC;IACpE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;CACzD,GAAG,IAAI,CAwBP;AAED,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAenF;AAED,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAepF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,sBAAsB,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;CACxB,GAAG,IAAI,CAWP;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,oBAAoB,CAAC;IACtC,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,IAAI,CAaP;AAED,UAAU,oBAAoB;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iCAAiC,CAAC,MAAM,EAAE;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;CACxB,GAAG,IAAI,CAaP"}