@wrongstack/core 0.284.1 → 0.286.0

package/dist/security/index.js

@@ -1,8 +1,3 @@
-import { randomBytes, createCipheriv, createDecipheriv, scryptSync } from 'crypto';
-import * as fs2 from 'fs';
-import * as fs from 'fs/promises';
-import * as path from 'path';
-
 // src/security/secret-scrubber.ts
 var PATTERNS = [
   // Anchored at the start where possible so partial matches inside larger
@@ -191,6 +186,17 @@ var DefaultSecretScrubber = class {
     return visit(obj);
   }
 };
+
+// src/security/secret-vault.ts
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes2, scryptSync } from "node:crypto";
+import * as fs2 from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as path2 from "node:path";
+
+// src/utils/atomic-write.ts
+import { randomBytes } from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
 async function atomicWrite(targetPath, content, opts = {}) {
   const dir = path.dirname(targetPath);
   await fs.mkdir(dir, { recursive: true });
@@ -253,7 +259,7 @@ async function renameWithRetry(from, to) {
       if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
         throw err;
       }
-      await new Promise((resolve2) => setTimeout(resolve2, delays[i]));
+      await new Promise((resolve) => setTimeout(resolve, delays[i]));
     }
   }
   throw lastErr;
@@ -326,7 +332,7 @@ function toErrorMessage(err) {
 // src/utils/expect-defined.ts
 function expectDefined(value, label) {
   if (value === null || value === void 0) {
-    const err = new Error("Expected value to be defined");
+    const err = new Error(label ? `Expected ${label} to be defined` : "Expected value to be defined");
     err.name = "ExpectDefinedError";
     throw err;
   }
@@ -571,6 +577,49 @@ function encryptedPrefixForVersion(version) {
   return `enc:v${version}:`;
 }
 
+// src/security/config-secrets.ts
+function decryptConfigSecrets(cfg, vault, opts) {
+  const warn = opts?.warn ?? ((msg) => console.warn(msg));
+  return walk(cfg, vault, (v, key) => {
+    try {
+      return vault.decrypt(v);
+    } catch (err) {
+      warn(
+        `[secret-vault] Failed to decrypt "${key}": ${err instanceof Error ? err.message : err}`
+      );
+      return "";
+    }
+  });
+}
+function encryptConfigSecrets(cfg, vault, _opts) {
+  return walk(cfg, vault, (v) => vault.encrypt(v));
+}
+function walk(node, vault, transform) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walk(item, vault, transform));
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField(k)) {
+      out[k] = transform(v, k);
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walk(v, vault, transform);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key)/i;
+var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
+function isSecretField(name) {
+  const lc = name.toLowerCase();
+  if (NON_SECRET_OVERRIDES.has(lc)) return false;
+  return SECRET_KEY_PATTERN.test(lc);
+}
+
 // src/security/secret-vault.ts
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
@@ -602,8 +651,8 @@ function deriveKEK(passphrase, salt) {
   });
 }
 function wrapDataKey(dataKey, keyVersion, passphrase) {
-  const salt = randomBytes(KEK_SALT_BYTES);
-  const iv = randomBytes(IV_BYTES);
+  const salt = randomBytes2(KEK_SALT_BYTES);
+  const iv = randomBytes2(IV_BYTES);
   const kek = deriveKEK(passphrase, salt);
   const cipher = createCipheriv(ALGO, kek, iv);
   const ct = Buffer.concat([cipher.update(dataKey), cipher.final()]);
@@ -656,31 +705,40 @@ function unwrapDataKey(buf, keyFile) {
     });
   }
 }
-function checkKeyFilePermissions(keyFile) {
+function checkKeyFilePermissions(keyFile, opts) {
   if (process.platform === "win32") return;
+  const warn = opts?.warn ?? ((msg) => console.warn(msg));
   try {
     const stat2 = fs2.statSync(keyFile);
     const actualMode = stat2.mode & 511;
     if (actualMode !== KEY_FILE_MODE) {
-      console.warn(JSON.stringify({
-        level: "warn",
-        event: "vault.key_file_wrong_permissions",
-        message: `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Run: chmod ${KEY_FILE_MODE.toString(8)} ${keyFile}`,
-        keyFile,
-        expectedMode: KEY_FILE_MODE,
-        actualMode,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
+      warn(
+        `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Run: chmod ${KEY_FILE_MODE.toString(8)} ${keyFile}`
+      );
     }
   } catch {
   }
 }
 var DefaultSecretVault = class {
   keyFile;
+  logger;
   key;
   _keyVersion = 1;
   constructor(opts) {
     this.keyFile = opts.keyFile;
+    this.logger = opts.logger;
+  }
+  /**
+   * Emit a structured warning. Uses the configured Logger when available;
+   * falls back to console.warn(JSON) so warnings are never silently dropped
+   * during early boot.
+   */
+  logWarn(msg, ctx) {
+    if (this.logger) {
+      this.logger.warn(msg, ctx);
+    } else {
+      console.warn(JSON.stringify({ ...ctx, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    }
   }
   /** Current key version. Starts at 1; incremented by rotateKey(). */
   get keyVersion() {
@@ -693,7 +751,7 @@ var DefaultSecretVault = class {
   encrypt(plaintext) {
     if (this.isEncrypted(plaintext)) return plaintext;
     const key = this.loadOrCreateKey();
-    const iv = randomBytes(IV_BYTES);
+    const iv = randomBytes2(IV_BYTES);
     const cipher = createCipheriv(ALGO, key, iv);
     const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
     const tag = cipher.getAuthTag();
@@ -746,9 +804,9 @@ var DefaultSecretVault = class {
    */
   rotateKey() {
     const oldVersion = this._keyVersion;
-    const newKey = randomBytes(KEY_BYTES);
+    const newKey = randomBytes2(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs2.mkdirSync(path.dirname(this.keyFile), { recursive: true });
+    fs2.mkdirSync(path2.dirname(this.keyFile), { recursive: true });
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       fs2.writeFileSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase), { mode: 384 });
@@ -759,7 +817,7 @@ var DefaultSecretVault = class {
       newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
       fs2.writeFileSync(this.keyFile, keyFileBuf, { mode: 384 });
     }
-    checkKeyFilePermissions(this.keyFile);
+    checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
     this.key = newKey;
     this._keyVersion = newVersion;
     return { oldVersion, newVersion };
@@ -778,7 +836,7 @@ var DefaultSecretVault = class {
       fs2.writeFileSync(this.keyFile, wrapDataKey(this.key, this._keyVersion, passphrase), {
         mode: 384
       });
-      checkKeyFilePermissions(this.keyFile);
+      checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
     } catch {
     }
   }
@@ -790,13 +848,13 @@ var DefaultSecretVault = class {
         const { key: key2, version } = unwrapDataKey(buf, this.keyFile);
         this.key = key2;
         this._keyVersion = version;
-        checkKeyFilePermissions(this.keyFile);
+        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
         return this.key;
       }
       if (buf.length === KEY_BYTES) {
         this.key = buf;
         this._keyVersion = 1;
-        checkKeyFilePermissions(this.keyFile);
+        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
         this.migrateToWrappedIfPassphrase();
         return this.key;
       }
@@ -820,7 +878,7 @@ var DefaultSecretVault = class {
         }
         this.key = Buffer.from(key2);
         this._keyVersion = version;
-        checkKeyFilePermissions(this.keyFile);
+        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
         this.migrateToWrappedIfPassphrase();
         return this.key;
       }
@@ -832,8 +890,8 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs2.mkdirSync(path.dirname(this.keyFile), { recursive: true });
-    const key = randomBytes(KEY_BYTES);
+    fs2.mkdirSync(path2.dirname(this.keyFile), { recursive: true });
+    const key = randomBytes2(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
     try {
@@ -845,13 +903,13 @@ var DefaultSecretVault = class {
         const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
         this.key = winnerKey;
         this._keyVersion = version;
-        checkKeyFilePermissions(this.keyFile);
+        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
         return this.key;
       }
       if (buf.length === KEY_BYTES) {
         this.key = buf;
         this._keyVersion = 1;
-        checkKeyFilePermissions(this.keyFile);
+        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
         return this.key;
       }
       if (buf.length === VERSIONED_KEY_FILE_SIZE) {
@@ -867,7 +925,7 @@ var DefaultSecretVault = class {
         const winnerKey = buf.subarray(KEY_FILE_MAGIC.length + 1);
         this.key = Buffer.from(winnerKey);
         this._keyVersion = version;
-        checkKeyFilePermissions(this.keyFile);
+        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
         return this.key;
       }
       throw new ConfigError({
@@ -881,64 +939,23 @@ var DefaultSecretVault = class {
     return key;
   }
 };
-function decryptConfigSecrets(cfg, vault, opts) {
-  const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  return walk(cfg, vault, (v, key) => {
-    try {
-      return vault.decrypt(v);
-    } catch (err) {
-      warn(
-        `[secret-vault] Failed to decrypt "${key}": ${err instanceof Error ? err.message : err}`
-      );
-      return "";
-    }
-  });
-}
-function encryptConfigSecrets(cfg, vault, _opts) {
-  return walk(cfg, vault, (v) => vault.encrypt(v));
-}
-function walk(node, vault, transform) {
-  if (node === null || node === void 0) return node;
-  if (typeof node !== "object") return node;
-  if (Array.isArray(node)) {
-    return node.map((item) => walk(item, vault, transform));
-  }
-  const out = /* @__PURE__ */ Object.create(null);
-  for (const [k, v] of Object.entries(node)) {
-    if (typeof v === "string" && isSecretField(k)) {
-      out[k] = transform(v, k);
-    } else if (typeof v === "object" && v !== null) {
-      out[k] = walk(v, vault, transform);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key)/i;
-var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
-function isSecretField(name) {
-  const lc = name.toLowerCase();
-  if (NON_SECRET_OVERRIDES.has(lc)) return false;
-  return SECRET_KEY_PATTERN.test(lc);
-}
 async function rewriteConfigEncrypted(configPath, vault, patch) {
   let current = {};
   try {
-    const raw = await fs.readFile(configPath, "utf8");
+    const raw = await fsp.readFile(configPath, "utf8");
     current = JSON.parse(raw);
   } catch {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fs.mkdir(path.dirname(configPath), { recursive: true });
+  await fsp.mkdir(path2.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions(configPath);
 }
 async function migratePlaintextSecrets(configPath, vault, logger) {
   let raw;
   try {
-    raw = await fs.readFile(configPath, "utf8");
+    raw = await fsp.readFile(configPath, "utf8");
   } catch {
     return { migrated: 0, file: configPath };
   }
@@ -964,7 +981,7 @@ async function rotateConfigKeys(configPath, vault, logger) {
   const warn = logger?.warn ?? ((msg) => console.warn(msg));
   let raw;
   try {
-    raw = await fs.readFile(configPath, "utf8");
+    raw = await fsp.readFile(configPath, "utf8");
   } catch {
     const { oldVersion: oldVersion2, newVersion: newVersion2 } = vault.rotateKey();
     log(`[secret-vault] Key rotated (v${oldVersion2} \u2192 v${newVersion2}) \u2014 no config file to re-encrypt`);
@@ -1045,8 +1062,8 @@ async function restrictFilePermissions(filePath, opts) {
   const warn = opts?.warn ?? ((msg) => console.warn(msg));
   if (process.platform === "win32") {
     try {
-      const { execFile } = await import('child_process');
-      const { promisify } = await import('util');
+      const { execFile } = await import("node:child_process");
+      const { promisify } = await import("node:util");
       const execFileAsync = promisify(execFile);
       const user = windowsAccountName();
       if (!user) {
@@ -1063,7 +1080,7 @@ async function restrictFilePermissions(filePath, opts) {
     }
   } else {
     try {
-      await fs.chmod(filePath, 384);
+      await fsp.chmod(filePath, 384);
     } catch {
     }
   }
@@ -1095,6 +1112,9 @@ function walkCount(node, vault, counter) {
   return out;
 }
 
+// src/security/permission-policy.ts
+import * as fs3 from "node:fs/promises";
+
 // src/security/capabilities.ts
 var ToolCapabilities = {
   /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
@@ -1158,7 +1178,7 @@ var DANGEROUS_FOR_SUBAGENTS = [
   ToolCapabilities.CONFIG_MUTATE,
   ToolCapabilities.PACKAGE_INSTALL
 ];
-[
+var WIDE_SUBAGENT_CAPABILITIES = [
   ToolCapabilities.FS_READ,
   ToolCapabilities.FS_WRITE,
   ToolCapabilities.NET_OUTBOUND,
@@ -1196,6 +1216,173 @@ function getDangerousCapabilities(toolOrCaps) {
   );
 }
 
+// src/security/permission-policy-schema.ts
+var TRUST_POLICY_SCHEMA_VERSION = 1;
+var TRUST_POLICY_LIMITS = Object.freeze({
+  maxTools: 1e3,
+  maxPatternsPerRule: 1e3,
+  maxToolNameChars: 256,
+  maxPatternChars: 4096
+});
+var TRUST_POLICY_JSON_SCHEMA = Object.freeze({
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "https://wrongstack.dev/schemas/trust-policy-v1.json",
+  title: "WrongStack Trust Policy",
+  type: "object",
+  maxProperties: TRUST_POLICY_LIMITS.maxTools,
+  propertyNames: {
+    minLength: 1,
+    maxLength: TRUST_POLICY_LIMITS.maxToolNameChars,
+    not: { enum: ["__proto__", "prototype", "constructor"] }
+  },
+  additionalProperties: {
+    type: "object",
+    additionalProperties: false,
+    properties: {
+      allow: {
+        type: "array",
+        maxItems: TRUST_POLICY_LIMITS.maxPatternsPerRule,
+        items: { type: "string", minLength: 1, maxLength: TRUST_POLICY_LIMITS.maxPatternChars }
+      },
+      deny: {
+        type: "array",
+        maxItems: TRUST_POLICY_LIMITS.maxPatternsPerRule,
+        items: { type: "string", minLength: 1, maxLength: TRUST_POLICY_LIMITS.maxPatternChars }
+      },
+      auto: { type: "boolean" },
+      trustWorkdir: { type: "boolean" },
+      denyPrivate: { type: "boolean" }
+    }
+  }
+});
+var RULE_FIELDS = /* @__PURE__ */ new Set(["allow", "deny", "auto", "trustWorkdir", "denyPrivate"]);
+var UNSAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function error(diagnostics, code, path3, message) {
+  diagnostics.push({ severity: "error", code, path: path3, message });
+}
+function validatePatterns(value, path3, diagnostics) {
+  if (!Array.isArray(value)) {
+    error(diagnostics, "invalid_pattern_list", path3, "must be an array of strings");
+    return void 0;
+  }
+  if (value.length > TRUST_POLICY_LIMITS.maxPatternsPerRule) {
+    error(
+      diagnostics,
+      "too_many_patterns",
+      path3,
+      `must contain at most ${TRUST_POLICY_LIMITS.maxPatternsPerRule} patterns`
+    );
+    return void 0;
+  }
+  const patterns = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, pattern] of value.entries()) {
+    const itemPath = `${path3}[${index}]`;
+    if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > TRUST_POLICY_LIMITS.maxPatternChars) {
+      error(
+        diagnostics,
+        "invalid_pattern",
+        itemPath,
+        `must be a non-empty string up to ${TRUST_POLICY_LIMITS.maxPatternChars} characters`
+      );
+      continue;
+    }
+    if (seen.has(pattern)) {
+      diagnostics.push({
+        severity: "warning",
+        code: "duplicate_pattern",
+        path: itemPath,
+        message: "duplicates an earlier pattern and was normalized away"
+      });
+      continue;
+    }
+    seen.add(pattern);
+    patterns.push(pattern);
+  }
+  return patterns;
+}
+function validateTrustPolicy(value) {
+  const diagnostics = [];
+  if (!isRecord(value)) {
+    return {
+      ok: false,
+      diagnostics: [
+        {
+          severity: "error",
+          code: "invalid_root",
+          path: "$",
+          message: "trust policy must be an object"
+        }
+      ]
+    };
+  }
+  const entries = Object.entries(value);
+  if (entries.length > TRUST_POLICY_LIMITS.maxTools) {
+    error(
+      diagnostics,
+      "too_many_tools",
+      "$",
+      `must contain at most ${TRUST_POLICY_LIMITS.maxTools} tool rules`
+    );
+  }
+  const policy = {};
+  for (const [toolName, rawRule] of entries.slice(0, TRUST_POLICY_LIMITS.maxTools)) {
+    const toolPath = `$[${JSON.stringify(toolName)}]`;
+    if (toolName.length === 0 || toolName.length > TRUST_POLICY_LIMITS.maxToolNameChars) {
+      error(
+        diagnostics,
+        "invalid_tool_name",
+        toolPath,
+        `tool name must be 1-${TRUST_POLICY_LIMITS.maxToolNameChars} characters`
+      );
+      continue;
+    }
+    if (UNSAFE_PROPERTY_NAMES.has(toolName)) {
+      error(
+        diagnostics,
+        "unsafe_tool_name",
+        toolPath,
+        "reserved object property names are not valid tool rules"
+      );
+      continue;
+    }
+    if (!isRecord(rawRule)) {
+      error(diagnostics, "invalid_rule", toolPath, "tool rule must be an object");
+      continue;
+    }
+    for (const field of Object.keys(rawRule)) {
+      if (!RULE_FIELDS.has(field)) {
+        error(
+          diagnostics,
+          "unknown_field",
+          `${toolPath}.${field}`,
+          `unknown policy field "${field}"`
+        );
+      }
+    }
+    const rule = {};
+    for (const field of ["allow", "deny"]) {
+      if (rawRule[field] === void 0) continue;
+      const patterns = validatePatterns(rawRule[field], `${toolPath}.${field}`, diagnostics);
+      if (patterns) rule[field] = patterns;
+    }
+    for (const field of ["auto", "trustWorkdir", "denyPrivate"]) {
+      const setting = rawRule[field];
+      if (setting === void 0) continue;
+      if (typeof setting !== "boolean") {
+        error(diagnostics, "invalid_boolean", `${toolPath}.${field}`, "must be a boolean");
+      } else {
+        rule[field] = setting;
+      }
+    }
+    policy[toolName] = rule;
+  }
+  return diagnostics.some((diagnostic) => diagnostic.severity === "error") ? { ok: false, diagnostics } : { ok: true, policy, diagnostics };
+}
+
 // src/utils/lru-cache.ts
 var LruCache = class {
   store = /* @__PURE__ */ new Map();
@@ -1230,253 +1417,13 @@ var LruCache = class {
     return this.store.size;
   }
 };
-var CATASTROPHIC_PATTERNS = [
-  /\b(?:mkfs(?:\.[a-z0-9]+)?|mke2fs|newfs)\b/i,
-  // make a filesystem — wipes a partition
-  /\bformat\s+[A-Za-z]:/i,
-  // format C: — wipes a Windows volume
-  /\bdiskpart\b/i,
-  // Windows partition editor
-  /\bdd\b[^|]*\bof=(?:\/dev\/|\\\\[.?]\\)/i,
-  // dd writing straight to a raw device
-  />\s*\/dev\/(?:sd|hd|nvme|disk|mapper|vd)/i,
-  // redirect into a raw block device
-  /:\(\)\s*\{\s*:\|:&\s*\}\s*;/
-  // classic fork bomb
-];
-var HIGH_IMPACT_PATTERNS = [
-  /\b(?:curl|wget|fetch|httpie|http|irm|iwr|Invoke-WebRequest|Invoke-RestMethod)\b[\s\S]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash|zsh|fish|pwsh|powershell|iex|Invoke-Expression)\b/i,
-  /\b(?:powershell|pwsh)(?:\.exe)?\b[\s\S]{0,120}-(?:enc|encodedcommand)\b/i,
-  /\b(?:shutdown|reboot)\b/i
-];
-var CATASTROPHIC_POSIX_ROOTS = /* @__PURE__ */ new Set([
-  "/etc",
-  "/usr",
-  "/bin",
-  "/sbin",
-  "/lib",
-  "/lib64",
-  "/var",
-  "/boot",
-  "/dev",
-  "/sys",
-  "/proc",
-  "/opt",
-  "/root",
-  "/home",
-  "/srv",
-  "/run",
-  "/system",
-  "/library",
-  "/applications",
-  "/users"
-]);
-var CATASTROPHIC_WIN_SUBDIRS = /* @__PURE__ */ new Set([
-  "windows",
-  "system32",
-  "winnt",
-  "program files",
-  "program files (x86)",
-  "programdata",
-  "users"
-]);
-var SHELL_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", "|", ";", ">", ">>", "<", "2>", "2>>"]);
+
+// src/security/yolo-risk.ts
 function getInputString(input, key) {
   if (!input || typeof input !== "object") return void 0;
   const value = input[key];
   return typeof value === "string" ? value : void 0;
 }
-function pathLooksInsideProject(rawPath, projectRoot) {
-  if (!projectRoot) return false;
-  if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path.resolve(projectRoot, rawPath);
-  const relative2 = path.relative(projectRoot, resolved);
-  return !!relative2 && !relative2.startsWith("..") && !path.isAbsolute(relative2);
-}
-function tokenizeShell(command) {
-  return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
-}
-function commandSegment(tokens, start) {
-  const out = [];
-  for (let i = start; i < tokens.length; i++) {
-    const token = tokens[i];
-    if (token === void 0 || SHELL_OPERATORS.has(token)) break;
-    out.push(token);
-  }
-  return out;
-}
-function hasShortFlag(args, letters) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const arg of args) {
-    if (!arg.startsWith("-") || arg.startsWith("--")) continue;
-    for (const ch of arg.replace(/^-+/, "")) seen.add(ch.toLowerCase());
-  }
-  return letters.split("").every((letter) => seen.has(letter));
-}
-function hasRecursiveForceDelete(command, projectRoot) {
-  const tokens = tokenizeShell(command);
-  for (let i = 0; i < tokens.length; i++) {
-    const token = tokens[i]?.toLowerCase();
-    if (!token) continue;
-    if (token === "rm" || token === "rmdir") {
-      const args = commandSegment(tokens, i + 1);
-      const recursiveForce = hasShortFlag(args, "rf") || args.some((arg) => arg === "--recursive") && args.some((arg) => arg === "--force");
-      if (recursiveForce) {
-        const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
-        if (targets.length > 0 && targets.every((target) => target.trim().length === 0)) {
-          continue;
-        }
-        if (targets.length === 0) return true;
-        if (targets.some(isCatastrophicDeleteTarget)) return true;
-        if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
-      }
-    }
-    if (token === "remove-item" || token === "ri") {
-      const args = commandSegment(tokens, i + 1).map((arg) => arg.toLowerCase());
-      const recurse = args.some((arg) => arg === "-recurse" || arg === "-r");
-      const force = args.some((arg) => arg === "-force" || arg === "-f");
-      if (recurse && force && !args.includes("-whatif")) {
-        const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
-        if (targets.length === 0) return true;
-        if (targets.some(isCatastrophicDeleteTarget)) return true;
-        if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
-      }
-    }
-    if (token === "rd" || token === "rmdir") {
-      const args = commandSegment(tokens, i + 1).map((arg) => arg.toLowerCase());
-      if (args.includes("/s")) {
-        const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
-        if (targets.length === 0) return true;
-        if (targets.some(isCatastrophicDeleteTarget)) return true;
-        if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
-      }
-    }
-  }
-  return false;
-}
-function hasGitHistoryRewrite(command) {
-  const tokens = tokenizeShell(command).map((token) => token.toLowerCase());
-  for (let i = 0; i < tokens.length; i++) {
-    if (tokens[i] !== "git") continue;
-    const args = commandSegment(tokens, i + 1);
-    if (args.includes("reset") && args.some((arg) => arg === "--hard" || arg.startsWith("--hard="))) {
-      return true;
-    }
-    const cleanIdx = args.indexOf("clean");
-    if (cleanIdx >= 0) {
-      const cleanArgs = args.slice(cleanIdx + 1);
-      if (cleanArgs.some((arg) => arg === "-f" || arg === "--force" || /^-[a-z]*f[a-z]*$/i.test(arg))) {
-        return true;
-      }
-    }
-    const pushIdx = args.indexOf("push");
-    if (pushIdx >= 0) {
-      const pushArgs = args.slice(pushIdx + 1);
-      if (pushArgs.some(
-        (arg) => arg === "-f" || arg === "--force" || arg === "--force-with-lease" || arg.startsWith("--force=") || arg.startsWith("--force-with-lease=")
-      )) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-function hasExternalPublish(command) {
-  const tokens = tokenizeShell(command).map((token) => token.toLowerCase());
-  for (let i = 0; i < tokens.length; i++) {
-    const cmd = tokens[i];
-    if (!cmd) continue;
-    const args = commandSegment(tokens, i + 1);
-    if (["npm", "pnpm", "yarn", "bun"].includes(cmd) && (args.includes("publish") || args.includes("deploy"))) {
-      return true;
-    }
-    if (cmd === "cargo" && (args.includes("publish") || args.includes("yank"))) return true;
-    if ((cmd === "docker" || cmd === "podman") && args.includes("push")) return true;
-    if (cmd === "kubectl") {
-      const deleteIdx = args.indexOf("delete");
-      if (deleteIdx >= 0 && (args[deleteIdx + 1] === "namespace" || args[deleteIdx + 1] === "ns")) {
-        return true;
-      }
-      if (args.includes("drain")) return true;
-    }
-  }
-  return false;
-}
-function hasFindExec(command) {
-  const tokens = tokenizeShell(command).map((token) => token.toLowerCase());
-  for (let i = 0; i < tokens.length; i++) {
-    if (tokens[i] !== "find") continue;
-    const args = commandSegment(tokens, i + 1);
-    if (args.some((arg) => arg === "-exec" || arg === "-ok" || arg === "-execdir")) return true;
-  }
-  return false;
-}
-function isCatastrophicDeleteTarget(rawTarget) {
-  const t = rawTarget.replace(/^['"]|['"]$/g, "").trim();
-  if (!t) return false;
-  if (t === "*" || t === "." || t === "./" || t === ".\\" || t === "./*" || t === ".\\*") return true;
-  const s = t.replace(/[\\/]\*+$/, "").replace(/[\\/]+$/, "");
-  if (s === "") return true;
-  if (s === "~" || /^\$HOME$/i.test(s) || /^%USERPROFILE%$/i.test(s)) return true;
-  if (/^[A-Za-z]:$/.test(s)) return true;
-  const norm = s.toLowerCase().replace(/\\/g, "/");
-  if (CATASTROPHIC_POSIX_ROOTS.has(norm)) return true;
-  const win = norm.match(/^[a-z]:\/([^/]+)$/);
-  if (win?.[1] && CATASTROPHIC_WIN_SUBDIRS.has(win[1])) return true;
-  return false;
-}
-function hasCatastrophicDelete(command) {
-  const tokens = tokenizeShell(command);
-  for (let i = 0; i < tokens.length; i++) {
-    const token = tokens[i]?.toLowerCase();
-    if (!token) continue;
-    if (token === "rm") {
-      const args = tokens.slice(i + 1);
-      const recursiveOrForce = args.some(
-        (arg) => /^-[^-]*[rf]/i.test(arg) || arg === "--recursive" || arg === "--force" || arg === "--no-preserve-root"
-      );
-      if (!recursiveOrForce) continue;
-      const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
-      if (targets.length === 0) return true;
-      if (targets.some(isCatastrophicDeleteTarget)) return true;
-    }
-    if (token === "remove-item" || token === "ri") {
-      const args = tokens.slice(i + 1);
-      const recursive = args.some((arg) => {
-        const a = arg.toLowerCase();
-        return a === "-recurse" || a === "-force";
-      });
-      if (!recursive) continue;
-      const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
-      if (targets.some(isCatastrophicDeleteTarget)) return true;
-    }
-    if (token === "rmdir" || token === "rd") {
-      const args = tokens.slice(i + 1);
-      const recursive = args.some((arg) => arg.toLowerCase() === "/s");
-      if (!recursive) continue;
-      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
-      if (targets.some(isCatastrophicDeleteTarget)) return true;
-    }
-    if (token === "del" || token === "erase") {
-      const args = tokens.slice(i + 1);
-      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
-      if (targets.some(isCatastrophicDeleteTarget)) return true;
-    }
-  }
-  return false;
-}
-function isClearlyDestructiveBashCommand(command, projectRoot) {
-  const trimmed = command.trim();
-  if (!trimmed) return false;
-  if (hasRecursiveForceDelete(trimmed, projectRoot)) return true;
-  if (hasGitHistoryRewrite(trimmed)) return true;
-  if (hasExternalPublish(trimmed)) return true;
-  if (hasFindExec(trimmed)) return true;
-  if (hasCatastrophicDelete(trimmed)) return true;
-  if (CATASTROPHIC_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
-  if (HIGH_IMPACT_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
-  return false;
-}
 
 // src/security/permission-policy.ts
 function matchesTrust(patterns, subject) {
@@ -1555,7 +1502,7 @@ var DefaultPermissionPolicy = class {
   trustFile;
   yolo;
   yoloDestructive;
-  /** When true, destructive ops still require confirmation even in YOLO mode. */
+  /** Deprecated compatibility flag; no longer gates YOLO calls. */
   confirmDestructive;
   /**
    * Session-scoped "soft deny" map. When the user presses 'n' (block once),
@@ -1590,7 +1537,7 @@ var DefaultPermissionPolicy = class {
   /**
    * Evaluate-result cache. Keyed by `tool.name::subject` so repeated calls
    * with the same tool+input skip namespace matching, subject computation,
-   * pattern matching (matchAny), and YOLO destructive gating.
+   * and pattern matching (matchAny).
    *
    * Cleared on any state change (reload, trust, deny, yolo toggle) because
    * the result depends on the full policy state. The write-tool smart-bypass
@@ -1604,11 +1551,13 @@ var DefaultPermissionPolicy = class {
    * the LRU evicts the least-recently-used entries first.
    */
   _evalCache = new LruCache(500);
+  policyDiagnostics = [];
+  policyInvalid = false;
   constructor(opts) {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
     this.yoloDestructive = opts.yoloDestructive ?? opts.forceAllYolo ?? false;
-    this.confirmDestructive = true;
+    this.confirmDestructive = opts.confirmDestructive ?? false;
     this.promptDelegate = opts.promptDelegate;
   }
   /**
@@ -1638,22 +1587,59 @@ var DefaultPermissionPolicy = class {
   getYoloDestructive() {
     return this.yoloDestructive;
   }
-  /** Toggle destructive confirmation gate (only meaningful when yolo is active). */
-  setConfirmDestructive(_enabled) {
-    if (!this.confirmDestructive) this._evalCache.clear();
-    this.confirmDestructive = true;
+  /** Toggle deprecated destructive confirmation compatibility flag. */
+  setConfirmDestructive(enabled) {
+    if (this.confirmDestructive !== enabled) this._evalCache.clear();
+    this.confirmDestructive = enabled;
   }
-  /** Check whether destructive confirmation gate is active. */
+  /** Check deprecated destructive confirmation compatibility flag. */
   getConfirmDestructive() {
     return this.confirmDestructive;
   }
+  /** Read-only diagnostics for policy inspector/editor surfaces. */
+  getPolicyDiagnostics() {
+    return this.policyDiagnostics.map((diagnostic) => ({ ...diagnostic }));
+  }
   async reload() {
+    this.policyDiagnostics = [];
+    this.policyInvalid = false;
     try {
-      const raw = await fs.readFile(this.trustFile, "utf8");
+      const raw = await fs3.readFile(this.trustFile, "utf8");
       const parsed = safeParse(raw);
-      if (parsed.ok && parsed.value) this.policy = parsed.value;
-    } catch {
+      if (!parsed.ok) {
+        this.policy = {};
+        this.policyInvalid = true;
+        this.policyDiagnostics = [
+          {
+            severity: "error",
+            code: "invalid_json",
+            path: "$",
+            message: parsed.error ?? "trust policy is not valid JSON"
+          }
+        ];
+      } else {
+        const validation = validateTrustPolicy(parsed.value);
+        this.policyDiagnostics = validation.diagnostics;
+        if (validation.ok) {
+          this.policy = validation.policy;
+        } else {
+          this.policy = {};
+          this.policyInvalid = true;
+        }
+      }
+    } catch (err) {
       this.policy = {};
+      if (err.code !== "ENOENT") {
+        this.policyInvalid = true;
+        this.policyDiagnostics = [
+          {
+            severity: "error",
+            code: "read_error",
+            path: "$",
+            message: err instanceof Error ? err.message : String(err)
+          }
+        ];
+      }
     }
     this.wildcardEntries = [];
     for (const [key, val] of Object.entries(this.policy)) {
@@ -1666,6 +1652,13 @@ var DefaultPermissionPolicy = class {
   }
   async evaluate(tool, input, ctx) {
     if (!this.loaded) await this.reload();
+    if (this.policyInvalid) {
+      return {
+        permission: "deny",
+        source: "deny",
+        reason: "trust policy is invalid; refusing tool execution until it is repaired"
+      };
+    }
     const namespaceEntry = this.findNamespaceEntry(tool.name);
     const entry = this.policy[tool.name] ?? namespaceEntry;
     const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
@@ -1698,29 +1691,6 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(cacheKey, decision);
       return decision;
     }
-    if (this.yolo) {
-      const destructive = this.isDestructiveYoloCall(tool, input, ctx);
-      if (destructive) {
-        if (this.promptDelegate) {
-          const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
-          if (decision === "deny") {
-            await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
-            return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
-          }
-          return {
-            permission: decision === "yes" || decision === "always" ? "auto" : "deny",
-            source: "user",
-            reason: "destructive yolo approved for this call"
-          };
-        }
-        return {
-          permission: "confirm",
-          source: "yolo_destructive",
-          riskTier: "destructive",
-          reason: "destructive tool needs explicit approval in YOLO mode"
-        };
-      }
-    }
     if (entry?.allow && subject && matchesTrust(entry.allow, subject)) {
       const decision = { permission: "auto", source: "trust", reason: "matched allow pattern" };
       this._evalCache.set(cacheKey, decision);
@@ -1802,47 +1772,6 @@ var DefaultPermissionPolicy = class {
     }
     return { permission: "confirm", source: "default" };
   }
-  // Capability-based destructive check (preferred over name-based)
-  isDestructiveByCapability(tool) {
-    const caps = tool.capabilities ?? [];
-    if (caps.includes(ToolCapabilities.SHELL_ARBITRARY)) return true;
-    if (caps.includes(ToolCapabilities.SHELL_RESTRICTED)) return true;
-    if (caps.includes(ToolCapabilities.SHELL_EXEC)) return true;
-    if (caps.includes(ToolCapabilities.FS_WRITE)) return true;
-    if (caps.includes(ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT)) return true;
-    return false;
-  }
-  isDestructiveYoloCall(tool, input, ctx) {
-    if (tool.name === "mcp_control") {
-      const action = getInputString(input, "action");
-      if (action === "list" || action === "search" || action === "activate" || action === "deactivate") {
-        return false;
-      }
-    }
-    if (this.isDestructiveByCapability(tool)) {
-      const caps = tool.capabilities ?? [];
-      if (caps.includes(ToolCapabilities.SHELL_ARBITRARY) || caps.includes(ToolCapabilities.SHELL_RESTRICTED) || caps.includes(ToolCapabilities.SHELL_EXEC)) {
-        const command = shellCommandLineFromInput(input);
-        return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : tool.riskTier === "destructive";
-      }
-      if (caps.includes(ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT)) return true;
-      if (caps.includes(ToolCapabilities.FS_WRITE)) {
-        const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
-        if (!targetPath || !ctx.projectRoot) return false;
-        return !pathLooksInsideProject(targetPath, ctx.projectRoot);
-      }
-    }
-    if (tool.name === "bash" || tool.name === "shell" || tool.name === "exec") {
-      const command = shellCommandLineFromInput(input);
-      return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : tool.riskTier === "destructive";
-    }
-    if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
-      const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
-      if (!targetPath || !ctx.projectRoot) return false;
-      return !pathLooksInsideProject(targetPath, ctx.projectRoot);
-    }
-    return tool.riskTier === "destructive";
-  }
   isSensitiveReadCall(tool, input) {
     const isReadTool = hasCapability(tool, ToolCapabilities.FS_READ) || tool.name === "read" || tool.name === "grep" || tool.name === "glob" || tool.name === "tree";
     if (isReadTool && inputPathLooksSensitive(input)) return true;
@@ -1859,6 +1788,9 @@ var DefaultPermissionPolicy = class {
   }
   async trust(rule) {
     if (!this.loaded) await this.reload();
+    if (this.policyInvalid) {
+      throw new Error("Cannot update trust rules while trust.json is invalid; repair it first.");
+    }
     const entry = this.policy[rule.tool] ?? {};
     entry.allow = Array.from(/* @__PURE__ */ new Set([...entry.allow ?? [], rule.pattern]));
     this.policy[rule.tool] = entry;
@@ -1877,6 +1809,9 @@ var DefaultPermissionPolicy = class {
   /** Persist a deny rule — this tool+pattern pair is permanently blocked. */
   async deny(rule) {
     if (!this.loaded) await this.reload();
+    if (this.policyInvalid) {
+      throw new Error("Cannot update deny rules while trust.json is invalid; repair it first.");
+    }
     const entry = this.policy[rule.tool] ?? {};
     entry.deny = Array.from(/* @__PURE__ */ new Set([...entry.deny ?? [], rule.pattern]));
     this.policy[rule.tool] = entry;
@@ -1950,7 +1885,25 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   async reload() {
   }
 };
-
-export { AutoApprovePermissionPolicy, DANGEROUS_FOR_SUBAGENTS, DefaultPermissionPolicy, DefaultSecretScrubber, DefaultSecretVault, ToolCapabilities, decryptConfigSecrets, encryptConfigSecrets, getDangerousCapabilities, hasCapability, hasDangerousCapabilityForSubagents, isSecretField, migratePlaintextSecrets, rewriteConfigEncrypted, rotateConfigKeys };
+export {
+  AutoApprovePermissionPolicy,
+  DANGEROUS_FOR_SUBAGENTS,
+  DefaultPermissionPolicy,
+  DefaultSecretScrubber,
+  DefaultSecretVault,
+  TRUST_POLICY_JSON_SCHEMA,
+  TRUST_POLICY_LIMITS,
+  TRUST_POLICY_SCHEMA_VERSION,
+  ToolCapabilities,
+  decryptConfigSecrets,
+  encryptConfigSecrets,
+  getDangerousCapabilities,
+  hasCapability,
+  hasDangerousCapabilityForSubagents,
+  isSecretField,
+  migratePlaintextSecrets,
+  rewriteConfigEncrypted,
+  rotateConfigKeys,
+  validateTrustPolicy
+};
 //# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map