@xrkseek/harness 0.3.11 → 0.4.0-rc.2

package/node_modules/@xrkseek/policy/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,cAAc,EACd,YAAY,EACZ,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,yBAAyB,GAC/B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/node_modules/@xrkseek/policy/dist/index.js

@@ -1,8 +1,9 @@
-export { assertPolicyAllow, createPolicyEngine, } from "./engine.js";
-export { allowProviderIdsOnly, allowToolNamesOnly, askToolNames, denyMcpConnect, denyProviderIds, denyToolNames, } from "./rules.js";
+export { assertPolicyAllow, createDefaultPolicyEngine, createPolicyEngine, DEFAULT_POLICY_VERDICTS, } from "./engine.js";
+export { PolicyGateError, policyWireError, } from "./wire-error.js";
+export { allowProviderIdsOnly, allowToolNamesOnly, askHostOpenActions, askToolNames, denyHostOpenActions, denyMcpConnect, denyMcpResourceServers, denyOfficeConnect, denyProviderIds, denySidebarEmbedSchemes, denySidebarFsOps, denyToolNames, } from "./rules.js";
 export { createPolicyToolCallGuard, createPolicyToolGuard, createPolicyToolPre, } from "./pipeline.js";
-export { READ_ONLY_DENIED_TOOLS, createReadOnlyToolPre, } from "./permission-pre.js";
+export { READ_ONLY_DENIED_TOOLS, createReadOnlyToolPre, createSessionReadOnlyToolPre, } from "./permission-pre.js";
 export { POLICY_RULESET_VERSION, PolicyRulesetParseError, createPolicyEngineFromRuleset, parsePolicyRuleset, } from "./ruleset.js";
-export { createPolicyEngineFromFile, loadPolicyRulesetFile, } from "./load.js";
+export { createPolicyEngineFromFile, decodePolicyRulesetText, loadPolicyRulesetFile, policyRulesetFormatFromPath, } from "./load.js";
 export { policyRulesetJsonSchema } from "./schema.js";
 //# sourceMappingURL=index.js.map

package/node_modules/@xrkseek/policy/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,GAExB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,eAAe,GAKhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,GAE5B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/node_modules/@xrkseek/policy/dist/load.d.ts

@@ -1,12 +1,20 @@
+import { type CreatePolicyEngineOptions } from "./engine.js";
 import { type PolicyRulesetJson } from "./ruleset.js";
 import type { PolicyEngine } from "./types.js";
-import type { CreatePolicyEngineOptions } from "./engine.js";
+export type PolicyRulesetFileFormat = "json" | "yaml" | "toml";
+/** Detect format from path extension (default json). */
+export declare function policyRulesetFormatFromPath(filePath: string): PolicyRulesetFileFormat;
 /**
- * Load and parse a policy ruleset JSON file.
- * Does not watch for changes — reload by calling again.
+ * Decode ruleset text into a plain object for {@link parsePolicyRuleset}.
+ * Same schema for JSON / YAML / TOML — no second engine.
+ */
+export declare function decodePolicyRulesetText(text: string, format: PolicyRulesetFileFormat, label?: string): unknown;
+/**
+ * Load and parse a policy ruleset file (`.json` / `.yaml` / `.yml` / `.toml`).
+ * Host watches `XRK_POLICY_FILE` and reloads via the same function.
  */
 export declare function loadPolicyRulesetFile(filePath: string): Promise<CreatePolicyEngineOptions>;
-/** Load file → create engine. */
+/** Load file → create engine (any supported format). */
 export declare function createPolicyEngineFromFile(filePath: string): Promise<PolicyEngine>;
 export type { PolicyRulesetJson };
 //# sourceMappingURL=load.d.ts.map

package/node_modules/@xrkseek/policy/dist/load.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../src/load.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7D;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,yBAAyB,CAAC,CAiBpC;AAED,iCAAiC;AACjC,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC,CAYvB;AAED,YAAY,EAAE,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../src/load.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/D,wDAAwD;AACxD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,GACf,uBAAuB,CAKzB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,uBAAuB,EAC/B,KAAK,SAAmB,GACvB,OAAO,CAmBT;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,yBAAyB,CAAC,CAcpC;AAED,wDAAwD;AACxD,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,YAAY,EAAE,iBAAiB,EAAE,CAAC"}

package/node_modules/@xrkseek/policy/dist/load.js

@@ -1,21 +1,51 @@
 import { readFile } from "node:fs/promises";
-import { createPolicyEngineFromRuleset, parsePolicyRuleset, } from "./ruleset.js";
+import path from "node:path";
+import yaml from "js-yaml";
+import { parse as parseToml } from "smol-toml";
+import { createPolicyEngine, } from "./engine.js";
+import { parsePolicyRuleset, } from "./ruleset.js";
+/** Detect format from path extension (default json). */
+export function policyRulesetFormatFromPath(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (ext === ".yaml" || ext === ".yml")
+        return "yaml";
+    if (ext === ".toml")
+        return "toml";
+    return "json";
+}
 /**
- * Load and parse a policy ruleset JSON file.
- * Does not watch for changes — reload by calling again.
+ * Decode ruleset text into a plain object for {@link parsePolicyRuleset}.
+ * Same schema for JSON / YAML / TOML — no second engine.
  */
-export async function loadPolicyRulesetFile(filePath) {
-    const text = await readFile(filePath, "utf8");
-    let raw;
+export function decodePolicyRulesetText(text, format, label = "policy ruleset") {
     try {
-        raw = JSON.parse(text);
+        if (format === "yaml") {
+            const raw = yaml.load(text);
+            if (raw === undefined || raw === null) {
+                throw new Error("empty YAML document");
+            }
+            return raw;
+        }
+        if (format === "toml") {
+            return parseToml(text);
+        }
+        return JSON.parse(text);
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        throw new Error(`policy ruleset ${filePath}: invalid JSON (${msg})`, {
+        throw new Error(`${label}: invalid ${format.toUpperCase()} (${msg})`, {
             cause: err,
         });
     }
+}
+/**
+ * Load and parse a policy ruleset file (`.json` / `.yaml` / `.yml` / `.toml`).
+ * Host watches `XRK_POLICY_FILE` and reloads via the same function.
+ */
+export async function loadPolicyRulesetFile(filePath) {
+    const text = await readFile(filePath, "utf8");
+    const format = policyRulesetFormatFromPath(filePath);
+    const raw = decodePolicyRulesetText(text, format, `policy ruleset ${filePath}`);
     try {
         return parsePolicyRuleset(raw);
     }
@@ -24,19 +54,8 @@ export async function loadPolicyRulesetFile(filePath) {
         throw new Error(`policy ruleset ${filePath}: ${msg}`, { cause: err });
     }
 }
-/** Load file → create engine. */
+/** Load file → create engine (any supported format). */
 export async function createPolicyEngineFromFile(filePath) {
-    const text = await readFile(filePath, "utf8");
-    let raw;
-    try {
-        raw = JSON.parse(text);
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        throw new Error(`policy ruleset ${filePath}: invalid JSON (${msg})`, {
-            cause: err,
-        });
-    }
-    return createPolicyEngineFromRuleset(raw);
+    return createPolicyEngine(await loadPolicyRulesetFile(filePath));
 }
 //# sourceMappingURL=load.js.map

package/node_modules/@xrkseek/policy/dist/load.js.map

@@ -1 +1 @@
-{"version":3,"file":"load.js","sourceRoot":"","sources":["../src/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,GAEnB,MAAM,cAAc,CAAC;AAItB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,mBAAmB,GAAG,GAAG,EAAE;YACnE,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,iCAAiC;AACjC,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,mBAAmB,GAAG,GAAG,EAAE;YACnE,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;IACD,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../src/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,GAEnB,MAAM,cAAc,CAAC;AAKtB,wDAAwD;AACxD,MAAM,UAAU,2BAA2B,CACzC,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACrD,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACnC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,MAA+B,EAC/B,KAAK,GAAG,gBAAgB;IAExB,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,aAAa,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,GAAG,EAAE;YACpE,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,uBAAuB,CACjC,IAAI,EACJ,MAAM,EACN,kBAAkB,QAAQ,EAAE,CAC7B,CAAC;IACF,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB;IAEhB,OAAO,kBAAkB,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/node_modules/@xrkseek/policy/dist/permission-pre.d.ts

@@ -3,4 +3,11 @@ import type { PreHandler } from "@xrkseek/core-tools";
 export declare const READ_ONLY_DENIED_TOOLS: Set<string>;
 /** Pre-execute: deny write/shell tools under `sandbox/mode: read-only`. */
 export declare function createReadOnlyToolPre(denyNames?: ReadonlySet<string>): PreHandler;
+/**
+ * Live sandbox gate: re-reads mode on every tool call so `/permission` /
+ * Settings live defaultPreset take effect without relying solely on agent
+ * rebuild timing (stale create-time `createReadOnlyToolPre` kept asking /
+ * denying against the wrong preset).
+ */
+export declare function createSessionReadOnlyToolPre(isReadOnly: () => boolean, denyNames?: ReadonlySet<string>): PreHandler;
 //# sourceMappingURL=permission-pre.d.ts.map

package/node_modules/@xrkseek/policy/dist/permission-pre.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-pre.d.ts","sourceRoot":"","sources":["../src/permission-pre.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,4DAA4D;AAC5D,eAAO,MAAM,sBAAsB,aAUjC,CAAC;AAEH,2EAA2E;AAC3E,wBAAgB,qBAAqB,CACnC,SAAS,GAAE,WAAW,CAAC,MAAM,CAA0B,GACtD,UAAU,CAUZ"}
+{"version":3,"file":"permission-pre.d.ts","sourceRoot":"","sources":["../src/permission-pre.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,4DAA4D;AAC5D,eAAO,MAAM,sBAAsB,aAUjC,CAAC;AAEH,2EAA2E;AAC3E,wBAAgB,qBAAqB,CACnC,SAAS,GAAE,WAAW,CAAC,MAAM,CAA0B,GACtD,UAAU,CAUZ;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,MAAM,OAAO,EACzB,SAAS,GAAE,WAAW,CAAC,MAAM,CAA0B,GACtD,UAAU,CAMZ"}

package/node_modules/@xrkseek/policy/dist/permission-pre.js

@@ -22,4 +22,18 @@ export function createReadOnlyToolPre(denyNames = READ_ONLY_DENIED_TOOLS) {
         };
     };
 }
+/**
+ * Live sandbox gate: re-reads mode on every tool call so `/permission` /
+ * Settings live defaultPreset take effect without relying solely on agent
+ * rebuild timing (stale create-time `createReadOnlyToolPre` kept asking /
+ * denying against the wrong preset).
+ */
+export function createSessionReadOnlyToolPre(isReadOnly, denyNames = READ_ONLY_DENIED_TOOLS) {
+    const staticDeny = createReadOnlyToolPre(denyNames);
+    return (ctx) => {
+        if (!isReadOnly())
+            return { action: "continue", args: ctx.args };
+        return staticDeny(ctx);
+    };
+}
 //# sourceMappingURL=permission-pre.js.map

package/node_modules/@xrkseek/policy/dist/permission-pre.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-pre.js","sourceRoot":"","sources":["../src/permission-pre.ts"],"names":[],"mappings":"AAEA,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,YAAY;IACZ,YAAY;IACZ,MAAM;IACN,UAAU;IACV,UAAU;IACV,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CACnC,YAAiC,sBAAsB;IAEvD,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QAChD,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,gCAAgC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"permission-pre.js","sourceRoot":"","sources":["../src/permission-pre.ts"],"names":[],"mappings":"AAEA,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,YAAY;IACZ,YAAY;IACZ,MAAM;IACN,UAAU;IACV,UAAU;IACV,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CACnC,YAAiC,sBAAsB;IAEvD,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QAChD,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,gCAAgC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,UAAyB,EACzB,YAAiC,sBAAsB;IAEvD,MAAM,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,CAAC,UAAU,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACjE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC"}

package/node_modules/@xrkseek/policy/dist/rules.d.ts

@@ -29,4 +29,34 @@ export declare function denyMcpConnect(options?: {
     readonly id?: string;
     readonly reason?: string;
 }): PolicyRule;
+/** Deny MCP resource list/templates/read for listed server ids. */
+export declare function denyMcpResourceServers(names: ReadonlySet<string> | readonly string[], options?: {
+    readonly id?: string;
+    readonly reason?: string;
+}): PolicyRule;
+/** Deny listed host.open actions (`path` · `url`). */
+export declare function denyHostOpenActions(names: ReadonlySet<string> | readonly string[], options?: {
+    readonly id?: string;
+    readonly reason?: string;
+}): PolicyRule;
+/** Require approval for listed host.open actions. */
+export declare function askHostOpenActions(names: ReadonlySet<string> | readonly string[], options?: {
+    readonly id?: string;
+    readonly reason?: string;
+}): PolicyRule;
+/** Deny sidebar.embed for listed URL schemes (`http` · `https` · …). */
+export declare function denySidebarEmbedSchemes(names: ReadonlySet<string> | readonly string[], options?: {
+    readonly id?: string;
+    readonly reason?: string;
+}): PolicyRule;
+/** Deny listed sidebar.fs ops (`read` · `write` · `html`). */
+export declare function denySidebarFsOps(names: ReadonlySet<string> | readonly string[], options?: {
+    readonly id?: string;
+    readonly reason?: string;
+}): PolicyRule;
+/** Explicit deny for any office.connect (align mcp.connect). */
+export declare function denyOfficeConnect(options?: {
+    readonly id?: string;
+    readonly reason?: string;
+}): PolicyRule;
 //# sourceMappingURL=rules.d.ts.map

package/node_modules/@xrkseek/policy/dist/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,UAAU,EAAiB,MAAM,YAAY,CAAC;AAM5E,4CAA4C;AAC5C,wBAAgB,aAAa,CAC3B,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC9C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAYZ;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC9C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAcZ;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC9C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAYZ;AAED,qDAAqD;AACrD,wBAAgB,eAAe,CAC7B,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC5C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAYZ;AAED,gDAAgD;AAChD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC5C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAcZ;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE;IACvC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,UAAU,CAWb"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,UAAU,EAAiB,MAAM,YAAY,CAAC;AAM5E,4CAA4C;AAC5C,wBAAgB,aAAa,CAC3B,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC9C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAYZ;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC9C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAcZ;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC9C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAYZ;AAED,qDAAqD;AACrD,wBAAgB,eAAe,CAC7B,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC5C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAYZ;AAED,gDAAgD;AAChD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC5C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAcZ;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE;IACvC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,UAAU,CAWb;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC9C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAYZ;AAED,sDAAsD;AACtD,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC9C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAYZ;AAED,qDAAqD;AACrD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC9C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAYZ;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC9C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAqBZ;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,EAC9C,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,UAAU,CAYZ;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,UAAU,CAUb"}

package/node_modules/@xrkseek/policy/dist/rules.js

@@ -96,4 +96,106 @@ export function denyMcpConnect(options) {
         },
     };
 }
+/** Deny MCP resource list/templates/read for listed server ids. */
+export function denyMcpResourceServers(names, options) {
+    const set = asSet(names);
+    const id = options?.id ?? "deny-mcp-resource";
+    const reason = options?.reason ?? "mcp.resource denied for server";
+    return {
+        id,
+        match(subject) {
+            if (subject.kind !== "mcp.resource")
+                return undefined;
+            if (!set.has(subject.serverId))
+                return undefined;
+            return { verdict: "deny", reason, ruleId: id };
+        },
+    };
+}
+/** Deny listed host.open actions (`path` · `url`). */
+export function denyHostOpenActions(names, options) {
+    const set = asSet(names);
+    const id = options?.id ?? "deny-host-open";
+    const reason = options?.reason ?? "host.open denied for action";
+    return {
+        id,
+        match(subject) {
+            if (subject.kind !== "host.open")
+                return undefined;
+            if (!set.has(subject.action))
+                return undefined;
+            return { verdict: "deny", reason, ruleId: id };
+        },
+    };
+}
+/** Require approval for listed host.open actions. */
+export function askHostOpenActions(names, options) {
+    const set = asSet(names);
+    const id = options?.id ?? "ask-host-open";
+    const reason = options?.reason ?? "host.open requires approval";
+    return {
+        id,
+        match(subject) {
+            if (subject.kind !== "host.open")
+                return undefined;
+            if (!set.has(subject.action))
+                return undefined;
+            return { verdict: "ask", reason, ruleId: id };
+        },
+    };
+}
+/** Deny sidebar.embed for listed URL schemes (`http` · `https` · …). */
+export function denySidebarEmbedSchemes(names, options) {
+    const set = asSet([...asSet(names)].map((s) => s.toLowerCase()));
+    const id = options?.id ?? "deny-sidebar-embed";
+    const reason = options?.reason ?? "sidebar.embed denied for scheme";
+    return {
+        id,
+        match(subject) {
+            if (subject.kind !== "sidebar.embed")
+                return undefined;
+            const scheme = subject.scheme?.toLowerCase() ??
+                (() => {
+                    try {
+                        return new URL(subject.url).protocol.replace(/:$/, "").toLowerCase();
+                    }
+                    catch {
+                        return "";
+                    }
+                })();
+            if (!scheme || !set.has(scheme))
+                return undefined;
+            return { verdict: "deny", reason, ruleId: id };
+        },
+    };
+}
+/** Deny listed sidebar.fs ops (`read` · `write` · `html`). */
+export function denySidebarFsOps(names, options) {
+    const set = asSet(names);
+    const id = options?.id ?? "deny-sidebar-fs";
+    const reason = options?.reason ?? "sidebar.fs denied for op";
+    return {
+        id,
+        match(subject) {
+            if (subject.kind !== "sidebar.fs")
+                return undefined;
+            if (!set.has(subject.op))
+                return undefined;
+            return { verdict: "deny", reason, ruleId: id };
+        },
+    };
+}
+/** Explicit deny for any office.connect (align mcp.connect). */
+export function denyOfficeConnect(options) {
+    const id = options?.id ?? "deny-office-connect";
+    const reason = options?.reason ?? "office.connect denied by default";
+    return {
+        id,
+        match(subject) {
+            if (subject.kind !== "office.connect")
+                return undefined;
+            return { verdict: "deny", reason, ruleId: id };
+        },
+    };
+}
 //# sourceMappingURL=rules.js.map

package/node_modules/@xrkseek/policy/dist/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAEA,SAAS,KAAK,CAAC,KAA8C;IAC3D,OAAO,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAC3B,KAA8C,EAC9C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,YAAY,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,kBAAkB,CAAC;IACrD,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,SAAS,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,kBAAkB,CAChC,KAA8C,EAC9C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,kBAAkB,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,uBAAuB,CAAC;IAC1D,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,SAAS,CAAC;YACnD,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,YAAY,CAC1B,KAA8C,EAC9C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,WAAW,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,wBAAwB,CAAC;IAC3D,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,SAAS,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,eAAe,CAC7B,GAA4C,EAC5C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,gBAAgB,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,sBAAsB,CAAC;IACzD,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;gBAAE,OAAO,SAAS,CAAC;YACtD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;gBAAE,OAAO,SAAS,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,oBAAoB,CAClC,GAA4C,EAC5C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,sBAAsB,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,2BAA2B,CAAC;IAC9D,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;gBAAE,OAAO,SAAS,CAAC;YACtD,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,OAG9B;IACC,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,kBAAkB,CAAC;IAC7C,MAAM,MAAM,GACV,OAAO,EAAE,MAAM,IAAI,+BAA+B,CAAC;IACrD,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,SAAS,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAEA,SAAS,KAAK,CAAC,KAA8C;IAC3D,OAAO,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAC3B,KAA8C,EAC9C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,YAAY,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,kBAAkB,CAAC;IACrD,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,SAAS,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,kBAAkB,CAChC,KAA8C,EAC9C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,kBAAkB,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,uBAAuB,CAAC;IAC1D,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,SAAS,CAAC;YACnD,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,YAAY,CAC1B,KAA8C,EAC9C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,WAAW,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,wBAAwB,CAAC;IAC3D,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,SAAS,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,eAAe,CAC7B,GAA4C,EAC5C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,gBAAgB,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,sBAAsB,CAAC;IACzD,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;gBAAE,OAAO,SAAS,CAAC;YACtD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;gBAAE,OAAO,SAAS,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,oBAAoB,CAClC,GAA4C,EAC5C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,sBAAsB,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,2BAA2B,CAAC;IAC9D,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;gBAAE,OAAO,SAAS,CAAC;YACtD,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,OAG9B;IACC,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,kBAAkB,CAAC;IAC7C,MAAM,MAAM,GACV,OAAO,EAAE,MAAM,IAAI,+BAA+B,CAAC;IACrD,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,SAAS,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CACpC,KAA8C,EAC9C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,mBAAmB,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,gCAAgC,CAAC;IACnE,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;gBAAE,OAAO,SAAS,CAAC;YACtD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,mBAAmB,CACjC,KAA8C,EAC9C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,gBAAgB,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,6BAA6B,CAAC;IAChE,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,SAAS,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,kBAAkB,CAChC,KAA8C,EAC9C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,eAAe,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,6BAA6B,CAAC;IAChE,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,SAAS,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CACrC,KAA8C,EAC9C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,oBAAoB,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,iCAAiC,CAAC;IACpE,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;gBAAE,OAAO,SAAS,CAAC;YACvD,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE;gBAC7B,CAAC,GAAG,EAAE;oBACJ,IAAI,CAAC;wBACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;oBACvE,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,EAAE,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YAClD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAC9B,KAA8C,EAC9C,OAA4D;IAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,iBAAiB,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,0BAA0B,CAAC;IAC7D,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,SAAS,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,OAGjC;IACC,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,qBAAqB,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,kCAAkC,CAAC;IACrE,OAAO;QACL,EAAE;QACF,KAAK,CAAC,OAAsB;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;gBAAE,OAAO,SAAS,CAAC;YACxD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@xrkseek/policy/dist/ruleset.d.ts

@@ -8,7 +8,10 @@ export interface PolicyRulesetRuleJson {
     readonly reason?: string;
     readonly match: {
         readonly kind: PolicySubjectKind;
-        /** Required for tool.call / provider.use (name lists). Ignored for mcp.connect deny. */
+        /**
+         * Name / id / action / scheme / op lists depending on kind.
+         * Ignored for mcp.connect / office.connect deny-all rules.
+         */
         readonly names?: readonly string[];
     };
 }

package/node_modules/@xrkseek/policy/dist/ruleset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ruleset.d.ts","sourceRoot":"","sources":["../src/ruleset.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EAEZ,iBAAiB,EACjB,aAAa,EACd,MAAM,YAAY,CAAC;AASpB,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,aAAa,CAAC;AAErB,eAAO,MAAM,sBAAsB,EAAG,CAAU,CAAC;AAEjD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC;AAE7D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;QACjC,wFAAwF;QACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACnD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAiGD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CA8C5E;AAED,2DAA2D;AAC3D,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAE1E"}
+{"version":3,"file":"ruleset.d.ts","sourceRoot":"","sources":["../src/ruleset.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EAEZ,iBAAiB,EACjB,aAAa,EACd,MAAM,YAAY,CAAC;AAepB,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,aAAa,CAAC;AAErB,eAAO,MAAM,sBAAsB,EAAG,CAAU,CAAC;AAEjD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC;AAE7D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;QACjC;;;WAGG;QACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACnD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAoJD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CA8C5E;AAED,2DAA2D;AAC3D,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAE1E"}

package/node_modules/@xrkseek/policy/dist/ruleset.js

@@ -1,4 +1,4 @@
-import { allowProviderIdsOnly, allowToolNamesOnly, askToolNames, denyMcpConnect, denyProviderIds, denyToolNames, } from "./rules.js";
+import { allowProviderIdsOnly, allowToolNamesOnly, askHostOpenActions, askToolNames, denyHostOpenActions, denyMcpConnect, denyMcpResourceServers, denyOfficeConnect, denyProviderIds, denySidebarEmbedSchemes, denySidebarFsOps, denyToolNames, } from "./rules.js";
 import { createPolicyEngine, } from "./engine.js";
 export const POLICY_RULESET_VERSION = 1;
 export class PolicyRulesetParseError extends Error {
@@ -11,6 +11,11 @@ const KINDS = new Set([
     "tool.call",
     "provider.use",
     "mcp.connect",
+    "mcp.resource",
+    "host.open",
+    "sidebar.embed",
+    "sidebar.fs",
+    "office.connect",
 ]);
 const VERDICTS = new Set(["allow", "deny", "ask"]);
 const ACTIONS = new Set(["deny", "ask", "allow-only"]);
@@ -54,7 +59,7 @@ function ruleFromJson(raw, index) {
     }
     const kind = raw.match.kind;
     if (typeof kind !== "string" || !KINDS.has(kind)) {
-        throw new PolicyRulesetParseError(`rule ${id}: match.kind must be tool.call|provider.use|mcp.connect`);
+        throw new PolicyRulesetParseError(`rule ${id}: match.kind must be a known PolicySubjectKind`);
     }
     const opts = {
         id,
@@ -66,7 +71,39 @@ function ruleFromJson(raw, index) {
         }
         return denyMcpConnect(opts);
     }
+    if (kind === "office.connect") {
+        if (action !== "deny") {
+            throw new PolicyRulesetParseError(`rule ${id}: office.connect only supports action deny`);
+        }
+        return denyOfficeConnect(opts);
+    }
     const names = parseNames(raw.match.names, id);
+    if (kind === "mcp.resource") {
+        if (action !== "deny") {
+            throw new PolicyRulesetParseError(`rule ${id}: mcp.resource only supports action deny`);
+        }
+        return denyMcpResourceServers(names, opts);
+    }
+    if (kind === "host.open") {
+        if (action === "allow-only") {
+            throw new PolicyRulesetParseError(`rule ${id}: host.open does not support allow-only (use deny or ask)`);
+        }
+        if (action === "ask")
+            return askHostOpenActions(names, opts);
+        return denyHostOpenActions(names, opts);
+    }
+    if (kind === "sidebar.embed") {
+        if (action !== "deny") {
+            throw new PolicyRulesetParseError(`rule ${id}: sidebar.embed only supports action deny`);
+        }
+        return denySidebarEmbedSchemes(names, opts);
+    }
+    if (kind === "sidebar.fs") {
+        if (action !== "deny") {
+            throw new PolicyRulesetParseError(`rule ${id}: sidebar.fs only supports action deny`);
+        }
+        return denySidebarFsOps(names, opts);
+    }
     if (kind === "tool.call") {
         if (action === "deny")
             return denyToolNames(names, opts);

package/node_modules/@xrkseek/policy/dist/ruleset.js.map

@@ -1 +1 @@
-{"version":3,"file":"ruleset.js","sourceRoot":"","sources":["../src/ruleset.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAU,CAAC;AAqBjD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAoB;IACvC,WAAW;IACX,cAAc;IACd,aAAa;CACd,CAAC,CAAC;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzE,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,MAAc;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,MAAM,0CAA0C,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,MAAM,2CAA2C,CAC1D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,KAAa;IAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,uBAAuB,CAAC,SAAS,KAAK,oBAAoB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;IAClB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,uBAAuB,CAAC,SAAS,KAAK,sBAAsB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAA0B,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,sCAAsC,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,KAAK,SAAS;QACtB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAC9B,CAAC,CAAC,GAAG,CAAC,MAAM;YACZ,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;IAEb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAyB,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,yDAAyD,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG;QACX,EAAE;QACF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;IAEF,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,yCAAyC,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE9C,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvD,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,eAAe;IACf,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,8DAA8D,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;QACxD,MAAM,IAAI,uBAAuB,CAC/B,uBAAuB,MAAM,CAAC,OAAO,CAAC,eAAe,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,QAA+C,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,GAAsD,EAAE,CAAC;QAChE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAsB,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAkB,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,uBAAuB,CAC/B,YAAY,CAAC,0BAA0B,CACxC,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,CAAsB,CAAC,GAAG,CAAkB,CAAC;QACjD,CAAC;QACD,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,OAAO,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"ruleset.js","sourceRoot":"","sources":["../src/ruleset.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAU,CAAC;AAwBjD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAoB;IACvC,WAAW;IACX,cAAc;IACd,aAAa;IACb,cAAc;IACd,WAAW;IACX,eAAe;IACf,YAAY;IACZ,gBAAgB;CACjB,CAAC,CAAC;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzE,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,MAAc;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,MAAM,0CAA0C,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,MAAM,2CAA2C,CAC1D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,KAAa;IAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,uBAAuB,CAAC,SAAS,KAAK,oBAAoB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;IAClB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,uBAAuB,CAAC,SAAS,KAAK,sBAAsB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAA0B,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,sCAAsC,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,KAAK,SAAS;QACtB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAC9B,CAAC,CAAC,GAAG,CAAC,MAAM;YACZ,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;IAEb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAyB,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,gDAAgD,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG;QACX,EAAE;QACF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;IAEF,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,yCAAyC,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,4CAA4C,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE9C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,0CAA0C,CACrD,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,2DAA2D,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7D,OAAO,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,2CAA2C,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,wCAAwC,CACnD,CAAC;QACJ,CAAC;QACD,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvD,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,eAAe;IACf,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,8DAA8D,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;QACxD,MAAM,IAAI,uBAAuB,CAC/B,uBAAuB,MAAM,CAAC,OAAO,CAAC,eAAe,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,QAA+C,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,GAAsD,EAAE,CAAC;QAChE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAsB,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAkB,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,uBAAuB,CAC/B,YAAY,CAAC,0BAA0B,CACxC,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,CAAsB,CAAC,GAAG,CAAkB,CAAC;QACjD,CAAC;QACD,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,OAAO,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/node_modules/@xrkseek/policy/dist/schema.d.ts

@@ -26,6 +26,21 @@ export declare const policyRulesetJsonSchema: {
                 readonly "mcp.connect": {
                     readonly enum: readonly ["allow", "deny", "ask"];
                 };
+                readonly "mcp.resource": {
+                    readonly enum: readonly ["allow", "deny", "ask"];
+                };
+                readonly "host.open": {
+                    readonly enum: readonly ["allow", "deny", "ask"];
+                };
+                readonly "sidebar.embed": {
+                    readonly enum: readonly ["allow", "deny", "ask"];
+                };
+                readonly "sidebar.fs": {
+                    readonly enum: readonly ["allow", "deny", "ask"];
+                };
+                readonly "office.connect": {
+                    readonly enum: readonly ["allow", "deny", "ask"];
+                };
             };
         };
         readonly rules: {
@@ -51,7 +66,7 @@ export declare const policyRulesetJsonSchema: {
                         readonly additionalProperties: false;
                         readonly properties: {
                             readonly kind: {
-                                readonly enum: readonly ["tool.call", "provider.use", "mcp.connect"];
+                                readonly enum: readonly ["tool.call", "provider.use", "mcp.connect", "mcp.resource", "host.open", "sidebar.embed", "sidebar.fs", "office.connect"];
                             };
                             readonly names: {
                                 readonly type: "array";

package/node_modules/@xrkseek/policy/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgD1B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8D1B,CAAC"}

package/node_modules/@xrkseek/policy/dist/schema.js

@@ -18,6 +18,11 @@ export const policyRulesetJsonSchema = {
                 "tool.call": { enum: ["allow", "deny", "ask"] },
                 "provider.use": { enum: ["allow", "deny", "ask"] },
                 "mcp.connect": { enum: ["allow", "deny", "ask"] },
+                "mcp.resource": { enum: ["allow", "deny", "ask"] },
+                "host.open": { enum: ["allow", "deny", "ask"] },
+                "sidebar.embed": { enum: ["allow", "deny", "ask"] },
+                "sidebar.fs": { enum: ["allow", "deny", "ask"] },
+                "office.connect": { enum: ["allow", "deny", "ask"] },
             },
         },
         rules: {
@@ -36,7 +41,16 @@ export const policyRulesetJsonSchema = {
                         additionalProperties: false,
                         properties: {
                             kind: {
-                                enum: ["tool.call", "provider.use", "mcp.connect"],
+                                enum: [
+                                    "tool.call",
+                                    "provider.use",
+                                    "mcp.connect",
+                                    "mcp.resource",
+                                    "host.open",
+                                    "sidebar.embed",
+                                    "sidebar.fs",
+                                    "office.connect",
+                                ],
                             },
                             names: {
                                 type: "array",

package/node_modules/@xrkseek/policy/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,GAAG,EAAE,iDAAiD;IACtD,KAAK,EAAE,eAAe;IACtB,WAAW,EACT,oDAAoD;IACtD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,SAAS,CAAC;IACrB,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QACrB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAC/C,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAClD,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;aAClD;SACF;QACD,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;gBACnC,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACpC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE;oBAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,CAAC,MAAM,CAAC;wBAClB,oBAAoB,EAAE,KAAK;wBAC3B,UAAU,EAAE;4BACV,IAAI,EAAE;gCACJ,IAAI,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,aAAa,CAAC;6BACnD;4BACD,KAAK,EAAE;gCACL,IAAI,EAAE,OAAO;gCACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gCACvC,QAAQ,EAAE,CAAC;6BACZ;yBACF;qBACF;iBACF;aACF;SACF;KACF;CACO,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,GAAG,EAAE,iDAAiD;IACtD,KAAK,EAAE,eAAe;IACtB,WAAW,EACT,oDAAoD;IACtD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,SAAS,CAAC;IACrB,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QACrB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAC/C,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAClD,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBACjD,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAClD,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAC/C,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBACnD,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;gBAChD,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;aACrD;SACF;QACD,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;gBACnC,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACpC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE;oBAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,CAAC,MAAM,CAAC;wBAClB,oBAAoB,EAAE,KAAK;wBAC3B,UAAU,EAAE;4BACV,IAAI,EAAE;gCACJ,IAAI,EAAE;oCACJ,WAAW;oCACX,cAAc;oCACd,aAAa;oCACb,cAAc;oCACd,WAAW;oCACX,eAAe;oCACf,YAAY;oCACZ,gBAAgB;iCACjB;6BACF;4BACD,KAAK,EAAE;gCACL,IAAI,EAAE,OAAO;gCACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gCACvC,QAAQ,EAAE,CAAC;6BACZ;yBACF;qBACF;iBACF;aACF;SACF;KACF;CACO,CAAC"}