@yanlinglabs/winter-agent-runtime 0.0.27

package/dist/permissions/auto/engine.d.ts

@@ -0,0 +1,74 @@
+import type { AutoEngine } from "../evaluator.js";
+export { BLOCKED_BY_CLASSIFIER_MESSAGE } from "../evaluator.js";
+import { type ActionEnvelope } from "./envelope.js";
+import { type NormalizedAutoModeConfig } from "./config.js";
+import { type AutoVerdictCache, type AutoCounterStore } from "./caches.js";
+import type { AttributedContext } from "../../hooks/reducer.js";
+export interface ClassifierRawResult {
+    verdict: "allow" | "deny" | "no_verdict";
+    category?: string;
+    severity?: string;
+    reasonCode?: string;
+    auditReason?: string;
+}
+export interface ClassifierContext {
+    autoConfig: NormalizedAutoModeConfig;
+    classifierContext: AttributedContext[];
+    recentUserMessages?: string[];
+    winterMdContent?: string;
+    repository?: {
+        remotes: string[];
+    };
+    gitStatusSummary?: string;
+}
+export interface ClassifierInterface {
+    classify(envelope: ActionEnvelope, context: ClassifierContext): Promise<ClassifierRawResult>;
+}
+export declare const alwaysNoVerdictClassifier: ClassifierInterface;
+export interface ScriptedClassifier extends ClassifierInterface {
+    readonly calls: ReadonlyArray<{
+        envelope: ActionEnvelope;
+        context: ClassifierContext;
+    }>;
+}
+export declare function createScriptedClassifier(script: ClassifierRawResult | ClassifierRawResult[] | ((envelope: ActionEnvelope, context: ClassifierContext) => ClassifierRawResult | Promise<ClassifierRawResult>)): ScriptedClassifier;
+export type AutoAuditEventType = "permission_evaluated" | "classifier_started" | "classifier_result" | "classifier_cache_hit" | "permission_denied" | "fallback_state";
+export interface AutoAuditRecord {
+    type: AutoAuditEventType;
+    sessionId: string;
+    at: string;
+    toolName: string;
+    toolUseId?: string;
+    agentId?: string;
+    verdict?: "allow" | "deny" | "no_verdict";
+    category?: string;
+    severity?: string;
+    reasonCode?: string;
+    auditReason?: string;
+    fallbackActive?: boolean;
+    consecutive?: number;
+    total?: number;
+    policyVersion: number;
+    policyHash: string;
+    latencyMs: number;
+    model?: string;
+}
+export interface AutoAuditRecorder {
+    record(entry: AutoAuditRecord): void | Promise<void>;
+}
+export declare const NO_OP_AUTO_AUDIT_RECORDER: AutoAuditRecorder;
+export declare function redactAuditReason(reason: string | undefined, ctx: {
+    cwd: string;
+    home: string;
+}): string | undefined;
+export interface AutoEngineOptions {
+    sessionId: string;
+    runtimeKind?: string;
+    classifier?: ClassifierInterface;
+    counters?: AutoCounterStore;
+    cache?: AutoVerdictCache;
+    audit?: AutoAuditRecorder;
+    getClassifierContext?: () => AttributedContext[];
+    getGeneration?: () => number;
+}
+export declare function createAutoEngine(options: AutoEngineOptions): AutoEngine;

package/dist/permissions/auto/envelope.d.ts

@@ -0,0 +1,45 @@
+import type { PermissionCall, EvaluationContext } from "../evaluator.js";
+import type { AttributedContext } from "../../hooks/reducer.js";
+export interface ResolvedEnvelopePath {
+    path: string;
+    resolvedTarget: string;
+    isSymlink: boolean;
+}
+export interface ActionProvenance {
+    suspicious?: boolean;
+    source?: string;
+}
+export interface ActionBoundaries {
+    protectedWrite: boolean;
+    criticalRemoval: boolean;
+    criticalReason?: string;
+}
+export interface ActionEnvelope {
+    toolUseId?: string;
+    agentId?: string;
+    sessionId?: string;
+    runtimeKind?: string;
+    turnId?: string;
+    toolName: string;
+    canonicalToolName: string;
+    input: Record<string, unknown>;
+    cwd: string;
+    roots: string[];
+    resolvedPaths: ResolvedEnvelopePath[];
+    shellSubcommands?: string[];
+    shellRedirectTargets?: string[];
+    provenance?: ActionProvenance;
+    boundaries: ActionBoundaries;
+    sessionCreatedResources: string[];
+    networkDestinations?: string[];
+    repository?: {
+        remotes: string[];
+    };
+    classifierContext: AttributedContext[];
+}
+export interface BuildActionEnvelopeExtras {
+    sessionId?: string;
+    runtimeKind?: string;
+    classifierContext?: AttributedContext[];
+}
+export declare function buildActionEnvelope(call: PermissionCall, ctx: EvaluationContext, extras?: BuildActionEnvelopeExtras): ActionEnvelope;

package/dist/permissions/auto/inheritance.d.ts

@@ -0,0 +1,27 @@
+import type { PermissionMode } from "@yanlinglabs/winter-agent-sdk";
+import type { PolicyState } from "../policy-state.js";
+export declare const AUTO_MODE_STRICTNESS_ORDER: readonly PermissionMode[];
+export declare class ChildResumeModeIncomparableError extends Error {
+    readonly modeA: PermissionMode;
+    readonly modeB: PermissionMode;
+    constructor(modeA: PermissionMode, modeB: PermissionMode);
+}
+export declare function stricterOf(a: PermissionMode, b: PermissionMode): PermissionMode;
+export interface ChildAgentDefinition {
+    permissionMode?: PermissionMode;
+}
+export interface ComputeChildPolicyOptions {
+    disableBypassPermissionsMode?: boolean;
+}
+export interface ChildPolicyResult {
+    effectiveMode: PermissionMode;
+    parentPolicyVersion: number;
+    parentPolicyHash: string;
+}
+export declare function computeChildPolicy(parent: PolicyState, def: ChildAgentDefinition, opts?: ComputeChildPolicyOptions): ChildPolicyResult;
+export interface RecordedChildPolicy {
+    effectiveMode: PermissionMode;
+    parentPolicyVersion: number;
+    parentPolicyHash: string;
+}
+export declare function resolveChildResumeMode(recorded: RecordedChildPolicy, currentParentMode: PermissionMode): PermissionMode;

package/dist/permissions/edit-recognition.d.ts

@@ -0,0 +1,30 @@
+import { type BrandProfile } from "@yanlinglabs/winter-agent-sdk";
+export type RecognizedEditKind = "edit" | "bashFsOp" | "other";
+export interface RecognizedEditOperation {
+    kind: RecognizedEditKind;
+    paths: string[];
+}
+export declare const RECOGNIZED_BASH_FS_OPS: ReadonlySet<string>;
+export declare function tokenizeWords(s: string): string[];
+export declare function isFlagToken(token: string): boolean;
+export declare function nonFlagOperands(tokens: string[]): string[];
+export declare function fileRulePathField(toolName: string): "file_path" | "notebook_path" | "path";
+export declare function shellCommandOf(call: {
+    toolName: string;
+    input: Record<string, unknown>;
+}): string | undefined;
+export declare function recognizeEditOperation(call: {
+    toolName: string;
+    input: Record<string, unknown>;
+}, opts?: {
+    sessionRoot?: string;
+    brand?: Pick<BrandProfile, "projectDirName">;
+    home?: string;
+}): RecognizedEditOperation | null;
+/**
+ * Why a shell command's WRITES cannot be auto-approved, or `undefined`: a process substitution, a
+ * command that cannot be parsed, a write target that is a variable/command expansion, a `~user` form
+ * or a glob, and `cp`/`mv` with ANY flag (`--target-directory=PATH` hides the destination). The
+ * working-directory and `cd` checks that follow claude's are evaluator.ts's (they need the session).
+ */
+export declare function shellWriteConstraint(command: string): string | undefined;

package/dist/permissions/evaluator.d.ts

@@ -0,0 +1,284 @@
+import type { PermissionBehavior, PermissionUpdate, RuleSource, PermissionDecisionClassification } from "@yanlinglabs/winter-agent-sdk";
+import type { SourcedRuleEntry, SourcedRuleSet } from "./ruleset.js";
+import type { PolicyState, AutoModeConfig } from "./policy-state.js";
+import { type ProtectedBrand } from "./protected.js";
+export type { AutoModeConfig };
+export type { PermissionDecisionClassification };
+export interface PermissionCall {
+    toolName: string;
+    input: Record<string, unknown>;
+    toolUseId?: string;
+    agentId?: string;
+}
+export declare const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
+export interface HookDecision {
+    decision: "allow" | "deny" | "ask" | "defer" | "no_opinion";
+    transformedInput?: Record<string, unknown>;
+    message?: string;
+    interrupt?: boolean;
+    hookId?: string;
+}
+export interface PermissionRequestHookDecision {
+    decision: "allow" | "deny";
+    transformedInput?: Record<string, unknown>;
+    updatedPermissions?: PermissionUpdate[];
+    message?: string;
+    interrupt?: boolean;
+    hookId?: string;
+}
+export interface HookStage {
+    preToolUse(call: PermissionCall, ctx: EvaluationContext): Promise<HookDecision>;
+    permissionRequest(call: PermissionCall, ctx: EvaluationContext, meta: PromptStageMeta): Promise<PermissionRequestHookDecision | null>;
+}
+export interface PromptStageMeta {
+    decisionReason: string;
+    toolUseID?: string;
+    agentID?: string;
+    matchedAskRule?: {
+        source: RuleSource;
+        toolName: string;
+        ruleContent?: string;
+    };
+    blockedPath?: string;
+}
+export interface PromptDecision {
+    decision: "allow" | "deny";
+    transformedInput?: Record<string, unknown>;
+    message?: string;
+    interrupt?: boolean;
+    updatedPermissions?: PermissionUpdate[];
+    decisionClassification?: PermissionDecisionClassification;
+}
+export interface PromptStage {
+    prompt(call: PermissionCall, ctx: EvaluationContext, meta: PromptStageMeta): Promise<PromptDecision | null>;
+}
+export interface AutoEngineVerdict {
+    verdict: "allow" | "deny" | "no_verdict";
+    category?: string;
+    reasonCode?: string;
+    fallbackToPrompt?: boolean;
+}
+export interface AutoEngine {
+    classify(call: PermissionCall, ctx: EvaluationContext): Promise<AutoEngineVerdict>;
+    noteFallbackResolution?(outcome: "allow" | "deny"): void;
+    noteHeadlessFallbackDenial?(call: PermissionCall, ctx: EvaluationContext): void | Promise<void>;
+}
+export interface CriticalRemovalResult {
+    critical: boolean;
+    reason?: string;
+}
+export interface SpecialChecks {
+    isProtectedWrite(call: PermissionCall, ctx: EvaluationContext): boolean;
+    isCriticalRemoval(call: PermissionCall, ctx: EvaluationContext): CriticalRemovalResult;
+}
+export interface EvaluationContext {
+    policy: PolicyState;
+    cwd: string;
+    /**
+     * Does this Bash call's `dangerouslyDisableSandbox` actually take it OUT of a sandbox it would
+     * otherwise run in? (dist-session fixes, lane C C3 -- claude's `!shouldUseSandbox(input) &&
+     * shouldUseSandbox({...input, dangerouslyDisableSandbox: false})`.) False when the session's sandbox
+     * is off, when the policy forbids unsandboxed commands (the flag is then ignored), or when the
+     * command is an allowed `excludedCommands` entry. Only such a call is an ESCAPE, handled by
+     * `resolveSandboxEscape`. Injected because the evaluator cannot see the session's sandbox settings;
+     * ABSENT reads as "the flag escapes" -- the conservative answer.
+     */
+    bashSandboxEscape?: (call: PermissionCall) => boolean;
+    /**
+     * The CURRENT TURN's abort signal (lane C, C2). The prompt stage hands it to the permission RPC, so
+     * an interrupt while a prompt is open cancels that request at its source -- the bridge writes
+     * `control_cancel_request` and the host's `canUseTool` sees its signal abort (claude parity). Absent
+     * outside a turn (and in every hand-built test context): the request then waits as it always has.
+     */
+    signal?: AbortSignal;
+    sessionRoot: string;
+    home: string;
+    trustedWorkspace: boolean;
+    allowManagedPermissionRulesOnly?: boolean;
+    additionalDirectories?: string[];
+    sessionBypassEnabled?: boolean;
+    /**
+     * Phase 5 Task 8 (rider 18): every name a skill answers to -- `SkillIndex.identities(name)`.
+     *
+     * Injected rather than imported for the same reason `requiresInteraction` below is: the evaluator
+     * is stateless and holds no session, while the skill index is per-session state
+     * (`skills/runtime.ts`'s registry, keyed `agentId ?? sessionId`). engine.ts supplies it; a direct
+     * caller may omit it, and a `Skill(...)` rule then matches on the literal name alone -- correct,
+     * just blind to the `<projectDir>:<name>` alias a project skill also answers to.
+     */
+    skillIdentities?: (skillName: string) => readonly string[];
+    /**
+     * Phase 5 fix wave, I1: the RESOLVED winter root, DISTINCT from `home` (the OS home) above.
+     *
+     * Two consumers, both of which were silently wrong under a `<PREFIX>HOME` whose basename is not
+     * the brand's own dot-dir: the P5-B workflow-script carve-out (which must name the directory
+     * `workflows/store.ts` actually persists to) and `isProtectedWrite`'s own carve-out check.
+     * Absent = the pre-fix behaviour, `<home>/<homeDirName>/...` only.
+     */
+    winterHome?: string;
+    /**
+     * WS-21 §3.7: the shared runtime home's durable-paths root (`config.storeHome`), preferred over
+     * `winterHome` by the SAME two consumers `winterHome`'s own header names -- `projects/` (what the
+     * P5-B workflow-script carve-out and `isProtectedWrite`'s own wholesale-protect check both
+     * address) lives under the store home once the router links `buildRunHome`, not under the per-run
+     * folder `winterHome` names. Absent falls back to `winterHome`, byte-identical to pre-WS-21.
+     */
+    storeHome?: string;
+    /**
+     * The session's outputs directory (`RuntimeConfig.outputsDir`, exported to the shell as `$OUTDIR`).
+     * Two effects, both mirroring what the Bash tool already does with it (a sandbox-writable root):
+     * a shell write there is inside the session's writable directories (claude's sandbox-write-allowlist
+     * step), and, when it sits inside the winter home, the protected floor's winter-home part does not
+     * cover it (protected.ts's outputs carve-out). It is NOT a working directory: acceptEdits and the
+     * mode allows are unchanged. Absent = no outputs directory.
+     */
+    outputsDir?: string;
+    /**
+     * P7a (D19): the session's brand -- the protected-path floor's own dot-dir and instructions file.
+     *
+     * Optional, `WINTER_BRAND` when absent, so every hand-built evaluation context in this package's
+     * tests keeps exactly today's verdicts.
+     */
+    brand?: ProtectedBrand;
+    /**
+     * Phase 5 fix wave, B-H1(a): "will this exact call run under the OS sandbox, with
+     * `autoAllowBashIfSandboxed` on?" -- WS-12 §1's composition MUST, which had no consumer at all.
+     *
+     * INJECTED rather than computed here, for the same reason `requiresInteraction` and
+     * `skillIdentities` are: the answer depends on the session's resolved `SandboxSettings`, on
+     * `sandbox-exec` being available on this host, and on the call's own `dangerouslyDisableSandbox`
+     * (an escape -- see `bashSandboxEscape`), none of which this module can see. Absent = the pre-fix behaviour, i.e. the setting
+     * stays inert for any caller that does not supply it.
+     */
+    bashRunsSandboxed?: (call: PermissionCall) => boolean;
+    hookStage: HookStage;
+    promptStage: PromptStage;
+    autoEngine: AutoEngine;
+    specialChecks: SpecialChecks;
+    requiresInteraction?: (toolName: string) => boolean;
+    /**
+     * The session's `web.fetch.privateAddressPolicy`, exactly as configured -- `"allow" | "ask" | "deny"`.
+     *
+     * INJECTED for the same reason `requiresInteraction` is: the value lives on the session's web
+     * runtime, and this module holds no session. Taken RAW (a plain `string`) and normalised here by
+     * `normalizePrivateAddressPolicy`, which fails closed: only the exact string `"allow"` is allow,
+     * `"deny"` is deny, and ANYTHING ELSE -- an unrecognised value, and an absent one -- is `"ask"`,
+     * the option's own documented default. So a hand-built context that omits this field gets the
+     * default posture rather than silently none.
+     */
+    webFetchPrivateAddressPolicy?: string;
+}
+export interface PermissionDecisionRecord {
+    decision: "allow" | "deny" | "ask" | "defer";
+    mechanism: "hook" | "rule" | "mode" | "canUseTool" | "autoEngine" | "crash";
+    source?: RuleSource;
+    hookId?: string;
+    ruleRef?: string;
+    transformedInput?: Record<string, unknown>;
+    message?: string;
+    interrupt?: boolean;
+    updatedPermissions?: PermissionUpdate[];
+    decisionClassification?: PermissionDecisionClassification;
+    policyVersion: number;
+    deniedBareSchemaRemoval?: boolean;
+    /**
+     * WHY an `allow` was allowed, where the reason is not already carried by `mechanism`/`ruleRef`.
+     * Set today by two paths: the preapproved-host auto-allow (`PREAPPROVED_HOST_REASON`) and the
+     * lexically-unfetchable WebFetch short-circuit (`UNFETCHABLE_URL_REASON`).
+     */
+    decisionReason?: string;
+    /**
+     * Set on an `allow` that was EXPLICITLY approved for this exact call, as opposed to one the
+     * session's mode or a broad rule let through:
+     *   - `"prompt"` -- something ANSWERED a request for this call: a `canUseTool` answer, or a
+     *     PermissionRequest hook's. The asker saw this call's own input.
+     *   - `"rule"`   -- a standing allow rule NAMES this call's target exactly. For WebFetch that is
+     *     `WebFetch(domain:<host>)` with no `*` in it, equal to the call's hostname, from a tier this
+     *     workspace's trust admits. It is stamped whichever stage produced the allow -- the consent is
+     *     the rule's existence, not the route the call happened to take (under `bypassPermissions` the
+     *     mode stage allows first and the rule is never consulted, yet the user's consent is the same).
+     *
+     * ABSENT for everything else: a mode allow, a bare / `Tool(*)` / glob rule, a PreToolUse hook's
+     * pre-approval, the classifier. None of those is a statement about THIS target.
+     *
+     * STAMPED ONLY FOR THE TOOLS THAT CONSUME IT -- today `WebFetch`, whose executor must know whether
+     * a private-address target was consented to (it cannot prompt mid-call). Every other tool's record
+     * is byte-identical to what it was before this field existed.
+     */
+    explicitApproval?: "prompt" | "rule";
+}
+export declare const NO_OPINION_HOOK_STAGE: HookStage;
+export declare const NO_OPINION_PROMPT_STAGE: PromptStage;
+export declare const NO_OPINION_AUTO_ENGINE: AutoEngine;
+export declare const NO_SPECIAL_CHECKS: SpecialChecks;
+export declare function boundedRoots(ctx: EvaluationContext): string[];
+export declare function extractCandidateWritePaths(call: PermissionCall, ctx: EvaluationContext): string[];
+/**
+ * Port of claude's `mL` (dump byte 14442494, pinned 2.1.250) -- the safety check `$K` (same byte
+ * region) runs on every candidate write path BEFORE any other approval logic, unconditionally
+ * forcing an ask (`classifierApprovable:!1` in claude's own source -- never classifier/auto-
+ * approvable, unlike `$K`'s OTHER checks) when it fires. Ported here as a pure predicate; the
+ * evaluator wires it in as a new stage-3 mandatory-ask reason, below.
+ *
+ * Two of claude's own branches are Windows/WSL-only BY CLAUDE'S OWN GATE and are DELIBERATELY
+ * omitted, disclosed rather than silently dropped (this codebase targets macOS only, CLAUDE.md's own
+ * latest-OS-floors rule):
+ *   - the `U()==="windows"||U()==="wsl"`-gated colon-position check (a second `:` after index 2,
+ *     Windows alternate-data-stream syntax) is genuinely inert off Windows/WSL in claude's OWN
+ *     source -- there is nothing to port.
+ *   - the trailing `Dg(e,!0)&&!Ha(e)&&!Fe(e,t)` clause is STRUCTURALLY DEAD on macOS in claude's own
+ *     source too: `Dg`'s (dump byte 14418249) own first line is `if(U()!=="windows")return!1`, which
+ *     short-circuits the whole `&&` chain to `false` on every non-Windows host claude itself runs
+ *     on. Porting an intentional no-op would just be dead code; omitted, disclosed rather than
+ *     silently dropped.
+ *
+ * `FU` (dump byte 11268201: `function FU(t){return lt.test(t)||t.includes("??")&&lt.test(pt(t))}`,
+ * `pt` win32-normalizes only on Windows, else identity) IS ported below, in its macOS-reduced form
+ * (`pt` is the identity function here, so `FU` reduces to the single regex test) -- claude calls it
+ * unconditionally, not gated to Windows, so this is a straight port, not a judgment call. `lt`'s own
+ * literal bytes (re-verified with a fresh byte-slice extraction after an advisor review caught a
+ * narrower first draft: the dump's raw bytes are `[` `\` `\` `/` `]`, i.e. a JS source character
+ * class holding an ESCAPED backslash plus a forward slash) is `/^[\\/]\?\?[\\/]/` -- EITHER separator
+ * at both ends (`\??\`, `\??/`, `/??\`, `/??/`), not `/` alone.
+ */
+export declare function isSuspiciousPath(path: string): boolean;
+export declare const REAL_SPECIAL_CHECKS: SpecialChecks;
+export declare function findMatchingRuleEntry(rules: SourcedRuleSet, call: PermissionCall, behavior: PermissionBehavior, ctx: EvaluationContext, opts?: {
+    skip?: (entry: SourcedRuleEntry) => boolean;
+}): SourcedRuleEntry | undefined;
+export declare function findAgentDenyRule(rules: SourcedRuleSet, type: string, opts?: {
+    allowManagedPermissionRulesOnly?: boolean;
+}): SourcedRuleEntry | undefined;
+/**
+ * R3b §4's own denial prose, verbatim shape (ground truth: d2-report.md scenario 3):
+ * "Agent type '<t>' has been denied by permission rule '<ruleRef>' from <source>." `<source>` is
+ * Winter's OWN rule-source label for wherever the matched entry actually came from (`entry.source`
+ * -- "sdk" for `Options.disallowedTools`, "user"/"project"/"local"/"managed"/"session" for the
+ * others) -- never a hardcoded "cliArg" (that is claude's OWN label for the differential harness's
+ * `--disallowedTools` CLI flag, a mechanism this repo's own tests do not reproduce; the task brief
+ * is explicit that the source label must match Winter's own).
+ */
+export declare function agentTypeDeniedMessage(type: string, entry: SourcedRuleEntry): string;
+/** The `skip` predicate the stage-2 deny lookup passes, or `undefined` when this call earns no carve-out at all. */
+export declare function workflowScriptCarveOutSkip(call: PermissionCall, ctx: EvaluationContext): ((entry: SourcedRuleEntry) => boolean) | undefined;
+/** The auto-memory `skip` predicate, or `undefined` when this call earns no carve-out at all. */
+export declare function memoryCarveOutSkip(call: PermissionCall, ctx: EvaluationContext): ((entry: SourcedRuleEntry) => boolean) | undefined;
+/**
+ * The ONE skip both stage-2 deny lookups pass: the union of the two `projects/**` carve-outs.
+ *
+ * A union rather than a third predicate, so each carve-out keeps its own independently-testable
+ * entry point (`brand-rebrand.test.ts` pins `workflowScriptCarveOutSkip` by name) and neither can
+ * widen the other. Both arms return the identical `isProjectsBaselineDeny` predicate, so which arm
+ * produced it is not observable downstream -- only WHETHER this call earns one at all.
+ */
+export declare function projectsCarveOutSkip(call: PermissionCall, ctx: EvaluationContext): ((entry: SourcedRuleEntry) => boolean) | undefined;
+/** The reason recorded on a preapproved-host allow -- the reference runtime's own wording. */
+export declare const PREAPPROVED_HOST_REASON = "Preapproved host";
+/** `decisionReason` for the whole-branch review's M2 short-circuit: see `certainlyUnfetchableWebFetchTarget` and the branch that uses it. */
+export declare const UNFETCHABLE_URL_REASON = "WebFetch refuses this URL before any network access";
+export declare const PLAN_WRITE_WITHHELD_MESSAGE = "Denied: plan mode withholds file/shell writes until the plan is approved or session bypass is enabled (WS-07 \u00A76.5)";
+export declare const BLOCKED_BY_CLASSIFIER_MESSAGE = "Blocked by classifier";
+export declare const SANDBOX_ESCAPE_REASON = "Run outside of the sandbox";
+export declare function evaluate(call: PermissionCall, ctx: EvaluationContext): Promise<PermissionDecisionRecord>;
+export type ReadAccessProbe = "silent" | "prompt" | "deny";
+export declare function probeReadAccess(filePath: string, ctx: EvaluationContext): ReadAccessProbe;