agent-control-plane-core 0.9.2 → 0.10.0

package/README.md

@@ -125,6 +125,9 @@ NATIVE_ASK_TIER = false;
 Read `NATIVE_ASK_TIER` instead of keeping a list of which agents to escalate an
 `ask` to a `deny` on: a guardrail that must not let an ask through escalates it
 where the flag is `false`, and leaves it alone where the host does the asking.
+`renderEscalated(adapter, verdict, event, { soleGate })` applies that rule: it
+re-renders as a `deny` any non-allow verdict that would render unenforced on a
+vetoable call, except an `ask` on a host whose flag is `true`.
 It describes the HOST, not the verdict — `ask` renders as `enforced: false`
 everywhere — and it names the pre-tool gate, since a tool that already ran has
 nothing left to suspend. Conformance probes your real `render` against it, so a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-control-plane-core",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "description": "Vendor-neutral control-plane contract for coding agents: a normalized ToolCallEvent/Verdict schema with per-agent adapters (Claude Code, Codex, Amp, Gemini CLI) and a conformance suite.",
   "type": "module",
   "repository": {

package/src/adapters/amp.mjs

@@ -159,7 +159,10 @@ export function parse(native) {
 
 /**
  * Amp honours a distinct ask tier: exit 1 is its "ask the user", a code Amp
- * treats as neither the allow (0) nor the reject (2). {@link render} emits it
+ * treats as neither the allow (0) nor the reject (2). Source: Amp's own notes,
+ * "`0` allows the tool call, `1` makes Amp ask, and `2` rejects the tool call"
+ * (https://ampcode.com/notes/permissions). No live probe has measured it, and
+ * no source says what exit 1 does in a headless run. {@link render} emits it
  * for every `ask`, so a consumer must NOT escalate an `ask` to a `deny` here.
  * The table below leans on the same tier for the non-vetoable deny, which is
  * only honest because the tier is real.

package/src/control-plane.mjs

@@ -958,3 +958,34 @@ export function gatedResponse(
     [row.reason_stream]: blockReason(reason),
   });
 }
+
+/**
+ * Render `verdict` on `adapter`'s host, escalating to a `deny` when the host
+ * would otherwise let the call run without the gate it asked for. A non-allow
+ * verdict that renders unenforced on a vetoable call is re-rendered as a deny,
+ * unless it is an `ask` and the host honours its own ask tier
+ * ({@link Adapter} `NATIVE_ASK_TIER`). Nothing changes for an allow, for a call
+ * this guardrail cannot veto (a deny there blocks nothing either), or for a
+ * render the host already enforces. The deny keeps the verdict's other fields.
+ * @param {Adapter} adapter
+ * @param {Verdict} verdict
+ * @param {ToolCallEvent} event
+ * @param {{ soleGate?: boolean }} [options] passed through to `render`
+ * @returns {NativeResponse}
+ */
+export function renderEscalated(adapter, verdict, event, options = {}) {
+  const { decision } = normalizeVerdict(verdict);
+  const response = adapter.render(verdict, event, options);
+  if (
+    response.enforced ||
+    decision === Decision.ALLOW ||
+    !event.this_call_vetoable ||
+    (decision === Decision.ASK && adapter.NATIVE_ASK_TIER)
+  )
+    return response;
+  return adapter.render(
+    { ...verdict, decision: Decision.DENY },
+    event,
+    options,
+  );
+}

package/types/adapters/amp.d.mts

@@ -98,7 +98,10 @@ export const NATIVE_EVENT_FOR: Record<string, string | undefined>;
 export const UNRENDERED_FIELDS: Record<string, ReadonlySet<string> | undefined>;
 /**
  * Amp honours a distinct ask tier: exit 1 is its "ask the user", a code Amp
- * treats as neither the allow (0) nor the reject (2). {@link render} emits it
+ * treats as neither the allow (0) nor the reject (2). Source: Amp's own notes,
+ * "`0` allows the tool call, `1` makes Amp ask, and `2` rejects the tool call"
+ * (https://ampcode.com/notes/permissions). No live probe has measured it, and
+ * no source says what exit 1 does in a headless run. {@link render} emits it
  * for every `ask`, so a consumer must NOT escalate an `ask` to a `deny` here.
  * The table below leans on the same tier for the non-vetoable deny, which is
  * only honest because the tier is real.

package/types/control-plane.d.mts

@@ -288,6 +288,23 @@ export function gatedResponse(agent: string, { transport, enforced, unblocked_ex
     stdout?: unknown;
     reason?: string;
 }): NativeResponse;
+/**
+ * Render `verdict` on `adapter`'s host, escalating to a `deny` when the host
+ * would otherwise let the call run without the gate it asked for. A non-allow
+ * verdict that renders unenforced on a vetoable call is re-rendered as a deny,
+ * unless it is an `ask` and the host honours its own ask tier
+ * ({@link Adapter} `NATIVE_ASK_TIER`). Nothing changes for an allow, for a call
+ * this guardrail cannot veto (a deny there blocks nothing either), or for a
+ * render the host already enforces. The deny keeps the verdict's other fields.
+ * @param {Adapter} adapter
+ * @param {Verdict} verdict
+ * @param {ToolCallEvent} event
+ * @param {{ soleGate?: boolean }} [options] passed through to `render`
+ * @returns {NativeResponse}
+ */
+export function renderEscalated(adapter: Adapter, verdict: Verdict, event: ToolCallEvent, options?: {
+    soleGate?: boolean;
+}): NativeResponse;
 /**
  * The vendor-neutral control-plane contract.
  *