agentlock-shared 0.2.0 → 0.3.0

package/dist/content-crypto.js

@@ -1,58 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PAYLOAD_VERSION_WCK = exports.PAYLOAD_VERSION_LEGACY = void 0;
-exports.generateWCK = generateWCK;
-exports.wrapKey = wrapKey;
-exports.unwrapKey = unwrapKey;
-exports.deriveKEK = deriveKEK;
-exports.wrapWCKForUser = wrapWCKForUser;
-exports.unwrapWCKFromUser = unwrapWCKFromUser;
-const tweetnacl_1 = __importDefault(require("tweetnacl"));
-const tweetnacl_util_1 = require("tweetnacl-util");
-const scrypt_1 = require("@noble/hashes/scrypt");
-/** Payload encrypted with MASTER_KEY (legacy) */
-exports.PAYLOAD_VERSION_LEGACY = 0;
-/** Payload encrypted with per-workspace WCK */
-exports.PAYLOAD_VERSION_WCK = 1;
-/** Generate a random 32-byte Workspace Content Key */
-function generateWCK() {
-    return tweetnacl_1.default.randomBytes(32);
-}
-/** Wrap a WCK using a wrapping key (e.g. MASTER_KEY). Returns base64 ciphertext + nonce. */
-function wrapKey(wck, wrappingKey) {
-    const nonce = tweetnacl_1.default.randomBytes(tweetnacl_1.default.secretbox.nonceLength);
-    const box = tweetnacl_1.default.secretbox(wck, nonce, wrappingKey);
-    return { ciphertext: (0, tweetnacl_util_1.encodeBase64)(box), nonce: (0, tweetnacl_util_1.encodeBase64)(nonce) };
-}
-/** Unwrap a WCK using a wrapping key. Returns the raw 32-byte WCK. */
-function unwrapKey(ciphertext, nonce, wrappingKey) {
-    const box = (0, tweetnacl_util_1.decodeBase64)(ciphertext);
-    const n = (0, tweetnacl_util_1.decodeBase64)(nonce);
-    const result = tweetnacl_1.default.secretbox.open(box, n, wrappingKey);
-    if (!result) {
-        throw new Error('unwrapKey failed: invalid wrapping key or corrupted data');
-    }
-    return result;
-}
-/** Derive a Key Encryption Key from a passphrase using scrypt. */
-function deriveKEK(passphrase, salt) {
-    const pw = new TextEncoder().encode(passphrase);
-    return (0, scrypt_1.scrypt)(pw, salt, { N: 2 ** 15, r: 8, p: 1, dkLen: 32 });
-}
-/** Wrap a WCK for a user using their passphrase. Returns base64 strings. */
-function wrapWCKForUser(wck, passphrase) {
-    const salt = tweetnacl_1.default.randomBytes(32);
-    const kek = deriveKEK(passphrase, salt);
-    const { ciphertext, nonce } = wrapKey(wck, kek);
-    return { ciphertext, nonce, salt: (0, tweetnacl_util_1.encodeBase64)(salt) };
-}
-/** Unwrap a WCK using a user's passphrase. Returns the raw 32-byte WCK. */
-function unwrapWCKFromUser(ciphertext, nonce, salt, passphrase) {
-    const saltBytes = (0, tweetnacl_util_1.decodeBase64)(salt);
-    const kek = deriveKEK(passphrase, saltBytes);
-    return unwrapKey(ciphertext, nonce, kek);
-}
-//# sourceMappingURL=content-crypto.js.map

package/dist/content-crypto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"content-crypto.js","sourceRoot":"","sources":["../src/content-crypto.ts"],"names":[],"mappings":";;;;;;AAUA,kCAEC;AAGD,0BAOC;AAGD,8BAYC;AAGD,8BAMC;AAGD,wCAQC;AAGD,8CASC;AArED,0DAA6B;AAC7B,mDAA4D;AAC5D,iDAA8C;AAE9C,iDAAiD;AACpC,QAAA,sBAAsB,GAAG,CAAC,CAAC;AACxC,+CAA+C;AAClC,QAAA,mBAAmB,GAAG,CAAC,CAAC;AAErC,sDAAsD;AACtD,SAAgB,WAAW;IACzB,OAAO,mBAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,4FAA4F;AAC5F,SAAgB,OAAO,CACrB,GAAe,EACf,WAAuB;IAEvB,MAAM,KAAK,GAAG,mBAAI,CAAC,WAAW,CAAC,mBAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,mBAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACpD,OAAO,EAAE,UAAU,EAAE,IAAA,6BAAY,EAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAA,6BAAY,EAAC,KAAK,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,sEAAsE;AACtE,SAAgB,SAAS,CACvB,UAAkB,EAClB,KAAa,EACb,WAAuB;IAEvB,MAAM,GAAG,GAAG,IAAA,6BAAY,EAAC,UAAU,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,IAAA,6BAAY,EAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,mBAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kEAAkE;AAClE,SAAgB,SAAS,CACvB,UAAkB,EAClB,IAAgB;IAEhB,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO,IAAA,eAAM,EAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,4EAA4E;AAC5E,SAAgB,cAAc,CAC5B,GAAe,EACf,UAAkB;IAElB,MAAM,IAAI,GAAG,mBAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAA,6BAAY,EAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,2EAA2E;AAC3E,SAAgB,iBAAiB,CAC/B,UAAkB,EAClB,KAAa,EACb,IAAY,EACZ,UAAkB;IAElB,MAAM,SAAS,GAAG,IAAA,6BAAY,EAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC"}

package/src/__tests__/crypto.test.ts

@@ -1,169 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import nacl from 'tweetnacl';
-import { encodeBase64 } from 'tweetnacl-util';
-import {
-  encrypt,
-  decrypt,
-  envelopeEncrypt,
-  envelopeDecrypt,
-  generateKey,
-  encryptCredential,
-  decryptCredential,
-} from '../crypto.js';
-
-// Deterministic test key (not from env -- tests must not depend on MASTER_KEY)
-const testMasterKey = nacl.randomBytes(32);
-
-describe('encrypt / decrypt (low-level)', () => {
-  it('round-trips a string', () => {
-    const data = 'hello world';
-    const encrypted = encrypt(data, testMasterKey);
-    expect(encrypted).not.toBe(data);
-    expect(decrypt(encrypted, testMasterKey)).toBe(data);
-  });
-
-  it('produces different ciphertext each call (random nonce)', () => {
-    const data = 'deterministic?';
-    const a = encrypt(data, testMasterKey);
-    const b = encrypt(data, testMasterKey);
-    expect(a).not.toBe(b);
-  });
-
-  it('rejects wrong key', () => {
-    const data = 'secret';
-    const encrypted = encrypt(data, testMasterKey);
-    const wrongKey = nacl.randomBytes(32);
-    expect(() => decrypt(encrypted, wrongKey)).toThrow('Decryption failed');
-  });
-
-  it('handles empty string', () => {
-    const encrypted = encrypt('', testMasterKey);
-    expect(decrypt(encrypted, testMasterKey)).toBe('');
-  });
-
-  it('handles unicode', () => {
-    const data = 'Hello unicode world';
-    const encrypted = encrypt(data, testMasterKey);
-    expect(decrypt(encrypted, testMasterKey)).toBe(data);
-  });
-});
-
-describe('envelopeEncrypt / envelopeDecrypt', () => {
-  it('round-trips a string', () => {
-    const data = 'envelope test data';
-    const encrypted = envelopeEncrypt(data, testMasterKey);
-    expect(encrypted).toMatch(/^env1:/);
-    expect(envelopeDecrypt(encrypted, testMasterKey)).toBe(data);
-  });
-
-  it('produces different ciphertext each call (fresh DEK + nonce)', () => {
-    const data = 'same data';
-    const a = envelopeEncrypt(data, testMasterKey);
-    const b = envelopeEncrypt(data, testMasterKey);
-    expect(a).not.toBe(b);
-  });
-
-  it('rejects wrong master key', () => {
-    const data = 'secret';
-    const encrypted = envelopeEncrypt(data, testMasterKey);
-    const wrongKey = nacl.randomBytes(32);
-    expect(() => envelopeDecrypt(encrypted, wrongKey)).toThrow();
-  });
-
-  it('handles empty string', () => {
-    const encrypted = envelopeEncrypt('', testMasterKey);
-    expect(envelopeDecrypt(encrypted, testMasterKey)).toBe('');
-  });
-
-  it('handles large data', () => {
-    const data = 'x'.repeat(100_000);
-    const encrypted = envelopeEncrypt(data, testMasterKey);
-    expect(envelopeDecrypt(encrypted, testMasterKey)).toBe(data);
-  });
-
-  it('handles JSON data', () => {
-    const obj = { tool: 'http', payload: { url: 'https://example.com' }, nested: [1, 2, 3] };
-    const data = JSON.stringify(obj);
-    const encrypted = envelopeEncrypt(data, testMasterKey);
-    const decrypted = JSON.parse(envelopeDecrypt(encrypted, testMasterKey));
-    expect(decrypted).toEqual(obj);
-  });
-
-  it('envelopeDecrypt rejects non-envelope data', () => {
-    const legacy = encrypt('legacy data', testMasterKey);
-    expect(() => envelopeDecrypt(legacy, testMasterKey)).toThrow('missing env1: prefix');
-  });
-
-  it('rejects malformed envelope (no separator)', () => {
-    expect(() => envelopeDecrypt('env1:nodatahere', testMasterKey)).toThrow('missing DEK/payload separator');
-  });
-
-  it('rejects malformed envelope (empty parts)', () => {
-    // env1:: has withoutPrefix=":" where lastIndexOf(':') returns 0,
-    // caught by the separatorIndex <= 0 check
-    expect(() => envelopeDecrypt('env1::', testMasterKey)).toThrow('missing DEK/payload separator');
-    // env1:abc: has empty payload after separator
-    expect(() => envelopeDecrypt('env1:abc:', testMasterKey)).toThrow('empty DEK or payload');
-  });
-});
-
-describe('decrypt() backward compatibility', () => {
-  it('transparently decrypts envelope-encrypted data', () => {
-    const data = 'new envelope data';
-    const encrypted = envelopeEncrypt(data, testMasterKey);
-    // decrypt() should auto-detect the env1: prefix and handle it
-    expect(decrypt(encrypted, testMasterKey)).toBe(data);
-  });
-
-  it('still decrypts legacy direct-encrypted data', () => {
-    const data = 'legacy direct data';
-    const encrypted = encrypt(data, testMasterKey);
-    // Legacy data should still work with decrypt()
-    expect(decrypt(encrypted, testMasterKey)).toBe(data);
-  });
-
-  it('handles mixed legacy and envelope data in sequence', () => {
-    const legacyData = 'old format';
-    const envelopeData = 'new format';
-
-    const legacyEncrypted = encrypt(legacyData, testMasterKey);
-    const envelopeEncrypted = envelopeEncrypt(envelopeData, testMasterKey);
-
-    // Both should decrypt through the same decrypt() function
-    expect(decrypt(legacyEncrypted, testMasterKey)).toBe(legacyData);
-    expect(decrypt(envelopeEncrypted, testMasterKey)).toBe(envelopeData);
-  });
-});
-
-describe('encryptCredential / decryptCredential (existing DEK pattern)', () => {
-  it('still works correctly after envelope changes', () => {
-    const payload = { api_key: 'sk-test-12345', name: 'test-cred' };
-    const { encryptedDEK, encryptedPayload } = encryptCredential(payload, testMasterKey);
-    const decrypted = decryptCredential(encryptedDEK, encryptedPayload, testMasterKey);
-    expect(decrypted).toEqual(payload);
-  });
-});
-
-describe('envelope format structure', () => {
-  it('has exactly the env1:wrappedDEK:payload format', () => {
-    const encrypted = envelopeEncrypt('test', testMasterKey);
-    const parts = encrypted.split(':');
-    // Should be: "env1", wrappedDEK (base64), payload (base64)
-    expect(parts[0]).toBe('env1');
-    expect(parts.length).toBe(3);
-    // Both parts after prefix should be valid base64
-    expect(parts[1].length).toBeGreaterThan(0);
-    expect(parts[2].length).toBeGreaterThan(0);
-  });
-
-  it('base64 parts do not contain colons', () => {
-    // Run multiple times to catch edge cases with different random nonces
-    for (let i = 0; i < 20; i++) {
-      const encrypted = envelopeEncrypt(`test data ${i}`, testMasterKey);
-      const withoutPrefix = encrypted.slice(5); // remove "env1:"
-      const colonCount = (withoutPrefix.match(/:/g) || []).length;
-      // Exactly one colon separating wrappedDEK and payload
-      expect(colonCount).toBe(1);
-    }
-  });
-});

package/src/__tests__/messaging.test.ts

@@ -1,83 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { SendMessageSchema, AgentSendMessageSchema, ApproveRequestSchema } from '../schemas';
-
-describe('SendMessageSchema', () => {
-  it('accepts valid message with content only', () => {
-    const result = SendMessageSchema.safeParse({ content: 'Hello agent' });
-    expect(result.success).toBe(true);
-  });
-
-  it('accepts message with thread_id and expires_at', () => {
-    const result = SendMessageSchema.safeParse({
-      content: 'Do this task',
-      thread_id: '550e8400-e29b-41d4-a716-446655440000',
-      expires_at: '2026-04-01T12:00:00Z',
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it('rejects empty content', () => {
-    const result = SendMessageSchema.safeParse({ content: '' });
-    expect(result.success).toBe(false);
-  });
-
-  it('rejects content over 4096 chars', () => {
-    const result = SendMessageSchema.safeParse({ content: 'x'.repeat(4097) });
-    expect(result.success).toBe(false);
-  });
-
-  it('rejects invalid thread_id', () => {
-    const result = SendMessageSchema.safeParse({ content: 'hi', thread_id: 'not-a-uuid' });
-    expect(result.success).toBe(false);
-  });
-});
-
-describe('AgentSendMessageSchema', () => {
-  it('requires thread_id', () => {
-    const result = AgentSendMessageSchema.safeParse({ content: 'Reply' });
-    expect(result.success).toBe(false);
-  });
-
-  it('accepts valid reply', () => {
-    const result = AgentSendMessageSchema.safeParse({
-      content: 'I found 3 files',
-      thread_id: '550e8400-e29b-41d4-a716-446655440000',
-    });
-    expect(result.success).toBe(true);
-  });
-});
-
-describe('ApproveRequestSchema with reply_message', () => {
-  it('accepts approve without reply', () => {
-    const result = ApproveRequestSchema.safeParse({ action: 'approve' });
-    expect(result.success).toBe(true);
-  });
-
-  it('accepts approve with reply_message', () => {
-    const result = ApproveRequestSchema.safeParse({
-      action: 'approve',
-      reply_message: 'Only delete files older than 7 days',
-    });
-    expect(result.success).toBe(true);
-    if (result.success) {
-      expect(result.data.reply_message).toBe('Only delete files older than 7 days');
-    }
-  });
-
-  it('accepts deny with reason and reply_message', () => {
-    const result = ApproveRequestSchema.safeParse({
-      action: 'deny',
-      reason: 'Too risky',
-      reply_message: 'Try a safer approach',
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it('rejects reply_message over 2000 chars', () => {
-    const result = ApproveRequestSchema.safeParse({
-      action: 'approve',
-      reply_message: 'x'.repeat(2001),
-    });
-    expect(result.success).toBe(false);
-  });
-});

package/src/__tests__/policy.test.ts

@@ -1,222 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { evaluatePolicy, DEFAULT_POLICY_RULES } from '../policy.js';
-import type { AgentActionRequest } from '../types.js';
-
-describe('Policy Engine', () => {
-  it('should ALLOW read actions by default', () => {
-    // Use a non-http tool to test the default read policy (http without URL is now correctly blocked)
-    const action: AgentActionRequest = { action_type: 'read', tool: 'demo.list', payload: {} };
-    expect(evaluatePolicy(action, DEFAULT_POLICY_RULES).decision).toBe('ALLOW');
-  });
-
-  it('should REQUIRE_APPROVAL for write actions', () => {
-    const action: AgentActionRequest = { action_type: 'write', tool: 'demo', payload: {} };
-    expect(evaluatePolicy(action, DEFAULT_POLICY_RULES).decision).toBe('REQUIRE_APPROVAL');
-  });
-
-  it('should BLOCK admin actions', () => {
-    const action: AgentActionRequest = { action_type: 'admin', tool: 'system', payload: {} };
-    expect(evaluatePolicy(action, DEFAULT_POLICY_RULES).decision).toBe('BLOCK');
-  });
-
-  it('should REQUIRE_APPROVAL for financial actions', () => {
-    const action: AgentActionRequest = { action_type: 'financial', tool: 'stripe', payload: {} };
-    expect(evaluatePolicy(action, DEFAULT_POLICY_RULES).decision).toBe('REQUIRE_APPROVAL');
-  });
-
-  it('should BLOCK disallowed HTTP domains', () => {
-    const action: AgentActionRequest = {
-      action_type: 'read',
-      tool: 'http',
-      payload: { url: 'https://evil.com/data', method: 'GET' },
-    };
-    const rules = {
-      ...DEFAULT_POLICY_RULES,
-      http: { allowedDomains: ['trusted.com'], allowedMethods: ['GET'], blockList: [] },
-    };
-    expect(evaluatePolicy(action, rules).decision).toBe('BLOCK');
-  });
-
-  it('should BLOCK explicitly blocklisted domains', () => {
-    const action: AgentActionRequest = {
-      action_type: 'read',
-      tool: 'http',
-      payload: { url: 'https://evil.com/data', method: 'GET' },
-    };
-    const rules = {
-      ...DEFAULT_POLICY_RULES,
-      http: { allowedDomains: [], allowedMethods: ['GET'], blockList: ['evil.com'] },
-    };
-    expect(evaluatePolicy(action, rules).decision).toBe('BLOCK');
-  });
-
-  it('should REQUIRE_APPROVAL for admin actions even when defaultMode is allow', () => {
-    const action: AgentActionRequest = { action_type: 'admin', tool: 'system', payload: {} };
-    const rules = { ...DEFAULT_POLICY_RULES, defaultMode: 'allow' as const, rules: [] };
-    const result = evaluatePolicy(action, rules);
-    expect(result.decision).toBe('REQUIRE_APPROVAL');
-  });
-
-  it('should REQUIRE_APPROVAL for financial actions even when defaultMode is allow', () => {
-    const action: AgentActionRequest = { action_type: 'financial', tool: 'stripe', payload: {} };
-    const rules = { ...DEFAULT_POLICY_RULES, defaultMode: 'allow' as const, rules: [] };
-    const result = evaluatePolicy(action, rules);
-    expect(result.decision).toBe('REQUIRE_APPROVAL');
-  });
-
-  it('should REQUIRE_APPROVAL for admin action even with explicit ALLOW rule', () => {
-    const action: AgentActionRequest = { action_type: 'admin', tool: 'admin.delete_user', payload: {} };
-    const rules = {
-      ...DEFAULT_POLICY_RULES,
-      defaultMode: 'allow' as const,
-      rules: [{ action_type: 'admin' as const, decision: 'ALLOW' as const }],
-    };
-    const result = evaluatePolicy(action, rules);
-    expect(result.decision).toBe('REQUIRE_APPROVAL');
-  });
-
-  it('should REQUIRE_APPROVAL for financial action even with explicit ALLOW rule', () => {
-    const action: AgentActionRequest = { action_type: 'financial', tool: 'stripe.charge', payload: {} };
-    const rules = {
-      ...DEFAULT_POLICY_RULES,
-      defaultMode: 'allow' as const,
-      rules: [{ action_type: 'financial' as const, decision: 'ALLOW' as const }],
-    };
-    const result = evaluatePolicy(action, rules);
-    expect(result.decision).toBe('REQUIRE_APPROVAL');
-  });
-
-  it('should still respect explicit rules for admin even with defaultMode allow', () => {
-    const action: AgentActionRequest = { action_type: 'admin', tool: 'system', payload: {} };
-    const rules = {
-      ...DEFAULT_POLICY_RULES,
-      defaultMode: 'allow' as const,
-      rules: [{ action_type: 'admin' as const, decision: 'BLOCK' as const }],
-    };
-    expect(evaluatePolicy(action, rules).decision).toBe('BLOCK');
-  });
-
-  it('should BLOCK when cost exceeds limit', () => {
-    const action: AgentActionRequest = {
-      action_type: 'financial',
-      tool: 'stripe',
-      payload: {},
-      cost_estimate: 1000,
-    };
-    const rules = { ...DEFAULT_POLICY_RULES, limits: { maxCostPerAction: 100 } };
-    expect(evaluatePolicy(action, rules).decision).toBe('BLOCK');
-  });
-
-  // --- Case-sensitivity bypass tests ---
-
-  it('should enforce HTTP domain allowlist even with mixed-case tool name', () => {
-    const action: AgentActionRequest = {
-      action_type: 'read',
-      tool: 'Http.get',
-      payload: { url: 'https://evil.com/data', method: 'GET' },
-    };
-    const rules = {
-      ...DEFAULT_POLICY_RULES,
-      http: { allowedDomains: ['trusted.com'], allowedMethods: ['GET'], blockList: [] },
-    };
-    expect(evaluatePolicy(action, rules).decision).toBe('BLOCK');
-  });
-
-  it('should match tool-specific rules case-insensitively', () => {
-    const action: AgentActionRequest = {
-      action_type: 'read',
-      tool: 'MCP.list_tools',
-      payload: {},
-    };
-    const result = evaluatePolicy(action, DEFAULT_POLICY_RULES);
-    expect(result.decision).toBe('ALLOW');
-  });
-
-  // --- URL edge cases ---
-
-  it('should not match subdomain of blocklisted domain (e.g., notevil.com vs evil.com)', () => {
-    const action: AgentActionRequest = {
-      action_type: 'read',
-      tool: 'http.get',
-      payload: { url: 'https://notevil.com/data', method: 'GET' },
-    };
-    const rules = {
-      ...DEFAULT_POLICY_RULES,
-      http: { allowedDomains: ['notevil.com', 'trusted.com'], allowedMethods: ['GET'], blockList: ['evil.com'] },
-    };
-    expect(evaluatePolicy(action, rules).decision).not.toBe('BLOCK');
-  });
-
-  it('should BLOCK HTTP tool with no URL in payload', () => {
-    const action: AgentActionRequest = {
-      action_type: 'read',
-      tool: 'http.get',
-      payload: {},
-    };
-    const rules = {
-      ...DEFAULT_POLICY_RULES,
-      http: { allowedDomains: ['trusted.com'], allowedMethods: ['GET'], blockList: [] },
-    };
-    expect(evaluatePolicy(action, rules).decision).toBe('BLOCK');
-  });
-
-  // --- Browser tool policy ---
-
-  it('should REQUIRE_APPROVAL for browser.open', () => {
-    const action: AgentActionRequest = {
-      action_type: 'write',
-      tool: 'browser.open',
-      payload: { url: 'https://example.com' },
-    };
-    const result = evaluatePolicy(action, DEFAULT_POLICY_RULES);
-    expect(result.decision).toBe('REQUIRE_APPROVAL');
-  });
-
-  it('should BLOCK browser.* actions without a session (reaching policy engine)', () => {
-    const action: AgentActionRequest = {
-      action_type: 'write',
-      tool: 'browser.click',
-      payload: {},
-    };
-    const result = evaluatePolicy(action, DEFAULT_POLICY_RULES);
-    expect(result.decision).toBe('BLOCK');
-  });
-
-  // --- Unknown action_type ---
-
-  it('should BLOCK unknown action types', () => {
-    const action = {
-      action_type: 'delete' as 'read',
-      tool: 'custom.tool',
-      payload: {},
-    };
-    const result = evaluatePolicy(action, DEFAULT_POLICY_RULES);
-    expect(result.decision).toBe('BLOCK');
-  });
-
-  // --- cost_estimate omission ---
-
-  it('should not enforce budget check when cost_estimate is omitted', () => {
-    const action: AgentActionRequest = {
-      action_type: 'write',
-      tool: 'demo',
-      payload: {},
-      // cost_estimate intentionally omitted
-    };
-    const rules = { ...DEFAULT_POLICY_RULES, limits: { maxCostPerAction: 100 } };
-    // Should match action_type 'write' rule, not be BLOCK-ed by cost limit
-    expect(evaluatePolicy(action, rules).decision).toBe('REQUIRE_APPROVAL');
-  });
-
-  // --- HTTP allowlist not configured ---
-
-  it('should REQUIRE_APPROVAL when HTTP allowlist is empty (safe default)', () => {
-    const action: AgentActionRequest = {
-      action_type: 'read',
-      tool: 'http.get',
-      payload: { url: 'https://any-site.com/data', method: 'GET' },
-    };
-    const result = evaluatePolicy(action, DEFAULT_POLICY_RULES);
-    expect(result.decision).toBe('REQUIRE_APPROVAL');
-  });
-});

package/src/__tests__/redact.test.ts

@@ -1,41 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { redact, redactHeaders } from '../redact.js';
-
-describe('Redaction', () => {
-  it('should redact api_key fields', () => {
-    const obj = { name: 'test', api_key: 'super-secret-123', data: { token: 'abc' } };
-    const result = redact(obj) as Record<string, unknown>;
-    expect(result.api_key).toBe('[REDACTED]');
-    expect((result.data as Record<string, unknown>).token).toBe('[REDACTED]');
-    expect(result.name).toBe('test');
-  });
-
-  it('should redact Authorization headers', () => {
-    const headers = { Authorization: 'Bearer secret', 'Content-Type': 'application/json' };
-    const result = redactHeaders(headers);
-    expect(result['Authorization']).toBe('[REDACTED]');
-    expect(result['Content-Type']).toBe('application/json');
-  });
-
-  it('should handle nested objects', () => {
-    const obj = { level1: { level2: { password: 'secret', safe: 'ok' } } };
-    const result = redact(obj) as { level1: { level2: { password: string; safe: string } } };
-    expect(result.level1.level2.password).toBe('[REDACTED]');
-    expect(result.level1.level2.safe).toBe('ok');
-  });
-
-  it('should handle arrays', () => {
-    const obj = { items: [{ token: 'secret1' }, { token: 'secret2' }] };
-    const result = redact(obj) as { items: { token: string }[] };
-    expect(result.items[0].token).toBe('[REDACTED]');
-    expect(result.items[1].token).toBe('[REDACTED]');
-  });
-
-  it('should not redact safe fields', () => {
-    const obj = { name: 'test', url: 'https://example.com', status: 200 };
-    const result = redact(obj) as typeof obj;
-    expect(result.name).toBe('test');
-    expect(result.url).toBe('https://example.com');
-    expect(result.status).toBe(200);
-  });
-});

package/src/__tests__/signing.test.ts

@@ -1,55 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { generateKeypair, signRequest, verifyRequest, canonicalStringify } from '../signing.js';
-
-describe('Ed25519 Signing', () => {
-  it('should generate valid keypair', () => {
-    const kp = generateKeypair();
-    expect(kp.publicKey).toBeTruthy();
-    expect(kp.privateKey).toBeTruthy();
-    expect(kp.publicKey.length).toBeGreaterThan(0);
-  });
-
-  it('should sign and verify a request', () => {
-    const kp = generateKeypair();
-    const body = { action_type: 'write', tool: 'demo', payload: { key: 'value' } };
-    const headers = signRequest(body, 'agent-123', kp.privateKey);
-    expect(() => verifyRequest(body, headers, kp.publicKey)).not.toThrow();
-  });
-
-  it('should reject tampered body (top-level field)', () => {
-    const kp = generateKeypair();
-    const body = { action_type: 'write', tool: 'demo', payload: { key: 'value' } };
-    const headers = signRequest(body, 'agent-123', kp.privateKey);
-    const tampered = { ...body, tool: 'admin' };
-    expect(() => verifyRequest(tampered, headers, kp.publicKey)).toThrow('Invalid signature');
-  });
-
-  it('should reject tampered nested payload field', () => {
-    const kp = generateKeypair();
-    const body = { action_type: 'write', tool: 'demo', payload: { key: 'value', amount: 100 } };
-    const headers = signRequest(body, 'agent-123', kp.privateKey);
-    const tampered = { ...body, payload: { key: 'value', amount: 999999 } };
-    expect(() => verifyRequest(tampered, headers, kp.publicKey)).toThrow('Invalid signature');
-  });
-
-  it('canonicalStringify should sort keys recursively at all nesting levels', () => {
-    const obj = { z: 1, a: { y: 2, b: 3 }, m: [{ q: 4, c: 5 }] };
-    const result = canonicalStringify(obj);
-    // All object levels must have sorted keys
-    expect(result).toBe('{"a":{"b":3,"y":2},"m":[{"c":5,"q":4}],"z":1}');
-  });
-
-  it('should reject missing headers', () => {
-    const kp = generateKeypair();
-    const body = { action_type: 'write', tool: 'demo', payload: {} };
-    expect(() => verifyRequest(body, {}, kp.publicKey)).toThrow('Missing required signature headers');
-  });
-
-  it('should reject stale timestamp', () => {
-    const kp = generateKeypair();
-    const body = { action_type: 'write', tool: 'demo', payload: {} };
-    const headers = signRequest(body, 'agent-123', kp.privateKey);
-    headers['x-timestamp'] = String(Date.now() - 10 * 60 * 1000);
-    expect(() => verifyRequest(body, headers, kp.publicKey)).toThrow('Timestamp skew');
-  });
-});