anantham-v2 2.0.0-alpha.1 → 2.0.2

package/dist/execution/process-bounds-manager.js

@@ -0,0 +1,115 @@
+/**
+ * Process Lifecycle & Resource Bounds Manager
+ * PRD-EXEC-005: Process Lifecycle & Resource Bounds
+ */
+import { spawn } from "node:child_process";
+export class ProcessBoundsManager {
+    activeProcesses = new Map();
+    enforceBufferLimit(output, maxBufferBytes) {
+        if (output.length <= maxBufferBytes)
+            return output;
+        return output.slice(0, maxBufferBytes) + "\n[TRUNCATED: max buffer exceeded]";
+    }
+    async executeBoundedProcess(command, args, cwd, bounds, env = process.env) {
+        const startTime = Date.now();
+        let stdoutBuffer = "";
+        let stderrBuffer = "";
+        let timedOut = false;
+        let truncated = false;
+        return new Promise((resolve) => {
+            const child = spawn(command, args, {
+                cwd,
+                env,
+                shell: false,
+            });
+            if (child.pid) {
+                this.activeProcesses.set(child.pid, child);
+            }
+            // Timeout timer
+            const timer = setTimeout(() => {
+                timedOut = true;
+                this.killProcessTree(child, bounds.killSignal ?? "SIGTERM");
+            }, bounds.timeoutMs);
+            child.stdout?.on("data", (chunk) => {
+                if (stdoutBuffer.length + chunk.length > bounds.maxBufferBytes) {
+                    truncated = true;
+                    const allowed = bounds.maxBufferBytes - stdoutBuffer.length;
+                    if (allowed > 0) {
+                        stdoutBuffer += chunk.toString("utf-8", 0, allowed);
+                    }
+                }
+                else {
+                    stdoutBuffer += chunk.toString("utf-8");
+                }
+            });
+            child.stderr?.on("data", (chunk) => {
+                if (stderrBuffer.length + chunk.length > bounds.maxBufferBytes) {
+                    truncated = true;
+                    const allowed = bounds.maxBufferBytes - stderrBuffer.length;
+                    if (allowed > 0) {
+                        stderrBuffer += chunk.toString("utf-8", 0, allowed);
+                    }
+                }
+                else {
+                    stderrBuffer += chunk.toString("utf-8");
+                }
+            });
+            child.on("close", (code, signal) => {
+                clearTimeout(timer);
+                if (child.pid) {
+                    this.activeProcesses.delete(child.pid);
+                }
+                resolve({
+                    stdout: stdoutBuffer,
+                    stderr: stderrBuffer,
+                    exitCode: code,
+                    signal,
+                    durationMs: Date.now() - startTime,
+                    timedOut,
+                    truncated,
+                });
+            });
+            child.on("error", (err) => {
+                clearTimeout(timer);
+                if (child.pid) {
+                    this.activeProcesses.delete(child.pid);
+                }
+                resolve({
+                    stdout: stdoutBuffer,
+                    stderr: stderrBuffer + `\nProcess error: ${err.message}`,
+                    exitCode: -1,
+                    signal: null,
+                    durationMs: Date.now() - startTime,
+                    timedOut,
+                    truncated,
+                });
+            });
+        });
+    }
+    killProcessTree(child, signal = "SIGKILL") {
+        try {
+            if (child.pid) {
+                if (process.platform === "win32") {
+                    spawn("taskkill", ["/pid", child.pid.toString(), "/T", "/F"]);
+                }
+                else {
+                    child.kill(signal);
+                }
+                this.activeProcesses.delete(child.pid);
+            }
+        }
+        catch {
+            // ignore kill errors
+        }
+    }
+    getActiveCount() {
+        return this.activeProcesses.size;
+    }
+    terminateAll() {
+        for (const child of this.activeProcesses.values()) {
+            this.killProcessTree(child, "SIGKILL");
+        }
+        this.activeProcesses.clear();
+    }
+}
+//# sourceMappingURL=process-bounds-manager.js.map

package/dist/execution/process-bounds-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-bounds-manager.js","sourceRoot":"","sources":["../../src/execution/process-bounds-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAa9D,MAAM,OAAO,oBAAoB;IACvB,eAAe,GAA8B,IAAI,GAAG,EAAE,CAAC;IAExD,kBAAkB,CAAC,MAAc,EAAE,cAAsB;QAC9D,IAAI,MAAM,CAAC,MAAM,IAAI,cAAc;YAAE,OAAO,MAAM,CAAC;QACnD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,GAAG,oCAAoC,CAAC;IAChF,CAAC;IAEM,KAAK,CAAC,qBAAqB,CAChC,OAAe,EACf,IAAc,EACd,GAAW,EACX,MAAqB,EACrB,MAA8B,OAAO,CAAC,GAA6B;QAEnE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;gBACjC,GAAG;gBACH,GAAG;gBACH,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YAEH,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7C,CAAC;YAED,gBAAgB;YAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;YAC9D,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAErB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,IAAI,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC/D,SAAS,GAAG,IAAI,CAAC;oBACjB,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC;oBAC5D,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;wBAChB,YAAY,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;oBACtD,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,YAAY,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,IAAI,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC/D,SAAS,GAAG,IAAI,CAAC;oBACjB,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC;oBAC5D,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;wBAChB,YAAY,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;oBACtD,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,YAAY,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBACjC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;oBACd,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACzC,CAAC;gBACD,OAAO,CAAC;oBACN,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,YAAY;oBACpB,QAAQ,EAAE,IAAI;oBACd,MAAM;oBACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAClC,QAAQ;oBACR,SAAS;iBACV,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;oBACd,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACzC,CAAC;gBACD,OAAO,CAAC;oBACN,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,YAAY,GAAG,oBAAoB,GAAG,CAAC,OAAO,EAAE;oBACxD,QAAQ,EAAE,CAAC,CAAC;oBACZ,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAClC,QAAQ;oBACR,SAAS;iBACV,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,eAAe,CAAC,KAAmB,EAAE,SAAyB,SAAS;QAC5E,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBACjC,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,CAAC;gBACD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IAEM,cAAc;QACnB,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;IACnC,CAAC;IAEM,YAAY;QACjB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YAClD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/dist/execution/risk-classifier.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Tool Execution Risk Classifier
+ * PRD-EXEC-003: Tool Execution & Risk Classification
+ */
+import type { ExecutionRiskLevel, ToolExecutionRequest } from "./types.js";
+export declare class ToolRiskClassifier {
+    private static readonly DESTRUCTIVE_PATTERNS;
+    private static readonly NETWORK_TOOLS;
+    private static readonly READ_TOOLS;
+    private static readonly WRITE_TOOLS;
+    classifyRequest(request: ToolExecutionRequest): ExecutionRiskLevel;
+    requiresUserApproval(risk: ExecutionRiskLevel, maxAllowedWithoutApproval: ExecutionRiskLevel): boolean;
+    private extractCommandLine;
+}
+//# sourceMappingURL=risk-classifier.d.ts.map

package/dist/execution/risk-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-classifier.d.ts","sourceRoot":"","sources":["../../src/execution/risk-classifier.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAE3E,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAU1C;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAOlC;IAEH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAS/B;IAEH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAMhC;IAEI,eAAe,CAAC,OAAO,EAAE,oBAAoB,GAAG,kBAAkB;IA8ClE,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,kBAAkB,GAAG,OAAO;IAY7G,OAAO,CAAC,kBAAkB;CAY3B"}

package/dist/execution/risk-classifier.js

@@ -0,0 +1,104 @@
+/**
+ * Tool Execution Risk Classifier
+ * PRD-EXEC-003: Tool Execution & Risk Classification
+ */
+export class ToolRiskClassifier {
+    static DESTRUCTIVE_PATTERNS = [
+        /\brm\s+(-rf|-fr|--recursive)\b/i,
+        /\bdel\s+\/f\s+\/s\s+\/q\b/i,
+        /\bformat\s+[a-z]:/i,
+        /\bdd\s+if=/i,
+        /\bmkfs\b/i,
+        /\bdrop\s+database\b/i,
+        /\bdrop\s+table\b/i,
+        /\bgit\s+reset\s+--hard\b/i,
+        /\bgit\s+clean\s+-fdx\b/i,
+    ];
+    static NETWORK_TOOLS = new Set([
+        "read_url_content",
+        "search_web",
+        "fetch",
+        "curl",
+        "wget",
+        "http_request",
+    ]);
+    static READ_TOOLS = new Set([
+        "view_file",
+        "list_dir",
+        "grep_search",
+        "find_by_name",
+        "read_resource",
+        "list_resources",
+        "inspect_code",
+        "codegraph_explore",
+    ]);
+    static WRITE_TOOLS = new Set([
+        "write_to_file",
+        "replace_file_content",
+        "generate_image",
+        "create_file",
+        "edit_file",
+    ]);
+    classifyRequest(request) {
+        const tool = request.toolName.toLowerCase();
+        // 1. Check for explicit destructive actions in arguments
+        const cmd = this.extractCommandLine(request);
+        if (cmd) {
+            for (const pattern of ToolRiskClassifier.DESTRUCTIVE_PATTERNS) {
+                if (pattern.test(cmd)) {
+                    return "destructive";
+                }
+            }
+        }
+        // 2. Check for network tools
+        if (ToolRiskClassifier.NETWORK_TOOLS.has(tool)) {
+            return "network";
+        }
+        // 3. Check for command execution
+        if (tool === "run_command" || tool === "execute_command" || tool === "exec" || tool === "bash") {
+            // Check if command is network or read-only
+            if (cmd) {
+                if (/\b(curl|wget|ping|ssh|scp|nc|telnet|ftp)\b/i.test(cmd)) {
+                    return "network";
+                }
+                if (/^(git\s+(status|log|diff|branch)|ls|dir|cat|type|echo|pwd|whoami)\b/i.test(cmd.trim())) {
+                    return "read";
+                }
+            }
+            return "execute";
+        }
+        // 4. Check for write tools
+        if (ToolRiskClassifier.WRITE_TOOLS.has(tool)) {
+            return "write";
+        }
+        // 5. Check for read tools
+        if (ToolRiskClassifier.READ_TOOLS.has(tool)) {
+            return "read";
+        }
+        // Default to execute risk for unknown custom or MCP tools
+        return "execute";
+    }
+    requiresUserApproval(risk, maxAllowedWithoutApproval) {
+        const rank = {
+            read: 1,
+            write: 2,
+            execute: 3,
+            network: 4,
+            destructive: 5,
+        };
+        return rank[risk] > rank[maxAllowedWithoutApproval];
+    }
+    extractCommandLine(request) {
+        if (typeof request.arguments.CommandLine === "string") {
+            return request.arguments.CommandLine;
+        }
+        if (typeof request.arguments.command === "string") {
+            return request.arguments.command;
+        }
+        if (typeof request.arguments.cmd === "string") {
+            return request.arguments.cmd;
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=risk-classifier.js.map

package/dist/execution/risk-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-classifier.js","sourceRoot":"","sources":["../../src/execution/risk-classifier.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,OAAO,kBAAkB;IACrB,MAAM,CAAU,oBAAoB,GAAG;QAC7C,iCAAiC;QACjC,4BAA4B;QAC5B,oBAAoB;QACpB,aAAa;QACb,WAAW;QACX,sBAAsB;QACtB,mBAAmB;QACnB,2BAA2B;QAC3B,yBAAyB;KAC1B,CAAC;IAEM,MAAM,CAAU,aAAa,GAAG,IAAI,GAAG,CAAC;QAC9C,kBAAkB;QAClB,YAAY;QACZ,OAAO;QACP,MAAM;QACN,MAAM;QACN,cAAc;KACf,CAAC,CAAC;IAEK,MAAM,CAAU,UAAU,GAAG,IAAI,GAAG,CAAC;QAC3C,WAAW;QACX,UAAU;QACV,aAAa;QACb,cAAc;QACd,eAAe;QACf,gBAAgB;QAChB,cAAc;QACd,mBAAmB;KACpB,CAAC,CAAC;IAEK,MAAM,CAAU,WAAW,GAAG,IAAI,GAAG,CAAC;QAC5C,eAAe;QACf,sBAAsB;QACtB,gBAAgB;QAChB,aAAa;QACb,WAAW;KACZ,CAAC,CAAC;IAEI,eAAe,CAAC,OAA6B;QAClD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE5C,yDAAyD;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,MAAM,OAAO,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,CAAC;gBAC9D,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtB,OAAO,aAAa,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,kBAAkB,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,iCAAiC;QACjC,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/F,2CAA2C;YAC3C,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,6CAA6C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5D,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,IAAI,sEAAsE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC5F,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,2BAA2B;QAC3B,IAAI,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,0BAA0B;QAC1B,IAAI,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,0DAA0D;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IAEM,oBAAoB,CAAC,IAAwB,EAAE,yBAA6C;QACjG,MAAM,IAAI,GAAuC;YAC/C,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,CAAC;SACf,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtD,CAAC;IAEO,kBAAkB,CAAC,OAA6B;QACtD,IAAI,OAAO,OAAO,CAAC,SAAS,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;QACnC,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,SAAS,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC"}

package/dist/execution/sandbox-manager.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Sandbox Execution & Isolation Manager
+ * PRD-EXEC-004: Execution Isolation & Sandboxing
+ * PRD-INV-004: Sandbox Isolation & Tool Integrity Invariants
+ */
+import type { SandboxType, ToolExecutionRequest } from "./types.js";
+export interface SandboxEnvironment {
+    type: SandboxType;
+    workspaceRoot: string;
+    allowedPaths: string[];
+    isNetworkAllowed: boolean;
+    validatePath(targetPath: string): {
+        allowed: boolean;
+        reason?: string;
+    };
+}
+export declare class LocalDirectSandbox implements SandboxEnvironment {
+    type: SandboxType;
+    workspaceRoot: string;
+    allowedPaths: string[];
+    isNetworkAllowed: boolean;
+    constructor(workspaceRoot: string, allowedPaths?: string[], isNetworkAllowed?: boolean);
+    validatePath(targetPath: string): {
+        allowed: boolean;
+        reason?: string;
+    };
+}
+export declare class SandboxManager {
+    private activeSandboxes;
+    createSandbox(sessionId: string, type: SandboxType, workspaceRoot: string, options?: {
+        allowedPaths?: string[];
+        isNetworkAllowed?: boolean;
+    }): SandboxEnvironment;
+    getSandbox(sessionId: string): SandboxEnvironment | undefined;
+    enforceSandboxBoundaries(sandbox: SandboxEnvironment, request: ToolExecutionRequest): {
+        allowed: boolean;
+        reason?: string;
+    };
+}
+//# sourceMappingURL=sandbox-manager.d.ts.map

package/dist/execution/sandbox-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../../src/execution/sandbox-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED,qBAAa,kBAAmB,YAAW,kBAAkB;IACpD,IAAI,EAAE,WAAW,CAAkB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;gBAErB,aAAa,EAAE,MAAM,EAAE,YAAY,GAAE,MAAM,EAAO,EAAE,gBAAgB,UAAO;IAMhF,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;CAa/E;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,eAAe,CAA8C;IAE9D,aAAa,CAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAAO,GACpE,kBAAkB;IAsBd,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAI7D,wBAAwB,CAC7B,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,oBAAoB,GAC5B;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;CAgCzC"}

package/dist/execution/sandbox-manager.js

@@ -0,0 +1,78 @@
+/**
+ * Sandbox Execution & Isolation Manager
+ * PRD-EXEC-004: Execution Isolation & Sandboxing
+ * PRD-INV-004: Sandbox Isolation & Tool Integrity Invariants
+ */
+import { resolve, relative } from "node:path";
+export class LocalDirectSandbox {
+    type = "local_direct";
+    workspaceRoot;
+    allowedPaths;
+    isNetworkAllowed;
+    constructor(workspaceRoot, allowedPaths = [], isNetworkAllowed = true) {
+        this.workspaceRoot = resolve(workspaceRoot);
+        this.allowedPaths = [this.workspaceRoot, ...allowedPaths.map((p) => resolve(p))];
+        this.isNetworkAllowed = isNetworkAllowed;
+    }
+    validatePath(targetPath) {
+        const absTarget = resolve(this.workspaceRoot, targetPath);
+        for (const allowed of this.allowedPaths) {
+            const rel = relative(allowed.toLowerCase(), absTarget.toLowerCase());
+            if (!rel.startsWith("..") && !rel.startsWith("/") && !rel.startsWith("\\")) {
+                return { allowed: true };
+            }
+        }
+        return {
+            allowed: false,
+            reason: `Path '${targetPath}' escapes allowed sandbox directories`,
+        };
+    }
+}
+export class SandboxManager {
+    activeSandboxes = new Map(); // sessionId -> sandbox
+    createSandbox(sessionId, type, workspaceRoot, options = {}) {
+        let sandbox;
+        switch (type) {
+            case "local_direct":
+            case "local_virtualized":
+            case "container":
+            case "cloud":
+            default:
+                sandbox = new LocalDirectSandbox(workspaceRoot, options.allowedPaths, options.isNetworkAllowed ?? true);
+                sandbox.type = type;
+                break;
+        }
+        this.activeSandboxes.set(sessionId, sandbox);
+        return sandbox;
+    }
+    getSandbox(sessionId) {
+        return this.activeSandboxes.get(sessionId);
+    }
+    enforceSandboxBoundaries(sandbox, request) {
+        // 1. Path isolation check for write/read file targets
+        const targetFile = request.arguments.TargetFile ||
+            request.arguments.AbsolutePath ||
+            request.arguments.filePath ||
+            request.arguments.path;
+        if (targetFile) {
+            const pathValidation = sandbox.validatePath(targetFile);
+            if (!pathValidation.allowed) {
+                return pathValidation;
+            }
+        }
+        // 2. Network isolation check
+        if (!sandbox.isNetworkAllowed) {
+            const tool = request.toolName.toLowerCase();
+            if (["read_url_content", "search_web", "fetch", "curl", "wget"].includes(tool) ||
+                (request.arguments.CommandLine &&
+                    /\b(curl|wget|ping|ssh|scp|nc)\b/i.test(String(request.arguments.CommandLine)))) {
+                return {
+                    allowed: false,
+                    reason: `Network access is disabled for this sandbox environment`,
+                };
+            }
+        }
+        return { allowed: true };
+    }
+}
+//# sourceMappingURL=sandbox-manager.js.map

package/dist/execution/sandbox-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-manager.js","sourceRoot":"","sources":["../../src/execution/sandbox-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAW9C,MAAM,OAAO,kBAAkB;IACtB,IAAI,GAAgB,cAAc,CAAC;IACnC,aAAa,CAAS;IACtB,YAAY,CAAW;IACvB,gBAAgB,CAAU;IAEjC,YAAY,aAAqB,EAAE,eAAyB,EAAE,EAAE,gBAAgB,GAAG,IAAI;QACrF,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAEM,YAAY,CAAC,UAAkB;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAC1D,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,SAAS,UAAU,uCAAuC;SACnE,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IACjB,eAAe,GAAoC,IAAI,GAAG,EAAE,CAAC,CAAC,uBAAuB;IAEtF,aAAa,CAClB,SAAiB,EACjB,IAAiB,EACjB,aAAqB,EACrB,UAAmE,EAAE;QAErE,IAAI,OAA2B,CAAC;QAEhC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,cAAc,CAAC;YACpB,KAAK,mBAAmB,CAAC;YACzB,KAAK,WAAW,CAAC;YACjB,KAAK,OAAO,CAAC;YACb;gBACE,OAAO,GAAG,IAAI,kBAAkB,CAC9B,aAAa,EACb,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,gBAAgB,IAAI,IAAI,CACjC,CAAC;gBACF,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;gBACpB,MAAM;QACV,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,UAAU,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAEM,wBAAwB,CAC7B,OAA2B,EAC3B,OAA6B;QAE7B,sDAAsD;QACtD,MAAM,UAAU,GACb,OAAO,CAAC,SAAS,CAAC,UAAqB;YACvC,OAAO,CAAC,SAAS,CAAC,YAAuB;YACzC,OAAO,CAAC,SAAS,CAAC,QAAmB;YACrC,OAAO,CAAC,SAAS,CAAC,IAAe,CAAC;QAErC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YACxD,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC5B,OAAO,cAAc,CAAC;YACxB,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC5C,IACE,CAAC,kBAAkB,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC1E,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW;oBAC5B,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,EACjF,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,yDAAyD;iBAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/execution/tool-gateway-orchestrator.d.ts

@@ -0,0 +1,28 @@
+/**
+ * ToolGateway Execution Engine Orchestrator
+ * PRD-EXEC-002: Execution Engine Architecture
+ * PRD-INV-004: Sandbox Isolation & Tool Integrity Invariants
+ */
+import type { ToolExecutionRequest, ToolExecutionResult, ToolGatewaySecurityPolicy } from "./types.js";
+import { ToolRiskClassifier } from "./risk-classifier.js";
+import { SandboxManager } from "./sandbox-manager.js";
+import { ProcessBoundsManager } from "./process-bounds-manager.js";
+export declare class ToolGatewayOrchestrator {
+    private riskClassifier;
+    private sandboxManager;
+    private processBoundsManager;
+    private policy;
+    private auditLog;
+    constructor(options?: {
+        policy?: Partial<ToolGatewaySecurityPolicy>;
+        riskClassifier?: ToolRiskClassifier;
+        sandboxManager?: SandboxManager;
+        processBoundsManager?: ProcessBoundsManager;
+    });
+    getRiskClassifier(): ToolRiskClassifier;
+    getSandboxManager(): SandboxManager;
+    getProcessBoundsManager(): ProcessBoundsManager;
+    getAuditLog(): ToolExecutionResult[];
+    executeTool(request: ToolExecutionRequest, executor: (req: ToolExecutionRequest) => Promise<unknown> | unknown, userApproved?: boolean): Promise<ToolExecutionResult>;
+}
+//# sourceMappingURL=tool-gateway-orchestrator.d.ts.map

package/dist/execution/tool-gateway-orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-gateway-orchestrator.d.ts","sourceRoot":"","sources":["../../src/execution/tool-gateway-orchestrator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,qBAAa,uBAAuB;IAClC,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,QAAQ,CAA6B;gBAEjC,OAAO,GAAE;QACnB,MAAM,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC5C,cAAc,CAAC,EAAE,kBAAkB,CAAC;QACpC,cAAc,CAAC,EAAE,cAAc,CAAC;QAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;KACxC;IAoBC,iBAAiB,IAAI,kBAAkB;IAIvC,iBAAiB,IAAI,cAAc;IAInC,uBAAuB,IAAI,oBAAoB;IAI/C,WAAW,IAAI,mBAAmB,EAAE;IAI9B,WAAW,CACtB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,CAAC,GAAG,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,EACnE,YAAY,UAAQ,GACnB,OAAO,CAAC,mBAAmB,CAAC;CA+GhC"}

package/dist/execution/tool-gateway-orchestrator.js

@@ -0,0 +1,143 @@
+/**
+ * ToolGateway Execution Engine Orchestrator
+ * PRD-EXEC-002: Execution Engine Architecture
+ * PRD-INV-004: Sandbox Isolation & Tool Integrity Invariants
+ */
+import { randomUUID } from "node:crypto";
+import { ToolRiskClassifier } from "./risk-classifier.js";
+import { SandboxManager } from "./sandbox-manager.js";
+import { ProcessBoundsManager } from "./process-bounds-manager.js";
+export class ToolGatewayOrchestrator {
+    riskClassifier;
+    sandboxManager;
+    processBoundsManager;
+    policy;
+    auditLog = [];
+    constructor(options = {}) {
+        this.riskClassifier = options.riskClassifier ?? new ToolRiskClassifier();
+        this.sandboxManager = options.sandboxManager ?? new SandboxManager();
+        this.processBoundsManager = options.processBoundsManager ?? new ProcessBoundsManager();
+        this.policy = {
+            allowedTools: options.policy?.allowedTools ?? ["*"],
+            blockedTools: options.policy?.blockedTools ?? [],
+            maxRiskLevelWithoutApproval: options.policy?.maxRiskLevelWithoutApproval ?? "read",
+            allowNetwork: options.policy?.allowNetwork ?? true,
+            allowDestructive: options.policy?.allowDestructive ?? false,
+            defaultSandbox: options.policy?.defaultSandbox ?? "local_direct",
+            globalBounds: {
+                timeoutMs: 30000,
+                maxBufferBytes: 5 * 1024 * 1024,
+                ...options.policy?.globalBounds,
+            },
+        };
+    }
+    getRiskClassifier() {
+        return this.riskClassifier;
+    }
+    getSandboxManager() {
+        return this.sandboxManager;
+    }
+    getProcessBoundsManager() {
+        return this.processBoundsManager;
+    }
+    getAuditLog() {
+        return [...this.auditLog];
+    }
+    async executeTool(request, executor, userApproved = false) {
+        const startTime = Date.now();
+        const auditRecordId = randomUUID();
+        const tool = request.toolName;
+        // 1. Tool allowlist / blocklist check
+        if (this.policy.blockedTools.includes(tool)) {
+            const result = {
+                id: request.id,
+                success: false,
+                toolName: tool,
+                riskLevel: "destructive",
+                error: `Tool '${tool}' is explicitly blocked by ToolGateway policy`,
+                durationMs: Date.now() - startTime,
+                sandboxType: request.sandboxType ?? this.policy.defaultSandbox,
+                requiresApproval: true,
+                auditRecordId,
+            };
+            this.auditLog.push(result);
+            return result;
+        }
+        // 2. Risk classification
+        const riskLevel = this.riskClassifier.classifyRequest(request);
+        // 3. Approval check
+        const requiresApproval = this.riskClassifier.requiresUserApproval(riskLevel, this.policy.maxRiskLevelWithoutApproval);
+        if (requiresApproval && !userApproved) {
+            const result = {
+                id: request.id,
+                success: false,
+                toolName: tool,
+                riskLevel,
+                error: `Tool execution requires user approval (risk level '${riskLevel}' exceeds threshold '${this.policy.maxRiskLevelWithoutApproval}')`,
+                durationMs: Date.now() - startTime,
+                sandboxType: request.sandboxType ?? this.policy.defaultSandbox,
+                requiresApproval: true,
+                approvedByUser: false,
+                auditRecordId,
+            };
+            this.auditLog.push(result);
+            return result;
+        }
+        // 4. Sandbox boundary enforcement
+        const sandbox = this.sandboxManager.getSandbox(request.sessionId) ??
+            this.sandboxManager.createSandbox(request.sessionId, request.sandboxType ?? this.policy.defaultSandbox, request.workspaceRoot, { isNetworkAllowed: this.policy.allowNetwork });
+        const boundaryCheck = this.sandboxManager.enforceSandboxBoundaries(sandbox, request);
+        if (!boundaryCheck.allowed) {
+            const result = {
+                id: request.id,
+                success: false,
+                toolName: tool,
+                riskLevel,
+                error: `Sandbox violation: ${boundaryCheck.reason}`,
+                durationMs: Date.now() - startTime,
+                sandboxType: sandbox.type,
+                requiresApproval,
+                approvedByUser: userApproved,
+                auditRecordId,
+            };
+            this.auditLog.push(result);
+            return result;
+        }
+        // 5. Execution under sandbox
+        try {
+            const output = await executor(request);
+            const result = {
+                id: request.id,
+                success: true,
+                toolName: tool,
+                riskLevel,
+                output,
+                durationMs: Date.now() - startTime,
+                sandboxType: sandbox.type,
+                requiresApproval,
+                approvedByUser: userApproved,
+                auditRecordId,
+            };
+            this.auditLog.push(result);
+            return result;
+        }
+        catch (err) {
+            const errorMsg = err instanceof Error ? err.message : String(err);
+            const result = {
+                id: request.id,
+                success: false,
+                toolName: tool,
+                riskLevel,
+                error: errorMsg,
+                durationMs: Date.now() - startTime,
+                sandboxType: sandbox.type,
+                requiresApproval,
+                approvedByUser: userApproved,
+                auditRecordId,
+            };
+            this.auditLog.push(result);
+            return result;
+        }
+    }
+}
+//# sourceMappingURL=tool-gateway-orchestrator.js.map

package/dist/execution/tool-gateway-orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-gateway-orchestrator.js","sourceRoot":"","sources":["../../src/execution/tool-gateway-orchestrator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,OAAO,uBAAuB;IAC1B,cAAc,CAAqB;IACnC,cAAc,CAAiB;IAC/B,oBAAoB,CAAuB;IAC3C,MAAM,CAA4B;IAClC,QAAQ,GAA0B,EAAE,CAAC;IAE7C,YAAY,UAKR,EAAE;QACJ,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,cAAc,EAAE,CAAC;QACrE,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,IAAI,oBAAoB,EAAE,CAAC;QAEvF,IAAI,CAAC,MAAM,GAAG;YACZ,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,CAAC,GAAG,CAAC;YACnD,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE;YAChD,2BAA2B,EAAE,OAAO,CAAC,MAAM,EAAE,2BAA2B,IAAI,MAAM;YAClF,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,IAAI;YAClD,gBAAgB,EAAE,OAAO,CAAC,MAAM,EAAE,gBAAgB,IAAI,KAAK;YAC3D,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,IAAI,cAAc;YAChE,YAAY,EAAE;gBACZ,SAAS,EAAE,KAAK;gBAChB,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;gBAC/B,GAAG,OAAO,CAAC,MAAM,EAAE,YAAY;aAChC;SACF,CAAC;IACJ,CAAC;IAEM,iBAAiB;QACtB,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAEM,iBAAiB;QACtB,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAEM,uBAAuB;QAC5B,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAEM,WAAW;QAChB,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,OAA6B,EAC7B,QAAmE,EACnE,YAAY,GAAG,KAAK;QAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;QAE9B,sCAAsC;QACtC,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAwB;gBAClC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,aAAa;gBACxB,KAAK,EAAE,SAAS,IAAI,+CAA+C;gBACnE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc;gBAC9D,gBAAgB,EAAE,IAAI;gBACtB,aAAa;aACd,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,yBAAyB;QACzB,MAAM,SAAS,GAAuB,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAEnF,oBAAoB;QACpB,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAC/D,SAAS,EACT,IAAI,CAAC,MAAM,CAAC,2BAA2B,CACxC,CAAC;QAEF,IAAI,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,MAAM,MAAM,GAAwB;gBAClC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,IAAI;gBACd,SAAS;gBACT,KAAK,EAAE,sDAAsD,SAAS,wBAAwB,IAAI,CAAC,MAAM,CAAC,2BAA2B,IAAI;gBACzI,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc;gBAC9D,gBAAgB,EAAE,IAAI;gBACtB,cAAc,EAAE,KAAK;gBACrB,aAAa;aACd,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,GACX,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;YACjD,IAAI,CAAC,cAAc,CAAC,aAAa,CAC/B,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EACjD,OAAO,CAAC,aAAa,EACrB,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAC/C,CAAC;QAEJ,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAwB;gBAClC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,IAAI;gBACd,SAAS;gBACT,KAAK,EAAE,sBAAsB,aAAa,CAAC,MAAM,EAAE;gBACnD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,gBAAgB;gBAChB,cAAc,EAAE,YAAY;gBAC5B,aAAa;aACd,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,MAAM,GAAwB;gBAClC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,IAAI;gBACd,SAAS;gBACT,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,gBAAgB;gBAChB,cAAc,EAAE,YAAY;gBAC5B,aAAa;aACd,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClE,MAAM,MAAM,GAAwB;gBAClC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,IAAI;gBACd,SAAS;gBACT,KAAK,EAAE,QAAQ;gBACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,gBAAgB;gBAChB,cAAc,EAAE,YAAY;gBAC5B,aAAa;aACd,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;CACF"}

package/dist/execution/types.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Execution Engine & ToolGateway Types
+ * PRD-EXEC-002, PRD-EXEC-003, PRD-EXEC-004, PRD-EXEC-005, PRD-INV-004
+ */
+export type ExecutionRiskLevel = "read" | "write" | "execute" | "network" | "destructive";
+export type ToolRiskLevel = ExecutionRiskLevel;
+export type SandboxType = "local_direct" | "local_virtualized" | "container" | "cloud";
+export interface ProcessBounds {
+    timeoutMs: number;
+    maxBufferBytes: number;
+    maxMemoryMb?: number;
+    killSignal?: NodeJS.Signals;
+}
+export interface ToolExecutionRequest {
+    id: string;
+    toolName: string;
+    action: string;
+    arguments: Record<string, unknown>;
+    sessionId: string;
+    agentId: string;
+    workspaceRoot: string;
+    sandboxType?: SandboxType;
+    overridingBounds?: Partial<ProcessBounds>;
+}
+export interface ToolExecutionResult {
+    id: string;
+    success: boolean;
+    toolName: string;
+    riskLevel: ExecutionRiskLevel;
+    output?: unknown;
+    error?: string;
+    durationMs: number;
+    sandboxType: SandboxType;
+    requiresApproval: boolean;
+    approvedByUser?: boolean;
+    auditRecordId: string;
+}
+export interface ToolGatewaySecurityPolicy {
+    allowedTools: string[];
+    blockedTools: string[];
+    maxRiskLevelWithoutApproval: ExecutionRiskLevel;
+    allowNetwork: boolean;
+    allowDestructive: boolean;
+    defaultSandbox: SandboxType;
+    globalBounds: ProcessBounds;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/execution/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/execution/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAG1F,MAAM,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAE/C,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,mBAAmB,GAAG,WAAW,GAAG,OAAO,CAAC;AAEvF,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,2BAA2B,EAAE,kBAAkB,CAAC;IAChD,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,WAAW,CAAC;IAC5B,YAAY,EAAE,aAAa,CAAC;CAC7B"}

package/dist/execution/types.js

@@ -0,0 +1,6 @@
+/**
+ * Execution Engine & ToolGateway Types
+ * PRD-EXEC-002, PRD-EXEC-003, PRD-EXEC-004, PRD-EXEC-005, PRD-INV-004
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/execution/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/execution/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}