avorelo 0.1.0 → 0.3.0

package/scripts/lib/agent-policy-profile.js

@@ -1,210 +0,0 @@
-"use strict";
-
-const { getCurrentPlan } = require("./entitlements");
-
-const POLICY_MODES = Object.freeze(["visibility", "warn", "approve", "enforce"]);
-
-function unique(values) {
-  return [...new Set((values || []).filter(Boolean))];
-}
-
-function toIso(value) {
-  return value instanceof Date ? value.toISOString() : new Date(value || Date.now()).toISOString();
-}
-
-function normalizeMode(value, fallback) {
-  return POLICY_MODES.includes(value) ? value : fallback;
-}
-
-function normalizePlan(value) {
-  return String(value || "free").trim().toLowerCase() === "pro" ? "pro" : "free";
-}
-
-function buildBaseProfile(plan, now) {
-  const createdAt = toIso(now);
-
-  if (plan === "pro") {
-    return {
-      profileId: "avorelo-pro-least-privilege",
-      plan,
-      mode: "approve",
-      allowedActionTypes: [
-        "prompt_compile",
-        "file_read",
-        "visual_qa_run",
-        "browser_action",
-        "tool_call",
-        "mcp_tool_call",
-        "command_run",
-        "git_operation",
-      ],
-      deniedActionTypes: [
-        "secret_access",
-      ],
-      allowedPaths: [
-        ".",
-        "src/",
-        "tests/",
-        "docs/",
-        "deferred/site-implementation/",
-        "src/landing-page/",
-      ],
-      deniedPaths: [
-        ".env",
-        ".env.*",
-        ".ssh/",
-        ".github/workflows/",
-        "secrets/",
-        "credentials/",
-      ],
-      allowedDomains: [
-        "localhost",
-        "127.0.0.1",
-        "::1",
-      ],
-      deniedDomains: [
-        "*.internal",
-      ],
-      allowedTools: [
-        "prompt_compiler",
-        "visual_qa",
-        "refactor_boundary",
-        "browser_governance",
-        "security_protection",
-        "context_cost_optimizer",
-        "evidence_report",
-      ],
-      deniedTools: [],
-      approvalRequiredFor: [
-        "sensitive_file_write",
-        "external_browser_domain",
-        "write_capable_tool",
-        "write_capable_mcp",
-        "deploy_operation",
-        "external_export",
-        "unknown_tool",
-      ],
-      ttlSeconds: 1800,
-      evidenceRequired: true,
-      sourceTrustRequired: true,
-      zeroStandingPermissions: true,
-      scopedJitStyleAccess: true,
-      enforcementAvailable: "where_supported",
-      createdAt,
-    };
-  }
-
-  return {
-    profileId: "avorelo-free-visibility-warn",
-    plan,
-    mode: "warn",
-    allowedActionTypes: [
-      "prompt_compile",
-      "file_read",
-      "visual_qa_run",
-      "browser_action",
-      "tool_call",
-      "mcp_tool_call",
-      "command_run",
-    ],
-    deniedActionTypes: [
-      "secret_access",
-    ],
-    allowedPaths: [
-      ".",
-      "src/",
-      "tests/",
-      "docs/",
-      "deferred/site-implementation/",
-      "src/landing-page/",
-    ],
-    deniedPaths: [
-      ".env",
-      ".env.*",
-      ".ssh/",
-      "secrets/",
-      "credentials/",
-    ],
-    allowedDomains: [
-      "localhost",
-      "127.0.0.1",
-      "::1",
-    ],
-    deniedDomains: [
-      "*.internal",
-    ],
-    allowedTools: [
-      "prompt_compiler",
-      "visual_qa",
-      "security_protection",
-      "evidence_report",
-    ],
-    deniedTools: [],
-    approvalRequiredFor: [
-      "sensitive_file_write",
-      "external_browser_domain",
-      "write_capable_tool",
-      "write_capable_mcp",
-      "deploy_operation",
-      "external_export",
-      "unknown_tool",
-    ],
-    ttlSeconds: 900,
-    evidenceRequired: true,
-    sourceTrustRequired: false,
-    zeroStandingPermissions: true,
-    scopedJitStyleAccess: false,
-    enforcementAvailable: "visibility_and_warning",
-    createdAt,
-  };
-}
-
-function buildPolicyProfile(options = {}) {
-  const cwd = options.cwd;
-  const plan = normalizePlan(options.plan || getCurrentPlan({ cwd }));
-  const now = options.now || new Date();
-  const base = buildBaseProfile(plan, now);
-  const overrides = options.overrides && typeof options.overrides === "object" ? options.overrides : {};
-
-  return {
-    ...base,
-    ...overrides,
-    plan,
-    mode: normalizeMode(overrides.mode, base.mode),
-    allowedActionTypes: unique(overrides.allowedActionTypes || base.allowedActionTypes),
-    deniedActionTypes: unique(overrides.deniedActionTypes || base.deniedActionTypes),
-    allowedPaths: unique(overrides.allowedPaths || base.allowedPaths),
-    deniedPaths: unique(overrides.deniedPaths || base.deniedPaths),
-    allowedDomains: unique(overrides.allowedDomains || base.allowedDomains),
-    deniedDomains: unique(overrides.deniedDomains || base.deniedDomains),
-    allowedTools: unique(overrides.allowedTools || base.allowedTools),
-    deniedTools: unique(overrides.deniedTools || base.deniedTools),
-    approvalRequiredFor: unique(overrides.approvalRequiredFor || base.approvalRequiredFor),
-    createdAt: toIso(overrides.createdAt || base.createdAt),
-  };
-}
-
-function describePolicyProfile(profile) {
-  const mode = normalizeMode(profile?.mode, "warn");
-  const plan = normalizePlan(profile?.plan);
-
-  if (plan === "pro") {
-    return {
-      headline: "Advanced least-privilege protection",
-      summary: mode === "enforce"
-        ? "Pro can enforce blocks for clearly unsafe actions and require approval where supported."
-        : "Pro narrows risky actions, requires approval for sensitive work, and keeps deeper local evidence where supported.",
-    };
-  }
-
-  return {
-    headline: "Basic safer-by-default visibility",
-    summary: "Free surfaces risky skills, instructions, tools, browser capability, and the latest local evidence without making the workflow heavy.",
-  };
-}
-
-module.exports = {
-  POLICY_MODES,
-  buildPolicyProfile,
-  describePolicyProfile,
-};