dsh-kingdom 0.7.0 → 0.8.0

package/lib/capability/dsh-enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsh-enforcement.js","sourceRoot":"","sources":["../../src/capability/dsh-enforcement.ts"],"names":[],"mappings":"AA2DA;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,SAAkB,EAAE,KAAa,EAAQ,EAAE;QACtE,IAAI,KAAK,GAAG,CAAC;YAAE,OAAM;QACrB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACpC,OAAM;QACR,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACpD,OAAM;QACR,CAAC;QACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAA+B,CAAA;YAC9C,gEAAgE;YAChE,iEAAiE;YACjE,IAAI,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBACtB,OAAM;YACR,CAAC;YACD,gDAAgD;YAChD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;gBACjE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;oBACzB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzB,KAAK,MAAM,IAAI,IAAI,KAAK;4BAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBACvD,CAAC;yBAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAC9C,mCAAmC;wBACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;4BAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBACxD,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;oBAC/B,CAAC;oBACD,OAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IACrB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,kEAAkE;AAClE,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IACpD,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,mCAAmC,CAAA;AAEzE,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAA0B,CAAA;AAE9D,SAAS,UAAU,CAAC,OAA8B;IAChD,OAAO,OAAO,CAAC,KAAK,CAAC,OAA4B,CAAA;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA8B,EAAE,IAAyB;IAChG,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAA;IAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;IACnE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAA;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAA;IACvE,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACjH,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACvH,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/G,MAAM,WAAW,GAAyC,cAAc,KAAK,WAAW,IAAI,cAAc,KAAK,iBAAiB,IAAI,cAAc,KAAK,oBAAoB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAA;IACnM,MAAM,YAAY,GAA4C,eAAe,KAAK,OAAO,IAAI,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/I,sGAAsG;IACtG,MAAM,oBAAoB,GAAkB,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;IAEpG,kEAAkE;IAClE,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;IAE9E,+CAA+C;IAC/C,+FAA+F;IAC/F,IAAI,OAAO,GAAa,EAAE,CAAA;IAC1B,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC3C,IAAI,aAAa,IAAI,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAA;YACnE,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,OAAO,GAAG,EAAE,CAAA;QACd,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,iFAAiF;QACjF,OAAO,GAAG,SAAS,CAAA;IACrB,CAAC;IAED,sBAAsB;IACtB,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IAE9D,OAAO;QACL,KAAK;QACL,WAAW,EAAE,WAAW,IAAI,IAAI;QAChC,cAAc,EAAE,YAAY,IAAI,IAAI;QACpC,QAAQ,EAAE,oBAAoB,IAAI,IAAI;KACvC,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAmB,EACnB,OAA8B,EAC9B,OAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,SAAS,GAAmB,EAAE,CAAA;IACpC,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAA;IAExC,8CAA8C;IAC9C,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;IACjE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC3D,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClB,OAAO,CAAC,IAAI,CAAC,mBAAmB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3D,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;gBACjC,+DAA+D;gBAC/D,qDAAqD;gBACrD,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,IAAI,CAAC,IAAI,EAAE,CAAA;YAC/F,CAAC,CAAC,CAAA;YACF,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClB,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC5D,OAAO,CAAC,IAAI,CAAC,qBAAqB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACnG,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;QACnD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;gBAC7E,OAAO,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACzF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;QAC9C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;gBAC9E,OAAO,CAAC,IAAI,CAAC,mBAAmB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACpE,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;IACjD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACzG,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAEnF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBAAC,OAAO,EAAE,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACnD,CAAC;IAED,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAA;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE;YACP,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO;YACP,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC;KACF,CAAC,CAAA;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAA;AAC5C,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA8B;IACxE,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IAC/B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IACjD,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC;YAAC,OAAO,EAAE,CAAC;YAAC,QAAQ,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC;YAC3B,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;SACpF,CAAC;KACH,CAAA;AACH,CAAC"}

package/lib/capability/resolver.js

@@ -0,0 +1,66 @@
+/** 某能力是否可被 Runtime 实际 enforce（context-bound；未知能力 → false，fail-closed）。 */
+export function isEnforceable(capability, enforceable) {
+    if (capability.startsWith('tool:')) {
+        return enforceable.tools.includes(capability.slice('tool:'.length));
+    }
+    switch (capability) {
+        case 'filesystem.write':
+            return enforceable.sandboxMode === 'workspace-write';
+        case 'filesystem.read':
+            return enforceable.sandboxMode === 'read-only' || enforceable.sandboxMode === 'workspace-write';
+        case 'shell.exec':
+            return enforceable.sandboxMode !== null;
+        case 'approval.never':
+            return enforceable.approvalPolicy === 'never';
+        default:
+            return false;
+    }
+}
+export function resolveEffectiveCapability(input) {
+    const { requirement, grant, ceiling, enforceable } = input;
+    const effective = {};
+    const deniedReasons = [];
+    if (ceiling === null) {
+        // B-4/B-7：NULL ceiling 的王国不得进入 GOVERNED_PERSISTENT（交集为空，全部拒绝）
+        for (const cap of Object.keys(requirement)) {
+            deniedReasons.push(`${cap}: kingdom 未配置 capability ceiling（B-7：NULL ceiling 不得进入 GOVERNED_PERSISTENT）`);
+        }
+        return { effective, coverage: 'NONE', deniedReasons };
+    }
+    const required = Object.keys(requirement).filter(cap => requirement[cap] === true);
+    for (const cap of required) {
+        const granted = grant[cap] === true;
+        const ceilingOk = ceiling[cap] === true;
+        const enforceableNow = isEnforceable(cap, enforceable);
+        if (!granted) {
+            deniedReasons.push(`${cap}: Supervisor grant 未包含`);
+            continue;
+        }
+        if (!ceilingOk) {
+            deniedReasons.push(`${cap}: 超出 Owner ceiling 允许清单`);
+            continue;
+        }
+        if (!enforceableNow) {
+            deniedReasons.push(`${cap}: Runtime 无法证明 enforce（sandbox=${enforceable.sandboxMode ?? 'none'}, approval=${enforceable.approvalPolicy ?? 'none'}, tools=${enforceable.tools.length})`);
+            continue;
+        }
+        effective[cap] = true;
+    }
+    let coverage;
+    if (required.length === 0)
+        coverage = 'NONE';
+    else if (Object.keys(effective).length === required.length)
+        coverage = 'FULL';
+    else if (Object.keys(effective).length > 0)
+        coverage = 'PARTIAL';
+    else
+        coverage = 'NONE';
+    return { effective, coverage, deniedReasons };
+}
+/** 从 effective 集构建 EnforcementPlan 的 tool 面（tool:<name> → name）。 */
+export function effectiveTools(effective) {
+    return Object.keys(effective)
+        .filter(cap => cap.startsWith('tool:') && effective[cap] === true)
+        .map(cap => cap.slice('tool:'.length));
+}
+//# sourceMappingURL=resolver.js.map

package/lib/capability/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/capability/resolver.ts"],"names":[],"mappings":"AAyCA,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,WAAkC;IAClF,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IACrE,CAAC;IACD,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,kBAAkB;YACrB,OAAO,WAAW,CAAC,WAAW,KAAK,iBAAiB,CAAA;QACtD,KAAK,iBAAiB;YACpB,OAAO,WAAW,CAAC,WAAW,KAAK,WAAW,IAAI,WAAW,CAAC,WAAW,KAAK,iBAAiB,CAAA;QACjG,KAAK,YAAY;YACf,OAAO,WAAW,CAAC,WAAW,KAAK,IAAI,CAAA;QACzC,KAAK,gBAAgB;YACnB,OAAO,WAAW,CAAC,cAAc,KAAK,OAAO,CAAA;QAC/C;YACE,OAAO,KAAK,CAAA;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAuB;IAChE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAA;IAC1D,MAAM,SAAS,GAA4B,EAAE,CAAA;IAC7C,MAAM,aAAa,GAAa,EAAE,CAAA;IAElC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,8DAA8D;QAC9D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,aAAa,CAAC,IAAI,CAAC,GAAG,GAAG,6EAA6E,CAAC,CAAA;QACzG,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IACvD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAA;IAClF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;QACvC,MAAM,cAAc,GAAG,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,aAAa,CAAC,IAAI,CAAC,GAAG,GAAG,wBAAwB,CAAC,CAAA;YAClD,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,GAAG,GAAG,yBAAyB,CAAC,CAAA;YACnD,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,aAAa,CAAC,IAAI,CAAC,GAAG,GAAG,kCAAkC,WAAW,CAAC,WAAW,IAAI,MAAM,cAAc,WAAW,CAAC,cAAc,IAAI,MAAM,WAAW,WAAW,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;YACrL,SAAQ;QACV,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;IACvB,CAAC;IAED,IAAI,QAAgC,CAAA;IACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,QAAQ,GAAG,MAAM,CAAA;SACvC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,QAAQ,GAAG,MAAM,CAAA;SACxE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,GAAG,SAAS,CAAA;;QAC3D,QAAQ,GAAG,MAAM,CAAA;IAEtB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAA;AAC/C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,SAAkC;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;SAC1B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;SACjE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;AAC1C,CAAC"}

package/lib/capability/service.js

@@ -0,0 +1,117 @@
+import { advanceLeaseState, bindCapabilityDecision, releaseExecutionLease, recordCapabilityDecision, setLeasePlan, } from '../core/governed.js';
+import { effectiveTools, resolveEffectiveCapability } from './resolver.js';
+function parseJson(json) {
+    if (!json)
+        return null;
+    try {
+        const value = JSON.parse(json);
+        if (typeof value === 'object' && value !== null && !Array.isArray(value))
+            return value;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** 从 effective 集 + 请求构建 EnforcementRequest。 */
+function buildRequest(resolution, sandboxMode, territoryPath, presetId) {
+    return {
+        tools: effectiveTools(resolution.effective),
+        territoryPath,
+        sandboxMode,
+        approvalPolicy: 'never',
+        ...(presetId ? { presetId } : {}),
+    };
+}
+/** 释放 lease 的 zero-execution 收尾（合法源：RECOVERING/MATERIALIZING/RELEASING）。 */
+function zeroExecutionRelease(store, leaseId, reason) {
+    const lease = store.getLease(leaseId);
+    if (!lease)
+        throw new Error(`zeroExecutionRelease: lease ${leaseId} 不存在`);
+    if (lease.state === 'MATERIALIZING' || lease.state === 'RELEASING' || lease.state === 'RECOVERING') {
+        return releaseExecutionLease(store, leaseId, { phase: 'capability-gate', reason }, reason);
+    }
+    // ACQUIRED/PREPARING 等只能先进 RECOVERING 再带证据释放
+    const recovering = advanceLeaseState(store, leaseId, 'RECOVERING');
+    void recovering;
+    return releaseExecutionLease(store, leaseId, { phase: 'capability-gate', reason }, reason);
+}
+/**
+ * 完整能力闸门（TX-0D..TX-2S/2F）：
+ * - 返回 materialized=false + DENIED Decision = zero execution（无 Execution / Dispatch）；
+ * - 返回 materialized=true + GRANTED+ENFORCED Decision，Lease 停在 DISPATCH_READY（等 TX-3）。
+ */
+export async function runCapabilityGate(input) {
+    const { store, adapter, kingdomId, taskId, attemptNo, workerBindingId, supervisorBindingId, leaseId } = input;
+    const requirement = parseJson(input.requirementJson) ?? {};
+    const ceiling = parseJson(input.ceilingJson);
+    const enforceable = await adapter.capabilities(input.context);
+    const resolution = resolveEffectiveCapability({ requirement, grant: input.grant, ceiling, enforceable });
+    const deny = (enforcementStatus, reasonCode) => {
+        const decision = recordCapabilityDecision(store, {
+            kingdomId, taskId, workerBindingId, supervisorBindingId,
+            requirementSnapshot: input.requirementJson ?? undefined,
+            ceilingSnapshot: input.ceilingJson ?? undefined,
+            proposedGrantSnapshot: JSON.stringify(input.grant),
+            effectiveSnapshot: JSON.stringify(resolution.effective),
+            decision: 'DENIED',
+            enforcementStatus,
+            requirementCoverage: resolution.coverage,
+            reasonCode: reasonCode ?? resolution.deniedReasons[0] ?? null,
+        });
+        const lease = zeroExecutionRelease(store, leaseId, `capability-denied:${enforcementStatus}`);
+        return { decision, lease, materialized: false };
+    };
+    // TX-0D：ceiling 缺失 → 拒（B-7）
+    if (ceiling === null) {
+        return deny('UNAVAILABLE', 'CEILING_NOT_CONFIGURED');
+    }
+    // TX-0D：必需能力未全覆盖 → 拒（fail-closed，不部分治理）
+    if (resolution.coverage !== 'FULL') {
+        return deny('NOT_ATTEMPTED', resolution.deniedReasons[0] ?? 'REQUIREMENT_NOT_FULLY_EFFECTIVE');
+    }
+    // TX-1：写 plan → PREPARING → MATERIALIZING
+    const plan = {
+        type: 'DshEnforcementPlan/v1',
+        payload: {
+            tools: effectiveTools(resolution.effective),
+            sandboxMode: input.sandboxMode,
+            approvalPolicy: 'never',
+            presetId: input.presetId ?? null,
+            coverage: resolution.coverage,
+            effective: resolution.effective,
+        },
+    };
+    setLeasePlan(store, leaseId, JSON.stringify(plan));
+    advanceLeaseState(store, leaseId, 'PREPARING');
+    advanceLeaseState(store, leaseId, 'MATERIALIZING');
+    const territoryPath = input.context.agent.session.header?.cwd ?? '';
+    const request = buildRequest(resolution, input.sandboxMode, territoryPath, input.presetId);
+    // TX-2 前置：preflight（无副作用）
+    const preflight = await adapter.preflight(request, input.context);
+    if (!preflight.ok) {
+        await adapter.cleanup(request, input.context);
+        return deny('UNAVAILABLE', `PREFLIGHT_FAILED:${preflight.reasons.join(';')}`);
+    }
+    // TX-2S/2F：materialize
+    const materialized = await adapter.materialize(request, input.context);
+    if (!materialized.ok || !materialized.evidenceJson) {
+        await adapter.cleanup(request, input.context);
+        return deny('FAILED', `MATERIALIZE_FAILED:${(materialized.reasons ?? []).join(';') || 'no-reason'}`);
+    }
+    const decision = recordCapabilityDecision(store, {
+        kingdomId, taskId, workerBindingId, supervisorBindingId,
+        requirementSnapshot: input.requirementJson ?? undefined,
+        ceilingSnapshot: input.ceilingJson ?? undefined,
+        proposedGrantSnapshot: JSON.stringify(input.grant),
+        effectiveSnapshot: JSON.stringify(resolution.effective),
+        decision: 'GRANTED',
+        enforcementStatus: 'ENFORCED',
+        enforcementEvidenceJson: materialized.evidenceJson,
+        requirementCoverage: resolution.coverage,
+    });
+    bindCapabilityDecision(store, leaseId, decision.decision_id);
+    const lease = advanceLeaseState(store, leaseId, 'DISPATCH_READY');
+    return { decision, lease, materialized: true };
+}
+//# sourceMappingURL=service.js.map

package/lib/capability/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/capability/service.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,GACb,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAkC,MAAM,eAAe,CAAA;AA8B1G,SAAS,SAAS,CAAC,IAAmB;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAgC,CAAA;QACjH,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,SAAS,YAAY,CAAC,UAAsB,EAAE,WAA4C,EAAE,aAAqB,EAAE,QAAiB;IAClI,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QAC3C,aAAa;QACb,WAAW;QACX,cAAc,EAAE,OAAO;QACvB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,oBAAoB,CAAC,KAAmB,EAAE,OAAe,EAAE,MAAc;IAChF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,MAAM,CAAC,CAAA;IACzE,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QACnG,OAAO,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;IAC5F,CAAC;IACD,6CAA6C;IAC7C,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;IAClE,KAAK,UAAU,CAAA;IACf,OAAO,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA0B;IAChE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IAC7G,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAA;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAC5C,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC7D,MAAM,UAAU,GAAG,0BAA0B,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;IAExG,MAAM,IAAI,GAAG,CAAC,iBAA6D,EAAE,UAAyB,EAAwB,EAAE;QAC9H,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,EAAE;YAC/C,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,mBAAmB;YACvD,mBAAmB,EAAE,KAAK,CAAC,eAAe,IAAI,SAAS;YACvD,eAAe,EAAE,KAAK,CAAC,WAAW,IAAI,SAAS;YAC/C,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YAClD,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;YACvD,QAAQ,EAAE,QAAQ;YAClB,iBAAiB;YACjB,mBAAmB,EAAE,UAAU,CAAC,QAAQ;YACxC,UAAU,EAAE,UAAU,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI;SAC9D,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,iBAAiB,EAAE,CAAC,CAAA;QAC5F,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;IACjD,CAAC,CAAA;IAED,4BAA4B;IAC5B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAA;IACtD,CAAC;IACD,wCAAwC;IACxC,IAAI,UAAU,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,iCAAiC,CAAC,CAAA;IAChG,CAAC;IAED,0CAA0C;IAC1C,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE;YACP,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;YAC3C,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,cAAc,EAAE,OAAO;YACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC;KACF,CAAA;IACD,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;IAClD,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;IAC9C,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,CAAA;IAElD,MAAM,aAAa,GAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAoD,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAA;IACjH,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IAE1F,0BAA0B;IAC1B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACjE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,OAAO,IAAI,CAAC,aAAa,EAAE,oBAAoB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,uBAAuB;IACvB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACtE,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;QACnD,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,OAAO,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,CAAA;IACtG,CAAC;IAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,EAAE;QAC/C,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,mBAAmB;QACvD,mBAAmB,EAAE,KAAK,CAAC,eAAe,IAAI,SAAS;QACvD,eAAe,EAAE,KAAK,CAAC,WAAW,IAAI,SAAS;QAC/C,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;QAClD,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;QACvD,QAAQ,EAAE,SAAS;QACnB,iBAAiB,EAAE,UAAU;QAC7B,uBAAuB,EAAE,YAAY,CAAC,YAAY;QAClD,mBAAmB,EAAE,UAAU,CAAC,QAAQ;KACzC,CAAC,CAAA;IACF,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC5D,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAA;IACjE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;AAChD,CAAC"}