evolcore 0.0.1 → 0.0.3

package/dist/core/auth/operation-authorizer.js

@@ -0,0 +1,720 @@
+import { getRoleDefinition } from '../../config/roles.js';
+import { isManagementRole } from '../../config/builtin-roles.js';
+import { relationFieldWriteOperation, resolveRoleFieldPermission, } from '../../config/config-field-policy.js';
+import { isResolvedConfigMutation, } from '../../config/resolved-config-op.js';
+import { normalizePeer } from '../model/config-scope.js';
+import { getOperationMeta } from './operation-catalog.js';
+import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
+export const USER_PLANE_CAPABILITY_CEILING = {
+    allowOperations: new Set([
+        'model.list',
+        'model.current',
+        'model.use',
+        'model.effort',
+        'model.reset',
+        'permission.current',
+        'permission.answer',
+        'chatmode.current',
+        'chatmode.update',
+        'mentionmode.current',
+        'mentionmode.update',
+        'session.list',
+        'session.create',
+        'session.rename',
+        'trigger.list',
+        'trigger.show',
+        'trigger.history',
+        'trigger.eventCatalog',
+        'trigger.create',
+        'trigger.update',
+        'trigger.setEnabled',
+        'trigger.cancel',
+        'trigger.delete',
+        'trigger.run',
+        'stats.summary',
+        'stats.session',
+        'stats.context',
+        'file.list',
+        'file.fetch',
+        'ec.msg.send',
+        'ec.msg.file',
+        'ec.group.send',
+        'ec.group.file',
+        'config.get',
+        'config.set',
+        'config.unset',
+    ]),
+    denyOperations: new Set([
+        'role.assign',
+        'role.revoke',
+        'config.write',
+        'gateway.write',
+        'cli.exec.raw',
+        'shell.exec',
+        'rce.exec',
+    ]),
+    denyNamespaces: new Set([
+        'role',
+        'connect',
+        'contact',
+        'agent',
+        'system',
+        'storage',
+        'aid',
+    ]),
+    allowCategories: new Set(['read', 'write-own']),
+    denyCategories: new Set(['write-agent', 'process', 'dangerous']),
+};
+export function authorizeCommand(ctx) {
+    return authorizeCommandInternal(ctx);
+}
+export function authorizeResolvedConfigOperation(op, context) {
+    return authorizeResolvedConfigCommand(op, context);
+}
+export function authorizeResolvedConfigCommand(command, context) {
+    return authorizeCommandInternal({ ...context, intent: intentForResolvedConfig(command, context.source) }, command);
+}
+/**
+ * Resolve the role-level capability used by relation setting discovery.
+ * Target ownership/current-relation constraints are considered satisfied by
+ * the caller because the Role snapshot is already bound to one normalized
+ * relation. Context-sensitive private/group and control constraints remain
+ * enforced here.
+ */
+export function evaluateRoleOperationCapability(params) {
+    const opMeta = getOperationMeta(params.operation);
+    if (!opMeta) {
+        return {
+            allow: false,
+            operation: params.operation,
+            reason: `Unknown operation: ${params.operation}`,
+        };
+    }
+    const roleDef = getRoleDefinition(params.role, params.selfAid);
+    if (!roleDef || roleDef.allowAccess === false) {
+        return {
+            allow: false,
+            operation: params.operation,
+            reason: `Role ${params.role} cannot access commands`,
+        };
+    }
+    const matched = matchCommandPermission(params.operation, opMeta.category, roleDef.commandPermissions || {}, opMeta.dangerous);
+    if (!matched) {
+        return {
+            allow: false,
+            operation: params.operation,
+            reason: `Role ${params.role} has no permission for ${params.operation}`,
+        };
+    }
+    const { permission, matchedRule } = matched;
+    if (!permission.allow) {
+        return {
+            allow: false,
+            operation: params.operation,
+            reason: permission.reason || `Role ${params.role} explicitly denies ${params.operation}`,
+            matchedRule,
+        };
+    }
+    const scopes = permission.scopes || opMeta.defaultScopes;
+    if (!scopes.includes(params.scope)) {
+        return {
+            allow: false,
+            operation: params.operation,
+            reason: `Scope ${params.scope} is not allowed for ${params.operation}`,
+            matchedRule,
+        };
+    }
+    const constraints = permission.constraints;
+    if (constraints?.privateOnly && params.chatType !== 'private') {
+        return { allow: false, operation: params.operation, reason: 'Operation is private-chat only', matchedRule };
+    }
+    if (constraints?.groupOnly && params.chatType !== 'group') {
+        return { allow: false, operation: params.operation, reason: 'Operation is group-chat only', matchedRule };
+    }
+    if (constraints?.requireAgentOwner && params.role !== 'owner') {
+        return { allow: false, operation: params.operation, reason: 'Operation requires Agent owner', matchedRule };
+    }
+    if (constraints?.requireAgentAdmin && params.role !== 'owner' && params.role !== 'admin') {
+        return { allow: false, operation: params.operation, reason: 'Operation requires Agent admin', matchedRule };
+    }
+    if (constraints?.requireControlChannel && !params.fromControlChannel) {
+        return { allow: false, operation: params.operation, reason: 'Operation requires the control channel', matchedRule };
+    }
+    if (opMeta.dangerous && !isExplicitDangerousGrant(matchedRule, permission)) {
+        return { allow: false, operation: params.operation, reason: 'Dangerous operation is not explicitly granted', matchedRule };
+    }
+    return { allow: true, operation: params.operation, matchedRule };
+}
+function authorizeCommandInternal(ctx, resolvedConfigCommand) {
+    const { intent, role } = ctx;
+    const operation = intent.operation;
+    const opMeta = getOperationMeta(operation);
+    if (!opMeta) {
+        return denyDecision(ctx, 'NOT_ALLOWED', `Unknown operation: ${operation}`, operation, intent.scope);
+    }
+    if (isFieldConfigOperation(operation) && !resolvedConfigCommand) {
+        return denyDecision(ctx, 'NOT_ALLOWED', 'Resolved config operation is required', operation, intent.scope, opMeta.dangerous);
+    }
+    if (resolvedConfigCommand
+        && (resolvedConfigCommand.operationId !== operation || resolvedConfigCommand.commandScope !== intent.scope)) {
+        return denyDecision(ctx, 'NOT_ALLOWED', 'Resolved config operation does not match the command intent', operation, intent.scope, opMeta.dangerous);
+    }
+    if (ctx.chatType === 'group'
+        && (resolvedConfigCommand ? isResolvedConfigMutation(resolvedConfigCommand) : isConfigMutationOperation(operation))
+        && intent.scope !== 'relation') {
+        return denyDecision(ctx, 'SCOPE_MISMATCH', 'Group chats may only modify relation-scoped config', operation, intent.scope, opMeta.dangerous);
+    }
+    const sourceAllowed = !opMeta.sources
+        || opMeta.sources.includes(ctx.source)
+        || ((ctx.source === 'ecweb' || ctx.source === 'control') && opMeta.sources.includes('menu'));
+    if (!sourceAllowed) {
+        return denyDecision(ctx, 'NOT_ALLOWED', `Operation ${operation} is not available from source ${ctx.source}`, operation, intent.scope, opMeta.dangerous);
+    }
+    if (resolvedConfigCommand) {
+        const targetCheck = checkResolvedConfigTarget(ctx, resolvedConfigCommand);
+        if (!targetCheck.ok) {
+            return denyDecision(ctx, intent.scope === 'relation' ? 'ARGUMENT_MISMATCH' : 'SCOPE_MISMATCH', targetCheck.reason || 'Config target is outside the current task context', operation, intent.scope, opMeta.dangerous);
+        }
+        const identityMutationCheck = checkManagementIdentityMutation(ctx, resolvedConfigCommand);
+        if (!identityMutationCheck.ok) {
+            return denyDecision(ctx, 'NOT_ALLOWED', identityMutationCheck.reason || 'Static management identities cannot be changed by this role', operation, intent.scope, opMeta.dangerous);
+        }
+        if (resolvedConfigCommand.kind === 'global' && !ctx.isDaemonOwner) {
+            return denyDecision(ctx, 'NOT_ALLOWED', `Global config command ${operation} requires daemon owner permission`, operation, intent.scope, opMeta.dangerous);
+        }
+        if (role === 'owner' && !ctx.isDaemonOwner && intent.scope === 'process') {
+            return denyDecision(ctx, 'SCOPE_MISMATCH', 'Agent owners cannot access process, defaults, or global config commands', operation, intent.scope, opMeta.dangerous);
+        }
+        if (!isManagementRole(role) && intent.scope !== 'relation') {
+            return denyDecision(ctx, 'SCOPE_MISMATCH', `Role ${role} may only access relation-scoped config`, operation, intent.scope, opMeta.dangerous);
+        }
+        if (ctx.isDaemonOwner || role === 'owner') {
+            return {
+                allow: true,
+                operation,
+                scope: intent.scope,
+                role: ctx.isDaemonOwner ? 'owner' : role,
+                dangerous: opMeta.dangerous,
+                matchedRule: ctx.isDaemonOwner ? 'daemon-owner' : 'agent-owner',
+            };
+        }
+    }
+    const roleDef = getRoleDefinition(role, ctx.selfAid);
+    if (!roleDef) {
+        return denyDecision(ctx, 'ROLE_ACCESS_DENIED', `Unknown role: ${role}`, operation, intent.scope, opMeta.dangerous);
+    }
+    if (roleDef.allowAccess === false) {
+        return denyDecision(ctx, 'ROLE_ACCESS_DENIED', `Role ${role} is not allowed to access commands`, operation, intent.scope, opMeta.dangerous);
+    }
+    if (!isManagementRole(role)
+        && !resolvedConfigCommand
+        && !isUserPlaneOperationAllowed(operation, opMeta.category, opMeta.dangerous)) {
+        return denyDecision(ctx, 'NOT_ALLOWED', `Operation ${operation} is outside the user permission plane`, operation, intent.scope, opMeta.dangerous);
+    }
+    const matchResult = matchCommandPermission(operation, opMeta.category, roleDef.commandPermissions || {}, opMeta.dangerous);
+    if (!matchResult) {
+        return denyDecision(ctx, 'NO_PERMISSION', `Role ${role} has no permission for ${operation}`, operation, intent.scope, opMeta.dangerous);
+    }
+    const { permission, matchedRule } = matchResult;
+    if (!permission.allow) {
+        return denyDecision(ctx, 'NOT_ALLOWED', permission.reason || `Role ${role} explicitly denies ${operation}`, operation, intent.scope, opMeta.dangerous, matchedRule);
+    }
+    if (resolvedConfigCommand?.kind === 'field'
+        && isFieldConfigOperation(operation)
+        && matchedRule !== operation
+        && matchedRule !== 'config.*') {
+        return denyDecision(ctx, 'NO_PERMISSION', `Role ${role} requires an explicit config permission`, operation, intent.scope, opMeta.dangerous, matchedRule);
+    }
+    if (resolvedConfigCommand?.dangerous) {
+        if (matchedRule !== operation || permission.allow !== true || permission.dangerous !== true) {
+            return denyDecision(ctx, 'DANGEROUS_NOT_GRANTED', `Dangerous config operation ${operation} requires an exact dangerous grant`, operation, intent.scope, opMeta.dangerous, matchedRule);
+        }
+        if (!permission.scopes || permission.scopes.length === 0) {
+            return denyDecision(ctx, 'SCOPE_MISMATCH', `Dangerous config operation ${operation} requires explicit scopes`, operation, intent.scope, opMeta.dangerous, matchedRule);
+        }
+        if (resolvedConfigCommand.kind === 'field') {
+            const allowedConfigKeys = permission.constraints?.allowedConfigKeys;
+            if (!allowedConfigKeys || allowedConfigKeys.length === 0 || !allowedConfigKeys.includes(resolvedConfigCommand.field)) {
+                return denyDecision(ctx, 'ARGUMENT_MISMATCH', `Dangerous config field ${resolvedConfigCommand.field} requires a non-empty allowedConfigKeys constraint`, operation, intent.scope, opMeta.dangerous, matchedRule);
+            }
+        }
+    }
+    if (permission.constraints?.requireExplicitDangerousGrant && !isExplicitDangerousGrant(matchedRule, permission)) {
+        return denyDecision(ctx, 'DANGEROUS_NOT_GRANTED', `Operation ${operation} requires an explicit dangerous grant`, operation, intent.scope, opMeta.dangerous, matchedRule);
+    }
+    if (opMeta.dangerous && !resolvedConfigCommand && !isExplicitDangerousGrant(matchedRule, permission)) {
+        return denyDecision(ctx, 'DANGEROUS_NOT_GRANTED', `Dangerous operation ${operation} requires an explicit dangerous grant`, operation, intent.scope, opMeta.dangerous, matchedRule);
+    }
+    const allowedScopes = permission.scopes || opMeta.defaultScopes;
+    if (!allowedScopes.includes(intent.scope)) {
+        return denyDecision(ctx, 'SCOPE_MISMATCH', `Scope ${intent.scope} is not in allowed scopes: ${allowedScopes.join(', ')}`, operation, intent.scope, opMeta.dangerous, matchedRule);
+    }
+    if (resolvedConfigCommand?.kind === 'field' && isFieldConfigOperation(operation)) {
+        const fieldPolicy = operation === 'config.get' ? 'behavior-read' : 'role-overridable-write';
+        const fieldCheck = checkConfigFieldPolicy(ctx, fieldPolicy, resolvedConfigCommand);
+        if (!fieldCheck.ok) {
+            return denyDecision(ctx, 'ARGUMENT_MISMATCH', fieldCheck.reason || 'Config field is not allowed', operation, intent.scope, opMeta.dangerous, matchedRule);
+        }
+    }
+    if (permission.constraints) {
+        const constraintCheck = checkConstraints(ctx, permission.constraints, resolvedConfigCommand);
+        if (!constraintCheck.ok) {
+            return denyDecision(ctx, 'ARGUMENT_MISMATCH', constraintCheck.reason || 'Command arguments do not satisfy permission constraints', operation, intent.scope, opMeta.dangerous, matchedRule);
+        }
+    }
+    return {
+        allow: true,
+        operation,
+        scope: intent.scope,
+        role,
+        dangerous: opMeta.dangerous,
+        matchedRule,
+        constraints: permission.constraints,
+    };
+}
+function matchCommandPermission(operation, category, commandPerms, isDangerous) {
+    const namespace = operation.split('.')[0];
+    const matches = [];
+    for (const [rule, permission] of Object.entries(commandPerms)) {
+        const rank = getRuleRank(rule, permission, operation, namespace, category, isDangerous);
+        if (rank > 0) {
+            matches.push({ permission, matchedRule: rule, rank });
+        }
+    }
+    if (matches.length === 0)
+        return null;
+    matches.sort((a, b) => b.rank - a.rank);
+    return matches[0];
+}
+function getRuleRank(rule, permission, operation, namespace, category, isDangerous) {
+    const denyOffset = permission.allow ? 0 : 1;
+    if (rule === operation)
+        return 1000 + denyOffset;
+    if (rule === `${namespace}.*`)
+        return 800 + denyOffset;
+    if (rule.startsWith('category:') && rule.slice('category:'.length) === category)
+        return 600 + denyOffset;
+    if (rule === 'dangerous:*' && isDangerous)
+        return 400 + denyOffset;
+    if (rule === '*' && !isDangerous)
+        return 200 + denyOffset;
+    return 0;
+}
+function isExplicitDangerousGrant(rule, permission) {
+    return permission.allow === true && permission.dangerous === true && (rule === 'dangerous:*' || !rule.includes('*') && !rule.startsWith('category:'));
+}
+function isUserPlaneOperationAllowed(operation, category, dangerous) {
+    const namespace = operation.split('.')[0];
+    if (dangerous)
+        return false;
+    if (USER_PLANE_CAPABILITY_CEILING.denyCategories.has(category))
+        return false;
+    if (!USER_PLANE_CAPABILITY_CEILING.allowCategories.has(category))
+        return false;
+    if (USER_PLANE_CAPABILITY_CEILING.denyOperations.has(operation))
+        return false;
+    if (USER_PLANE_CAPABILITY_CEILING.denyNamespaces.has(namespace))
+        return false;
+    return USER_PLANE_CAPABILITY_CEILING.allowOperations.has(operation);
+}
+function checkConstraints(ctx, constraints, resolvedConfigCommand) {
+    if (constraints.ownPeerOnly) {
+        const peerCheck = checkOwnPeer(ctx);
+        if (!peerCheck.ok)
+            return peerCheck;
+    }
+    if (constraints.ownAgentOnly || constraints.targetCurrentAgentOnly) {
+        const argSelf = stringArg(ctx.intent.args.self);
+        if (argSelf && argSelf !== ctx.selfAid) {
+            return { ok: false, reason: 'Only the current agent can be targeted' };
+        }
+    }
+    if (constraints.requireAgentOwner && ctx.role !== 'owner') {
+        return { ok: false, reason: 'This command requires agent owner permission' };
+    }
+    if (constraints.requireAgentAdmin && ctx.role !== 'owner' && ctx.role !== 'admin') {
+        return { ok: false, reason: 'This command requires agent admin permission' };
+    }
+    if (constraints.privateOnly && ctx.chatType !== 'private') {
+        return { ok: false, reason: 'This command is only allowed in private chats' };
+    }
+    if (constraints.groupOnly && ctx.chatType !== 'group') {
+        const target = stringArg(ctx.intent.args.targetId) ?? stringArg(ctx.intent.args.peer) ?? '<unknown>';
+        const sameGroup = constraints.currentRelationOnly ? ' and may only target that same group' : '';
+        return {
+            ok: false,
+            reason: `Denied ${ctx.intent.operation}: role=${ctx.role}, source_chat=${ctx.chatType ?? 'unknown'}, target_group=${target}. This role may send group messages only from a group-chat task${sameGroup}; the target being a group is not sufficient.`,
+        };
+    }
+    if (constraints.requireDaemonOwner && !ctx.isDaemonOwner) {
+        return { ok: false, reason: 'This command requires daemon owner permission' };
+    }
+    if (constraints.requireControlChannel && !ctx.fromControlChannel) {
+        return { ok: false, reason: 'This command requires the control channel' };
+    }
+    if (constraints.forbiddenFlags) {
+        for (const flag of constraints.forbiddenFlags) {
+            if (ctx.intent.args[flag] !== undefined) {
+                return { ok: false, reason: `Forbidden argument: --${flag}` };
+            }
+        }
+    }
+    if (constraints.allowedArgs) {
+        for (const [key, allowedValues] of Object.entries(constraints.allowedArgs)) {
+            const value = ctx.intent.args[key];
+            if (value !== undefined && Array.isArray(allowedValues) && !allowedValues.includes(value)) {
+                return { ok: false, reason: `Argument --${key} value ${String(value)} is not allowed` };
+            }
+        }
+    }
+    if (constraints.deniedArgs) {
+        for (const [key, deniedValues] of Object.entries(constraints.deniedArgs)) {
+            const value = ctx.intent.args[key];
+            if (value !== undefined && Array.isArray(deniedValues) && deniedValues.includes(value)) {
+                return { ok: false, reason: `Argument --${key} value ${String(value)} is denied` };
+            }
+        }
+    }
+    if (constraints.allowedConfigKeys) {
+        const keyCheck = checkAllowedConfigKeys(ctx, constraints.allowedConfigKeys);
+        if (!keyCheck.ok)
+            return keyCheck;
+    }
+    if (constraints.allowedPrefixes) {
+        const prefixCheck = checkAllowedPrefixes(ctx, constraints.allowedPrefixes);
+        if (!prefixCheck.ok)
+            return prefixCheck;
+    }
+    if (constraints.requireFieldOverride) {
+        const fieldCheck = checkFieldOverride(ctx, constraints.requireFieldOverride);
+        if (!fieldCheck.ok)
+            return fieldCheck;
+    }
+    if (constraints.configFieldPolicy) {
+        const fieldCheck = checkConfigFieldPolicy(ctx, constraints.configFieldPolicy, resolvedConfigCommand?.kind === 'field' ? resolvedConfigCommand : undefined);
+        if (!fieldCheck.ok)
+            return fieldCheck;
+    }
+    if (constraints.currentRelationOnly) {
+        const relationCheck = checkCurrentRelation(ctx, resolvedConfigCommand);
+        if (!relationCheck.ok)
+            return relationCheck;
+    }
+    return { ok: true };
+}
+function isFieldConfigOperation(operation) {
+    return operation === 'config.get' || operation === 'config.set' || operation === 'config.unset';
+}
+function isConfigMutationOperation(operation) {
+    return operation === 'config.set' || operation === 'config.unset' || operation === 'config.write';
+}
+function checkConfigFieldPolicy(ctx, policy, resolvedConfigOp) {
+    if (!resolvedConfigOp)
+        return { ok: false, reason: 'Resolved config operation is required' };
+    const field = resolvedConfigOp.field;
+    if (!resolvedConfigOp.route || (resolvedConfigOp.fieldRule.class !== 'safe-scalar' && resolvedConfigOp.fieldRule.class !== 'safe-readonly-object')) {
+        return { ok: false, reason: `Config field ${field} is not available to user roles` };
+    }
+    const roleDef = getRoleDefinition(ctx.role, ctx.selfAid);
+    const fieldPermission = roleDef
+        ? resolveRoleFieldPermission(roleDef.permissions || {}, field)
+        : undefined;
+    if (policy === 'behavior-read')
+        return { ok: true };
+    if (fieldPermission && !fieldPermission.allowOverride) {
+        return { ok: false, reason: `Role ${ctx.role} cannot override ${field}` };
+    }
+    if (ctx.intent.operation === 'config.set') {
+        const valueCheck = fieldPermission
+            ? checkFieldValueAllowed(fieldPermission, resolvedConfigOp.value)
+            : { ok: true };
+        if (!valueCheck.ok)
+            return valueCheck;
+    }
+    if (ctx.intent.operation === 'config.set' || ctx.intent.operation === 'config.unset') {
+        const operation = relationFieldWriteOperation(field);
+        if (operation) {
+            const capability = evaluateRoleOperationCapability({
+                role: ctx.role,
+                selfAid: ctx.selfAid,
+                operation,
+                scope: 'relation',
+                chatType: ctx.chatType,
+                fromControlChannel: ctx.fromControlChannel,
+            });
+            if (!capability.allow) {
+                return {
+                    ok: false,
+                    reason: capability.reason || `Role ${ctx.role} cannot perform ${operation}`,
+                };
+            }
+        }
+    }
+    return { ok: true };
+}
+function checkResolvedConfigTarget(ctx, command) {
+    if (command.kind === 'global' || command.configScope === 'process' || command.configScope === 'defaults') {
+        return { ok: true };
+    }
+    if (command.configScope === 'agent') {
+        if (!ctx.selfAid || !command.self || command.self !== ctx.selfAid) {
+            return { ok: false, reason: 'Only the current agent can be targeted' };
+        }
+        return { ok: true };
+    }
+    if (ctx.allowExplicitRelationTarget && ctx.role === 'owner') {
+        if (!ctx.selfAid || !command.self || command.self !== ctx.selfAid) {
+            return { ok: false, reason: 'Only the current agent relation can be targeted' };
+        }
+        if (!command.peerKey) {
+            return { ok: false, reason: 'Explicit relation target is required' };
+        }
+        try {
+            normalizeRelationPeer(command.peerKey);
+            return { ok: true };
+        }
+        catch {
+            return { ok: false, reason: 'Cannot verify the explicit relation target' };
+        }
+    }
+    return checkCurrentRelation(ctx, command);
+}
+function checkManagementIdentityMutation(ctx, command) {
+    if (command.kind !== 'field' || command.subcommand === 'get')
+        return { ok: true };
+    const field = command.field.split('.')[0];
+    if (field !== 'owners' && field !== 'admins')
+        return { ok: true };
+    if (command.configScope !== 'agent') {
+        return { ok: false, reason: `${field} requires an explicit current-agent target` };
+    }
+    if (ctx.isDaemonOwner || ctx.role === 'owner')
+        return { ok: true };
+    return { ok: false, reason: `Only an Agent owner can modify ${field}` };
+}
+function checkCurrentRelation(ctx, resolvedConfigCommand) {
+    const requestedSelf = resolvedConfigCommand?.self ?? stringArg(ctx.intent.args.self);
+    if (!ctx.selfAid || !requestedSelf || requestedSelf !== ctx.selfAid) {
+        return { ok: false, reason: 'Only the current agent relation can be targeted' };
+    }
+    const requestedPeer = resolvedConfigCommand?.peerKey || stringArg(ctx.intent.args.peerKey) || stringArg(ctx.intent.args.peer);
+    if (!ctx.peerKey || !requestedPeer) {
+        return { ok: false, reason: 'Current relation context is required' };
+    }
+    try {
+        if (normalizeRelationPeer(requestedPeer) !== normalizeRelationPeer(ctx.peerKey)) {
+            if (ctx.intent.operation.startsWith('ec.group.')) {
+                const currentGroup = peerIdFromArg(ctx.peerKey);
+                const targetGroup = stringArg(ctx.intent.args.targetId) ?? peerIdFromArg(requestedPeer);
+                return {
+                    ok: false,
+                    reason: `Denied ${ctx.intent.operation}: role=${ctx.role}, current_group=${currentGroup}, target_group=${targetGroup}. This role may send only to the current group; cross-group sends require admin or owner permission.`,
+                };
+            }
+            return { ok: false, reason: 'Only the current relation can be targeted' };
+        }
+    }
+    catch {
+        return { ok: false, reason: 'Cannot verify the current relation target' };
+    }
+    return { ok: true };
+}
+function intentForResolvedConfig(command, source) {
+    return {
+        operation: command.operationId,
+        scope: command.commandScope,
+        source,
+        args: {
+            ...(command.kind === 'field' ? {
+                field: command.field,
+                ...(command.subcommand === 'set' ? { value: command.value } : {}),
+            } : {}),
+            ...(command.kind === 'scoped' && command.field ? { field: command.field } : {}),
+            configScope: command.configScope,
+            ...(command.self ? { self: command.self } : {}),
+            ...(command.peerKey ? { peer: command.peerKey, peerKey: command.peerKey } : {}),
+        },
+        rawArgv: command.canonicalArgv,
+        ...(command.dangerous ? { dangerous: true } : {}),
+    };
+}
+function normalizeRelationPeer(peer) {
+    const legacyIndex = peer.indexOf('::');
+    if (legacyIndex > 0) {
+        return formatPeerKey(peer.slice(0, legacyIndex), peer.slice(legacyIndex + 2));
+    }
+    return normalizePeer(peer);
+}
+function checkAllowedConfigKeys(ctx, allowedConfigKeys) {
+    if (allowedConfigKeys.length === 0)
+        return { ok: true };
+    for (const key of configKeysFromArgs(ctx.intent.args)) {
+        if (!allowedConfigKeys.includes(key)) {
+            return { ok: false, reason: `Config key ${key} is not allowed` };
+        }
+    }
+    return { ok: true };
+}
+function checkAllowedPrefixes(ctx, allowedPrefixes) {
+    if (allowedPrefixes.length === 0)
+        return { ok: true };
+    for (const value of prefixedValuesFromArgs(ctx.intent.args)) {
+        if (!allowedPrefixes.some(prefix => value.startsWith(prefix))) {
+            return { ok: false, reason: `Value ${value} does not match an allowed prefix` };
+        }
+    }
+    return { ok: true };
+}
+function configKeysFromArgs(args) {
+    const keys = new Set();
+    for (const name of ['key', 'field', 'fieldPath', 'path', 'name', 'configKey']) {
+        collectStringValues(args[name], keys);
+    }
+    for (const name of ['keys', 'fields', 'fieldPaths', 'paths', 'configKeys']) {
+        collectStringValues(args[name], keys);
+    }
+    return [...keys];
+}
+function prefixedValuesFromArgs(args) {
+    const values = new Set();
+    for (const name of ['path', 'cwd', 'file', 'filePath', 'target', 'targetPath', 'prefix']) {
+        collectStringValues(args[name], values);
+    }
+    for (const name of ['paths', 'files', 'filePaths', 'targets', 'targetPaths']) {
+        collectStringValues(args[name], values);
+    }
+    return [...values];
+}
+function collectStringValues(value, out) {
+    if (typeof value === 'string' && value.length > 0) {
+        out.add(value);
+        return;
+    }
+    if (!Array.isArray(value))
+        return;
+    for (const item of value) {
+        if (typeof item === 'string' && item.length > 0)
+            out.add(item);
+    }
+}
+function checkOwnPeer(ctx) {
+    const argPeer = stringArg(ctx.intent.args.peer);
+    const argPeerKey = stringArg(ctx.intent.args.peerKey);
+    const expectedPeerKey = ctx.peerKey || inferPeerKey(ctx);
+    if (!argPeer && !argPeerKey)
+        return { ok: true };
+    const requestedPeerId = argPeer ? peerIdFromArg(argPeer) : undefined;
+    const requestedPeerKeyId = argPeerKey ? peerIdFromArg(argPeerKey) : undefined;
+    if (ctx.actorId) {
+        if (requestedPeerId && requestedPeerId !== ctx.actorId) {
+            return { ok: false, reason: 'Only the actor peer can be targeted' };
+        }
+        if (requestedPeerKeyId && requestedPeerKeyId !== ctx.actorId) {
+            return { ok: false, reason: 'Only the actor peer can be targeted' };
+        }
+    }
+    if (!expectedPeerKey)
+        return { ok: false, reason: 'Cannot verify peer ownership' };
+    const candidateKeys = new Set();
+    if (argPeerKey)
+        candidateKeys.add(argPeerKey);
+    if (argPeer) {
+        candidateKeys.add(argPeer);
+        const channelType = parseChannelType(expectedPeerKey);
+        if (channelType)
+            candidateKeys.add(formatPeerKey(channelType, argPeer));
+        const legacyChannelType = parseLegacyChannelType(expectedPeerKey);
+        if (legacyChannelType)
+            candidateKeys.add(`${legacyChannelType}::${argPeer}`);
+    }
+    if (!candidateKeys.has(expectedPeerKey)) {
+        return { ok: false, reason: 'Only the actor peer can be targeted' };
+    }
+    return { ok: true };
+}
+function peerIdFromArg(value) {
+    try {
+        return parsePeerKey(value).channelId;
+    }
+    catch {
+        const legacyIdx = value.indexOf('::');
+        if (legacyIdx > 0)
+            return value.slice(legacyIdx + 2);
+        return value;
+    }
+}
+function inferPeerKey(ctx) {
+    const actorId = ctx.actorId;
+    const argPeer = stringArg(ctx.intent.args.peer);
+    if (!actorId || !argPeer || argPeer !== actorId)
+        return undefined;
+    const channelType = typeof ctx.channel === 'string' ? ctx.channel.split('#')[0] : undefined;
+    return channelType ? formatPeerKey(channelType, actorId) : undefined;
+}
+function parseChannelType(peerKey) {
+    try {
+        return parsePeerKey(peerKey).channelType;
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseLegacyChannelType(peerKey) {
+    const idx = peerKey.indexOf('::');
+    return idx > 0 ? peerKey.slice(0, idx) : undefined;
+}
+function checkFieldOverride(ctx, field) {
+    const roleDef = getRoleDefinition(ctx.role, ctx.selfAid);
+    const fieldPermission = roleDef?.permissions?.[field];
+    if (!fieldPermission) {
+        return { ok: false, reason: `Role ${ctx.role} has no field permission for ${field}` };
+    }
+    if (!fieldPermission.allowOverride) {
+        return { ok: false, reason: `Role ${ctx.role} cannot override ${field}` };
+    }
+    const value = valueForFieldOverride(ctx, field);
+    if (value === undefined)
+        return { ok: true };
+    return checkFieldValueAllowed(fieldPermission, value);
+}
+function valueForFieldOverride(ctx, field) {
+    if (field.endsWith('.model'))
+        return ctx.intent.args.model ?? ctx.intent.args.value;
+    if (field.endsWith('.effort'))
+        return ctx.intent.args.effort ?? ctx.intent.args.value;
+    return ctx.intent.args.value ?? ctx.intent.args[field];
+}
+function checkFieldValueAllowed(permission, value) {
+    if (permission.allowedModels && typeof value === 'string') {
+        const allowed = permission.allowedModels.some(pattern => globMatches(pattern, value));
+        if (!allowed)
+            return { ok: false, reason: `Model ${value} is not allowed for this role` };
+    }
+    if (permission.allowedValues && permission.allowedValues.length > 0) {
+        if (!permission.allowedValues.includes(value)) {
+            return { ok: false, reason: `Value ${String(value)} is not allowed for this role` };
+        }
+    }
+    return { ok: true };
+}
+function globMatches(pattern, value) {
+    if (pattern === '*')
+        return true;
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
+    return new RegExp(`^${escaped}$`).test(value);
+}
+function stringArg(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function denyDecision(ctx, code, reason, operation, scope, dangerous, matchedRule) {
+    return {
+        allow: false,
+        code,
+        reason,
+        operation,
+        scope,
+        role: ctx.role,
+        dangerous,
+        matchedRule,
+    };
+}