fullcourtdefense-cli 1.34.8 → 1.34.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/actionPolicyEngine.d.ts +0 -18
- package/dist/actionPolicyEngine.js +7157 -1612
- package/dist/commands/hook.js +10 -1
- package/dist/commands/mcpGateway.js +9 -9
- package/dist/nativeHook.js +3 -1
- package/dist/version.json +1 -1
- package/package.json +4 -2
|
@@ -1,21 +1,3 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Action-policy evaluation ENGINE — pure, self-contained, no I/O, no imports.
|
|
3
|
-
*
|
|
4
|
-
* This file is the single source of truth for HOW a tool call is matched
|
|
5
|
-
* against org Action Policies. It runs in TWO places:
|
|
6
|
-
*
|
|
7
|
-
* - backend/src/modules/policies/action-policy-engine.ts (server: check-tool-call)
|
|
8
|
-
* - sdks/cli/src/actionPolicyEngine.ts (CLI: OFFLINE enforcement)
|
|
9
|
-
*
|
|
10
|
-
* The CLI copy lets fleet machines keep enforcing the org's real policies when
|
|
11
|
-
* the control plane is unreachable: the runtime bundle ships the policy rules
|
|
12
|
-
* (hash-versioned, so edits bust the cache within one poll) and hooks / the
|
|
13
|
-
* MCP gateway evaluate locally with EXACTLY these semantics.
|
|
14
|
-
*
|
|
15
|
-
* THE TWO COPIES MUST STAY BYTE-IDENTICAL. A CI drift-guard test
|
|
16
|
-
* (backend/src/__tests__/action-policy-engine-sync.test.ts) fails the build if
|
|
17
|
-
* they diverge. Change this file? Copy it to the other location verbatim.
|
|
18
|
-
*/
|
|
19
1
|
export type ActionPolicyVerdict = 'allow' | 'block' | 'require_approval' | 'log';
|
|
20
2
|
/**
|
|
21
3
|
* Constraint operators. `not_matches` is the glob complement of `matches`: it is what lets an
|