mova_agent 0.1.1

package/build/src/interpreter/interpreter.js

@@ -0,0 +1,732 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Interpreter = void 0;
+const ajv_loader_1 = require("../ajv/ajv_loader");
+const schema_registry_1 = require("../ajv/schema_registry");
+const registry_1 = require("../handlers/registry");
+const evidence_writer_1 = require("../evidence/evidence_writer");
+const episode_writer_1 = require("../episodes/episode_writer");
+const policy_engine_1 = require("../policy/policy_engine");
+const crypto_1 = require("crypto");
+const token_meter_1 = require("../telemetry/token_meter");
+const token_budget_enforcer_1 = require("../telemetry/token_budget_enforcer");
+const token_budget_loader_1 = require("../telemetry/token_budget_loader");
+const logger_1 = require("../logging/logger");
+const path_1 = __importDefault(require("path"));
+/**
+ * Основной интерпретатор планов MOVA Agent
+ */
+class Interpreter {
+    evidenceWriter;
+    episodeWriter; // Base episode writer
+    policyEngine;
+    tokenBudgetLoader;
+    schemaInitializationPromise;
+    constructor() {
+        this.evidenceWriter = new evidence_writer_1.EvidenceWriter();
+        this.episodeWriter = new episode_writer_1.EpisodeWriter();
+        this.policyEngine = new policy_engine_1.PolicyEngine();
+        this.tokenBudgetLoader = new token_budget_loader_1.TokenBudgetLoader();
+        // Initialize schemas and track the promise
+        this.schemaInitializationPromise = this.initializeSchemas();
+    }
+    /**
+     * Wait for the interpreter to be fully initialized with all schemas
+     */
+    async ready() {
+        await this.schemaInitializationPromise;
+    }
+    async initializeSchemas() {
+        try {
+            const registry = new schema_registry_1.SchemaRegistry(ajv_loader_1.ajvLoader);
+            await registry.loadAllSchemas(); // Load both MOVA and local schemas
+        }
+        catch (error) {
+            (0, logger_1.getLogger)().info(`Warning: Could not initialize schema registry: ${error.message}`);
+        }
+    }
+    /**
+     * Основной метод запуска выполнения плана
+     */
+    async runPlan(params) {
+        // Wait for schema initialization to complete
+        await this.ready();
+        const { planEnvelope, toolPool, instructionProfile, tokenBudgetPath, tokenBudgetProfile } = params;
+        try {
+            // Load token budget contract
+            const tokenBudgetContract = await this.tokenBudgetLoader.load(tokenBudgetPath, tokenBudgetProfile);
+            // Set tool pool and instruction profile in policy engine for enforcement
+            this.policyEngine.setToolPool(toolPool);
+            this.policyEngine.setInstructionProfile(instructionProfile);
+            // 1) Ajv validate plan envelope
+            const planValidation = await (0, ajv_loader_1.validate)('env.mova_agent_plan_v1', planEnvelope);
+            if (!planValidation.ok) {
+                const error = `Plan validation failed: ${planValidation.errors?.join(', ')}`;
+                await this.recordSecurityEvent('validation_failed', { error, planEnvelope });
+                return { success: false, error };
+            }
+            // 2) Ajv validate tool pool
+            // Note: Since we don't have a specific schema for the full tool pool structure yet,
+            // we'll validate individual tools as we encounter them
+            if (!toolPool || !toolPool.tools || !Array.isArray(toolPool.tools)) {
+                const error = 'Invalid tool pool structure';
+                await this.recordSecurityEvent('validation_failed', { error, toolPool });
+                return { success: false, error };
+            }
+            // 3) Validate instruction profile with deny-by-default policy
+            const profileValidation = this.validateInstructionProfile(instructionProfile);
+            if (!profileValidation.ok) {
+                const error = `Instruction profile validation failed: ${profileValidation.errors?.join(', ')}`;
+                await this.recordSecurityEvent('validation_failed', { error, instructionProfile });
+                return { success: false, error };
+            }
+            // 4) Build an execution context
+            const runId = `run_${(0, crypto_1.randomUUID)()}`;
+            const requestId = `req_${(0, crypto_1.randomUUID)()}`;
+            const evidenceDir = await this.evidenceWriter.createRunDirectory(requestId, runId);
+            // Create run-specific episode writer
+            const runEpisodeWriter = this.episodeWriter.createRunWriter(requestId, runId);
+            // Initialize token meter and budget enforcer
+            const tokenMeter = new token_meter_1.TokenMeter(evidenceDir);
+            const tokenBudgetEnforcer = new token_budget_enforcer_1.TokenBudgetEnforcer(tokenBudgetContract, tokenMeter);
+            // Save the resolved token budget contract
+            this.tokenBudgetLoader.saveResolvedContract(tokenBudgetContract, evidenceDir);
+            const context = {
+                run_id: runId,
+                request_id: requestId,
+                evidence_dir: evidenceDir,
+                instructionProfile: instructionProfile,
+                caps: instructionProfile.caps,
+                redaction_rules: instructionProfile.redaction_rules,
+                step_inputs: new Map(),
+                step_outputs: new Map(),
+                step_bindings: new Map(),
+                current_step_index: 0,
+                step_security_events: [],
+                has_fatal_security_event: false,
+                episodeWriter: runEpisodeWriter,
+                tokenMeter,
+                tokenBudgetEnforcer,
+                budgetStatus: 'passed',
+                budgetViolations: [],
+            };
+            // Write initial artifacts
+            await this.evidenceWriter.writeArtifact(evidenceDir, 'request.envelope.json', params.requestEnvelope || {});
+            await this.evidenceWriter.writeArtifact(evidenceDir, 'plan.envelope.json', planEnvelope);
+            await this.evidenceWriter.writeArtifact(evidenceDir, 'tool_pool.resolved.json', toolPool);
+            await this.evidenceWriter.writeArtifact(evidenceDir, 'instruction_profile.resolved.json', instructionProfile);
+            // 5) Execute steps in order
+            let executionError;
+            try {
+                for (const step of planEnvelope.payload.steps) {
+                    // Check if we can execute this step based on token budget
+                    const budgetStatus = context.tokenBudgetEnforcer.checkModelCall();
+                    if (budgetStatus.exceeded) {
+                        // Handle budget violation
+                        context.budgetStatus = budgetStatus.action === 'fail' ? 'failed' : 'warned';
+                        context.budgetViolations.push(...budgetStatus.violations);
+                        // Create budget violation episodes for each violation
+                        for (const violation of budgetStatus.violations) {
+                            const budgetViolationEpisode = context.tokenBudgetEnforcer.createBudgetViolationEpisode(violation, {
+                                run_id: context.run_id,
+                                request_id: context.request_id,
+                                step_id: step.id,
+                            });
+                            await context.episodeWriter.writeSecurityEvent(budgetViolationEpisode);
+                        }
+                        if (budgetStatus.action === 'fail') {
+                            executionError = `Budget exceeded: ${budgetStatus.violations.map((v) => v.message).join('; ')}`;
+                            break;
+                        }
+                        else if (budgetStatus.action === 'warn') {
+                            (0, logger_1.getLogger)().info(`Budget warning: ${budgetStatus.violations.map((v) => v.message).join('; ')}`);
+                        }
+                    }
+                    const stepResult = await this.executeStep(step, context, toolPool);
+                    if (!stepResult.success && step.on_error !== 'soft') {
+                        // Step failed and is marked as fatal
+                        executionError = `Step ${step.id} failed: ${stepResult.error}`;
+                        break; // Exit the loop on fatal error
+                    }
+                    // Store output for potential use by subsequent steps
+                    if (stepResult.output) {
+                        context.step_outputs.set(step.id, stepResult.output);
+                    }
+                }
+                // 6) Emit final run summary episode and return structured result
+                // Check if there were any fatal security events or execution errors
+                const finalStatus = context.has_fatal_security_event || executionError ? 'failed' : 'completed';
+                const finalError = context.has_fatal_security_event
+                    ? 'Fatal security event occurred during execution'
+                    : executionError;
+                const runSummary = await this.createRunSummary(context, finalStatus, finalError);
+                await this.evidenceWriter.writeArtifact(evidenceDir, 'run_summary.json', runSummary);
+                // Create a final execution episode for the overall run
+                await context.episodeWriter.writeExecutionEpisode({
+                    episode_type: 'execution_run_summary',
+                    result_status: finalStatus,
+                    result_summary: finalError ? `Run failed: ${finalError}` : 'Run completed successfully',
+                    input_data_refs: [
+                        {
+                            data_type: 'ds.mova_agent_plan_v1',
+                            data_id: planEnvelope.payload.steps.length > 0
+                                ? planEnvelope.payload.steps[0].id
+                                : 'unknown',
+                        },
+                    ],
+                    payload: {
+                        run_id: context.run_id,
+                        request_id: context.request_id,
+                        total_steps: planEnvelope.payload.steps.length,
+                        steps_completed: context.step_outputs.size,
+                        status: finalStatus,
+                        error: finalError,
+                    },
+                });
+                return {
+                    success: !context.has_fatal_security_event && !executionError,
+                    run_summary: runSummary,
+                };
+            }
+            finally {
+                // Always save token usage report in the evidence directory, even if execution fails
+                // Determine if this is a quality suite run based on the evidence directory path
+                const isQualitySuite = evidenceDir.includes('quality');
+                context.tokenMeter.saveReport(path_1.default.join(evidenceDir, 'token_usage.json'), isQualitySuite ? 'quality suite uses noop handlers' : undefined);
+            }
+        }
+        catch (error) {
+            const errorMessage = `Unexpected error during plan execution: ${error.message}`;
+            // We don't have context here, so we'll call without it
+            await this.recordSecurityEvent('execution_error', {
+                error: errorMessage,
+                stack: error.stack,
+            });
+            return { success: false, error: errorMessage };
+        }
+    }
+    /**
+     * Выполнить один шаг плана
+     */
+    async executeStep(step, context, toolPool) {
+        try {
+            // a) Resolve input
+            let input = step.input;
+            if (step.input_from) {
+                const referencedStepId = step.input_from.step_id;
+                if (!context.step_outputs.has(referencedStepId)) {
+                    throw new Error(`Input references non-existent step: ${referencedStepId}`);
+                }
+                const referencedOutput = context.step_outputs.get(referencedStepId);
+                if (step.input_from.path) {
+                    // Simple path resolution - in a real implementation this would be more sophisticated
+                    input = this.resolvePath(referencedOutput, step.input_from.path);
+                }
+                else {
+                    input = referencedOutput;
+                }
+            }
+            // b) Validate input schema (if provided)
+            if (step.expected_output_schema_ref && input) {
+                const inputValidation = await (0, ajv_loader_1.validate)(step.expected_output_schema_ref, input);
+                if (!inputValidation.ok) {
+                    const error = `Step input validation failed: ${inputValidation.errors?.join(', ')}`;
+                    // Emit failure episode using MOVA 4.1.1 format
+                    await context.episodeWriter.writeExecutionEpisode({
+                        episode_type: 'execution_step',
+                        result_status: 'failed',
+                        result_summary: `Step ${step.id} failed: ${error}`,
+                        input_data_refs: [{ data_type: 'ds.mova_agent_step_v1', data_id: step.id }],
+                        payload: {
+                            step_id: step.id,
+                            error: error,
+                            status: 'failed',
+                        },
+                    });
+                    await this.recordSecurityEvent('input_validation_failed', { step_id: step.id, error, input }, context);
+                    return { success: false, error };
+                }
+            }
+            // c) Policy checks using the policy engine
+            const tool = toolPool.tools.find((t) => t.id === step.connector_id);
+            if (!tool) {
+                const error = `Tool not found in pool: ${step.connector_id}`;
+                // Emit failure episode using MOVA 4.1.1 format
+                await context.episodeWriter.writeExecutionEpisode({
+                    episode_type: 'execution_step',
+                    result_status: 'failed',
+                    result_summary: `Step ${step.id} failed: ${error}`,
+                    input_data_refs: [{ data_type: 'ds.mova_agent_step_v1', data_id: step.id }],
+                    payload: {
+                        step_id: step.id,
+                        error: error,
+                        status: 'failed',
+                    },
+                });
+                await this.recordSecurityEvent('tool_not_allowlisted', { step_id: step.id, error, connector_id: step.connector_id }, context);
+                return { success: false, error };
+            }
+            // Perform comprehensive policy check
+            const policyEvaluation = this.policyEngine.evaluateStepComprehensive({
+                id: step.id,
+                verb: step.verb,
+                connector_id: step.connector_id,
+                input: input,
+                tool_binding: tool.binding,
+            });
+            if (!policyEvaluation.allowed) {
+                const error = `Step failed policy evaluation: ${policyEvaluation.reason}`;
+                // Emit failure episode using MOVA 4.1.1 format
+                await context.episodeWriter.writeExecutionEpisode({
+                    episode_type: 'execution_step',
+                    result_status: 'failed',
+                    result_summary: `Step ${step.id} failed: ${error}`,
+                    input_data_refs: [{ data_type: 'ds.mova_agent_step_v1', data_id: step.id }],
+                    payload: {
+                        step_id: step.id,
+                        error: error,
+                        status: 'failed',
+                    },
+                });
+                await this.recordSecurityEvent('policy_check_failed', {
+                    step_id: step.id,
+                    error,
+                    policy_reason: policyEvaluation.reason,
+                    input,
+                    binding: tool.binding,
+                }, context);
+                return { success: false, error };
+            }
+            // Additional specific checks for destinations
+            if (input && (input.url || input.endpoint)) {
+                const destUrl = input.url || input.endpoint;
+                const allowlist = tool.binding.destination_allowlist;
+                if (allowlist && allowlist.length > 0) {
+                    const isAllowed = allowlist.some((allowed) => {
+                        try {
+                            const inputUrl = new URL(destUrl);
+                            const allowedUrl = new URL(allowed);
+                            return (inputUrl.hostname === allowedUrl.hostname &&
+                                inputUrl.protocol === allowedUrl.protocol &&
+                                (inputUrl.port === allowedUrl.port || allowedUrl.port === ''));
+                        }
+                        catch {
+                            return false; // If we can't parse the URL, consider it not allowed
+                        }
+                    });
+                    if (!isAllowed) {
+                        const error = `Destination not allowlisted: ${destUrl}`;
+                        // Emit failure episode using MOVA 4.1.1 format
+                        await context.episodeWriter.writeExecutionEpisode({
+                            episode_type: 'execution_step',
+                            result_status: 'failed',
+                            result_summary: `Step ${step.id} failed: ${error}`,
+                            input_data_refs: [{ data_type: 'ds.mova_agent_step_v1', data_id: step.id }],
+                            payload: {
+                                step_id: step.id,
+                                error: error,
+                                status: 'failed',
+                            },
+                        });
+                        await this.recordSecurityEvent('destination_not_allowlisted', {
+                            step_id: step.id,
+                            error,
+                            destination: destUrl,
+                            allowed_destinations: allowlist,
+                        }, context);
+                        return { success: false, error };
+                    }
+                }
+            }
+            // Check limits are present (already checked in policy engine, but keeping as extra safeguard)
+            if (!tool.binding.limits || !tool.binding.limits.timeout_ms) {
+                const error = `Required limits not specified for tool: ${step.connector_id}`;
+                // Emit failure episode using MOVA 4.1.1 format
+                await context.episodeWriter.writeExecutionEpisode({
+                    episode_type: 'execution_step',
+                    result_status: 'failed',
+                    result_summary: `Step ${step.id} failed: ${error}`,
+                    input_data_refs: [{ data_type: 'ds.mova_agent_step_v1', data_id: step.id }],
+                    payload: {
+                        step_id: step.id,
+                        error: error,
+                        status: 'failed',
+                    },
+                });
+                await this.recordSecurityEvent('limits_not_specified', { step_id: step.id, error, connector_id: step.connector_id }, context);
+                return { success: false, error };
+            }
+            // Check tool call budget
+            const toolBudgetStatus = context.tokenBudgetEnforcer.checkToolCall();
+            if (toolBudgetStatus.exceeded) {
+                // Handle budget violation
+                context.budgetStatus = toolBudgetStatus.action === 'fail' ? 'failed' : 'warned';
+                context.budgetViolations.push(...toolBudgetStatus.violations);
+                // Create budget violation episodes for each violation
+                for (const violation of toolBudgetStatus.violations) {
+                    const budgetViolationEpisode = context.tokenBudgetEnforcer.createBudgetViolationEpisode(violation, { run_id: context.run_id, request_id: context.request_id, step_id: step.id });
+                    await context.episodeWriter.writeSecurityEvent(budgetViolationEpisode);
+                }
+                if (toolBudgetStatus.action === 'fail') {
+                    const error = `Tool call budget exceeded: ${toolBudgetStatus.violations.map((v) => v.message).join('; ')}`;
+                    // Emit failure episode using MOVA 4.1.1 format
+                    await context.episodeWriter.writeExecutionEpisode({
+                        episode_type: 'execution_step',
+                        result_status: 'failed',
+                        result_summary: `Step ${step.id} failed: ${error}`,
+                        input_data_refs: [{ data_type: 'ds.mova_agent_step_v1', data_id: step.id }],
+                        payload: {
+                            step_id: step.id,
+                            error: error,
+                            status: 'failed',
+                        },
+                    });
+                    return { success: false, error };
+                }
+                else if (toolBudgetStatus.action === 'warn') {
+                    (0, logger_1.getLogger)().info(`Tool call budget warning: ${toolBudgetStatus.violations.map((v) => v.message).join('; ')}`);
+                }
+            }
+            // d) Dispatch handler by binding.driver_kind from static registry
+            const handler = registry_1.HandlerRegistry.getInstance()[tool.binding.driver_kind];
+            if (!handler) {
+                const error = `Handler not found for driver kind: ${tool.binding.driver_kind}`;
+                // Emit failure episode using MOVA 4.1.1 format
+                await context.episodeWriter.writeExecutionEpisode({
+                    episode_type: 'execution_step',
+                    result_status: 'failed',
+                    result_summary: `Step ${step.id} failed: ${error}`,
+                    input_data_refs: [{ data_type: 'ds.mova_agent_step_v1', data_id: step.id }],
+                    payload: {
+                        step_id: step.id,
+                        error: error,
+                        status: 'failed',
+                    },
+                });
+                await this.recordSecurityEvent('handler_not_found', { step_id: step.id, error, driver_kind: tool.binding.driver_kind }, context);
+                return { success: false, error };
+            }
+            // e) Execute handler
+            const handlerResult = await handler(input, tool, context);
+            // Check tool output budget
+            const outputStr = JSON.stringify(handlerResult);
+            const toolOutputBudgetStatus = context.tokenBudgetEnforcer.checkToolOutput(outputStr);
+            if (toolOutputBudgetStatus.exceeded) {
+                // Handle budget violation
+                context.budgetStatus = toolOutputBudgetStatus.action === 'fail' ? 'failed' : 'warned';
+                context.budgetViolations.push(...toolOutputBudgetStatus.violations);
+                // Create budget violation episodes for each violation
+                for (const violation of toolOutputBudgetStatus.violations) {
+                    const budgetViolationEpisode = context.tokenBudgetEnforcer.createBudgetViolationEpisode(violation, { run_id: context.run_id, request_id: context.request_id, step_id: step.id });
+                    await context.episodeWriter.writeSecurityEvent(budgetViolationEpisode);
+                }
+                if (toolOutputBudgetStatus.action === 'fail') {
+                    const error = `Tool output budget exceeded: ${toolOutputBudgetStatus.violations.map((v) => v.message).join('; ')}`;
+                    // Emit failure episode using MOVA 4.1.1 format
+                    await context.episodeWriter.writeExecutionEpisode({
+                        episode_type: 'execution_step',
+                        result_status: 'failed',
+                        result_summary: `Step ${step.id} failed: ${error}`,
+                        input_data_refs: [{ data_type: 'ds.mova_agent_step_v1', data_id: step.id }],
+                        payload: {
+                            step_id: step.id,
+                            error: error,
+                            status: 'failed',
+                        },
+                    });
+                    return { success: false, error };
+                }
+                else if (toolOutputBudgetStatus.action === 'warn') {
+                    (0, logger_1.getLogger)().info(`Tool output budget warning: ${toolOutputBudgetStatus.violations.map((v) => v.message).join('; ')}`);
+                }
+            }
+            // Record successful tool call
+            context.tokenBudgetEnforcer.recordSuccessfulToolCall(outputStr);
+            // f) Validate output schema (if provided)
+            if (tool.binding.schema_refs?.output && handlerResult) {
+                const outputValidation = await (0, ajv_loader_1.validate)(tool.binding.schema_refs.output, handlerResult);
+                if (!outputValidation.ok) {
+                    const error = `Step output validation failed: ${outputValidation.errors?.join(', ')}`;
+                    // Emit failure episode using MOVA 4.1.1 format
+                    await context.episodeWriter.writeExecutionEpisode({
+                        episode_type: 'execution_step',
+                        result_status: 'failed',
+                        result_summary: `Step ${step.id} failed: ${error}`,
+                        input_data_refs: [{ data_type: 'ds.mova_agent_step_v1', data_id: step.id }],
+                        payload: {
+                            step_id: step.id,
+                            error: error,
+                            status: 'failed',
+                        },
+                    });
+                    await this.recordSecurityEvent('output_validation_failed', { step_id: step.id, error, output: handlerResult }, context);
+                    return { success: false, error };
+                }
+            }
+            // g) Write artifacts (inputs/outputs/logs)
+            await this.evidenceWriter.writeArtifact(context.evidence_dir, `logs/${step.id}.log`, {
+                input,
+                output: handlerResult,
+                timestamp: new Date().toISOString(),
+            });
+            // h) Emit episode for the step using MOVA 4.1.1 format
+            await context.episodeWriter.writeExecutionEpisode({
+                episode_type: 'execution_step',
+                result_status: 'completed',
+                result_summary: `Step ${step.id} executed successfully`,
+                input_data_refs: [{ data_type: 'ds.mova_agent_step_v1', data_id: step.id }],
+                payload: {
+                    step_id: step.id,
+                    input,
+                    output: handlerResult,
+                    status: 'success',
+                },
+            });
+            return { success: true, output: handlerResult };
+        }
+        catch (error) {
+            const errorMessage = `Step execution failed: ${error.message}`;
+            // Write error log
+            await this.evidenceWriter.writeArtifact(context.evidence_dir, `logs/${step.id}.log`, {
+                error: errorMessage,
+                timestamp: new Date().toISOString(),
+            });
+            // Emit failure episode using MOVA 4.1.1 format
+            await context.episodeWriter.writeExecutionEpisode({
+                episode_type: 'execution_step',
+                result_status: 'failed',
+                result_summary: `Step ${step.id} failed: ${errorMessage}`,
+                input_data_refs: [{ data_type: 'ds.mova_agent_step_v1', data_id: step.id }],
+                payload: {
+                    step_id: step.id,
+                    error: errorMessage,
+                    status: 'failed',
+                },
+            });
+            return { success: false, error: errorMessage };
+        }
+    }
+    /**
+     * Простой резолвер пути для получения значения из объекта по строковому пути
+     */
+    resolvePath(obj, path) {
+        return path.split('.').reduce((current, part) => current?.[part], obj);
+    }
+    /**
+     * Записать событие безопасности
+     */
+    async recordSecurityEvent(eventType, details, context) {
+        // Determine if this is a high severity event that should mark the run as failed
+        const severity = this.getSecurityEventSeverity(eventType);
+        const isHighSeverity = ['high', 'critical'].includes(severity);
+        // If we have context, mark the run as having a fatal security event
+        if (context && isHighSeverity) {
+            context.has_fatal_security_event = true;
+        }
+        // Use the run-specific episode writer to write security events
+        const runEpisodeWriter = context?.episodeWriter ||
+            this.episodeWriter.createRunWriter(context?.request_id || 'unknown', context?.run_id || 'unknown');
+        // Explicitly type the category and severity to satisfy TypeScript
+        const category = this.getSecurityEventCategory(eventType);
+        const eventSeverity = severity;
+        await runEpisodeWriter.writeSecurityEvent({
+            episode_type: `security_event/${eventType}`,
+            security_event_type: eventType,
+            security_event_category: category,
+            severity: eventSeverity,
+            result_status: 'failed', // Security events typically represent failures
+            result_summary: `Security event: ${eventType}`,
+            detection_source: 'runtime_guard',
+            policy_profile_id: 'mova_security_default_v1',
+            security_model_version: '1.0.0',
+            // Include context information in meta_episode
+            meta_episode: {
+                request_id: context?.request_id || 'unknown',
+                run_id: context?.run_id || 'unknown',
+                step_id: details?.step_id,
+            },
+        });
+    }
+    /**
+     * Определить категорию события безопасности
+     */
+    getSecurityEventCategory(eventType) {
+        const categoryMap = {
+            validation_failed: 'policy_violation',
+            tool_not_allowlisted: 'authorization',
+            destination_not_allowlisted: 'authorization',
+            limits_not_specified: 'config',
+            input_validation_failed: 'policy_violation',
+            output_validation_failed: 'policy_violation',
+            handler_not_found: 'config',
+            execution_error: 'infrastructure',
+            timeout: 'rate_limit',
+        };
+        return categoryMap[eventType] || 'other';
+    }
+    /**
+     * Определить уровень серьезности события безопасности
+     */
+    getSecurityEventSeverity(eventType) {
+        const severityMap = {
+            validation_failed: 'high',
+            tool_not_allowlisted: 'high',
+            destination_not_allowlisted: 'high',
+            limits_not_specified: 'medium',
+            input_validation_failed: 'medium',
+            output_validation_failed: 'medium',
+            handler_not_found: 'high',
+            execution_error: 'high',
+            timeout: 'high',
+        };
+        return severityMap[eventType] || 'low';
+    }
+    /**
+     * Валидация профиля инструкций с политикой deny-by-default
+     */
+    validateInstructionProfile(profile) {
+        // Проверяем, что профиль не пустой
+        if (!profile) {
+            return { ok: false, errors: ['Instruction profile is required'] };
+        }
+        // Валидация лимитов
+        if (profile.caps) {
+            const errors = [];
+            if (profile.caps.max_timeout_ms && typeof profile.caps.max_timeout_ms !== 'number') {
+                errors.push('max_timeout_ms must be a number');
+            }
+            if (profile.caps.max_data_size && typeof profile.caps.max_data_size !== 'number') {
+                errors.push('max_data_size must be a number');
+            }
+            if (profile.caps.max_steps && typeof profile.caps.max_steps !== 'number') {
+                errors.push('max_steps must be a number');
+            }
+            if (errors.length > 0) {
+                return { ok: false, errors };
+            }
+        }
+        // Проверка правил маскировки
+        if (profile.redaction_rules && !Array.isArray(profile.redaction_rules)) {
+            return { ok: false, errors: ['redaction_rules must be an array'] };
+        }
+        return { ok: true };
+    }
+    /**
+     * Создать сводку выполнения
+     */
+    async createRunSummary(context, status, error) {
+        // Save token usage report
+        context.tokenMeter.saveReport();
+        return {
+            run_id: context.run_id,
+            request_id: context.request_id,
+            status,
+            timestamp_start: new Date().toISOString(), // в реальности это должно быть точное время начала
+            timestamp_end: new Date().toISOString(),
+            steps_executed: context.step_outputs.size,
+            steps_successful: status === 'completed' ? context.step_outputs.size : context.step_outputs.size - 1, // упрощённо
+            steps_failed: status === 'failed' ? 1 : 0, // упрощённо
+            total_duration_ms: 0, // в реальности нужно отслеживать время
+            error_summary: error,
+            token_budget: context.tokenBudgetEnforcer.getBudgetInfo(),
+            token_usage: context.tokenMeter.getBriefSummary(),
+            budget_status: context.budgetStatus,
+            budget_violations: context.budgetViolations,
+        };
+    }
+    /**
+     * Основной метод выполнения плана
+     */
+    async executePlan(plan) {
+        // Инициализируем контекст выполнения
+        const tokenMeter = new token_meter_1.TokenMeter();
+        const tokenBudgetEnforcer = new token_budget_enforcer_1.TokenBudgetEnforcer({ version: '1.0', limits: {}, policy: { on_budget_exceeded: 'warn' } }, tokenMeter);
+        const context = {
+            run_id: (0, crypto_1.randomUUID)(),
+            request_id: plan.request_id || (0, crypto_1.randomUUID)(),
+            evidence_dir: 'artifacts/mova_agent/evidence',
+            instructionProfile: plan.instruction_profile,
+            step_inputs: new Map(),
+            step_outputs: new Map(),
+            step_bindings: new Map(),
+            current_step_index: 0,
+            step_security_events: [],
+            has_fatal_security_event: false,
+            episodeWriter: this.episodeWriter.createRunWriter(plan.request_id || (0, crypto_1.randomUUID)(), (0, crypto_1.randomUUID)()),
+            tokenMeter,
+            tokenBudgetEnforcer,
+            budgetStatus: 'passed',
+            budgetViolations: [],
+        };
+        try {
+            // Валидация профиля инструкций
+            const profileValidation = this.validateInstructionProfile(plan.instruction_profile);
+            if (!profileValidation.ok) {
+                throw new Error(`Instruction profile validation failed: ${profileValidation.errors?.join(', ')}`);
+            }
+            (0, logger_1.getLogger)().info(`Starting execution for plan: ${plan.plan_id}`);
+            // Создадим минимальный тулпул для тестирования
+            const toolPool = {
+                tools: [],
+            };
+            // Выполняем каждый шаг плана
+            for (const step of plan.steps) {
+                // Адаптируем структуру шага для внутреннего формата
+                const internalStep = {
+                    id: step.step_id,
+                    verb: step.verb,
+                    connector_id: '', // будет установлено из binding
+                    input: step.input,
+                };
+                // Добавляем обработку binding в контекст для данного шага
+                if (step.tool_binding) {
+                    context.step_bindings.set(step.step_id, step.tool_binding);
+                    // Найдем соответствующий тул в тулпуле или создадим его
+                    const toolId = `${step.verb}_tool`;
+                    const toolExists = toolPool.tools.some((tool) => tool.id === toolId);
+                    if (!toolExists) {
+                        toolPool.tools.push({
+                            id: toolId,
+                            connector: { verb: step.verb }, // упрощенно
+                            binding: step.tool_binding,
+                        });
+                    }
+                }
+                const stepResult = await this.executeStep(internalStep, context, toolPool);
+                if (stepResult.success) {
+                    context.step_outputs.set(step.step_id, stepResult.output);
+                }
+                else {
+                    throw new Error(`Step ${step.step_id} failed: ${stepResult.error}`);
+                }
+                context.current_step_index++;
+            }
+            // Создаем итоговую сводку
+            const summary = await this.createRunSummary(context, 'success');
+            return {
+                ok: true,
+                summary,
+                outputs: Object.fromEntries(context.step_outputs),
+            };
+        }
+        catch (error) {
+            // Регистрируем ошибку безопасности
+            await this.recordSecurityEvent('execution_failure', {
+                error: error.message,
+                plan_id: plan.plan_id,
+            });
+            // Создаем сводку с ошибкой
+            const summary = await this.createRunSummary(context, 'failure', error.message);
+            return {
+                ok: false,
+                error: error.message,
+                summary,
+            };
+        }
+    }
+}
+exports.Interpreter = Interpreter;
+//# sourceMappingURL=interpreter.js.map