nativesoul 0.1.0

package/plugins/shared/hooks/policy-fail-closed.cjs

@@ -0,0 +1,95 @@
+'use strict';
+
+// Generated by scripts/generate-policy-fail-closed.mjs from packages/core/src/policy-fail-closed.ts.
+// Do not edit by hand.
+
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preToolUseEvent = preToolUseEvent;
+exports.isSensitivePreToolUsePayload = isSensitivePreToolUsePayload;
+exports.buildFailClosedPreToolUseResult = buildFailClosedPreToolUseResult;
+function preToolUseEvent(payload) {
+    const record = isRecord(payload) ? payload : {};
+    const toolInput = isRecord(record.tool_input) ? record.tool_input : isRecord(record.input) ? record.input : {};
+    const toolName = stringValue(record.tool_name) ?? stringValue(record.tool) ?? stringValue(record.name) ?? "unknown_tool";
+    const action = stringValue(record.action) ?? stringValue(toolInput.action) ?? toolName;
+    const target = stringValue(record.target) ??
+        stringValue(toolInput.target) ??
+        stringValue(toolInput.file_path) ??
+        stringValue(toolInput.path) ??
+        stringValue(toolInput.url) ??
+        stringValue(toolInput.command);
+    const command = stringValue(toolInput.command) ?? stringValue(record.command);
+    return {
+        action,
+        className: inferPolicyClass(toolName, [target, command].filter(Boolean).join(" ")),
+        target,
+        project: stringValue(record.project) ?? stringValue(record.project_id) ?? stringValue(toolInput.project) ?? stringValue(toolInput.project_id)
+    };
+}
+function isSensitivePreToolUsePayload(payload) {
+    const event = preToolUseEvent(payload);
+    return event.className === "external_write" || event.className === "destructive";
+}
+function buildFailClosedPreToolUseResult(input) {
+    if (!isSensitivePreToolUsePayload(input)) {
+        return null;
+    }
+    const event = preToolUseEvent(input);
+    return {
+        allowed: false,
+        blocked: true,
+        message: `NativeSoul policy unavailable; blocked sensitive tool use ${event.action}.`,
+        evaluation: {
+            action: event.action,
+            class: event.className,
+            target: event.target ?? null,
+            decision: "approval_required",
+            reasons: ["POLICY_UNAVAILABLE_FAIL_CLOSED"],
+            matched_standing_order: null
+        }
+    };
+}
+function inferPolicyClass(toolName, target) {
+    const combined = `${toolName} ${target ?? ""}`.toLowerCase();
+    if (/\b(bash|shell|sh|zsh|exec_command)\b/u.test(toolName.toLowerCase())) {
+        return inferShellCommandClass(target ?? "");
+    }
+    if (/\b(rm\s+-[^\s]*[rf][^\s]*|delete|reset\s+--hard|destroy|purge|drop)\b/u.test(combined)) {
+        return "destructive";
+    }
+    if (/(slack|gmail|outlook|github|gh\s+pr|gh\s+issue|git\s+push|vercel\s+deploy|deploy|publish|send|post|comment|merge|api|curl\s+.*(-x|--request|-d|--data|--data-raw|--form)\s*(post|put|patch|delete)?)/u.test(combined)) {
+        return "external_write";
+    }
+    if (/(write|edit|patch|apply|create|move|rename|git\s+commit)/u.test(combined)) {
+        return "write_project";
+    }
+    if (/(curl|fetch|browser|http|web)/u.test(combined)) {
+        return "probe_external";
+    }
+    return "read_local";
+}
+function inferShellCommandClass(command) {
+    const normalized = command.toLowerCase();
+    if (/\b(rm\s+-[^\s]*[rf][^\s]*|delete|reset\s+--hard|destroy|purge|drop)\b/u.test(normalized)) {
+        return "destructive";
+    }
+    if (/(curl\s+.*(-x|--request|-d|--data|--data-raw|--form)\s*(post|put|patch|delete)?|gh\s+(pr|issue|release)|git\s+push|vercel\s+deploy|npm\s+publish|pnpm\s+publish|deploy|publish)/u.test(normalized)) {
+        return "external_write";
+    }
+    if (/(^|\s)(touch|mkdir|mv|cp|tee|chmod|chown|git\s+commit)\b|(^|[^>])>[^>]|>>/u.test(normalized)) {
+        return "write_project";
+    }
+    if (/^(pwd|ls|cat|head|tail|rg|grep|sed\s+-n|find\s+.*-print|git\s+(status|diff|log|show))(\s|$)/u.test(normalized.trim())) {
+        return "read_local";
+    }
+    if (/(curl|fetch|http|https?:\/\/)/u.test(normalized)) {
+        return "probe_external";
+    }
+    return "write_project";
+}
+function isRecord(value) {
+    return Boolean(value) && !Array.isArray(value) && typeof value === "object";
+}
+function stringValue(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}

package/policy-packs/local-readonly.json

@@ -0,0 +1,47 @@
+{
+  "id": "local-readonly",
+  "version": "1.0.0",
+  "title": "Local read-only guardrails",
+  "description": "Prefer local reads and require approval for project writes while operators evaluate NativeSoul behavior.",
+  "intended_use": "Use for first installs, audits, and dry-run verification where no automatic authority changes should happen.",
+  "approvals": [
+    "operator_review"
+  ],
+  "standing_orders": [
+    {
+      "id": "local-readonly-defaults",
+      "action": "propose",
+      "authority": "proposal",
+      "allowed": [
+        "read_workspace",
+        "inspect_status"
+      ],
+      "approval_required": [
+        "write_project",
+        "change_host_config"
+      ],
+      "scope_projects": [],
+      "scope_hosts": [],
+      "reason": "Keep first-run validation observable and reversible."
+    }
+  ],
+  "policy_proposals": [
+    {
+      "target": "POLICY.md",
+      "summary": "Require explicit operator approval before writes to project files or host configuration during first-run validation.",
+      "rationale": "NativeSoul should prove bootstrap, memory, and host checks before changing authority-bearing surfaces.",
+      "rollback_note": "Remove the proposed first-run approval language from POLICY.md after review."
+    }
+  ],
+  "managed_blocks": [],
+  "rollback": {
+    "strategy": "proposal-only",
+    "restores": [
+      "POLICY.md proposal text"
+    ],
+    "notes": "No files are changed by listing, showing, or validating this pack."
+  },
+  "metadata": {
+    "maturity": "starter"
+  }
+}

package/policy-packs/team-review.json

@@ -0,0 +1,49 @@
+{
+  "id": "team-review",
+  "version": "1.0.0",
+  "title": "Team review workflow",
+  "description": "Require review for external writes and destructive actions in shared team repositories.",
+  "intended_use": "Use when NativeSoul is installed in a team-owned repository and changes need an approval trail.",
+  "approvals": [
+    "operator_review",
+    "team_review"
+  ],
+  "standing_orders": [
+    {
+      "id": "team-external-write-review",
+      "action": "propose",
+      "authority": "proposal",
+      "allowed": [
+        "read_workspace",
+        "inspect_status"
+      ],
+      "approval_required": [
+        "external_write",
+        "destructive",
+        "identity_policy_change"
+      ],
+      "scope_projects": [],
+      "scope_hosts": [],
+      "reason": "Shared repositories need review before external side effects or destructive work."
+    }
+  ],
+  "policy_proposals": [
+    {
+      "target": "POLICY.md",
+      "summary": "Require team review before external writes, destructive actions, or identity/policy changes.",
+      "rationale": "Team repositories need explicit approval evidence before changes leave the local workspace or affect authority.",
+      "rollback_note": "Remove the proposed team-review approval language from POLICY.md after review."
+    }
+  ],
+  "managed_blocks": [],
+  "rollback": {
+    "strategy": "proposal-only",
+    "restores": [
+      "POLICY.md proposal text"
+    ],
+    "notes": "This catalog pack is read-only until the apply/rollback story implements approved writes."
+  },
+  "metadata": {
+    "maturity": "starter"
+  }
+}

package/schemas/audit-event.schema.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://nativesoul.local/schemas/audit-event.v1.json",
+  "title": "NativeSoul Audit Event",
+  "type": "object",
+  "required": ["id", "type", "actor", "origin", "result", "created_at", "hash"],
+  "properties": {
+    "id": { "type": "string", "pattern": "^evt_" },
+    "type": { "type": "string" },
+    "actor": { "type": "string" },
+    "origin": { "type": "string" },
+    "result": { "type": "string", "enum": ["ok", "error", "blocked"] },
+    "details": { "type": "object" },
+    "created_at": { "type": "string" },
+    "hash": { "type": "string", "pattern": "^sha256:" }
+  },
+  "additionalProperties": false
+}

package/schemas/capability-card.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://nativesoul.local/schemas/capability-card.v1.json",
+  "title": "NativeSoul Capability Card",
+  "type": "object",
+  "required": ["card_version", "id", "uid", "host", "normalized_kind", "readiness", "source", "schema_hash", "use_when", "requires", "side_effects", "approval", "examples"],
+  "properties": {
+    "card_version": { "const": 1 },
+    "id": { "type": "string" },
+    "uid": { "type": "string" },
+    "host": { "type": "string" },
+    "native_kind": { "type": "string" },
+    "normalized_kind": { "type": "string" },
+    "readiness": {
+      "type": "object",
+      "required": ["installed", "enabled", "active", "authenticated", "healthy", "allowed", "ready"],
+      "properties": {
+        "installed": { "type": "boolean" },
+        "enabled": { "type": "boolean" },
+        "active": { "type": "boolean" },
+        "authenticated": { "type": "boolean" },
+        "healthy": { "type": "boolean" },
+        "allowed": { "type": "boolean" },
+        "ready": { "type": "boolean" }
+      },
+      "additionalProperties": false
+    },
+    "source": { "type": "string" },
+    "schema_hash": { "type": "string" },
+    "use_when": { "type": "array", "items": { "type": "string" } },
+    "requires": { "type": "array", "items": { "type": "string" } },
+    "side_effects": { "type": "array", "items": { "type": "string" } },
+    "approval": { "type": "string" },
+    "examples": { "type": "array", "items": { "type": "string" } }
+  },
+  "additionalProperties": false
+}

package/schemas/capability.schema.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://nativesoul.local/schemas/capability.v1.json",
+  "title": "NativeSoul Capability",
+  "type": "object",
+  "required": ["uid", "host", "native_kind", "normalized_kind", "installed", "enabled", "active", "authenticated", "healthy", "allowed", "ready", "source", "last_seen_at"],
+  "properties": {
+    "uid": { "type": "string" },
+    "host": { "type": "string" },
+    "native_kind": { "type": "string" },
+    "normalized_kind": { "type": "string" },
+    "native_id": { "type": ["string", "null"] },
+    "installed": { "type": "boolean" },
+    "enabled": { "type": "boolean" },
+    "active": { "type": "boolean" },
+    "authenticated": { "type": "boolean" },
+    "healthy": { "type": "boolean" },
+    "allowed": { "type": "boolean" },
+    "ready": { "type": "boolean" },
+    "source": { "type": "string" },
+    "capabilities": { "type": "array", "items": { "type": "string" } },
+    "last_seen_at": { "type": "string" }
+  },
+  "additionalProperties": true
+}

package/schemas/commitment.schema.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://nativesoul.local/schemas/commitment.v1.json",
+  "title": "NativeSoul Commitment",
+  "type": "object",
+  "required": ["id", "project_id", "summary", "status", "source", "created_at", "updated_at"],
+  "properties": {
+    "id": { "type": "string", "pattern": "^commitment_" },
+    "project_id": { "type": "string" },
+    "summary": { "type": "string" },
+    "status": { "type": "string", "enum": ["open", "completed", "dismissed", "expired"] },
+    "due_at": { "type": ["string", "null"] },
+    "ttl_expires_at": { "type": ["string", "null"] },
+    "source": { "type": "object" },
+    "created_at": { "type": "string" },
+    "updated_at": { "type": "string" }
+  },
+  "additionalProperties": false
+}

package/schemas/full-native-evidence.schema.json

@@ -0,0 +1,82 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://nativesoul.local/schemas/full-native-evidence.schema.json",
+  "title": "Full Native Evidence Contract",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "host",
+    "surface",
+    "status",
+    "ready",
+    "full_native",
+    "blocked_by_host",
+    "degraded_scan",
+    "generated_at",
+    "requirements",
+    "missing_requirements"
+  ],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "host": { "type": "string", "minLength": 1 },
+    "surface": { "type": "string", "minLength": 1 },
+    "status": {
+      "type": "string",
+      "enum": ["ready", "full_native", "blocked_by_host", "degraded_scan", "ready_fallback"]
+    },
+    "ready": { "type": "boolean" },
+    "full_native": { "type": "boolean" },
+    "blocked_by_host": { "type": "boolean" },
+    "degraded_scan": { "type": "boolean" },
+    "generated_at": { "type": "string", "format": "date-time" },
+    "requirements": {
+      "type": "array",
+      "minItems": 5,
+      "items": { "$ref": "#/$defs/requirement_evidence" }
+    },
+    "missing_requirements": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/requirement" }
+    }
+  },
+  "$defs": {
+    "requirement": {
+      "type": "string",
+      "enum": ["native_package", "native_hooks", "mcp", "native_scheduler", "official_inventory"]
+    },
+    "requirement_evidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["requirement", "satisfied", "evidence", "missing_reason"],
+      "properties": {
+        "requirement": { "$ref": "#/$defs/requirement" },
+        "satisfied": { "type": "boolean" },
+        "evidence": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/evidence_record" }
+        },
+        "missing_reason": {
+          "type": ["string", "null"]
+        }
+      }
+    },
+    "evidence_record": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source_kind", "reference", "observed_at", "confidence"],
+      "properties": {
+        "source_kind": {
+          "type": "string",
+          "enum": ["doctor", "local_cli", "local_api", "config_file", "official_docs"]
+        },
+        "reference": { "type": "string", "minLength": 1 },
+        "observed_at": { "type": "string", "format": "date-time" },
+        "confidence": {
+          "type": "string",
+          "enum": ["high", "medium", "low"]
+        }
+      }
+    }
+  }
+}

package/schemas/lease.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://nativesoul.local/schemas/lease.v1.json",
+  "title": "NativeSoul Lease",
+  "type": "object",
+  "required": ["id", "slot", "holder", "idempotency_key", "expires_at", "status"],
+  "properties": {
+    "id": { "type": "string" },
+    "slot": { "type": "string" },
+    "holder": { "type": "string" },
+    "idempotency_key": { "type": "string" },
+    "expires_at": { "type": "string" },
+    "status": { "type": "string", "enum": ["claimed", "completed", "expired"] }
+  },
+  "additionalProperties": false
+}

package/schemas/memory.schema.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://nativesoul.local/schemas/memory.v1.json",
+  "title": "NativeSoul Memory",
+  "type": "object",
+  "required": ["id", "type", "scope", "content", "summary", "source", "confidence", "authority", "sensitivity", "status", "created_at", "hash"],
+  "properties": {
+    "id": { "type": "string", "pattern": "^mem_" },
+    "type": { "type": "string" },
+    "scope": {
+      "type": "object",
+      "required": ["project"],
+      "properties": {
+        "user": { "type": "string" },
+        "project": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "content": { "type": "string" },
+    "summary": { "type": "string" },
+    "source": { "type": "object" },
+    "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
+    "authority": { "type": "string" },
+    "sensitivity": { "type": "string" },
+    "status": { "type": "string", "enum": ["candidate", "active", "superseded", "rejected", "forgotten"] },
+    "created_at": { "type": "string" },
+    "expires_at": { "type": ["string", "null"] },
+    "hash": { "type": "string", "pattern": "^sha256:" }
+  },
+  "additionalProperties": false
+}

package/schemas/migration.schema.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://nativesoul.local/schemas/migration.v1.json",
+  "title": "NativeSoul Migration",
+  "type": "object",
+  "required": ["version", "name", "checksum", "applied_at"],
+  "properties": {
+    "version": { "type": "integer", "minimum": 1 },
+    "name": { "type": "string" },
+    "checksum": { "type": "string" },
+    "applied_at": { "type": "string" }
+  },
+  "additionalProperties": false
+}

package/schemas/policy-pack.schema.json

@@ -0,0 +1,96 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://nativesoul.local/schemas/policy-pack.v1.json",
+  "title": "NativeSoul Policy Pack v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["id", "version", "title", "description", "intended_use", "standing_orders", "policy_proposals", "managed_blocks", "rollback"],
+  "properties": {
+    "id": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]{2,63}$"
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
+    },
+    "title": {
+      "type": "string",
+      "minLength": 1
+    },
+    "description": {
+      "type": "string",
+      "minLength": 1
+    },
+    "intended_use": {
+      "type": "string",
+      "minLength": 1
+    },
+    "approvals": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "standing_orders": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "action", "authority", "allowed", "approval_required", "scope_projects", "scope_hosts", "reason"],
+        "properties": {
+          "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{2,63}$" },
+          "action": { "type": "string", "enum": ["add", "propose"] },
+          "authority": { "type": "string", "enum": ["operator-approved", "proposal"] },
+          "allowed": { "type": "array", "items": { "type": "string" } },
+          "approval_required": { "type": "array", "items": { "type": "string" } },
+          "scope_projects": { "type": "array", "items": { "type": "string" } },
+          "scope_hosts": { "type": "array", "items": { "type": "string" } },
+          "reason": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "policy_proposals": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["target", "summary", "rationale", "rollback_note"],
+        "properties": {
+          "target": { "type": "string", "enum": ["SOUL.md", "POLICY.md"] },
+          "summary": { "type": "string", "minLength": 1 },
+          "rationale": { "type": "string", "minLength": 1 },
+          "rollback_note": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "managed_blocks": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["target", "marker", "content", "rollback_key"],
+        "properties": {
+          "target": { "type": "string", "minLength": 1 },
+          "marker": { "type": "string", "minLength": 1 },
+          "content": { "type": "string", "minLength": 1 },
+          "rollback_key": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "rollback": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["strategy", "restores", "notes"],
+      "properties": {
+        "strategy": { "type": "string", "enum": ["proposal-only", "managed-block", "snapshot-required"] },
+        "restores": { "type": "array", "items": { "type": "string" }, "minItems": 1 },
+        "notes": { "type": "string", "minLength": 1 }
+      }
+    },
+    "metadata": {
+      "type": "object",
+      "additionalProperties": {
+        "type": ["string", "number", "boolean", "null"]
+      }
+    }
+  }
+}

package/schemas/schedule.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://nativesoul.local/schemas/schedule.v1.json",
+  "title": "NativeSoul Schedule",
+  "type": "object",
+  "required": ["id", "host", "mode", "enabled", "native_schedule_supported"],
+  "properties": {
+    "id": { "type": "string" },
+    "host": { "type": "string" },
+    "mode": { "type": "string", "enum": ["leader", "federated", "per-project"] },
+    "enabled": { "type": "boolean" },
+    "native_schedule_supported": { "type": "boolean" },
+    "native_id": { "type": ["string", "null"] }
+  },
+  "additionalProperties": false
+}

package/schemas/session.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://nativesoul.local/schemas/session.v1.json",
+  "title": "NativeSoul Session",
+  "type": "object",
+  "required": ["id", "host", "cwd", "project_id", "mode", "started_at"],
+  "properties": {
+    "id": { "type": "string" },
+    "host": { "type": "string" },
+    "cwd": { "type": "string" },
+    "project_id": { "type": "string" },
+    "mode": { "type": "string", "enum": ["healthy", "degraded", "unsupported"] },
+    "started_at": { "type": "string" }
+  },
+  "additionalProperties": false
+}