open-multi-agent-kit 0.97.0 → 0.98.1

package/dist/guardrails/audit-logger.js

@@ -1,28 +0,0 @@
-import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
-import { dirname } from "node:path";
-export function appendAuditEvent(auditPath, event) {
-    return new Promise((resolve, reject) => {
-        try {
-            const dir = dirname(auditPath);
-            if (!existsSync(dir)) {
-                mkdirSync(dir, { recursive: true });
-            }
-            const line = `${JSON.stringify(event)}\n`;
-            appendFileSync(auditPath, line, "utf-8");
-            resolve();
-        }
-        catch (err) {
-            reject(err);
-        }
-    });
-}
-export function readAuditEvents(auditPath) {
-    if (!existsSync(auditPath))
-        return [];
-    const content = readFileSync(auditPath, "utf-8");
-    return content
-        .split("\n")
-        .filter((line) => line.trim().length > 0)
-        .map((line) => JSON.parse(line));
-}
-//# sourceMappingURL=audit-logger.js.map

package/dist/guardrails/audit-logger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/guardrails/audit-logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,KAA0B,EAAiB;IAC9F,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;YAC1C,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACzC,OAAO,EAAE,CAAC;QACX,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC;QACb,CAAC;IAAA,CACD,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAyB;IACzE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,OAAO;SACZ,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC,CAAC;AAAA,CACzD","sourcesContent":["import { appendFileSync, existsSync, mkdirSync, readFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport type { GuardrailAuditEvent } from \"../types/guardrails.ts\";\n\nexport function appendAuditEvent(auditPath: string, event: GuardrailAuditEvent): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\ttry {\n\t\t\tconst dir = dirname(auditPath);\n\t\t\tif (!existsSync(dir)) {\n\t\t\t\tmkdirSync(dir, { recursive: true });\n\t\t\t}\n\t\t\tconst line = `${JSON.stringify(event)}\\n`;\n\t\t\tappendFileSync(auditPath, line, \"utf-8\");\n\t\t\tresolve();\n\t\t} catch (err) {\n\t\t\treject(err);\n\t\t}\n\t});\n}\n\nexport function readAuditEvents(auditPath: string): GuardrailAuditEvent[] {\n\tif (!existsSync(auditPath)) return [];\n\tconst content = readFileSync(auditPath, \"utf-8\");\n\treturn content\n\t\t.split(\"\\n\")\n\t\t.filter((line) => line.trim().length > 0)\n\t\t.map((line) => JSON.parse(line) as GuardrailAuditEvent);\n}\n"]}

package/dist/guardrails/freedomd-adapter.d.ts

@@ -1,16 +0,0 @@
-import type { FreedomdAdapter, GuardrailDecision } from "../types/guardrails.ts";
-export declare class UnifiedFreedomdAdapter implements FreedomdAdapter {
-    private policy;
-    private goalId?;
-    private auditPath?;
-    constructor(options?: {
-        policyPath?: string;
-        goalId?: string;
-        auditPath?: string;
-    });
-    evaluate(toolName: string, toolInput: unknown): Promise<GuardrailDecision>;
-    private sanitizeInput;
-    private suggestAlternative;
-    private log;
-}
-//# sourceMappingURL=freedomd-adapter.d.ts.map

package/dist/guardrails/freedomd-adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"freedomd-adapter.d.ts","sourceRoot":"","sources":["../../src/guardrails/freedomd-adapter.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACX,eAAe,EAEf,iBAAiB,EAGjB,MAAM,wBAAwB,CAAC;AAahC,qBAAa,sBAAuB,YAAW,eAAe;IAC7D,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,SAAS,CAAC,CAAS;IAE3B,YAAY,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAMjF;IAEK,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqB/E;IAED,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,kBAAkB;YAeZ,GAAG;CAWjB","sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport YAML from \"yaml\";\nimport type {\n\tFreedomdAdapter,\n\tGuardrailAuditEvent,\n\tGuardrailDecision,\n\tGuardrailPolicy,\n\tGuardrailRule,\n} from \"../types/guardrails.ts\";\nimport { appendAuditEvent } from \"./audit-logger.ts\";\n\nfunction getCurrentDir(): string {\n\ttry {\n\t\treturn dirname(fileURLToPath(import.meta.url));\n\t} catch {\n\t\treturn __dirname;\n\t}\n}\n\nconst DEFAULT_POLICY_PATH = join(getCurrentDir(), \"policy.yaml\");\n\nexport class UnifiedFreedomdAdapter implements FreedomdAdapter {\n\tprivate policy: GuardrailPolicy;\n\tprivate goalId?: string;\n\tprivate auditPath?: string;\n\n\tconstructor(options?: { policyPath?: string; goalId?: string; auditPath?: string }) {\n\t\tconst path = options?.policyPath ?? DEFAULT_POLICY_PATH;\n\t\tconst raw = readFileSync(path, \"utf-8\");\n\t\tthis.policy = YAML.parse(raw) as GuardrailPolicy;\n\t\tthis.goalId = options?.goalId;\n\t\tthis.auditPath = options?.auditPath;\n\t}\n\n\tasync evaluate(toolName: string, toolInput: unknown): Promise<GuardrailDecision> {\n\t\tconst inputText = this.sanitizeInput(toolInput);\n\n\t\tfor (const rule of this.policy.rules) {\n\t\t\tif (!rule.enabled) continue;\n\t\t\tif (rule.toolName && rule.toolName !== toolName) continue;\n\t\t\tif (rule.pattern && !new RegExp(rule.pattern, \"i\").test(inputText)) continue;\n\n\t\t\tconst decision: GuardrailDecision = {\n\t\t\t\tallowed: false,\n\t\t\t\trule,\n\t\t\t\treason: `Blocked by rule \"${rule.id}\": ${rule.description}`,\n\t\t\t\tsuggestion: this.suggestAlternative(rule),\n\t\t\t};\n\t\t\tawait this.log(toolName, inputText, decision);\n\t\t\treturn decision;\n\t\t}\n\n\t\tconst allow: GuardrailDecision = { allowed: true };\n\t\tawait this.log(toolName, inputText, allow);\n\t\treturn allow;\n\t}\n\n\tprivate sanitizeInput(input: unknown): string {\n\t\tif (input === null || input === undefined) return \"\";\n\t\tif (typeof input === \"string\") return input;\n\t\ttry {\n\t\t\treturn JSON.stringify(input);\n\t\t} catch {\n\t\t\treturn String(input);\n\t\t}\n\t}\n\n\tprivate suggestAlternative(rule: GuardrailRule): string | undefined {\n\t\tswitch (rule.category) {\n\t\t\tcase \"network\":\n\t\t\t\treturn \"Use context-mode_ctx_fetch_and_index or context-mode_ctx_execute instead of shell networking.\";\n\t\t\tcase \"destructive\":\n\t\t\t\treturn \"Use targeted rm of specific files or confirm destructive operations interactively.\";\n\t\t\tcase \"privilege_escalation\":\n\t\t\t\treturn \"Run the command without sudo or use a dedicated privileged lane grant.\";\n\t\t\tcase \"secret_exposure\":\n\t\t\t\treturn \"Avoid reading secret files; use environment-variable references with $ prefix.\";\n\t\t\tdefault:\n\t\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tprivate async log(toolName: string, toolInput: string, decision: GuardrailDecision): Promise<void> {\n\t\tif (!this.auditPath) return;\n\t\tconst event: GuardrailAuditEvent = {\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tgoalId: this.goalId,\n\t\t\ttoolName,\n\t\t\ttoolInput,\n\t\t\tdecision,\n\t\t};\n\t\tawait appendAuditEvent(this.auditPath, event);\n\t}\n}\n"]}

package/dist/guardrails/freedomd-adapter.js

@@ -1,87 +0,0 @@
-import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import YAML from "yaml";
-import { appendAuditEvent } from "./audit-logger.js";
-function getCurrentDir() {
-    try {
-        return dirname(fileURLToPath(import.meta.url));
-    }
-    catch {
-        return __dirname;
-    }
-}
-const DEFAULT_POLICY_PATH = join(getCurrentDir(), "policy.yaml");
-export class UnifiedFreedomdAdapter {
-    policy;
-    goalId;
-    auditPath;
-    constructor(options) {
-        const path = options?.policyPath ?? DEFAULT_POLICY_PATH;
-        const raw = readFileSync(path, "utf-8");
-        this.policy = YAML.parse(raw);
-        this.goalId = options?.goalId;
-        this.auditPath = options?.auditPath;
-    }
-    async evaluate(toolName, toolInput) {
-        const inputText = this.sanitizeInput(toolInput);
-        for (const rule of this.policy.rules) {
-            if (!rule.enabled)
-                continue;
-            if (rule.toolName && rule.toolName !== toolName)
-                continue;
-            if (rule.pattern && !new RegExp(rule.pattern, "i").test(inputText))
-                continue;
-            const decision = {
-                allowed: false,
-                rule,
-                reason: `Blocked by rule "${rule.id}": ${rule.description}`,
-                suggestion: this.suggestAlternative(rule),
-            };
-            await this.log(toolName, inputText, decision);
-            return decision;
-        }
-        const allow = { allowed: true };
-        await this.log(toolName, inputText, allow);
-        return allow;
-    }
-    sanitizeInput(input) {
-        if (input === null || input === undefined)
-            return "";
-        if (typeof input === "string")
-            return input;
-        try {
-            return JSON.stringify(input);
-        }
-        catch {
-            return String(input);
-        }
-    }
-    suggestAlternative(rule) {
-        switch (rule.category) {
-            case "network":
-                return "Use context-mode_ctx_fetch_and_index or context-mode_ctx_execute instead of shell networking.";
-            case "destructive":
-                return "Use targeted rm of specific files or confirm destructive operations interactively.";
-            case "privilege_escalation":
-                return "Run the command without sudo or use a dedicated privileged lane grant.";
-            case "secret_exposure":
-                return "Avoid reading secret files; use environment-variable references with $ prefix.";
-            default:
-                return undefined;
-        }
-    }
-    async log(toolName, toolInput, decision) {
-        if (!this.auditPath)
-            return;
-        const event = {
-            timestamp: new Date().toISOString(),
-            goalId: this.goalId,
-            toolName,
-            toolInput,
-            decision,
-        };
-        await appendAuditEvent(this.auditPath, event);
-    }
-}
-//# sourceMappingURL=freedomd-adapter.js.map

package/dist/guardrails/freedomd-adapter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"freedomd-adapter.js","sourceRoot":"","sources":["../../src/guardrails/freedomd-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,MAAM,CAAC;AAQxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,SAAS,aAAa,GAAW;IAChC,IAAI,CAAC;QACJ,OAAO,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,aAAa,CAAC,CAAC;AAEjE,MAAM,OAAO,sBAAsB;IAC1B,MAAM,CAAkB;IACxB,MAAM,CAAU;IAChB,SAAS,CAAU;IAE3B,YAAY,OAAsE,EAAE;QACnF,MAAM,IAAI,GAAG,OAAO,EAAE,UAAU,IAAI,mBAAmB,CAAC;QACxD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;IAAA,CACpC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,SAAkB,EAA8B;QAChF,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAEhD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAC5B,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YAC1D,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,SAAS;YAE7E,MAAM,QAAQ,GAAsB;gBACnC,OAAO,EAAE,KAAK;gBACd,IAAI;gBACJ,MAAM,EAAE,oBAAoB,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE;gBAC3D,UAAU,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;aACzC,CAAC;YACF,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC9C,OAAO,QAAQ,CAAC;QACjB,CAAC;QAED,MAAM,KAAK,GAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IAAA,CACb;IAEO,aAAa,CAAC,KAAc,EAAU;QAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IAAA,CACD;IAEO,kBAAkB,CAAC,IAAmB,EAAsB;QACnE,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvB,KAAK,SAAS;gBACb,OAAO,+FAA+F,CAAC;YACxG,KAAK,aAAa;gBACjB,OAAO,oFAAoF,CAAC;YAC7F,KAAK,sBAAsB;gBAC1B,OAAO,wEAAwE,CAAC;YACjF,KAAK,iBAAiB;gBACrB,OAAO,gFAAgF,CAAC;YACzF;gBACC,OAAO,SAAS,CAAC;QACnB,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,SAAiB,EAAE,QAA2B,EAAiB;QAClG,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,MAAM,KAAK,GAAwB;YAClC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ;YACR,SAAS;YACT,QAAQ;SACR,CAAC;QACF,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAAA,CAC9C;CACD","sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport YAML from \"yaml\";\nimport type {\n\tFreedomdAdapter,\n\tGuardrailAuditEvent,\n\tGuardrailDecision,\n\tGuardrailPolicy,\n\tGuardrailRule,\n} from \"../types/guardrails.ts\";\nimport { appendAuditEvent } from \"./audit-logger.ts\";\n\nfunction getCurrentDir(): string {\n\ttry {\n\t\treturn dirname(fileURLToPath(import.meta.url));\n\t} catch {\n\t\treturn __dirname;\n\t}\n}\n\nconst DEFAULT_POLICY_PATH = join(getCurrentDir(), \"policy.yaml\");\n\nexport class UnifiedFreedomdAdapter implements FreedomdAdapter {\n\tprivate policy: GuardrailPolicy;\n\tprivate goalId?: string;\n\tprivate auditPath?: string;\n\n\tconstructor(options?: { policyPath?: string; goalId?: string; auditPath?: string }) {\n\t\tconst path = options?.policyPath ?? DEFAULT_POLICY_PATH;\n\t\tconst raw = readFileSync(path, \"utf-8\");\n\t\tthis.policy = YAML.parse(raw) as GuardrailPolicy;\n\t\tthis.goalId = options?.goalId;\n\t\tthis.auditPath = options?.auditPath;\n\t}\n\n\tasync evaluate(toolName: string, toolInput: unknown): Promise<GuardrailDecision> {\n\t\tconst inputText = this.sanitizeInput(toolInput);\n\n\t\tfor (const rule of this.policy.rules) {\n\t\t\tif (!rule.enabled) continue;\n\t\t\tif (rule.toolName && rule.toolName !== toolName) continue;\n\t\t\tif (rule.pattern && !new RegExp(rule.pattern, \"i\").test(inputText)) continue;\n\n\t\t\tconst decision: GuardrailDecision = {\n\t\t\t\tallowed: false,\n\t\t\t\trule,\n\t\t\t\treason: `Blocked by rule \"${rule.id}\": ${rule.description}`,\n\t\t\t\tsuggestion: this.suggestAlternative(rule),\n\t\t\t};\n\t\t\tawait this.log(toolName, inputText, decision);\n\t\t\treturn decision;\n\t\t}\n\n\t\tconst allow: GuardrailDecision = { allowed: true };\n\t\tawait this.log(toolName, inputText, allow);\n\t\treturn allow;\n\t}\n\n\tprivate sanitizeInput(input: unknown): string {\n\t\tif (input === null || input === undefined) return \"\";\n\t\tif (typeof input === \"string\") return input;\n\t\ttry {\n\t\t\treturn JSON.stringify(input);\n\t\t} catch {\n\t\t\treturn String(input);\n\t\t}\n\t}\n\n\tprivate suggestAlternative(rule: GuardrailRule): string | undefined {\n\t\tswitch (rule.category) {\n\t\t\tcase \"network\":\n\t\t\t\treturn \"Use context-mode_ctx_fetch_and_index or context-mode_ctx_execute instead of shell networking.\";\n\t\t\tcase \"destructive\":\n\t\t\t\treturn \"Use targeted rm of specific files or confirm destructive operations interactively.\";\n\t\t\tcase \"privilege_escalation\":\n\t\t\t\treturn \"Run the command without sudo or use a dedicated privileged lane grant.\";\n\t\t\tcase \"secret_exposure\":\n\t\t\t\treturn \"Avoid reading secret files; use environment-variable references with $ prefix.\";\n\t\t\tdefault:\n\t\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tprivate async log(toolName: string, toolInput: string, decision: GuardrailDecision): Promise<void> {\n\t\tif (!this.auditPath) return;\n\t\tconst event: GuardrailAuditEvent = {\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tgoalId: this.goalId,\n\t\t\ttoolName,\n\t\t\ttoolInput,\n\t\t\tdecision,\n\t\t};\n\t\tawait appendAuditEvent(this.auditPath, event);\n\t}\n}\n"]}

package/dist/orchestration/lane-grant-auditor.d.ts

@@ -1,4 +0,0 @@
-import type { LaneGrant, LaneGrantAuditReport } from "../types/lane-grant.ts";
-export declare function auditLaneGrants(grants: LaneGrant[], evidencePath: string): LaneGrantAuditReport;
-export declare function formatAuditReport(report: LaneGrantAuditReport): string;
-//# sourceMappingURL=lane-grant-auditor.d.ts.map

package/dist/orchestration/lane-grant-auditor.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"lane-grant-auditor.d.ts","sourceRoot":"","sources":["../../src/orchestration/lane-grant-auditor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAgB,MAAM,wBAAwB,CAAC;AAsB5F,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,oBAAoB,CA+C/F;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAuBtE","sourcesContent":["import { minimatch } from \"minimatch\";\nimport type { LaneGrant, LaneGrantAuditReport, PathConflict } from \"../types/lane-grant.ts\";\n\nfunction pathsOverlap(a: string, b: string): boolean {\n\tconst normalizedA = a.replace(/\\\\/g, \"/\").replace(/\\/$/, \"\");\n\tconst normalizedB = b.replace(/\\\\/g, \"/\").replace(/\\/$/, \"\");\n\tif (normalizedA === normalizedB) return true;\n\tif (minimatch(normalizedA, normalizedB) || minimatch(normalizedB, normalizedA)) return true;\n\tif (normalizedA.startsWith(`${normalizedB}/`) || normalizedB.startsWith(`${normalizedA}/`)) return true;\n\treturn false;\n}\n\nfunction hasOverlap(scopesA: string[], scopesB: string[]): { overlaps: boolean; path: string } {\n\tfor (const a of scopesA) {\n\t\tfor (const b of scopesB) {\n\t\t\tif (pathsOverlap(a, b)) {\n\t\t\t\treturn { overlaps: true, path: a };\n\t\t\t}\n\t\t}\n\t}\n\treturn { overlaps: false, path: \"\" };\n}\n\nexport function auditLaneGrants(grants: LaneGrant[], evidencePath: string): LaneGrantAuditReport {\n\tconst conflicts: PathConflict[] = [];\n\n\tfor (let i = 0; i < grants.length; i++) {\n\t\tfor (let j = i + 1; j < grants.length; j++) {\n\t\t\tconst a = grants[i];\n\t\t\tconst b = grants[j];\n\n\t\t\t// Only writers can conflict with each other.\n\t\t\tif (a.authority !== \"write-scoped\" || b.authority !== \"write-scoped\") continue;\n\n\t\t\tconst writeA = a.allowedPaths;\n\t\t\tconst writeB = b.allowedPaths;\n\t\t\tconst overlap = hasOverlap(writeA, writeB);\n\n\t\t\tif (overlap.overlaps) {\n\t\t\t\tconflicts.push({\n\t\t\t\t\tlanes: [a.laneId, b.laneId],\n\t\t\t\t\toverlappingPath: overlap.path,\n\t\t\t\t\tseverity: \"merge-blocked\",\n\t\t\t\t\tsuggestion: `Serialize lanes ${a.laneId} and ${b.laneId}, or split write scopes so they do not overlap at ${overlap.path}.`,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\t// Any grant writing to a blocked path is a merge-blocker.\n\t\tconst grant = grants[i];\n\t\tfor (const allowed of grant.allowedPaths) {\n\t\t\tfor (const blocked of grant.blockedPaths) {\n\t\t\t\tif (pathsOverlap(allowed, blocked)) {\n\t\t\t\t\tconflicts.push({\n\t\t\t\t\t\tlanes: [grant.laneId, grant.laneId],\n\t\t\t\t\t\toverlappingPath: blocked,\n\t\t\t\t\t\tseverity: \"merge-blocked\",\n\t\t\t\t\t\tsuggestion: `Remove ${blocked} from allowedPaths or add an exception; it overlaps blockedPaths in ${grant.laneId}.`,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn {\n\t\tgrants,\n\t\tconflicts,\n\t\tmergeBlocked: conflicts.some((c) => c.severity === \"merge-blocked\"),\n\t\tevidencePath,\n\t};\n}\n\nexport function formatAuditReport(report: LaneGrantAuditReport): string {\n\tconst lines: string[] = [\n\t\t`# Lane Grant Audit Report`,\n\t\t\"\",\n\t\t`- Lanes audited: ${report.grants.length}`,\n\t\t`- Conflicts detected: ${report.conflicts.length}`,\n\t\t`- Merge blocked: ${report.mergeBlocked ? \"YES\" : \"NO\"}`,\n\t\t\"\",\n\t];\n\n\tif (report.conflicts.length === 0) {\n\t\tlines.push(\"No path conflicts detected.\");\n\t} else {\n\t\tlines.push(\"## Conflicts\");\n\t\tfor (const conflict of report.conflicts) {\n\t\t\tlines.push(\n\t\t\t\t`- **${conflict.severity.toUpperCase()}** \\`${conflict.lanes.join(\" ↔ \")}\\` at \\`${conflict.overlappingPath}\\``,\n\t\t\t);\n\t\t\tlines.push(`  - Suggestion: ${conflict.suggestion}`);\n\t\t}\n\t}\n\n\treturn lines.join(\"\\n\");\n}\n"]}

package/dist/orchestration/lane-grant-auditor.js

@@ -1,87 +0,0 @@
-import { minimatch } from "minimatch";
-function pathsOverlap(a, b) {
-    const normalizedA = a.replace(/\\/g, "/").replace(/\/$/, "");
-    const normalizedB = b.replace(/\\/g, "/").replace(/\/$/, "");
-    if (normalizedA === normalizedB)
-        return true;
-    if (minimatch(normalizedA, normalizedB) || minimatch(normalizedB, normalizedA))
-        return true;
-    if (normalizedA.startsWith(`${normalizedB}/`) || normalizedB.startsWith(`${normalizedA}/`))
-        return true;
-    return false;
-}
-function hasOverlap(scopesA, scopesB) {
-    for (const a of scopesA) {
-        for (const b of scopesB) {
-            if (pathsOverlap(a, b)) {
-                return { overlaps: true, path: a };
-            }
-        }
-    }
-    return { overlaps: false, path: "" };
-}
-export function auditLaneGrants(grants, evidencePath) {
-    const conflicts = [];
-    for (let i = 0; i < grants.length; i++) {
-        for (let j = i + 1; j < grants.length; j++) {
-            const a = grants[i];
-            const b = grants[j];
-            // Only writers can conflict with each other.
-            if (a.authority !== "write-scoped" || b.authority !== "write-scoped")
-                continue;
-            const writeA = a.allowedPaths;
-            const writeB = b.allowedPaths;
-            const overlap = hasOverlap(writeA, writeB);
-            if (overlap.overlaps) {
-                conflicts.push({
-                    lanes: [a.laneId, b.laneId],
-                    overlappingPath: overlap.path,
-                    severity: "merge-blocked",
-                    suggestion: `Serialize lanes ${a.laneId} and ${b.laneId}, or split write scopes so they do not overlap at ${overlap.path}.`,
-                });
-            }
-        }
-        // Any grant writing to a blocked path is a merge-blocker.
-        const grant = grants[i];
-        for (const allowed of grant.allowedPaths) {
-            for (const blocked of grant.blockedPaths) {
-                if (pathsOverlap(allowed, blocked)) {
-                    conflicts.push({
-                        lanes: [grant.laneId, grant.laneId],
-                        overlappingPath: blocked,
-                        severity: "merge-blocked",
-                        suggestion: `Remove ${blocked} from allowedPaths or add an exception; it overlaps blockedPaths in ${grant.laneId}.`,
-                    });
-                }
-            }
-        }
-    }
-    return {
-        grants,
-        conflicts,
-        mergeBlocked: conflicts.some((c) => c.severity === "merge-blocked"),
-        evidencePath,
-    };
-}
-export function formatAuditReport(report) {
-    const lines = [
-        `# Lane Grant Audit Report`,
-        "",
-        `- Lanes audited: ${report.grants.length}`,
-        `- Conflicts detected: ${report.conflicts.length}`,
-        `- Merge blocked: ${report.mergeBlocked ? "YES" : "NO"}`,
-        "",
-    ];
-    if (report.conflicts.length === 0) {
-        lines.push("No path conflicts detected.");
-    }
-    else {
-        lines.push("## Conflicts");
-        for (const conflict of report.conflicts) {
-            lines.push(`- **${conflict.severity.toUpperCase()}** \`${conflict.lanes.join(" ↔ ")}\` at \`${conflict.overlappingPath}\``);
-            lines.push(`  - Suggestion: ${conflict.suggestion}`);
-        }
-    }
-    return lines.join("\n");
-}
-//# sourceMappingURL=lane-grant-auditor.js.map

package/dist/orchestration/lane-grant-auditor.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"lane-grant-auditor.js","sourceRoot":"","sources":["../../src/orchestration/lane-grant-auditor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS,EAAW;IACpD,MAAM,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,WAAW,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxG,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,UAAU,CAAC,OAAiB,EAAE,OAAiB,EAAuC;IAC9F,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACzB,IAAI,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACxB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACpC,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAAA,CACrC;AAED,MAAM,UAAU,eAAe,CAAC,MAAmB,EAAE,YAAoB,EAAwB;IAChG,MAAM,SAAS,GAAmB,EAAE,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAEpB,6CAA6C;YAC7C,IAAI,CAAC,CAAC,SAAS,KAAK,cAAc,IAAI,CAAC,CAAC,SAAS,KAAK,cAAc;gBAAE,SAAS;YAE/E,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC;YAC9B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAE3C,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,SAAS,CAAC,IAAI,CAAC;oBACd,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;oBAC3B,eAAe,EAAE,OAAO,CAAC,IAAI;oBAC7B,QAAQ,EAAE,eAAe;oBACzB,UAAU,EAAE,mBAAmB,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,MAAM,qDAAqD,OAAO,CAAC,IAAI,GAAG;iBAC3H,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC1C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBAC1C,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;oBACpC,SAAS,CAAC,IAAI,CAAC;wBACd,KAAK,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;wBACnC,eAAe,EAAE,OAAO;wBACxB,QAAQ,EAAE,eAAe;wBACzB,UAAU,EAAE,UAAU,OAAO,uEAAuE,KAAK,CAAC,MAAM,GAAG;qBACnH,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO;QACN,MAAM;QACN,SAAS;QACT,YAAY,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC;QACnE,YAAY;KACZ,CAAC;AAAA,CACF;AAED,MAAM,UAAU,iBAAiB,CAAC,MAA4B,EAAU;IACvE,MAAM,KAAK,GAAa;QACvB,2BAA2B;QAC3B,EAAE;QACF,oBAAoB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC1C,yBAAyB,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE;QAClD,oBAAoB,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACxD,EAAE;KACF,CAAC;IAEF,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CACT,OAAO,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAK,CAAC,WAAW,QAAQ,CAAC,eAAe,IAAI,CAC/G,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAAA,CACxB","sourcesContent":["import { minimatch } from \"minimatch\";\nimport type { LaneGrant, LaneGrantAuditReport, PathConflict } from \"../types/lane-grant.ts\";\n\nfunction pathsOverlap(a: string, b: string): boolean {\n\tconst normalizedA = a.replace(/\\\\/g, \"/\").replace(/\\/$/, \"\");\n\tconst normalizedB = b.replace(/\\\\/g, \"/\").replace(/\\/$/, \"\");\n\tif (normalizedA === normalizedB) return true;\n\tif (minimatch(normalizedA, normalizedB) || minimatch(normalizedB, normalizedA)) return true;\n\tif (normalizedA.startsWith(`${normalizedB}/`) || normalizedB.startsWith(`${normalizedA}/`)) return true;\n\treturn false;\n}\n\nfunction hasOverlap(scopesA: string[], scopesB: string[]): { overlaps: boolean; path: string } {\n\tfor (const a of scopesA) {\n\t\tfor (const b of scopesB) {\n\t\t\tif (pathsOverlap(a, b)) {\n\t\t\t\treturn { overlaps: true, path: a };\n\t\t\t}\n\t\t}\n\t}\n\treturn { overlaps: false, path: \"\" };\n}\n\nexport function auditLaneGrants(grants: LaneGrant[], evidencePath: string): LaneGrantAuditReport {\n\tconst conflicts: PathConflict[] = [];\n\n\tfor (let i = 0; i < grants.length; i++) {\n\t\tfor (let j = i + 1; j < grants.length; j++) {\n\t\t\tconst a = grants[i];\n\t\t\tconst b = grants[j];\n\n\t\t\t// Only writers can conflict with each other.\n\t\t\tif (a.authority !== \"write-scoped\" || b.authority !== \"write-scoped\") continue;\n\n\t\t\tconst writeA = a.allowedPaths;\n\t\t\tconst writeB = b.allowedPaths;\n\t\t\tconst overlap = hasOverlap(writeA, writeB);\n\n\t\t\tif (overlap.overlaps) {\n\t\t\t\tconflicts.push({\n\t\t\t\t\tlanes: [a.laneId, b.laneId],\n\t\t\t\t\toverlappingPath: overlap.path,\n\t\t\t\t\tseverity: \"merge-blocked\",\n\t\t\t\t\tsuggestion: `Serialize lanes ${a.laneId} and ${b.laneId}, or split write scopes so they do not overlap at ${overlap.path}.`,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\t// Any grant writing to a blocked path is a merge-blocker.\n\t\tconst grant = grants[i];\n\t\tfor (const allowed of grant.allowedPaths) {\n\t\t\tfor (const blocked of grant.blockedPaths) {\n\t\t\t\tif (pathsOverlap(allowed, blocked)) {\n\t\t\t\t\tconflicts.push({\n\t\t\t\t\t\tlanes: [grant.laneId, grant.laneId],\n\t\t\t\t\t\toverlappingPath: blocked,\n\t\t\t\t\t\tseverity: \"merge-blocked\",\n\t\t\t\t\t\tsuggestion: `Remove ${blocked} from allowedPaths or add an exception; it overlaps blockedPaths in ${grant.laneId}.`,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn {\n\t\tgrants,\n\t\tconflicts,\n\t\tmergeBlocked: conflicts.some((c) => c.severity === \"merge-blocked\"),\n\t\tevidencePath,\n\t};\n}\n\nexport function formatAuditReport(report: LaneGrantAuditReport): string {\n\tconst lines: string[] = [\n\t\t`# Lane Grant Audit Report`,\n\t\t\"\",\n\t\t`- Lanes audited: ${report.grants.length}`,\n\t\t`- Conflicts detected: ${report.conflicts.length}`,\n\t\t`- Merge blocked: ${report.mergeBlocked ? \"YES\" : \"NO\"}`,\n\t\t\"\",\n\t];\n\n\tif (report.conflicts.length === 0) {\n\t\tlines.push(\"No path conflicts detected.\");\n\t} else {\n\t\tlines.push(\"## Conflicts\");\n\t\tfor (const conflict of report.conflicts) {\n\t\t\tlines.push(\n\t\t\t\t`- **${conflict.severity.toUpperCase()}** \\`${conflict.lanes.join(\" ↔ \")}\\` at \\`${conflict.overlappingPath}\\``,\n\t\t\t);\n\t\t\tlines.push(`  - Suggestion: ${conflict.suggestion}`);\n\t\t}\n\t}\n\n\treturn lines.join(\"\\n\");\n}\n"]}

package/dist/types/guardrails.d.ts

@@ -1,61 +0,0 @@
-/**
- * Unified guardrail types for OMK hard-fork runtime.
- *
- * Integrates Freedomd strict policy with OMK native extension-based
- * safety hooks (formerly hooks/). All tool/block decisions flow through
- * a single `GuardrailDecision` produced by the `FreedomdAdapter`.
- */
-export type ToolCategory = "destructive" | "network" | "secret_exposure" | "privilege_escalation" | "filesystem" | "shell" | "unknown";
-export type BlockOrigin = "freedomd" | "omk_extension" | "unified_policy";
-export interface GuardrailRule {
-    /** Unique rule identifier (kebab-case). */
-    id: string;
-    /** Human-readable description of what is being blocked. */
-    description: string;
-    /** Risk category for audit logs. */
-    category: ToolCategory;
-    /** Where this rule originated. */
-    origin: BlockOrigin;
-    /** Optional glob or regex matched against tool input. */
-    pattern?: string;
-    /** Optional exact tool name to match. */
-    toolName?: string;
-    /** When true the rule is active. */
-    enabled: boolean;
-}
-export interface GuardrailPolicy {
-    version: string;
-    /** Default action when no rule matches. */
-    defaultAction: "allow" | "deny";
-    /** Ordered list of unified rules. */
-    rules: GuardrailRule[];
-}
-export interface GuardrailDecision {
-    allowed: boolean;
-    /** Matched rule, if any. */
-    rule?: GuardrailRule;
-    /** Human-readable reason for the decision. */
-    reason?: string;
-    /** Suggested safe alternative, if blocked. */
-    suggestion?: string;
-}
-export interface GuardrailAuditEvent {
-    /** ISO-8601 timestamp. */
-    timestamp: string;
-    /** Goal or session identifier. */
-    goalId?: string;
-    /** Tool name that was evaluated. */
-    toolName: string;
-    /** Tool input that was evaluated (sanitized, no secrets). */
-    toolInput: string;
-    /** Final decision. */
-    decision: GuardrailDecision;
-}
-export interface FreedomdAdapter {
-    /**
-     * Evaluate a tool call against the unified policy.
-     * @returns a `GuardrailDecision` and optionally emits an audit event.
-     */
-    evaluate(toolName: string, toolInput: unknown): Promise<GuardrailDecision>;
-}
-//# sourceMappingURL=guardrails.d.ts.map

package/dist/types/guardrails.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/types/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,YAAY,GACrB,aAAa,GACb,SAAS,GACT,iBAAiB,GACjB,sBAAsB,GACtB,YAAY,GACZ,OAAO,GACP,SAAS,CAAC;AAEb,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,eAAe,GAAG,gBAAgB,CAAC;AAE1E,MAAM,WAAW,aAAa;IAC7B,2CAA2C;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,QAAQ,EAAE,YAAY,CAAC;IACvB,kCAAkC;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,qCAAqC;IACrC,KAAK,EAAE,aAAa,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IACnC,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB;IACtB,QAAQ,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC3E","sourcesContent":["/**\n * Unified guardrail types for OMK hard-fork runtime.\n *\n * Integrates Freedomd strict policy with OMK native extension-based\n * safety hooks (formerly hooks/). All tool/block decisions flow through\n * a single `GuardrailDecision` produced by the `FreedomdAdapter`.\n */\n\nexport type ToolCategory =\n\t| \"destructive\"\n\t| \"network\"\n\t| \"secret_exposure\"\n\t| \"privilege_escalation\"\n\t| \"filesystem\"\n\t| \"shell\"\n\t| \"unknown\";\n\nexport type BlockOrigin = \"freedomd\" | \"omk_extension\" | \"unified_policy\";\n\nexport interface GuardrailRule {\n\t/** Unique rule identifier (kebab-case). */\n\tid: string;\n\t/** Human-readable description of what is being blocked. */\n\tdescription: string;\n\t/** Risk category for audit logs. */\n\tcategory: ToolCategory;\n\t/** Where this rule originated. */\n\torigin: BlockOrigin;\n\t/** Optional glob or regex matched against tool input. */\n\tpattern?: string;\n\t/** Optional exact tool name to match. */\n\ttoolName?: string;\n\t/** When true the rule is active. */\n\tenabled: boolean;\n}\n\nexport interface GuardrailPolicy {\n\tversion: string;\n\t/** Default action when no rule matches. */\n\tdefaultAction: \"allow\" | \"deny\";\n\t/** Ordered list of unified rules. */\n\trules: GuardrailRule[];\n}\n\nexport interface GuardrailDecision {\n\tallowed: boolean;\n\t/** Matched rule, if any. */\n\trule?: GuardrailRule;\n\t/** Human-readable reason for the decision. */\n\treason?: string;\n\t/** Suggested safe alternative, if blocked. */\n\tsuggestion?: string;\n}\n\nexport interface GuardrailAuditEvent {\n\t/** ISO-8601 timestamp. */\n\ttimestamp: string;\n\t/** Goal or session identifier. */\n\tgoalId?: string;\n\t/** Tool name that was evaluated. */\n\ttoolName: string;\n\t/** Tool input that was evaluated (sanitized, no secrets). */\n\ttoolInput: string;\n\t/** Final decision. */\n\tdecision: GuardrailDecision;\n}\n\nexport interface FreedomdAdapter {\n\t/**\n\t * Evaluate a tool call against the unified policy.\n\t * @returns a `GuardrailDecision` and optionally emits an audit event.\n\t */\n\tevaluate(toolName: string, toolInput: unknown): Promise<GuardrailDecision>;\n}\n"]}

package/dist/types/guardrails.js

@@ -1,9 +0,0 @@
-/**
- * Unified guardrail types for OMK hard-fork runtime.
- *
- * Integrates Freedomd strict policy with OMK native extension-based
- * safety hooks (formerly hooks/). All tool/block decisions flow through
- * a single `GuardrailDecision` produced by the `FreedomdAdapter`.
- */
-export {};
-//# sourceMappingURL=guardrails.js.map

package/dist/types/guardrails.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/types/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * Unified guardrail types for OMK hard-fork runtime.\n *\n * Integrates Freedomd strict policy with OMK native extension-based\n * safety hooks (formerly hooks/). All tool/block decisions flow through\n * a single `GuardrailDecision` produced by the `FreedomdAdapter`.\n */\n\nexport type ToolCategory =\n\t| \"destructive\"\n\t| \"network\"\n\t| \"secret_exposure\"\n\t| \"privilege_escalation\"\n\t| \"filesystem\"\n\t| \"shell\"\n\t| \"unknown\";\n\nexport type BlockOrigin = \"freedomd\" | \"omk_extension\" | \"unified_policy\";\n\nexport interface GuardrailRule {\n\t/** Unique rule identifier (kebab-case). */\n\tid: string;\n\t/** Human-readable description of what is being blocked. */\n\tdescription: string;\n\t/** Risk category for audit logs. */\n\tcategory: ToolCategory;\n\t/** Where this rule originated. */\n\torigin: BlockOrigin;\n\t/** Optional glob or regex matched against tool input. */\n\tpattern?: string;\n\t/** Optional exact tool name to match. */\n\ttoolName?: string;\n\t/** When true the rule is active. */\n\tenabled: boolean;\n}\n\nexport interface GuardrailPolicy {\n\tversion: string;\n\t/** Default action when no rule matches. */\n\tdefaultAction: \"allow\" | \"deny\";\n\t/** Ordered list of unified rules. */\n\trules: GuardrailRule[];\n}\n\nexport interface GuardrailDecision {\n\tallowed: boolean;\n\t/** Matched rule, if any. */\n\trule?: GuardrailRule;\n\t/** Human-readable reason for the decision. */\n\treason?: string;\n\t/** Suggested safe alternative, if blocked. */\n\tsuggestion?: string;\n}\n\nexport interface GuardrailAuditEvent {\n\t/** ISO-8601 timestamp. */\n\ttimestamp: string;\n\t/** Goal or session identifier. */\n\tgoalId?: string;\n\t/** Tool name that was evaluated. */\n\ttoolName: string;\n\t/** Tool input that was evaluated (sanitized, no secrets). */\n\ttoolInput: string;\n\t/** Final decision. */\n\tdecision: GuardrailDecision;\n}\n\nexport interface FreedomdAdapter {\n\t/**\n\t * Evaluate a tool call against the unified policy.\n\t * @returns a `GuardrailDecision` and optionally emits an audit event.\n\t */\n\tevaluate(toolName: string, toolInput: unknown): Promise<GuardrailDecision>;\n}\n"]}

package/dist/types/lane-grant.d.ts

@@ -1,58 +0,0 @@
-/**
- * Lane grant schema for OMK subagent isolation.
- *
- * Mirrors the lane grant contract defined in `.omk/agent/AGENTS.md`.
- * Used by the lane-grant auditor to detect parallel writer conflicts
- * before merge.
- */
-export type AgentRole = "planner" | "explorer" | "coder" | "tester" | "reviewer" | "security" | "memory" | "synthesizer" | "architect" | "devops" | "qa";
-export type AuthorityLevel = "read-only" | "advisory" | "write-scoped" | "execute-tests" | "review-only" | "memory-write";
-export interface LaneGrant {
-    /** Unique lane identifier. */
-    laneId: string;
-    /** Agent role / type. */
-    agent: AgentRole;
-    /** Task node this lane executes. */
-    taskNodeId: string;
-    /** Plain-language allowed scope. */
-    scope: string;
-    /** Authority level. */
-    authority: AuthorityLevel;
-    /** Paths the lane may read. */
-    allowedPaths: string[];
-    /** Paths the lane must never touch. */
-    blockedPaths: string[];
-    /** Skill names available to the lane. */
-    skills: string[];
-    /** Hook/extension scripts active for the lane. */
-    hooks: string[];
-    /** MCP servers available to the lane. */
-    mcp: string[];
-    /** Measurable pass criteria. */
-    acceptance: string[];
-    /** Path where the lane writes evidence. */
-    evidenceOutput: string;
-    /** Explicitly forbidden actions. */
-    forbiddenActions: string[];
-}
-export interface PathConflict {
-    /** Lanes whose write scopes overlap. */
-    lanes: [string, string];
-    /** Overlapping path or directory subtree. */
-    overlappingPath: string;
-    /** Severity: advisory or merge-blocked. */
-    severity: "advisory" | "merge-blocked";
-    /** Suggested resolution. */
-    suggestion: string;
-}
-export interface LaneGrantAuditReport {
-    /** Lane grants that were audited. */
-    grants: LaneGrant[];
-    /** Detected conflicts. */
-    conflicts: PathConflict[];
-    /** Merge-blocked if any conflict has severity merge-blocked. */
-    mergeBlocked: boolean;
-    /** Evidence artifact path. */
-    evidencePath: string;
-}
-//# sourceMappingURL=lane-grant.d.ts.map

package/dist/types/lane-grant.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"lane-grant.d.ts","sourceRoot":"","sources":["../../src/types/lane-grant.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,SAAS,GAClB,SAAS,GACT,UAAU,GACV,OAAO,GACP,QAAQ,GACR,UAAU,GACV,UAAU,GACV,QAAQ,GACR,aAAa,GACb,WAAW,GACX,QAAQ,GACR,IAAI,CAAC;AAER,MAAM,MAAM,cAAc,GACvB,WAAW,GACX,UAAU,GACV,cAAc,GACd,eAAe,GACf,aAAa,GACb,cAAc,CAAC;AAElB,MAAM,WAAW,SAAS;IACzB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,KAAK,EAAE,SAAS,CAAC;IACjB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,uBAAuB;IACvB,SAAS,EAAE,cAAc,CAAC;IAC1B,+BAA+B;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uCAAuC;IACvC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yCAAyC;IACzC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yCAAyC;IACzC,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,gCAAgC;IAChC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,oCAAoC;IACpC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC5B,wCAAwC;IACxC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,6CAA6C;IAC7C,eAAe,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,QAAQ,EAAE,UAAU,GAAG,eAAe,CAAC;IACvC,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACpC,qCAAqC;IACrC,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,0BAA0B;IAC1B,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gEAAgE;IAChE,YAAY,EAAE,OAAO,CAAC;IACtB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;CACrB","sourcesContent":["/**\n * Lane grant schema for OMK subagent isolation.\n *\n * Mirrors the lane grant contract defined in `.omk/agent/AGENTS.md`.\n * Used by the lane-grant auditor to detect parallel writer conflicts\n * before merge.\n */\n\nexport type AgentRole =\n\t| \"planner\"\n\t| \"explorer\"\n\t| \"coder\"\n\t| \"tester\"\n\t| \"reviewer\"\n\t| \"security\"\n\t| \"memory\"\n\t| \"synthesizer\"\n\t| \"architect\"\n\t| \"devops\"\n\t| \"qa\";\n\nexport type AuthorityLevel =\n\t| \"read-only\"\n\t| \"advisory\"\n\t| \"write-scoped\"\n\t| \"execute-tests\"\n\t| \"review-only\"\n\t| \"memory-write\";\n\nexport interface LaneGrant {\n\t/** Unique lane identifier. */\n\tlaneId: string;\n\t/** Agent role / type. */\n\tagent: AgentRole;\n\t/** Task node this lane executes. */\n\ttaskNodeId: string;\n\t/** Plain-language allowed scope. */\n\tscope: string;\n\t/** Authority level. */\n\tauthority: AuthorityLevel;\n\t/** Paths the lane may read. */\n\tallowedPaths: string[];\n\t/** Paths the lane must never touch. */\n\tblockedPaths: string[];\n\t/** Skill names available to the lane. */\n\tskills: string[];\n\t/** Hook/extension scripts active for the lane. */\n\thooks: string[];\n\t/** MCP servers available to the lane. */\n\tmcp: string[];\n\t/** Measurable pass criteria. */\n\tacceptance: string[];\n\t/** Path where the lane writes evidence. */\n\tevidenceOutput: string;\n\t/** Explicitly forbidden actions. */\n\tforbiddenActions: string[];\n}\n\nexport interface PathConflict {\n\t/** Lanes whose write scopes overlap. */\n\tlanes: [string, string];\n\t/** Overlapping path or directory subtree. */\n\toverlappingPath: string;\n\t/** Severity: advisory or merge-blocked. */\n\tseverity: \"advisory\" | \"merge-blocked\";\n\t/** Suggested resolution. */\n\tsuggestion: string;\n}\n\nexport interface LaneGrantAuditReport {\n\t/** Lane grants that were audited. */\n\tgrants: LaneGrant[];\n\t/** Detected conflicts. */\n\tconflicts: PathConflict[];\n\t/** Merge-blocked if any conflict has severity merge-blocked. */\n\tmergeBlocked: boolean;\n\t/** Evidence artifact path. */\n\tevidencePath: string;\n}\n"]}

package/dist/types/lane-grant.js

@@ -1,9 +0,0 @@
-/**
- * Lane grant schema for OMK subagent isolation.
- *
- * Mirrors the lane grant contract defined in `.omk/agent/AGENTS.md`.
- * Used by the lane-grant auditor to detect parallel writer conflicts
- * before merge.
- */
-export {};
-//# sourceMappingURL=lane-grant.js.map

package/dist/types/lane-grant.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"lane-grant.js","sourceRoot":"","sources":["../../src/types/lane-grant.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * Lane grant schema for OMK subagent isolation.\n *\n * Mirrors the lane grant contract defined in `.omk/agent/AGENTS.md`.\n * Used by the lane-grant auditor to detect parallel writer conflicts\n * before merge.\n */\n\nexport type AgentRole =\n\t| \"planner\"\n\t| \"explorer\"\n\t| \"coder\"\n\t| \"tester\"\n\t| \"reviewer\"\n\t| \"security\"\n\t| \"memory\"\n\t| \"synthesizer\"\n\t| \"architect\"\n\t| \"devops\"\n\t| \"qa\";\n\nexport type AuthorityLevel =\n\t| \"read-only\"\n\t| \"advisory\"\n\t| \"write-scoped\"\n\t| \"execute-tests\"\n\t| \"review-only\"\n\t| \"memory-write\";\n\nexport interface LaneGrant {\n\t/** Unique lane identifier. */\n\tlaneId: string;\n\t/** Agent role / type. */\n\tagent: AgentRole;\n\t/** Task node this lane executes. */\n\ttaskNodeId: string;\n\t/** Plain-language allowed scope. */\n\tscope: string;\n\t/** Authority level. */\n\tauthority: AuthorityLevel;\n\t/** Paths the lane may read. */\n\tallowedPaths: string[];\n\t/** Paths the lane must never touch. */\n\tblockedPaths: string[];\n\t/** Skill names available to the lane. */\n\tskills: string[];\n\t/** Hook/extension scripts active for the lane. */\n\thooks: string[];\n\t/** MCP servers available to the lane. */\n\tmcp: string[];\n\t/** Measurable pass criteria. */\n\tacceptance: string[];\n\t/** Path where the lane writes evidence. */\n\tevidenceOutput: string;\n\t/** Explicitly forbidden actions. */\n\tforbiddenActions: string[];\n}\n\nexport interface PathConflict {\n\t/** Lanes whose write scopes overlap. */\n\tlanes: [string, string];\n\t/** Overlapping path or directory subtree. */\n\toverlappingPath: string;\n\t/** Severity: advisory or merge-blocked. */\n\tseverity: \"advisory\" | \"merge-blocked\";\n\t/** Suggested resolution. */\n\tsuggestion: string;\n}\n\nexport interface LaneGrantAuditReport {\n\t/** Lane grants that were audited. */\n\tgrants: LaneGrant[];\n\t/** Detected conflicts. */\n\tconflicts: PathConflict[];\n\t/** Merge-blocked if any conflict has severity merge-blocked. */\n\tmergeBlocked: boolean;\n\t/** Evidence artifact path. */\n\tevidencePath: string;\n}\n"]}