opensquid 0.5.395

package/dist/runtime/audit_adapters.js

@@ -0,0 +1,190 @@
+/**
+ * Audit producer → unified `AuditLog` adapters (Patch B).
+ *
+ * Each producer (AUTO.3 capability gate, SCHED.1 webhook server, DURABLE.4
+ * resumer, AUTO.6 inbound router) ships its own audit-sink interface in a
+ * producer-specific shape. The CLI.5 `AuditLog` is the single libsql-backed
+ * landing table. These adapters are the glue: each `adaptXxx(auditLog)`
+ * returns a sink that satisfies the producer's interface and translates
+ * each event variant into a unified `AuditEntry` via `auditLog.append`.
+ *
+ * Single-direction dependency: producers DO NOT import `AuditLog`. Only
+ * this module touches both sides. Wiring lives at the daemon construction
+ * site (separate commit) — this patch ships the adapter functions + tests
+ * only.
+ *
+ * `void auditLog.append(...)` is intentional fire-and-forget — the
+ * `AuditLog` class handles its own write errors (see `audit_log.ts` init +
+ * insert flow) and constraint C10 forbids audit-sink errors from
+ * influencing producer verdicts. The producer's `try/catch` around the
+ * sink (CapabilityGate.audit) already swallows any thrown exceptions; the
+ * `Promise` returned by `append` resolves independently.
+ *
+ * PII discipline: no producer event variant carries raw secrets / bearer
+ * tokens / signing keys. WebhookServer audit explicitly carries only
+ * `subscriptionId` (never `signingSecret`); InboundRouter carries
+ * `sender` (an externally-visible principal, not a credential); Resumer
+ * carries error messages already stringified at the producer boundary.
+ * No additional `hashDetailValue` wrapping is required at the adapter
+ * boundary — producers pre-hash any sensitive value before it reaches
+ * the sink.
+ */
+/**
+ * AUTO.3 capability gate → unified audit.
+ *
+ * Mapping:
+ *   - category = `'capability_gate'`
+ *   - decision = `verdict.allowed ? 'allowed' : 'denied'`
+ *   - packId   = `req.pack`
+ *   - detail   = `{ event_subtype: verdict.source, capability, target,
+ *                   method?, source, message? }`
+ *
+ * `source` is duplicated as both `event_subtype` (queryable subtype across
+ * all categories) and `source` (verbatim from verdict) so downstream
+ * dashboards can pivot either way.
+ */
+export function adaptCapabilityGate(auditLog, now = Date.now) {
+    return (verdict, req) => {
+        const detail = {
+            event_subtype: verdict.source,
+            capability: req.capability,
+            target: req.target,
+            source: verdict.source,
+        };
+        if (req.method !== undefined)
+            detail.method = req.method;
+        if (verdict.message !== undefined)
+            detail.message = verdict.message;
+        void auditLog.append({
+            occurredAtMs: now(),
+            category: 'capability_gate',
+            decision: verdict.allowed ? 'allowed' : 'denied',
+            packId: req.pack,
+            detail,
+        });
+    };
+}
+/**
+ * SCHED.1 webhook server → unified audit.
+ *
+ * Mapping per event variant:
+ *   - `received | dispatched | idempotent | deliver_only` → `success`
+ *   - `rejected_method | rejected_unknown | rejected_hmac | rejected_rate_limit` → `denied`
+ *   - `error` → `error`
+ *
+ * `packId` is undefined — webhook auth is daemon-level. The
+ * `subscriptionId` (when present) lives in `detail` so per-subscription
+ * queries route via detail-JSON filter, not the indexed column.
+ */
+export function adaptWebhookServer(auditLog, now = Date.now) {
+    return (entry) => {
+        const { event, ...rest } = entry;
+        const detail = { event_subtype: event, ...rest };
+        void auditLog.append({
+            occurredAtMs: now(),
+            category: 'webhook',
+            decision: webhookDecision(event),
+            detail,
+        });
+    };
+}
+function webhookDecision(event) {
+    switch (event) {
+        case 'received':
+        case 'dispatched':
+        case 'idempotent':
+        case 'deliver_only':
+            return 'success';
+        case 'rejected_method':
+        case 'rejected_unknown':
+        case 'rejected_hmac':
+        case 'rejected_rate_limit':
+            return 'denied';
+        case 'error':
+            return 'error';
+        default: {
+            const _exhaustive = event;
+            // Defensive — unknown event shouldn't reach here. Map to 'error'
+            // so an unmapped variant surfaces as an alert rather than silently
+            // landing in `success`.
+            void _exhaustive;
+            return 'error';
+        }
+    }
+}
+/**
+ * DURABLE.4 resumer → unified audit.
+ *
+ * Mapping (per Patch B spec lock):
+ *   - `resume_run | resume_skipped | resume_summary` → `success`
+ *     (no current variant maps to `denied`; skips are normal control
+ *     flow — pack uninstalled / version diverged — not a security
+ *     verdict. `evaluator_error` skips ride along inside `resume_skipped`
+ *     and stay `success` at the audit-decision level; the `reason` field
+ *     in detail carries the discriminator.)
+ *
+ * `packId` is set when the variant carries one (`resume_run` has it;
+ * `resume_summary` and `resume_skipped` don't).
+ */
+export function adaptResumer(auditLog, now = Date.now) {
+    return (entry) => {
+        const { event, ...rest } = entry;
+        const detail = { event_subtype: event, ...rest };
+        const append = {
+            occurredAtMs: now(),
+            category: 'resume',
+            decision: 'success',
+            detail,
+        };
+        if (entry.event === 'resume_run')
+            append.packId = entry.packId;
+        void auditLog.append(append);
+    };
+}
+/**
+ * AUTO.6 inbound router → unified audit.
+ *
+ * Mapping per event variant:
+ *   - `inbound_dispatched | inbound_subscribed` → `success`
+ *   - `inbound_sender_denied` → `denied`
+ *   - `inbound_unmapped | inbound_no_adapter | inbound_adapter_not_inboundable
+ *      | inbound_dispatch_error` → `error`
+ *
+ * Uses the new `'channel_inbound'` category (Patch B extends
+ * `AuditCategory`); outbound channel sends remain on `'channel_send'`.
+ * `packId` pulls from `entry.pack` (every variant carries it via
+ * `AuditCommon`).
+ */
+export function adaptInboundRouter(auditLog, now = Date.now) {
+    return (entry) => {
+        const { event, pack, ...rest } = entry;
+        const detail = { event_subtype: event, ...rest };
+        void auditLog.append({
+            occurredAtMs: now(),
+            category: 'channel_inbound',
+            decision: inboundDecision(event),
+            packId: pack,
+            detail,
+        });
+    };
+}
+function inboundDecision(event) {
+    switch (event) {
+        case 'inbound_dispatched':
+        case 'inbound_subscribed':
+            return 'success';
+        case 'inbound_sender_denied':
+            return 'denied';
+        case 'inbound_unmapped':
+        case 'inbound_no_adapter':
+        case 'inbound_adapter_not_inboundable':
+        case 'inbound_dispatch_error':
+            return 'error';
+        default: {
+            const _exhaustive = event;
+            void _exhaustive;
+            return 'error';
+        }
+    }
+}
+//# sourceMappingURL=audit_adapters.js.map

package/dist/runtime/audit_adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit_adapters.js","sourceRoot":"","sources":["../../src/runtime/audit_adapters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAqBH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAkB,EAClB,MAAa,IAAI,CAAC,GAAG;IAErB,OAAO,CAAC,OAA0B,EAAE,GAAsB,EAAQ,EAAE;QAClE,MAAM,MAAM,GAA4B;YACtC,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QACpE,KAAK,QAAQ,CAAC,MAAM,CAAC;YACnB,YAAY,EAAE,GAAG,EAAE;YACnB,QAAQ,EAAE,iBAAiB;YAC3B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YAChD,MAAM,EAAE,GAAG,CAAC,IAAI;YAChB,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAkB,EAAE,MAAa,IAAI,CAAC,GAAG;IAC1E,OAAO,CAAC,KAAwB,EAAQ,EAAE;QACxC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QACjC,MAAM,MAAM,GAA4B,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;QAC1E,KAAK,QAAQ,CAAC,MAAM,CAAC;YACnB,YAAY,EAAE,GAAG,EAAE;YACnB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC;YAChC,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAiC;IACxD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY,CAAC;QAClB,KAAK,YAAY,CAAC;QAClB,KAAK,cAAc;YACjB,OAAO,SAAS,CAAC;QACnB,KAAK,iBAAiB,CAAC;QACvB,KAAK,kBAAkB,CAAC;QACxB,KAAK,eAAe,CAAC;QACrB,KAAK,qBAAqB;YACxB,OAAO,QAAQ,CAAC;QAClB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,KAAK,CAAC;YACjC,iEAAiE;YACjE,mEAAmE;YACnE,wBAAwB;YACxB,KAAK,WAAW,CAAC;YACjB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,MAAa,IAAI,CAAC,GAAG;IACpE,OAAO,CAAC,KAAwB,EAAQ,EAAE;QACxC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QACjC,MAAM,MAAM,GAA4B,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAe;YACzB,YAAY,EAAE,GAAG,EAAE;YACnB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,SAAS;YACnB,MAAM;SACP,CAAC;QACF,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY;YAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/D,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAkB,EAClB,MAAa,IAAI,CAAC,GAAG;IAErB,OAAO,CAAC,KAA8B,EAAQ,EAAE;QAC9C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QACvC,MAAM,MAAM,GAA4B,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;QAC1E,KAAK,QAAQ,CAAC,MAAM,CAAC;YACnB,YAAY,EAAE,GAAG,EAAE;YACnB,QAAQ,EAAE,iBAAiB;YAC3B,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC;YAChC,MAAM,EAAE,IAAI;YACZ,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAuC;IAC9D,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,oBAAoB,CAAC;QAC1B,KAAK,oBAAoB;YACvB,OAAO,SAAS,CAAC;QACnB,KAAK,uBAAuB;YAC1B,OAAO,QAAQ,CAAC;QAClB,KAAK,kBAAkB,CAAC;QACxB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,iCAAiC,CAAC;QACvC,KAAK,wBAAwB;YAC3B,OAAO,OAAO,CAAC;QACjB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,KAAK,CAAC;YACjC,KAAK,WAAW,CAAC;YACjB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/runtime/audit_log.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Unified audit log (CLI.5).
+ *
+ * Single libsql `audit_log` table consolidating every audit-emit point
+ * in the daemon: AUTO.3 capability gate, SCHED.1 webhook server,
+ * SCHED.x schedule fires, DURABLE.4 resumer, channel_send, and the
+ * SEC.6 queued-shell-exec approval loop (`pending_shell` — the only
+ * category whose rows mutate post-write via `transitionPending`).
+ *
+ * Discipline:
+ *   - `detail_json` carries the category-specific payload — NEVER PII.
+ *     Producers MUST pre-hash sensitive values via `hashDetailValue`
+ *     (signing secrets, bearer tokens, URLs with creds). See per-
+ *     category callsites for the hash boundary.
+ *   - `(category, occurred_at_ms)` index covers every time-windowed
+ *     query the CLI exposes (sub-100ms/1M rows acceptance criterion).
+ *   - Pending approval: `transitionPending` is a single UPDATE WHERE
+ *     decision='prompted' — SQLite-atomic, so two racing approvals
+ *     yield exactly one `rowsAffected === 1`; the loser refuses to
+ *     fire the queued shell_exec twice.
+ *   - Tail: libsql has no CDC; polling cursor over `occurred_at_ms`,
+ *     exits on `signal.aborted`. Same posture as TraceReader.tail.
+ */
+import type { Client } from '@libsql/client';
+/** Locked category enum. `pending_shell` is the only mutable category.
+ *  `channel_inbound` (Patch B) is the inbound-routing counterpart of
+ *  `channel_send` — outbound stays `channel_send`. */
+export type AuditCategory = 'capability_gate' | 'webhook' | 'schedule' | 'resume' | 'channel_send' | 'channel_inbound' | 'pending_shell';
+/** Locked decision enum. `prompted` + `approved` + `rejected` are reserved
+ *  for the `pending_shell` state machine. */
+export type AuditDecision = 'allowed' | 'denied' | 'prompted' | 'success' | 'error' | 'approved' | 'rejected';
+export interface AuditEntry {
+    occurredAtMs: number;
+    category: AuditCategory;
+    decision: AuditDecision;
+    packId?: string;
+    skill?: string;
+    ruleId?: string;
+    /** Category-specific payload. Sensitive values MUST be pre-hashed. */
+    detail: Record<string, unknown>;
+}
+/** Read-back row — carries `id` so `approve/reject <id>` have a handle. */
+export interface AuditRow extends AuditEntry {
+    id: number;
+}
+export interface QueryOpts {
+    sinceMs?: number;
+    category?: AuditCategory;
+    decision?: AuditDecision;
+    /** Cap result set; default 100. `Number.POSITIVE_INFINITY` → no cap. */
+    limit?: number;
+}
+export interface TailOpts {
+    /** Cursor — only rows with `occurred_at_ms > sinceMs` are emitted. */
+    sinceMs?: number;
+    intervalMs?: number;
+    signal?: AbortSignal;
+    category?: AuditCategory;
+}
+export declare class AuditLog {
+    private readonly db;
+    private initialized;
+    constructor(db: Client);
+    /** Idempotent DDL — same posture as CheckpointStore.init (DURABLE.1). */
+    init(): Promise<void>;
+    /** Append one entry. `detail` is JSON-encoded as-is — producers pre-hash
+     *  sensitive fields via `hashDetailValue` (the log doesn't know which). */
+    append(entry: AuditEntry): Promise<void>;
+    /** Time-windowed query. `idx_audit_occurred_category` covers category +
+     *  sinceMs; decision is a post-index filter. Returns newest-first. */
+    query(opts?: QueryOpts): Promise<AuditRow[]>;
+    /** Live tail. Polling cursor over `occurred_at_ms`. Exits on
+     *  `signal.aborted` — caller owns the AbortController so SIGINT cleans
+     *  up cleanly (see audit.ts tail action). */
+    tail(opts?: TailOpts): Promise<AsyncIterable<AuditRow>>;
+    /** Atomic `prompted → approved|rejected` transition. Returns `true` on
+     *  the single winning row (`rowsAffected === 1`); `false` when the row
+     *  is already resolved (race loser) or doesn't exist. */
+    transitionPending(id: number, to: 'approved' | 'rejected'): Promise<boolean>;
+}
+/** Hash a sensitive raw value for `detail` (SHA-256, first 16 hex chars).
+ *  Use for: signing secrets, bearer tokens, URLs with query-string creds,
+ *  any value that could leak PII downstream. Not invertible. */
+export declare function hashDetailValue(raw: string): string;
+//# sourceMappingURL=audit_log.d.ts.map

package/dist/runtime/audit_log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit_log.d.ts","sourceRoot":"","sources":["../../src/runtime/audit_log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C;;sDAEsD;AACtD,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,SAAS,GACT,UAAU,GACV,QAAQ,GACR,cAAc,GACd,iBAAiB,GACjB,eAAe,CAAC;AAEpB;6CAC6C;AAC7C,MAAM,MAAM,aAAa,GACrB,SAAS,GACT,QAAQ,GACR,UAAU,GACV,SAAS,GACT,OAAO,GACP,UAAU,GACV,UAAU,CAAC;AAEf,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,2EAA2E;AAC3E,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAwBD,qBAAa,QAAQ;IAGP,OAAO,CAAC,QAAQ,CAAC,EAAE;IAF/B,OAAO,CAAC,WAAW,CAAS;gBAEC,EAAE,EAAE,MAAM;IAEvC,yEAAyE;IACnE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B;+EAC2E;IACrE,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB9C;0EACsE;IAChE,KAAK,CAAC,IAAI,GAAE,SAAc,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAmCtD;;iDAE6C;IACvC,IAAI,CAAC,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAoCjE;;6DAEyD;IACnD,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;CAUnF;AAED;;gEAEgE;AAChE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD"}

package/dist/runtime/audit_log.js

@@ -0,0 +1,215 @@
+/**
+ * Unified audit log (CLI.5).
+ *
+ * Single libsql `audit_log` table consolidating every audit-emit point
+ * in the daemon: AUTO.3 capability gate, SCHED.1 webhook server,
+ * SCHED.x schedule fires, DURABLE.4 resumer, channel_send, and the
+ * SEC.6 queued-shell-exec approval loop (`pending_shell` — the only
+ * category whose rows mutate post-write via `transitionPending`).
+ *
+ * Discipline:
+ *   - `detail_json` carries the category-specific payload — NEVER PII.
+ *     Producers MUST pre-hash sensitive values via `hashDetailValue`
+ *     (signing secrets, bearer tokens, URLs with creds). See per-
+ *     category callsites for the hash boundary.
+ *   - `(category, occurred_at_ms)` index covers every time-windowed
+ *     query the CLI exposes (sub-100ms/1M rows acceptance criterion).
+ *   - Pending approval: `transitionPending` is a single UPDATE WHERE
+ *     decision='prompted' — SQLite-atomic, so two racing approvals
+ *     yield exactly one `rowsAffected === 1`; the loser refuses to
+ *     fire the queued shell_exec twice.
+ *   - Tail: libsql has no CDC; polling cursor over `occurred_at_ms`,
+ *     exits on `signal.aborted`. Same posture as TraceReader.tail.
+ */
+import { createHash } from 'node:crypto';
+const CREATE_TABLE_SQL = `
+  CREATE TABLE IF NOT EXISTS audit_log (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    occurred_at_ms INTEGER NOT NULL,
+    category TEXT NOT NULL,
+    decision TEXT NOT NULL,
+    pack_id TEXT,
+    skill TEXT,
+    rule_id TEXT,
+    detail_json TEXT NOT NULL
+  );
+`;
+const CREATE_INDEX_SQL = `
+  CREATE INDEX IF NOT EXISTS idx_audit_occurred_category
+    ON audit_log(category, occurred_at_ms);
+`;
+const DEFAULT_TAIL_INTERVAL_MS = 1000;
+const MIN_TAIL_INTERVAL_MS = 100;
+const DEFAULT_QUERY_LIMIT = 100;
+export class AuditLog {
+    db;
+    initialized = false;
+    constructor(db) {
+        this.db = db;
+    }
+    /** Idempotent DDL — same posture as CheckpointStore.init (DURABLE.1). */
+    async init() {
+        if (this.initialized)
+            return;
+        await this.db.execute(CREATE_TABLE_SQL);
+        await this.db.execute(CREATE_INDEX_SQL);
+        this.initialized = true;
+    }
+    /** Append one entry. `detail` is JSON-encoded as-is — producers pre-hash
+     *  sensitive fields via `hashDetailValue` (the log doesn't know which). */
+    async append(entry) {
+        await this.init();
+        await this.db.execute({
+            sql: `INSERT INTO audit_log
+              (occurred_at_ms, category, decision, pack_id, skill, rule_id, detail_json)
+            VALUES (?, ?, ?, ?, ?, ?, ?)`,
+            args: [
+                entry.occurredAtMs,
+                entry.category,
+                entry.decision,
+                entry.packId ?? null,
+                entry.skill ?? null,
+                entry.ruleId ?? null,
+                JSON.stringify(entry.detail),
+            ],
+        });
+    }
+    /** Time-windowed query. `idx_audit_occurred_category` covers category +
+     *  sinceMs; decision is a post-index filter. Returns newest-first. */
+    async query(opts = {}) {
+        await this.init();
+        const filters = [];
+        const args = [];
+        if (opts.category !== undefined) {
+            filters.push('category = ?');
+            args.push(opts.category);
+        }
+        if (opts.sinceMs !== undefined) {
+            filters.push('occurred_at_ms >= ?');
+            args.push(opts.sinceMs);
+        }
+        if (opts.decision !== undefined) {
+            filters.push('decision = ?');
+            args.push(opts.decision);
+        }
+        const where = filters.length > 0 ? `WHERE ${filters.join(' AND ')}` : '';
+        const limit = opts.limit === undefined
+            ? DEFAULT_QUERY_LIMIT
+            : Number.isFinite(opts.limit)
+                ? opts.limit
+                : -1;
+        const limitClause = limit > 0 ? `LIMIT ${String(Math.floor(limit))}` : '';
+        const rs = await this.db.execute({
+            sql: `SELECT id, occurred_at_ms, category, decision, pack_id, skill, rule_id, detail_json
+            FROM audit_log
+            ${where}
+            ORDER BY occurred_at_ms DESC, id DESC
+            ${limitClause}`,
+            args,
+        });
+        return rs.rows.map(rowToAuditRow);
+    }
+    /** Live tail. Polling cursor over `occurred_at_ms`. Exits on
+     *  `signal.aborted` — caller owns the AbortController so SIGINT cleans
+     *  up cleanly (see audit.ts tail action). */
+    async tail(opts = {}) {
+        await this.init();
+        const interval = Math.max(MIN_TAIL_INTERVAL_MS, opts.intervalMs ?? DEFAULT_TAIL_INTERVAL_MS);
+        let cursor = opts.sinceMs ?? Date.now();
+        const category = opts.category;
+        const signal = opts.signal;
+        const db = this.db;
+        async function* gen() {
+            while (!signal?.aborted) {
+                const filters = ['occurred_at_ms > ?'];
+                const args = [cursor];
+                if (category !== undefined) {
+                    filters.push('category = ?');
+                    args.push(category);
+                }
+                const rs = await db.execute({
+                    sql: `SELECT id, occurred_at_ms, category, decision, pack_id, skill, rule_id, detail_json
+                FROM audit_log
+                WHERE ${filters.join(' AND ')}
+                ORDER BY occurred_at_ms ASC, id ASC`,
+                    args,
+                });
+                for (const r of rs.rows) {
+                    const row = rowToAuditRow(r);
+                    if (row.occurredAtMs > cursor)
+                        cursor = row.occurredAtMs;
+                    yield row;
+                }
+                if (signal?.aborted)
+                    return;
+                await sleep(interval, signal);
+            }
+        }
+        return gen();
+    }
+    /** Atomic `prompted → approved|rejected` transition. Returns `true` on
+     *  the single winning row (`rowsAffected === 1`); `false` when the row
+     *  is already resolved (race loser) or doesn't exist. */
+    async transitionPending(id, to) {
+        await this.init();
+        const rs = await this.db.execute({
+            sql: `UPDATE audit_log
+            SET decision = ?
+            WHERE id = ? AND category = 'pending_shell' AND decision = 'prompted'`,
+            args: [to, id],
+        });
+        return Number(rs.rowsAffected) === 1;
+    }
+}
+/** Hash a sensitive raw value for `detail` (SHA-256, first 16 hex chars).
+ *  Use for: signing secrets, bearer tokens, URLs with query-string creds,
+ *  any value that could leak PII downstream. Not invertible. */
+export function hashDetailValue(raw) {
+    return createHash('sha256').update(raw).digest('hex').slice(0, 16);
+}
+// Row → AuditRow. libsql cells narrow through Record<string, unknown>.
+function rowToAuditRow(row) {
+    const r = row;
+    const detailJson = typeof r.detail_json === 'string' ? r.detail_json : '{}';
+    let detail = {};
+    try {
+        const parsed = JSON.parse(detailJson);
+        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+            detail = parsed;
+        }
+    }
+    catch {
+        /* malformed JSON → empty detail (defensive — INSERT path always
+           writes valid JSON; only corruption could reach this branch). */
+    }
+    const out = {
+        id: Number(r.id),
+        occurredAtMs: Number(r.occurred_at_ms),
+        category: String(r.category),
+        decision: String(r.decision),
+        detail,
+    };
+    if (typeof r.pack_id === 'string')
+        out.packId = r.pack_id;
+    if (typeof r.skill === 'string')
+        out.skill = r.skill;
+    if (typeof r.rule_id === 'string')
+        out.ruleId = r.rule_id;
+    return out;
+}
+function sleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal?.aborted)
+            return resolve();
+        const onAbort = () => {
+            clearTimeout(timer);
+            resolve();
+        };
+        const timer = setTimeout(() => {
+            signal?.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
+//# sourceMappingURL=audit_log.js.map

package/dist/runtime/audit_log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit_log.js","sourceRoot":"","sources":["../../src/runtime/audit_log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA2DzC,MAAM,gBAAgB,GAAG;;;;;;;;;;;CAWxB,CAAC;AAEF,MAAM,gBAAgB,GAAG;;;CAGxB,CAAC;AAEF,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,MAAM,OAAO,QAAQ;IAGU;IAFrB,WAAW,GAAG,KAAK,CAAC;IAE5B,YAA6B,EAAU;QAAV,OAAE,GAAF,EAAE,CAAQ;IAAG,CAAC;IAE3C,yEAAyE;IACzE,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAC7B,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;+EAC2E;IAC3E,KAAK,CAAC,MAAM,CAAC,KAAiB;QAC5B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;YACpB,GAAG,EAAE;;yCAE8B;YACnC,IAAI,EAAE;gBACJ,KAAK,CAAC,YAAY;gBAClB,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,MAAM,IAAI,IAAI;gBACpB,KAAK,CAAC,KAAK,IAAI,IAAI;gBACnB,KAAK,CAAC,MAAM,IAAI,IAAI;gBACpB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;aAC7B;SACF,CAAC,CAAC;IACL,CAAC;IAED;0EACsE;IACtE,KAAK,CAAC,KAAK,CAAC,OAAkB,EAAE;QAC9B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAwB,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,SAAS;YACtB,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC3B,CAAC,CAAC,IAAI,CAAC,KAAK;gBACZ,CAAC,CAAC,CAAC,CAAC,CAAC;QACX,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;YAC/B,GAAG,EAAE;;cAEG,KAAK;;cAEL,WAAW,EAAE;YACrB,IAAI;SACL,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACpC,CAAC;IAED;;iDAE6C;IAC7C,KAAK,CAAC,IAAI,CAAC,OAAiB,EAAE;QAC5B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,UAAU,IAAI,wBAAwB,CAAC,CAAC;QAC7F,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAEnB,KAAK,SAAS,CAAC,CAAC,GAAG;YACjB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAa,CAAC,oBAAoB,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAwB,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtB,CAAC;gBACD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;oBAC1B,GAAG,EAAE;;wBAES,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;oDACO;oBAC1C,IAAI;iBACL,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;oBACxB,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;oBAC7B,IAAI,GAAG,CAAC,YAAY,GAAG,MAAM;wBAAE,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;oBACzD,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,IAAI,MAAM,EAAE,OAAO;oBAAE,OAAO;gBAC5B,MAAM,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IAED;;6DAEyD;IACzD,KAAK,CAAC,iBAAiB,CAAC,EAAU,EAAE,EAA2B;QAC7D,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;YAC/B,GAAG,EAAE;;kFAEuE;YAC5E,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;CACF;AAED;;gEAEgE;AAChE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,uEAAuE;AACvE,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,IAAI,MAAM,GAA4B,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,MAAM,GAAG,MAAiC,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP;0EACkE;IACpE,CAAC;IACD,MAAM,GAAG,GAAa;QACpB,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAkB;QAC7C,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAkB;QAC7C,MAAM;KACP,CAAC;IACF,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1D,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACrD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,OAAO,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/auto_correct.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Auto-correct drift policy runtime (AUTO.4).
+ *
+ * Authoritative source: `docs/tasks/automation.md` AUTO.4.
+ *
+ * Lifecycle of an `auto_correct` verdict:
+ *   1. Drift dispatcher emits `RuntimeAction{kind:'auto_correct', correctiveSkill, verdict}`.
+ *   2. Caller invokes `runAutoCorrect()` with pack + evaluator + capability gate
+ *      + a re-eval thunk for the offending rule.
+ *   3. Capability gate fires FIRST (`subagent_call` for `correctiveSkill`).
+ *      Gate denied → no invocation; fall-through descriptor returned.
+ *   4. Corrective skill's process runs via the evaluator. Process error or
+ *      drift verdict from the corrective skill itself → fall-through.
+ *   5. Re-eval original rule. Drift persists → fall-through. Pass → emit a
+ *      "corrected" pass verdict for the audit trail.
+ *
+ * LOOP CAP — 1 ATTEMPT MAX (locked).
+ *   If the corrective skill (or the re-eval) ITSELF produces drift, we do
+ *   NOT recurse — we return a fall-through descriptor so the caller routes
+ *   to `notify_pause` / `escalate`. The cap is structural: no `attemptCount`
+ *   parameter is accepted; there is no second attempt path to count to.
+ *
+ * NO SILENT FAIL-OPEN (C10):
+ *   Every failure mode returns `corrected: false` with a structured
+ *   `fallthrough` descriptor carrying a human-readable reason. The caller
+ *   MUST route this to `notify_pause`. Function never silently swallows.
+ *
+ * Engine-vocabulary: pack / skill / verdict / capability only.
+ */
+import type { FunctionRegistry, EvalCtx } from '../functions/registry.js';
+import type { CapabilityGate } from './capability_gate.js';
+import type { MessageVerdict as Verdict, Pack, RuleResult } from './types.js';
+/**
+ * `corrected: true` ⇒ caller treats the original verdict as resolved.
+ * `correctionVerdict` carries a synthetic pass verdict for audit logs.
+ *
+ * `corrected: false` ⇒ caller MUST route to `notify_pause` (or `escalate`)
+ * using `fallthrough.reason`. Loop cap forbids a second auto-correct.
+ */
+export interface AutoCorrectResult {
+    corrected: boolean;
+    correctionVerdict: Verdict | null;
+    fallthrough?: {
+        reason: string;
+        kind: 'capability_denied' | 'corrective_skill_missing' | 'corrective_skill_drift' | 'corrective_skill_error' | 'reeval_persistent_drift' | 'reeval_error';
+    };
+}
+export interface AutoCorrectDeps {
+    pack: Pack;
+    correctiveSkill: string;
+    verdict: Verdict;
+    evalCtx: EvalCtx;
+    registry: FunctionRegistry;
+    capabilityGate: CapabilityGate;
+    /**
+     * Re-evaluate the rule that originally produced `verdict`. Caller owns
+     * the thunk — the rule reference lives in the dispatcher layer, not here.
+     */
+    reevaluateOriginalRule: () => Promise<RuleResult>;
+}
+/**
+ * Single linear pipeline (no recursion, no retry). Audit reads as: 1
+ * capability check → 1 skill invocation → 1 re-eval → done. Every
+ * fall-through path returns immediately.
+ */
+export declare function runAutoCorrect(deps: AutoCorrectDeps): Promise<AutoCorrectResult>;
+//# sourceMappingURL=auto_correct.d.ts.map

package/dist/runtime/auto_correct.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto_correct.d.ts","sourceRoot":"","sources":["../../src/runtime/auto_correct.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAE1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,KAAK,EAAE,cAAc,IAAI,OAAO,EAAE,IAAI,EAAe,UAAU,EAAS,MAAM,YAAY,CAAC;AAElG;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EACA,mBAAmB,GACnB,0BAA0B,GAC1B,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,GACzB,cAAc,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B;;;OAGG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;CACnD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA8FtF"}