pi-codex-auto-review 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1.  Definitions.
+
+    "License" shall mean the terms and conditions for use, reproduction,
+    and distribution as defined by Sections 1 through 9 of this document.
+
+    "Licensor" shall mean the copyright owner or entity authorized by
+    the copyright owner that is granting the License.
+
+    "Legal Entity" shall mean the union of the acting entity and all
+    other entities that control, are controlled by, or are under common
+    control with that entity. For the purposes of this definition,
+    "control" means (i) the power, direct or indirect, to cause the
+    direction or management of such entity, whether by contract or
+    otherwise, or (ii) ownership of fifty percent (50%) or more of the
+    outstanding shares, or (iii) beneficial ownership of such entity.
+
+    "You" (or "Your") shall mean an individual or Legal Entity
+    exercising permissions granted by this License.
+
+    "Source" form shall mean the preferred form for making modifications,
+    including but not limited to software source code, documentation
+    source, and configuration files.
+
+    "Object" form shall mean any form resulting from mechanical
+    transformation or translation of a Source form, including but
+    not limited to compiled object code, generated documentation,
+    and conversions to other media types.
+
+    "Work" shall mean the work of authorship, whether in Source or
+    Object form, made available under the License, as indicated by a
+    copyright notice that is included in or attached to the work
+    (an example is provided in the Appendix below).
+
+    "Derivative Works" shall mean any work, whether in Source or Object
+    form, that is based on (or derived from) the Work and for which the
+    editorial revisions, annotations, elaborations, or other modifications
+    represent, as a whole, an original work of authorship. For the purposes
+    of this License, Derivative Works shall not include works that remain
+    separable from, or merely link (or bind by name) to the interfaces of,
+    the Work and Derivative Works thereof.
+
+    "Contribution" shall mean any work of authorship, including
+    the original version of the Work and any modifications or additions
+    to that Work or Derivative Works thereof, that is intentionally
+    submitted to Licensor for inclusion in the Work by the copyright owner
+    or by an individual or Legal Entity authorized to submit on behalf of
+    the copyright owner. For the purposes of this definition, "submitted"
+    means any form of electronic, verbal, or written communication sent
+    to the Licensor or its representatives, including but not limited to
+    communication on electronic mailing lists, source code control systems,
+    and issue tracking systems that are managed by, or on behalf of, the
+    Licensor for the purpose of discussing and improving the Work, but
+    excluding communication that is conspicuously marked or otherwise
+    designated in writing by the copyright owner as "Not a Contribution."
+
+    "Contributor" shall mean Licensor and any individual or Legal Entity
+    on behalf of whom a Contribution has been received by Licensor and
+    subsequently incorporated within the Work.
+
+2.  Grant of Copyright License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    copyright license to reproduce, prepare Derivative Works of,
+    publicly display, publicly perform, sublicense, and distribute the
+    Work and such Derivative Works in Source or Object form.
+
+3.  Grant of Patent License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    (except as stated in this section) patent license to make, have made,
+    use, offer to sell, sell, import, and otherwise transfer the Work,
+    where such license applies only to those patent claims licensable
+    by such Contributor that are necessarily infringed by their
+    Contribution(s) alone or by combination of their Contribution(s)
+    with the Work to which such Contribution(s) was submitted. If You
+    institute patent litigation against any entity (including a
+    cross-claim or counterclaim in a lawsuit) alleging that the Work
+    or a Contribution incorporated within the Work constitutes direct
+    or contributory patent infringement, then any patent licenses
+    granted to You under this License for that Work shall terminate
+    as of the date such litigation is filed.
+
+4.  Redistribution. You may reproduce and distribute copies of the
+    Work or Derivative Works thereof in any medium, with or without
+    modifications, and in Source or Object form, provided that You
+    meet the following conditions:
+
+    (a) You must give any other recipients of the Work or
+    Derivative Works a copy of this License; and
+
+    (b) You must cause any modified files to carry prominent notices
+    stating that You changed the files; and
+
+    (c) You must retain, in the Source form of any Derivative Works
+    that You distribute, all copyright, patent, trademark, and
+    attribution notices from the Source form of the Work,
+    excluding those notices that do not pertain to any part of
+    the Derivative Works; and
+
+    (d) If the Work includes a "NOTICE" text file as part of its
+    distribution, then any Derivative Works that You distribute must
+    include a readable copy of the attribution notices contained
+    within such NOTICE file, excluding those notices that do not
+    pertain to any part of the Derivative Works, in at least one
+    of the following places: within a NOTICE text file distributed
+    as part of the Derivative Works; within the Source form or
+    documentation, if provided along with the Derivative Works; or,
+    within a display generated by the Derivative Works, if and
+    wherever such third-party notices normally appear. The contents
+    of the NOTICE file are for informational purposes only and
+    do not modify the License. You may add Your own attribution
+    notices within Derivative Works that You distribute, alongside
+    or as an addendum to the NOTICE text from the Work, provided
+    that such additional attribution notices cannot be construed
+    as modifying the License.
+
+    You may add Your own copyright statement to Your modifications and
+    may provide additional or different license terms and conditions
+    for use, reproduction, or distribution of Your modifications, or
+    for any such Derivative Works as a whole, provided Your use,
+    reproduction, and distribution of the Work otherwise complies with
+    the conditions stated in this License.
+
+5.  Submission of Contributions. Unless You explicitly state otherwise,
+    any Contribution intentionally submitted for inclusion in the Work
+    by You to the Licensor shall be under the terms and conditions of
+    this License, without any additional terms or conditions.
+    Notwithstanding the above, nothing herein shall supersede or modify
+    the terms of any separate license agreement you may have executed
+    with Licensor regarding such Contributions.
+
+6.  Trademarks. This License does not grant permission to use the trade
+    names, trademarks, service marks, or product names of the Licensor,
+    except as required for reasonable and customary use in describing the
+    origin of the Work and reproducing the content of the NOTICE file.
+
+7.  Disclaimer of Warranty. Unless required by applicable law or
+    agreed to in writing, Licensor provides the Work (and each
+    Contributor provides its Contributions) on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+    implied, including, without limitation, any warranties or conditions
+    of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+    PARTICULAR PURPOSE. You are solely responsible for determining the
+    appropriateness of using or redistributing the Work and assume any
+    risks associated with Your exercise of permissions under this License.
+
+8.  Limitation of Liability. In no event and under no legal theory,
+    whether in tort (including negligence), contract, or otherwise,
+    unless required by applicable law (such as deliberate and grossly
+    negligent acts) or agreed to in writing, shall any Contributor be
+    liable to You for damages, including any direct, indirect, special,
+    incidental, or consequential damages of any character arising as a
+    result of this License or out of the use or inability to use the
+    Work (including but not limited to damages for loss of goodwill,
+    work stoppage, computer failure or malfunction, or any and all
+    other commercial damages or losses), even if such Contributor
+    has been advised of the possibility of such damages.
+
+9.  Accepting Warranty or Additional Liability. While redistributing
+    the Work or Derivative Works thereof, You may choose to offer,
+    and charge a fee for, acceptance of support, warranty, indemnity,
+    or other liability obligations and/or rights consistent with this
+    License. However, in accepting such obligations, You may act only
+    on Your own behalf and on Your sole responsibility, not on behalf
+    of any other Contributor, and only if You agree to indemnify,
+    defend, and hold each Contributor harmless for any liability
+    incurred by, or claims asserted against, such Contributor by reason
+    of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+Copyright 2025 OpenAI
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/NOTICE

@@ -0,0 +1,10 @@
+pi-codex-auto-review includes the execution policy library and guardian policy
+from OpenAI Codex, revision a956835d020762cb2b570053af06f643a11c0ecc.
+The upstream attribution notice is reproduced below.
+
+OpenAI Codex
+Copyright 2025 OpenAI
+
+This project includes code derived from [Ratatui](https://github.com/ratatui/ratatui), licensed under the MIT license.
+Copyright (c) 2016-2022 Florian Dehau
+Copyright (c) 2023-2025 The Ratatui Developers

package/README.md

@@ -0,0 +1,77 @@
+# pi-codex-auto-review
+
+Codex의 ‘Approve for me’에서 영감을 받은 Pi 자동 실행 승인 검토 확장입니다. Pi 도구 실행을 규칙과 현재 모델로 검토하고, 필요하면 사용자 승인을 요청합니다. Codex 공개 소스 [`rust-v0.160.0`](https://github.com/openai/codex/tree/a956835d020762cb2b570053af06f643a11c0ecc)의 실행 승인 동작을 참고한 독립 구현을 Pi 0.99.1의 공개 API와 운영체제 샌드박스에 연결했습니다. 설치·설정 방법은 [사용법](https://github.com/buYoung/pi-codex-auto-review/blob/HEAD/docs/usage.md) 문서에 있습니다.
+
+## 설치
+
+npm에 게시된 버전은 Pi에서 설치합니다. 배포 패키지는 macOS ARM64와 Linux x64용 규칙 엔진을 포함하며, 설치할 때 Rust 빌드가 필요하지 않습니다.
+
+```sh
+pi install npm:pi-codex-auto-review@0.1.0
+pi list
+```
+
+확장 로딩 실패를 Pi가 무시할 수 있으므로 보호 시작이 필수인 실행은 [사용법](https://github.com/buYoung/pi-codex-auto-review/blob/HEAD/docs/usage.md)의 CLI·SDK 진입점을 사용합니다. npm 게시를 위한 빌드와 계정 작업은 [배포 안내](https://github.com/buYoung/pi-codex-auto-review/blob/HEAD/docs/publishing.md)에 있습니다.
+
+## 동작 흐름
+
+1. **정책 판단** — 절대 차단 경로와 `commandRules`를 먼저 평가합니다. 차단 경로는 모델 검토나 저장 승인으로 해제하지 않습니다.
+2. **자동 검토** — 남은 작업은 현재 모델이 위험 등급과 결과를 판정합니다.
+3. **승인** — 남은 범위는 사용자가 확정합니다.
+4. **격리 실행** — 승인된 작업은 OS 샌드박스 안에서 실행합니다.
+
+## 요구 사항
+
+| 항목 | 요구 |
+| --- | --- |
+| Node.js | 22.19 이상 |
+| Pi | 0.99.1 (고정 버전) |
+| Rust | 소스 빌드에만 1.95 이상 필요 |
+| 운영체제 | npm 배포 대상은 macOS ARM64와 Linux x64. Windows는 네이티브 격리를 지원하지 않습니다 |
+
+## 보호 경계
+
+- 모드는 `workspace-write`(작업 공간과 기본 임시 경로 쓰기 허용)와 `read-only`입니다.
+- 제어·인증 경로와 프로젝트의 `.pi` 설정·확장 코드, 신뢰한 확장의 코드 디렉터리는 모델 쓰기를 절대 차단합니다.
+- 명령·인터프리터는 OS 격리 안에서 실행하고, 경계를 넘는 접근과 새 네트워크 목적지는 검토를 거칩니다.
+- 승인은 한 번, 세션, 규칙 저장 중 선택하며, 저장 승인은 정확한 도구·입력·정책에 묶입니다.
+- 자동 검토는 현재 모델로 수행하고, 반복 거부되면 실제 작업을 중단합니다. 검토 오류는 승인으로 바뀌지 않습니다.
+- MCP 도구 승인과 프로젝트 지침 탐색도 같은 신뢰·검토 경계 안에 둡니다.
+
+각 결합 조건과 설정은 [사용법](https://github.com/buYoung/pi-codex-auto-review/blob/HEAD/docs/usage.md) 문서에 있습니다.
+
+## 한계와 비보장
+
+- Pi와 명시적으로 신뢰한 확장은 제어 계층입니다. 같은 프로세스 확장 코드나 원격 MCP 서버 내부까지 이 샌드박스가 보호하지는 않습니다.
+- 하드링크 검사는 실행과 동시에 격리 밖 호스트 프로그램이 링크 구조를 바꾸는 공격까지 방어한다고 보장하지 않습니다.
+- Linux의 상위 디렉터리 쓰기 승인이 단일 파일 생성 권한과 완전히 같다고 보장하지 않습니다.
+- 이미 MCP 서버에 전달한 요청의 취소 효과는 외부 공급자의 구현에 달려 있습니다.
+- 공개 정책·흐름의 호환성 검증은 독점 Codex 모델과 모든 판단이 같다는 뜻이 아닙니다.
+- 별도로 설치한 Pi 호스트의 의존성을 자동으로 교체하지 않습니다. 이 저장소의 조치 근거는 [의존성 보안](https://github.com/buYoung/pi-codex-auto-review/blob/HEAD/docs/security/dependencies.md) 문서에 있습니다.
+
+## 검증
+
+```sh
+npm run verify:guard
+```
+
+`verify:guard`는 빌드와 전체 로컬 검증을 실행하고, 같은 소스의 `darwin-arm64`·`linux-x64` 전체 결과와 Linux x64 이미지의 실모델 결과를 하나로 묶습니다. 필요한 플랫폼 결과가 없거나 차단·실패·오래됐으면 종료 코드는 1입니다.
+
+- `npm run test:*` 단일 검증은 실제 자격 증명이나 유료 모델을 사용하지 않습니다. 환경 제한·의존성 부재는 통과로 처리하지 않습니다.
+- `npm run verify:platform`은 현재 운영체제의 전체 검증을 실행합니다.
+- GitHub Actions의 `자동 검토 운영체제 검증`은 실제 Linux x64 검사와 Docker 이미지·결과 반출을 수행합니다. workflow에는 Ollama 키를 전달하지 않습니다.
+- Windows의 `verify:windows`는 원본 규칙 엔진·승인 정책과 미지원 시작의 거부를 검증합니다.
+- Docker 컨테이너 검증 활용은 [사용법](https://github.com/buYoung/pi-codex-auto-review/blob/HEAD/docs/usage.md) 문서의 Docker 절에 있습니다.
+- 각 실행은 `.reports/pi-guard/runs/<실행 ID>/<플랫폼>/`에 저장되고, 보호·허용·차단 사례는 [보호 경계 검증표](https://github.com/buYoung/pi-codex-auto-review/blob/HEAD/docs/testing/auto-review-protection.md)에 있습니다.
+
+## 문서
+
+- [사용법](https://github.com/buYoung/pi-codex-auto-review/blob/HEAD/docs/usage.md) — 설치와 빌드, Pi 확장 등록, CLI·SDK, 정책 파일, 검증 활용
+- [배포 안내](https://github.com/buYoung/pi-codex-auto-review/blob/HEAD/docs/publishing.md) — 플랫폼별 패키지 준비와 수동 npm 게시
+- [의존성 보안](https://github.com/buYoung/pi-codex-auto-review/blob/HEAD/docs/security/dependencies.md) — 높은 심각도 감사 항목의 적용 근거와 재생성 방법
+- [보호 경계 검증표](https://github.com/buYoung/pi-codex-auto-review/blob/HEAD/docs/testing/auto-review-protection.md) — 보호·허용·검토 실패·취소 사례와 검증하지 않은 범위
+- [인계 자료](https://github.com/buYoung/pi-codex-auto-review/tree/HEAD/docs/handoffs/auto-review) — 플랫폼·실모델 검증의 실행 근거와 소스 해시. 새 변경의 완료 여부는 이 기준으로 확인합니다.
+
+## 라이선스
+
+[Apache-2.0](LICENSE). 포함된 Codex 코드와 정책의 출처 표시는 [NOTICE](NOTICE)와 `native/execpolicy/`의 LICENSE·NOTICE에 유지합니다.

package/dist/approvals.d.ts

@@ -0,0 +1,72 @@
+import { type Grant, type GuardAction, type PermissionDelta, type PolicyDecision, type ApprovalPolicy, type ReviewContext, type ReviewResult, type ExecutionAuthority } from './contracts.js';
+import { type Clock } from './signals.js';
+import { type ReviewProvider } from './reviewer.js';
+import { AuditLog } from './audit.js';
+import type { GuardSettings } from './policy/index.js';
+import { ReviewLifecycle } from './review/lifecycle.js';
+export type ApprovalChoice = 'deny' | 'once' | 'session' | 'persistent';
+export interface ApprovalUI {
+    select(action: GuardAction, delta: PermissionDelta, options: {
+        signal: AbortSignal;
+        timeoutMs: number;
+    }): Promise<ApprovalChoice | undefined>;
+}
+export interface GrantPersistence {
+    load(): Promise<Grant[]>;
+    save(grants: readonly Grant[]): Promise<void>;
+}
+export declare class FileGrantPersistence implements GrantPersistence {
+    readonly path: string;
+    constructor(path: string);
+    load(): Promise<Grant[]>;
+    save(grants: readonly Grant[]): Promise<void>;
+}
+export interface Admission {
+    readonly isAllowed: boolean;
+    readonly delta: PermissionDelta;
+    readonly reason: string;
+    readonly grant?: Grant;
+    readonly review?: ReviewResult;
+    readonly authority?: ExecutionAuthority;
+    readonly denialId?: string;
+}
+export declare class ApprovalManager {
+    readonly options: {
+        reviewTimeoutMs: number;
+        approvalTimeoutMs: number;
+        audit: AuditLog;
+        persistence?: GrantPersistence;
+        clock?: Clock;
+        approvalPolicy?: ApprovalPolicy;
+        approvalsReviewer?: 'auto_review' | 'user';
+    };
+    readonly lifecycle: ReviewLifecycle;
+    private grants;
+    private tail;
+    private epoch;
+    private sessionId?;
+    constructor(options: {
+        reviewTimeoutMs: number;
+        approvalTimeoutMs: number;
+        audit: AuditLog;
+        persistence?: GrantPersistence;
+        clock?: Clock;
+        approvalPolicy?: ApprovalPolicy;
+        approvalsReviewer?: 'auto_review' | 'user';
+    });
+    initialize(): Promise<void>;
+    reset(sessionId?: string): void;
+    invalidate(): void;
+    admit(action: GuardAction, policy: PolicyDecision, context: {
+        provider: ReviewProvider;
+        ui?: ApprovalUI;
+        trustedAuthorization: string;
+        signal?: AbortSignal;
+        reviewContext?: ReviewContext;
+        settings?: GuardSettings;
+        onReviewStart?: () => void;
+        onReviewResult?: (result?: ReviewResult) => void;
+        onInterrupt?: () => void;
+    }): Promise<Admission>;
+    settle(): Promise<void>;
+}

package/dist/approvals.js

@@ -0,0 +1,167 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, writeFile, rm } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { canonicalJson, immutable, ruleDigest, approvalEligible, GuardError, EMPTY_DELTA } from './contracts.js';
+import { deadlineSignal, withSignal } from './signals.js';
+import { reviewAction } from './reviewer.js';
+import { ReviewLifecycle } from './review/lifecycle.js';
+import { digest } from './contracts.js';
+export class FileGrantPersistence {
+    path;
+    constructor(path) {
+        this.path = path;
+    }
+    async load() {
+        try {
+            const data = JSON.parse(await readFile(this.path, 'utf8'));
+            if (!Array.isArray(data) || data.some(value => !value || value.scope !== 'persistent' || typeof value.ruleDigest !== 'string' || typeof value.policyRevision !== 'string' || typeof value.permissionDigest !== 'string' || !value.delta || !['readPaths', 'writePaths', 'domains'].every(key => Array.isArray(value.delta[key]) && value.delta[key].every((x) => typeof x === 'string'))))
+                throw new Error('Invalid persistent rules');
+            return immutable(data);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw new GuardError('INVALID_GRANTS', 'Persistent rules could not be loaded', { cause: error });
+        }
+    }
+    async save(grants) {
+        await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+        const temp = `${this.path}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(temp, canonicalJson(grants) + '\n', { mode: 0o600, flag: 'wx' });
+            await rename(temp, this.path);
+        }
+        finally {
+            await rm(temp, { force: true });
+        }
+    }
+}
+export class ApprovalManager {
+    options;
+    lifecycle = new ReviewLifecycle();
+    grants = [];
+    tail = Promise.resolve();
+    epoch = new AbortController();
+    sessionId;
+    constructor(options) {
+        this.options = options;
+    }
+    async initialize() { this.grants = await this.options.persistence?.load() ?? []; }
+    reset(sessionId) {
+        this.epoch.abort(new GuardError('SESSION_CHANGED', 'Session changed'));
+        this.epoch = new AbortController();
+        this.sessionId = sessionId;
+        this.grants = this.grants.filter(grant => grant.scope === 'persistent');
+        this.lifecycle.reset();
+    }
+    invalidate() { this.reset(this.sessionId); this.grants = []; }
+    async admit(action, policy, context) {
+        this.sessionId ??= action.sessionId;
+        const signal = AbortSignal.any([this.epoch.signal, ...(action.source === 'user-bash' ? [] : [this.lifecycle.signal]), ...(context.signal ? [context.signal] : [])]);
+        const deny = (reason) => ({ isAllowed: false, delta: EMPTY_DELTA, reason });
+        if (signal.aborted || action.sessionId !== this.sessionId)
+            return deny('Cancelled or stale session');
+        if (policy.actionDigest !== action.digest || policy.kind === 'deny' || policy.isHardDeny) {
+            await this.options.audit.record(action, 'policy', 'deny');
+            return deny(policy.reason);
+        }
+        if (policy.authority && policy.authority.actionDigest !== action.digest)
+            return deny('Authority belongs to another action');
+        if (policy.kind === 'allow') {
+            await this.options.audit.record(action, 'policy', 'allow');
+            return { isAllowed: true, delta: policy.delta, authority: policy.authority, reason: policy.reason };
+        }
+        if (!approvalEligible(this.options.approvalPolicy ?? 'on-request', policy.approvalCategory ?? 'sandbox'))
+            return deny('Approval policy disables this request category');
+        const obsolete = this.grants.filter(grant => grant.permissionDigest !== action.permissionDigest || grant.policyRevision !== action.policyRevision);
+        if (obsolete.length) {
+            this.grants = this.grants.filter(grant => !obsolete.includes(grant));
+            await this.options.audit.record(action, 'grant', 'invalidated-policy-or-profile');
+        }
+        const contextId = context.reviewContext?.contextId ?? 'legacy';
+        const retry = this.lifecycle.consumeRetry(action, contextId);
+        let reviewContext = context.reviewContext;
+        if (retry && reviewContext) {
+            const fields = { ...reviewContext, items: [...reviewContext.items, { id: retry.id, source: 'user-confirmation', trust: 'authorization', content: { type: 'exact-action-retry-approval', actionIdentity: retry.actionIdentity, denialId: retry.denialId, scope: 'one retry; fresh policy review required' } }] };
+            reviewContext = immutable({ ...fields, digest: digest(fields) });
+            await this.options.audit.record(action, 'retry', 'consumed');
+        }
+        const cached = retry || policy.requiresFreshReview || policy.requiresUserInput || policy.authority?.kind === 'reviewed-command' ? undefined : this.grants.find(grant => grant.ruleDigest === ruleDigest(action) && grant.permissionDigest === action.permissionDigest && grant.policyRevision === action.policyRevision && (grant.scope === 'persistent' || grant.sessionId === action.sessionId));
+        if (cached) {
+            this.lifecycle.record(action, contextId);
+            await this.options.audit.record(action, 'grant', cached.scope);
+            return { isAllowed: true, delta: cached.delta, grant: cached, reason: 'Bound rule authorized the action' };
+        }
+        context.onReviewStart?.();
+        const review = this.options.approvalsReviewer === 'user' || policy.requiresUserInput ? { decision: 'ask', reason: 'User review requested', result: undefined } : await reviewAction({ action, policyDecision: policy, provider: context.provider, trustedAuthorization: context.trustedAuthorization, hasUI: Boolean(context.ui), signal, timeoutMs: this.options.reviewTimeoutMs, clock: this.options.clock, context: reviewContext, settings: context.settings });
+        context.onReviewResult?.(review.result);
+        if (signal.aborted)
+            return { ...deny('Call cancelled'), review: review.result };
+        const recorded = this.lifecycle.record(action, contextId, review.result);
+        if (recorded.shouldInterrupt)
+            context.onInterrupt?.();
+        if (review.result)
+            await this.options.audit.recordReview(action, review.result);
+        if (review.decision === 'deny')
+            return { ...deny(review.reason), review: review.result, denialId: recorded.denialId };
+        if (review.decision === 'allow') {
+            if (signal.aborted)
+                return deny('Turn interrupted before approval could execute');
+            if (review.result && (review.result.status !== 'approved' || review.result.actionDigest !== action.digest || reviewContext && review.result.contextDigest !== reviewContext.digest))
+                return deny('Review result does not match the bound action and context');
+            if (!review.result && policy.authority?.kind === 'reviewed-command')
+                return deny('Full command approval requires a structured assessment');
+            await this.options.audit.record(action, 'review', 'approved');
+            return { isAllowed: true, delta: policy.delta, authority: policy.authority ?? { kind: 'scoped-permissions', actionDigest: action.digest }, reason: review.reason, review: review.result };
+        }
+        if (!context.ui)
+            return deny('Approval UI unavailable');
+        const ui = context.ui;
+        // Queue all dialogs, including compensated persistence, until this decision settles.
+        const pending = this.tail.then(async () => {
+            if (signal.aborted)
+                return deny('Queued approval cancelled');
+            const deadline = deadlineSignal(signal, this.options.approvalTimeoutMs, this.options.clock);
+            try {
+                const choice = await withSignal(ui.select(action, policy.delta, { signal: deadline.signal, timeoutMs: this.options.approvalTimeoutMs }), deadline.signal);
+                deadline.signal.throwIfAborted();
+                if (!choice || choice === 'deny')
+                    return deny('User denied the action');
+                if (!['once', 'session', 'persistent'].includes(choice))
+                    return deny('Invalid approval scope');
+                if (choice === 'persistent' && !this.options.persistence)
+                    return deny('Persistent rules are unavailable');
+                if (policy.authority?.kind === 'reviewed-command' && choice !== 'once')
+                    return deny('Full command authority can only be approved for one invocation');
+                if ((policy.requiresFreshReview || policy.requiresUserInput) && choice !== 'once')
+                    return deny('This request requires a fresh one-use approval');
+                const grant = immutable({ id: randomUUID(), scope: choice, actionDigest: action.digest, ruleDigest: ruleDigest(action), sessionId: action.sessionId, policyRevision: action.policyRevision, permissionDigest: action.permissionDigest, delta: policy.delta });
+                if (choice === 'persistent') {
+                    const prior = this.grants.filter(item => item.scope === 'persistent');
+                    await this.options.persistence.save([...prior, grant]);
+                    if (deadline.signal.aborted) {
+                        await this.options.persistence.save(prior);
+                        return deny('Persistent approval cancelled and reverted');
+                    }
+                }
+                deadline.signal.throwIfAborted();
+                if (choice !== 'once')
+                    this.grants.push(grant);
+                await this.options.audit.record(action, 'approval', choice);
+                // Once-grants are consumed at logical admission; helpers share this returned immutable profile.
+                return { isAllowed: true, delta: grant.delta, grant, authority: policy.authority, reason: 'User authorized the bound action' };
+            }
+            catch {
+                await this.options.audit.record(action, 'approval', 'cancelled-or-failed');
+                return deny('Approval cancelled or failed');
+            }
+            finally {
+                deadline.dispose();
+            }
+        });
+        this.tail = pending.then(() => { }, () => { });
+        return pending;
+    }
+    async settle() { await this.tail; await this.options.audit.flush(); }
+}
+//# sourceMappingURL=approvals.js.map

package/dist/approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../src/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAgK,MAAM,gBAAgB,CAAC;AAC/Q,OAAO,EAAE,cAAc,EAAE,UAAU,EAAc,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAGlE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAKxC,MAAM,OAAO,oBAAoB;IACV;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IACrC,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAChb,OAAO,SAAS,CAAC,IAAe,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAAC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,sCAAsC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;IAC1L,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAwB;QACjC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QAChD,IAAI,CAAC;YAAC,MAAM,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;gBAChH,CAAC;YAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IAML;IALZ,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,GAAY,EAAE,CAAC;IACrB,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3C,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9B,SAAS,CAAU;IAC3B,YAAqB,OAA4M;QAA5M,YAAO,GAAP,OAAO,CAAqM;IAAG,CAAC;IACrO,KAAK,CAAC,UAAU,KAAoB,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACjG,KAAK,CAAC,SAAkB;QACtB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,UAAU,KAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IACpE,KAAK,CAAC,KAAK,CAAC,MAAmB,EAAE,MAAsB,EAAE,OAA2Q;QAClU,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC;QACpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpK,MAAM,IAAI,GAAG,CAAC,MAAc,EAAa,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/F,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACrG,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACpL,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAC5H,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAAC,CAAC;QACjM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,YAAY,EAAE,MAAM,CAAC,gBAAgB,IAAI,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC,gDAAgD,CAAC,CAAC;QACxK,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,CAAC,CAAC;QACnJ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,+BAA+B,CAAC,CAAC;QAAC,CAAC;QACjL,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,SAAS,IAAI,QAAQ,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC1C,IAAI,KAAK,IAAI,aAAa,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,EAAC,GAAG,aAAa,EAAE,KAAK,EAAC,CAAC,GAAG,aAAa,CAAC,KAAK,EAAC,EAAC,EAAE,EAAC,KAAK,CAAC,EAAE,EAAC,MAAM,EAAC,mBAA4B,EAAC,KAAK,EAAC,eAAwB,EAAC,OAAO,EAAC,EAAC,IAAI,EAAC,6BAA6B,EAAC,cAAc,EAAC,KAAK,CAAC,cAAc,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,EAAC,yCAAyC,EAAC,EAAC,CAAC,EAAC,CAAC;YAC5S,aAAa,GAAG,SAAS,CAAC,EAAC,GAAG,MAAM,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACnY,IAAI,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAC,SAAS,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QAAC,CAAC;QACpO,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,KAAK,MAAM,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpc,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,EAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,eAAe;YAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,EAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAC,CAAC;QACpH,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClF,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,KAAK,aAAa,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC9P,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,KAAK,kBAAkB;gBAAE,OAAO,IAAI,CAAC,wDAAwD,CAAC,CAAC;YAC3I,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC9D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAC,IAAI,EAAC,oBAAoB,EAAC,YAAY,EAAC,MAAM,CAAC,MAAM,EAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACvL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACtB,qFAAqF;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAwB,EAAE;YAC5D,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5F,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC1J,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBACxE,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBAC/F,IAAI,MAAM,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;oBAAE,OAAO,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBAC1G,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,KAAK,kBAAkB,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC,gEAAgE,CAAC,CAAC;gBACtJ,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC,gDAAgD,CAAC,CAAC;gBACjJ,MAAM,KAAK,GAAU,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACrQ,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;oBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;oBACtE,MAAM,IAAI,CAAC,OAAO,CAAC,WAAY,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;oBACxD,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAAC,OAAO,IAAI,CAAC,4CAA4C,CAAC,CAAC;oBAAC,CAAC;gBAC1I,CAAC;gBACD,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBACjC,IAAI,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC/C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC5D,gGAAgG;gBAChG,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;YACjI,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAAC,CAAC;oBAC5H,CAAC;gBAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,MAAM,KAAoB,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CACrF"}

package/dist/audit.d.ts

@@ -0,0 +1,28 @@
+import type { GuardAction, ReviewResult, RiskLevel, UserAuthorization, ReviewTerminalState } from './contracts.js';
+interface ReviewAudit {
+    status: ReviewTerminalState;
+    riskLevel?: RiskLevel;
+    userAuthorization?: UserAuthorization;
+    rationale?: string;
+}
+export declare function redact(text: string, markers?: readonly string[]): string;
+export declare class AuditLog {
+    readonly path?: string | undefined;
+    readonly markers: readonly string[];
+    private tail;
+    constructor(path?: string | undefined, markers?: readonly string[]);
+    readonly records: {
+        timestamp: string;
+        actionDigest: string;
+        toolCallId: string;
+        tool: string;
+        sessionId: string;
+        event: string;
+        outcome: string;
+        review?: ReviewAudit;
+    }[];
+    recordReview(action: GuardAction, result: ReviewResult): Promise<void>;
+    record(action: GuardAction, event: string, outcome: string, review?: ReviewAudit): Promise<void>;
+    flush(): Promise<void>;
+}
+export {};

package/dist/audit.js

@@ -0,0 +1,40 @@
+import { mkdir, appendFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+export function redact(text, markers = []) {
+    let safe = text.replace(/SYNTHETIC_[A-Z0-9_:-]+/gi, '[REDACTED]')
+        .replace(/\b(Bearer\s+)[^\s"']+/gi, '$1[REDACTED]')
+        .replace(/\b((?:api[_-]?key|token|password|secret)\s*[=:]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;"']+)/gi, '$1[REDACTED]')
+        .replace(/\b(?:sk-[A-Za-z0-9_-]{8,}|AKIA[A-Z0-9]{16})\b/g, '[REDACTED]');
+    for (const marker of markers)
+        if (marker)
+            safe = safe.split(marker).join('[REDACTED]');
+    return safe;
+}
+export class AuditLog {
+    path;
+    markers;
+    tail = Promise.resolve();
+    constructor(path, markers = []) {
+        this.path = path;
+        this.markers = markers;
+    }
+    records = [];
+    async recordReview(action, result) {
+        const review = 'assessment' in result ? { status: result.status, riskLevel: result.assessment.risk_level, userAuthorization: result.assessment.user_authorization, rationale: redact(result.assessment.rationale, this.markers).slice(0, 1000) } : { status: result.status };
+        await this.record(action, 'review', result.status, review);
+    }
+    async record(action, event, outcome, review) {
+        // No arguments, command text, content, provider text or worker output enter the audit schema.
+        const record = { timestamp: new Date().toISOString(), actionDigest: action.digest, toolCallId: action.toolCallId, tool: action.tool, sessionId: action.sessionId, event, outcome, ...(review ? { review } : {}) };
+        const safe = JSON.parse(JSON.stringify(record, (_key, value) => typeof value === 'string' ? redact(value, this.markers) : value));
+        this.records.push(safe);
+        if (!this.path)
+            return;
+        const path = this.path;
+        const pending = this.tail.then(async () => { await mkdir(dirname(path), { recursive: true, mode: 0o700 }); await appendFile(path, JSON.stringify(safe) + '\n', { mode: 0o600 }); });
+        this.tail = pending.catch(() => { });
+        await pending;
+    }
+    async flush() { await this.tail; }
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,UAA6B,EAAE;IAClE,IAAI,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,YAAY,CAAC;SAC9D,OAAO,CAAC,yBAAyB,EAAE,cAAc,CAAC;SAClD,OAAO,CAAC,yGAAyG,EAAE,cAAc,CAAC;SAClI,OAAO,CAAC,gDAAgD,EAAE,YAAY,CAAC,CAAC;IAC3E,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,IAAI,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,OAAO,QAAQ;IAEE;IAAwB;IADrC,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACnD,YAAqB,IAAa,EAAW,UAA6B,EAAE;QAAvD,SAAI,GAAJ,IAAI,CAAS;QAAW,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IACvE,OAAO,GAA6J,EAAE,CAAC;IAChL,KAAK,CAAC,YAAY,CAAC,MAAmB,EAAE,MAAoB;QAC1D,MAAM,MAAM,GAAgB,YAAY,IAAI,MAAM,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,EAAC,SAAS,EAAC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAC,iBAAiB,EAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,EAAC,SAAS,EAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,IAAI,CAAC,EAAC,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,EAAC,CAAC;QAC5Q,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,MAAmB,EAAE,KAAa,EAAE,OAAe,EAAE,MAAoB;QACpF,8FAA8F;QAC9F,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAChN,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAkB,CAAC;QAC5J,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpL,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,MAAM,OAAO,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,KAAK,KAAoB,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;CAClD"}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export declare function main(argv: string[]): Promise<void>;