talos-code 0.0.1 → 0.1.0

package/dist/security/execution-backends.js

@@ -0,0 +1,236 @@
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { createExecutionBroker } from "./execution-broker.js";
+import { MXC_CHILD_ENVIRONMENT_NAMES, MXC_UI_POLICY, createMxcExecutionBackend, loadMxcSdk, mxcChildEnvironment, windowsCommandLine } from "./mxc-execution-backend.js";
+import { createProcessTreeEvidenceStore } from "./process-tree-evidence-store.js";
+import { createHostProcessTreeProbe, createSandboxWorkloadProbe, isolationCheckAborted } from "./process-tree-probe.js";
+/*
+ * ⭐⭐⭐ B1 slice 19 — THE PROBE'S ENVIRONMENT IS AN ALLOWLIST, BECAUSE IT GOES ON A COMMAND LINE.
+ *
+ * SDK 0.8.0 copies the environment it is given into the configuration it passes as `--config-base64` on
+ * the `wxc-exec.exe` command line (`dist/sandbox.js`, `injectEnvIntoConfig`; `dist/helper.js`,
+ * `resolveBinaryAndCommonArgs`), and a command line is what process auditing records.
+ *  · Round 1 passed `process.env` filtered by the kernel's name-shape denylist. Adversarial review
+ *    measured 24 of 29 realistic secret-bearing names with no credential shape (DATABASE_URL, SENTRY_DSN,
+ *    GH_PAT, MYSQL_PWD, HTTPS_PROXY with credentials, GIT_CONFIG_PARAMETERS carrying an authorization
+ *    header…) decoded out of that argument, and one 15,000-character variable was enough to approach
+ *    ENAMETOOLONG. A denylist cannot know what a value holds.
+ *  · The probe executor runs a fixed script that reads nothing from its environment (the folder arrives
+ *    in argv, the binary is `process.execPath`: `process-tree-probe.ts`, EXECUTOR_SOURCE and
+ *    DESCENDANT_SOURCE). It gets the system variables below and nothing else, as decided by the
+ *    coordinator. ⛔ A name is added only when a measurement shows the executor needs it.
+ *  · ⛔⛔ R0 lane S (2026-09-23): that list had no LOCALAPPDATA, and with it every sandboxed process died before
+ *    its first instruction (`WIN32_ERROR(203)`, measured; microsoft/mxc#1130). The probe now gets EXACTLY the
+ *    environment every brokered command gets — `MXC_CHILD_ENVIRONMENT_NAMES` in `mxc-execution-backend.ts`, where
+ *    each name carries its measurement — so "verified" is a statement about the container commands really run in.
+ */
+export const PROBE_ENVIRONMENT_NAMES = MXC_CHILD_ENVIRONMENT_NAMES;
+/** Only the allowlisted names this host defines, PATH System32-first. On Windows `process.env` lookups ignore case. */
+export function probeEnvironment(source = process.env) {
+    return mxcChildEnvironment(source);
+}
+/*
+ * ⭐ R3 (owner, 2026-09-24): the sandbox check starts at startup and is INTERRUPTIBLE. Measured before: a check still running
+ * when TALOS quit (the MXC workloads take seconds on a fresh profile, up to 30 s each) kept the process alive after its
+ * exit, and the next Ctrl+C reached a process whose raw mode was off and killed it with code 1 (acceptance s09).
+ *  · Every check runs under one process-wide AbortSignal and is tracked while it runs. Quitting calls
+ *    `abortIsolationChecks()`: the probes end every process they started (process-tree-probe.ts, `stopAll`) and the
+ *    call waits for them, bounded, so nothing a check started outlives TALOS.
+ *  · An aborted check is NO verdict: the availability question answers "not available", nothing is written to the
+ *    evidence store (a verdict landing after the abort is thrown away), and the next start checks again. The
+ *    three-signal unanimity rule of the probe is untouched.
+ */
+let checks = new AbortController();
+const runningChecks = new Set();
+/*
+ * ⛔ R3 (never a kill on trust): the pids a stopped check could not prove to be its own and therefore left running. The
+ * probe states them on its error (`leftover`); quitting hands them to the caller, so they are never silently ignored.
+ */
+const leftBehind = [];
+function noteLeftover(error) {
+    const pids = error?.leftover;
+    if (Array.isArray(pids))
+        for (const pid of pids)
+            if (typeof pid === 'number' && !leftBehind.includes(pid))
+                leftBehind.push(pid);
+}
+export function isolationCheckSignal() { return checks.signal; }
+function track(task) {
+    const settled = task.then(() => undefined, error => { noteLeftover(error); }).finally(() => { runningChecks.delete(settled); });
+    runningChecks.add(settled);
+    return task;
+}
+/** Runs one check under the process-wide abort, tracked until it settles. */
+export function runIsolationCheck(run) {
+    const signal = checks.signal;
+    if (signal.aborted)
+        return Promise.reject(isolationCheckAborted());
+    return track(run(signal));
+}
+/**
+ * TALOS is quitting: abort every running check and wait (at most `graceMs`) for them to end what they started. Answers
+ * the pids a check could not prove to be its own and so left running (R3: never a kill on trust), for the caller to state.
+ */
+export async function abortIsolationChecks(graceMs = 2_000) {
+    const previous = checks;
+    checks = new AbortController();
+    sharedBackends.clear();
+    previous.abort();
+    const pending = [...runningChecks];
+    if (pending.length > 0) {
+        let timer;
+        await Promise.race([Promise.allSettled(pending), new Promise(resolve => { timer = setTimeout(resolve, graceMs); timer.unref?.(); })]);
+        if (timer)
+            clearTimeout(timer);
+    }
+    return leftBehind.splice(0);
+}
+/** A result the caller waits for, or an AbortError the moment the signal fires, whatever the task does after. */
+function untilAborted(task, signal) {
+    if (signal.aborted)
+        return Promise.reject(isolationCheckAborted());
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(isolationCheckAborted());
+        signal.addEventListener('abort', onAbort, { once: true });
+        task.then(value => { signal.removeEventListener('abort', onAbort); resolve(value); }, error => { signal.removeEventListener('abort', onAbort); reject(error); });
+    });
+}
+/**
+ * Runs the probe's executor inside the same MXC containment the broker would use for a command,
+ * so the measurement is of the sandbox and not of a bare `child_process` tree.
+ *
+ * The volume root is granted read-only on purpose. Upstream microsoft/mxc#1109 records that a
+ * read-write grant on a user-profile directory is unusable on a BaseContainer host unless the
+ * volume root is also in the read-only grants, and that adding `C:\\Users` or the profile
+ * directory alone does not fix it. Without this the probe would answer "not verified" forever for
+ * a reason that has nothing to do with process trees.
+ */
+export function mxcSandboxedSpawn(getSdk) {
+    return async (request) => {
+        const sdk = await getSdk();
+        const volumeRoot = path.parse(request.probeDirectory).root;
+        const policy = {
+            version: '0.8.0-alpha',
+            filesystem: { readwritePaths: [request.probeDirectory], readonlyPaths: [volumeRoot], clearPolicyOnExit: true },
+            network: { egress: { default: 'deny' }, ingress: { default: 'deny', hostLoopback: 'deny' } },
+            /* R0 lane S, owner decision 4: the same UI policy as a brokered command (node.exe dies 0xC0000142 without Win32k). */
+            ui: { ...MXC_UI_POLICY }
+        };
+        const identity = `TALOS_CLI_PROBE_${createHash('sha256').update(request.probeDirectory).digest('hex').slice(0, 24)}`;
+        const config = sdk.createConfigFromPolicy(policy, 'process', identity);
+        config.process = { ...(config.process ?? { commandLine: '' }), commandLine: windowsCommandLine([request.executable, ...request.args]), cwd: request.cwd };
+        /* ⛔ B1 slice 19: never `process.env`, and never a denylist of it — see PROBE_ENVIRONMENT_NAMES above. */
+        const child = sdk.spawnSandboxFromConfig(config, { usePty: false, experimental: true }, request.cwd, probeEnvironment());
+        /*
+         * B1 slice 12, round 3: `exited` carries HOW the executor ended, so the probe's reason can say it.
+         * Measured on this host with the real SDK and this policy: node.exe exits 3221225794 (0xC0000142,
+         * STATUS_DLL_INIT_FAILED) within 73-139 ms, and before this the reason could only read «exit status
+         * not reported by the sandbox spawner».
+         * The promise settles once. `exit` is listened to first and Node emits it before `close`, so the
+         * status comes from `exit`; a `close` that arrives without a prior `exit` still settles the wait,
+         * with the status it carries or with nothing — never an invented one. A spawn `error` has no status.
+         */
+        let done = () => { };
+        const exited = new Promise(resolve => { done = resolve; });
+        child.once('exit', (code, signal) => done({ exitCode: code, signal }));
+        child.once('close', (code, signal) => done(code === undefined ? undefined : { exitCode: code, signal: signal ?? null }));
+        child.once('error', () => done());
+        return { pid: child.pid ?? undefined, kill: () => { try {
+                child.kill();
+            }
+            catch { } }, exited };
+    };
+}
+/**
+ * The process-tree measurement first (its reason is the one a person has read until now), then the real workloads
+ * (gate E3). Verified only when both are; the workload evidence rides on the process-tree evidence either way.
+ */
+export function withWorkloads(tree, workloads) {
+    return async () => {
+        const measured = await tree();
+        if (!measured.verified)
+            return measured;
+        const ran = await workloads();
+        const evidence = { ...measured.evidence, workloads: ran.workloads };
+        return ran.ok ? { verified: true, evidence } : { verified: false, reason: ran.reason ?? 'PROCESS_TREE_PROBE_WORKLOAD_FAILED', evidence };
+    };
+}
+export function createVerifiedMxcBackend(options) {
+    const platform = options.platform ?? process.platform;
+    const signal = options.signal ?? isolationCheckSignal();
+    const store = options.store ?? createProcessTreeEvidenceStore({ cacheRoot: options.paths.cacheRoot });
+    let sdkPromise;
+    const getSdk = () => sdkPromise ??= options.sdk !== undefined
+        ? Promise.resolve(options.sdk)
+        : options.sdkLoader !== undefined ? options.sdkLoader() : loadMxcSdk();
+    const probe = options.probe ?? withWorkloads(createHostProcessTreeProbe({ platform, spawn: mxcSandboxedSpawn(getSdk), signal }), createSandboxWorkloadProbe({ platform, spawn: mxcSandboxedSpawn(getSdk), signal }));
+    /*
+     * ⛔ R0 lane S: a record written by the default probe before it ran the workloads says nothing about them (a
+     *   positive one lives 24 h). Only a record that carries the workload evidence answers for the default probe; an
+     *   injected probe owns its own records.
+     */
+    const answersForThisProbe = (record) => options.probe !== undefined || record.evidence?.workloads !== undefined;
+    // One measurement per backend instance: the cache lookup and the probe tree both happen at most once.
+    let pending;
+    const verify = () => pending ??= track((async () => {
+        if (signal.aborted)
+            throw isolationCheckAborted();
+        const cached = await store.read();
+        if (cached && answersForThisProbe(cached))
+            return cached;
+        /* The probe is tracked too, so quitting waits (bounded) for it to end the processes it started. */
+        const measured = await untilAborted(track(probe()), signal);
+        /* ⛔ An aborted check is no verdict: a result that lands after the abort is never trusted nor cached. */
+        if (signal.aborted)
+            throw isolationCheckAborted();
+        /* ⛔ R3: a check that left running a process it could not prove its own is stated, never cached — the next start checks again. */
+        if ((measured.evidence?.cleanup?.leftover?.length ?? 0) > 0)
+            return measured;
+        // The cache is an optimisation, never a gate: an unwritable cache must not make a verified host unavailable.
+        try {
+            await store.write(measured);
+        }
+        catch { }
+        return measured;
+    })());
+    return createMxcExecutionBackend({ platform, sdkLoader: getSdk, verifyProcessTreeKillOnClose: verify });
+}
+/*
+ * R0 (2026-09-23, owner: wire the real sandbox state into auto mode). One verified backend per cache root and process,
+ * shared by the broker and by the auto classifier's isolation source, so the host is probed once and both answer from
+ * the same measurement. Injected SDKs, stores or probes (tests) always get their own backend.
+ */
+const sharedBackends = new Map();
+function sharedVerifiedBackend(options) {
+    if (options.sdk !== undefined || options.sdkLoader !== undefined || options.store !== undefined || options.probe !== undefined)
+        return createVerifiedMxcBackend(options);
+    const key = `${options.platform ?? process.platform}${options.paths.cacheRoot}`;
+    let backend = sharedBackends.get(key);
+    if (!backend) {
+        backend = createVerifiedMxcBackend(options);
+        sharedBackends.set(key, backend);
+    }
+    return backend;
+}
+export function createCliExecutionBroker(options) {
+    return createExecutionBroker({ platform: options.platform ?? process.platform, windowsSandbox: sharedVerifiedBackend(options) });
+}
+/** Isolation state for the auto classifier: verified only when the same backend the broker uses is available. */
+export function cliShellIsolation(options) {
+    return async () => {
+        const platform = options.platform ?? process.platform;
+        if (platform !== 'win32')
+            return { verified: false, reason: `no verified sandbox backend on ${platform}` };
+        /* R3: a check stopped because TALOS is quitting answers nothing (`aborted`), never a verdict. */
+        const signal = options.signal ?? isolationCheckSignal();
+        try {
+            const state = await sharedVerifiedBackend(options).available();
+            if (signal.aborted)
+                return { verified: false, aborted: true, reason: 'the check was stopped before it finished' };
+            return { verified: state.available === true, ...(state.reason ? { reason: state.reason } : {}) };
+        }
+        catch (error) {
+            return signal.aborted ? { verified: false, aborted: true, reason: 'the check was stopped before it finished' } : { verified: false, reason: error instanceof Error ? error.message : String(error) };
+        }
+    };
+}

package/dist/security/execution-broker.js

@@ -0,0 +1,102 @@
+import { createHash } from 'node:crypto';
+import { realpath, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { TalosError } from "../errors.js";
+function error(code, request, cause, hint) { return new TalosError({ code, component: 'execution-broker', retryable: false, ...(hint ? { hint } : {}), docs: 'https://learn.microsoft.com/windows/win32/secauthz/createprocessinsandbox', traceId: request.id }, cause); }
+async function canonicalDirectory(value, cwd, request) {
+    try {
+        const canonical = await realpath(path.resolve(cwd, value));
+        if (!(await stat(canonical)).isDirectory())
+            throw new Error('path is not a directory');
+        return canonical;
+    }
+    catch (cause) {
+        throw error('SANDBOX_PATH_INVALID', request, cause, `Create the sandbox path before execution: ${value}`);
+    }
+}
+function contains(root, candidate) { const relative = path.relative(root, candidate); return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative)); }
+/**
+ * Upstream microsoft/mxc#1109 forces the volume root into the read-only grants before a
+ * read-write grant on a user-profile directory is usable on a BaseContainer host. That grant makes
+ * the containment check below trivially true for every request, so a volume root never satisfies
+ * it on its own: the working directory must be covered by a grant that is narrower than the whole
+ * volume. The volume root is still forwarded to the backend as a read-only grant.
+ */
+function isVolumeRoot(candidate) { return path.parse(candidate).root === candidate; }
+async function normalizeRequest(request) {
+    const cwd = await canonicalDirectory(request.cwd, process.cwd(), request);
+    const readWritePaths = [...new Set(await Promise.all(request.readWritePaths.map(value => canonicalDirectory(value, cwd, request))))].sort();
+    const readOnlyPaths = [...new Set(await Promise.all(request.readOnlyPaths.map(value => canonicalDirectory(value, cwd, request))))].filter(value => !readWritePaths.some(root => contains(root, value))).sort();
+    if (![...readWritePaths, ...readOnlyPaths].filter(root => !isVolumeRoot(root)).some(root => contains(root, cwd)))
+        throw error('SANDBOX_CWD_NOT_GRANTED', request, undefined, 'Add cwd to readWritePaths or readOnlyPaths: a granted volume root does not cover it');
+    return { ...request, cwd, readWritePaths, readOnlyPaths };
+}
+export async function createWindowsSandboxPolicy(request) {
+    const normalized = await normalizeRequest(request);
+    const suffix = createHash('sha256').update(`${normalized.id}\0${normalized.cwd}`).digest('hex').slice(0, 24);
+    return { version: '0.1.0', identity: `TALOS_CLI_${suffix}`, appContainer: true, disallowWin32kSystemCalls: false, fsReadWrite: normalized.readWritePaths, fsReadOnly: normalized.readOnlyPaths, capabilities: normalized.network === 'internet-client' ? ['internetClient'] : [] };
+}
+function verifyEvidence(backend, request, applied) {
+    const mismatch = () => { throw error('SANDBOX_EVIDENCE_MISMATCH', request, undefined, `Backend ${backend.name} did not apply its declared enforcement`); };
+    if (applied.enforcement !== backend.level || applied.processTree !== 'job-object-kill-on-close')
+        mismatch();
+    if (backend.level === 'windows-sandbox') {
+        if (!applied.appContainer || applied.filesystem !== 'bfs' || applied.network !== request.network || applied.sandboxSpecVersion !== '0.1.0')
+            mismatch();
+    }
+    else if (applied.appContainer || applied.filesystem !== 'restricted-token' || applied.network !== 'not-enforced' || applied.sandboxSpecVersion !== undefined)
+        mismatch();
+}
+export function createExecutionBroker({ platform = process.platform, windowsSandbox, restrictedProcess }) {
+    return { async execute(input) {
+            const request = await normalizeRequest(input);
+            const windowsAvailability = platform === 'win32' && windowsSandbox?.level === 'windows-sandbox' ? await windowsSandbox.available() : { available: false, reason: 'Windows sandbox backend is unavailable' };
+            let backend;
+            if (windowsAvailability.available)
+                backend = windowsSandbox;
+            else if (request.requiredEnforcement === 'windows-sandbox')
+                throw error('SANDBOX_REQUIRED_UNAVAILABLE', request, new Error(windowsAvailability.reason ?? 'Windows sandbox backend is unavailable'), 'Install a verified Windows sandbox backend or change the explicit policy');
+            /*
+             * ⛔ B1 slice 12, round 2 — the hint below is what a person reads in the enforcement line
+             *   («no isolation backend on this host: <hint>»). It used to be one fixed sentence, discarding
+             *   the reason each backend had just given; on this host that hid
+             *   `PROCESS_TREE_PROBE_EXECUTOR_EXITED` behind «No execution backend satisfies the requested
+             *   enforcement». Every CONFIGURED backend is now named with its own reason. A backend that is
+             *   not configured is not a fact about the host, so it is not listed.
+             */
+            const declined = [];
+            if (!backend && windowsSandbox) {
+                if (platform !== 'win32')
+                    declined.push(`${windowsSandbox.name}: requires win32, this host is ${platform}`);
+                else if (windowsSandbox.level !== 'windows-sandbox')
+                    declined.push(`${windowsSandbox.name}: declares level ${windowsSandbox.level}, not windows-sandbox`);
+                else
+                    declined.push(`${windowsSandbox.name}: ${windowsAvailability.reason ?? 'unavailable, and it gave no reason'}`);
+            }
+            if (!backend && restrictedProcess) {
+                if (restrictedProcess.level !== 'restricted-process')
+                    declined.push(`${restrictedProcess.name}: declares level ${restrictedProcess.level}, not restricted-process`);
+                else {
+                    const restrictedAvailability = await restrictedProcess.available();
+                    if (restrictedAvailability.available)
+                        backend = restrictedProcess;
+                    else
+                        declined.push(`${restrictedProcess.name}: ${restrictedAvailability.reason ?? 'unavailable, and it gave no reason'}`);
+                }
+            }
+            if (!backend)
+                throw error('EXECUTION_BACKEND_UNAVAILABLE', request, undefined, declined.length > 0 ? declined.join('; ') : 'no execution backend is configured');
+            try {
+                const windowsSandboxPolicy = backend.level === 'windows-sandbox' ? await createWindowsSandboxPolicy(request) : undefined;
+                const result = await backend.execute(windowsSandboxPolicy ? { request, windowsSandboxPolicy } : { request });
+                verifyEvidence(backend, request, result.applied);
+                const evidence = { requestedEnforcement: request.requiredEnforcement, appliedEnforcement: result.applied.enforcement, backend: backend.name, appContainer: result.applied.appContainer, filesystem: result.applied.filesystem, network: result.applied.network, processTree: result.applied.processTree, ...(result.applied.processTreeEvidence ? { processTreeEvidence: result.applied.processTreeEvidence } : {}), ...(result.applied.sandboxSpecVersion ? { sandboxSpecVersion: result.applied.sandboxSpecVersion } : {}) };
+                return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr, evidence };
+            }
+            catch (cause) {
+                if (cause instanceof TalosError)
+                    throw cause;
+                throw error('EXECUTION_BACKEND_FAILED', request, cause, 'Inspect the backend health and enforcement evidence');
+            }
+        } };
+}

package/dist/security/forge-scan.js

@@ -0,0 +1,74 @@
+const OWNER_PACKAGE_KEYS = new Set(['schemaVersion', 'revision', 'manifest', 'simulation']);
+const SIMULATION_KEYS = new Set(['input', 'capabilityResults']);
+const MANIFEST_ID = /^[a-z0-9][a-z0-9_-]{2,63}$/u;
+const MANIFEST_FIELDS = new Set(['id', 'title', 'description', 'inputSchema', 'flow']);
+const FLOW_FIELDS = new Set(['entry', 'maxTransitions', 'nodes']);
+const NODE_FIELDS = {
+    capability: new Set(['id', 'type', 'capability', 'input', 'target', 'next']),
+    if: new Set(['id', 'type', 'condition', 'then', 'else']),
+    return: new Set(['id', 'type', 'value']),
+    fail: new Set(['id', 'type', 'code', 'message']),
+};
+/* R2 (gate E6): the code lives on `error.code` only; a `CODE: ` prefix made the failure line print it twice (D-06). */
+function fail(message) { throw Object.assign(new Error(message), { code: 'FORGE_PACKAGE_SCHEMA_INVALID' }); }
+function object(value) { return Boolean(value) && typeof value === 'object' && !Array.isArray(value); }
+export function validateForgeOwnerPackage(value) {
+    if (!object(value))
+        fail('package must be an object');
+    for (const key of Object.keys(value))
+        if (!OWNER_PACKAGE_KEYS.has(key))
+            fail('unknown package field ' + key);
+    if (value.schemaVersion !== 1)
+        fail('schemaVersion must be 1');
+    if (!Number.isSafeInteger(value.revision) || value.revision < 1)
+        fail('revision must be a positive integer');
+    if (!object(value.manifest))
+        fail('manifest must be an object');
+    if (typeof value.manifest.id !== 'string' || !MANIFEST_ID.test(value.manifest.id))
+        fail('manifest.id must be a safe lowercase slug');
+    if (Object.prototype.hasOwnProperty.call(value.manifest, 'version') || Object.prototype.hasOwnProperty.call(value.manifest, 'parentVersion'))
+        fail('owner revision must stay outside the executable manifest');
+    const simulation = value.simulation === undefined ? {} : value.simulation;
+    if (!object(simulation))
+        fail('simulation must be an object');
+    for (const key of Object.keys(simulation))
+        if (!SIMULATION_KEYS.has(key))
+            fail('unknown simulation field ' + key);
+    if (simulation.capabilityResults !== undefined && !object(simulation.capabilityResults))
+        fail('simulation.capabilityResults must be an object');
+    return { schemaVersion: 1, revision: Number(value.revision), manifest: value.manifest, simulation: { input: simulation.input ?? {}, capabilityResults: simulation.capabilityResults ?? {} } };
+}
+export function scanForgeManifest(manifest, canonical) {
+    const findings = [];
+    const add = (code, path, message, blocking = true) => findings.push({ code, path, message, blocking });
+    if (!canonical?.ok)
+        for (const message of Array.isArray(canonical?.diagnostica) ? canonical.diagnostica : ['canonical validation failed'])
+            add('FORGE_CANONICAL_VALIDATION', 'manifest', String(message), true);
+    if (object(manifest))
+        for (const key of Object.keys(manifest))
+            if (!MANIFEST_FIELDS.has(key))
+                add('FORGE_UNKNOWN_MANIFEST_FIELD', 'manifest.' + key, 'unknown manifest field ' + key, true);
+    const flow = object(manifest?.flow) ? manifest.flow : null;
+    if (flow)
+        for (const key of Object.keys(flow))
+            if (!FLOW_FIELDS.has(key))
+                add('FORGE_UNKNOWN_FLOW_FIELD', 'flow.' + key, 'unknown flow field ' + key, true);
+    if (flow && Array.isArray(flow.nodes)) {
+        flow.nodes.forEach((node, index) => {
+            if (!object(node))
+                return;
+            const allowed = NODE_FIELDS[String(node.type)] ?? new Set(['id', 'type']);
+            for (const key of Object.keys(node))
+                if (!allowed.has(key))
+                    add('FORGE_UNKNOWN_NODE_FIELD', `flow.nodes[${index}].${key}`, `unknown field "${key}" is not part of the declarative Forge DSL`, true);
+        });
+    }
+    return {
+        ok: Boolean(canonical?.ok) && !findings.some(f => f.blocking),
+        declarativeOnly: !findings.some(f => f.code.startsWith('FORGE_UNKNOWN_')),
+        capabilities: Array.isArray(canonical?.capacita) ? [...canonical.capacita] : [],
+        actions: Array.isArray(canonical?.azioni) ? [...canonical.azioni] : [],
+        risk: typeof canonical?.rischio === 'string' ? canonical.rischio : 'R1',
+        findings,
+    };
+}

package/dist/security/from-approval.js

@@ -0,0 +1,39 @@
+import { externalToolParts, isKernelTool, permissionToolFor } from "../tui/tool-display.js";
+/*
+ * R2 lane T (gate E3/E4): the approval payload `{tipo:<kernel tool name>, percorso|comando, toolCallId}`
+ * (talosHarness.mjs:8166-9714, reaching the CLI as `ApprovalRequested.azione`, agui-events.mjs:279) is mapped by the
+ * kernel NAME through the one tool table, never by matching Italian substrings. The old `raw.includes('scritt')` missed
+ * the kernel's own `scrivi`, which carried `percorso` and was therefore judged as a Read, and a read inside the project is
+ * allowed without asking (evaluate.ts:130): the default mode wrote files without asking (review E-07).
+ *
+ * Fields decide only where the name cannot, and always toward the stricter reading:
+ * - a payload carrying a command is judged as that shell command, whatever tool it names (the command is what runs);
+ * - a name that is not a kernel tool and names a path is a Write, never a Read (a Read would pass without asking);
+ * - `serverId` makes it an MCP call; TALOS's own services carry the tool name as operation, so "always" writes a rule
+ *   for that one operation (`TalosService(:notes_create)`) instead of `TalosService(:*)`, which matched every service.
+ */
+function text(value) { return typeof value === 'string' ? value : undefined; }
+export function permissionActionFromApproval(data) {
+    const a = (data.azione ?? data.action ?? data);
+    const command = text(a.comando) ?? text(a.command);
+    const name = text(a.tipo) ?? text(a.tool) ?? '';
+    const external = isKernelTool(name) ? null : externalToolParts(name);
+    let serverId = text(a.serverId), operation = text(a.operation);
+    if (external?.kind === 'mcp') {
+        serverId ??= external.owner;
+        operation ??= external.tool;
+    }
+    let tool;
+    if (command)
+        tool = 'Bash';
+    else if (isKernelTool(name) || external)
+        tool = permissionToolFor(name);
+    else if (serverId)
+        tool = 'Mcp';
+    else
+        tool = text(a.percorso) ?? text(a.path) ?? text(a.resource) ? 'Write' : 'TalosService';
+    const resource = text(a.percorso) ?? text(a.path) ?? text(a.resource) ?? (tool === 'WebFetch' ? text(a.url) : undefined);
+    if (!operation && name && (tool === 'TalosService' || tool === 'Plugin'))
+        operation = name;
+    return { tool, ...(command ? { command } : {}), ...(resource ? { resource } : {}), ...(serverId ? { serverId } : {}), ...(operation ? { operation } : {}) };
+}