tryassay 0.6.0 → 0.11.1

package/dist/runtime/tool-sandbox.js

@@ -0,0 +1,394 @@
+// ============================================================
+// Assay Verified Agent Runtime — Tool Sandbox
+// Process-isolated execution environment for tools.
+// Enforces network, filesystem, timeout, and memory constraints.
+// ============================================================
+import { fork } from 'node:child_process';
+import { writeFile, mkdir, rm, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { tmpdir } from 'node:os';
+// ── Tool Sandbox ───────────────────────────────────────────
+export class ToolSandbox {
+    sandboxDir;
+    constructor(sandboxBaseDir) {
+        this.sandboxDir = sandboxBaseDir ?? join(tmpdir(), 'assay-sandbox');
+    }
+    /**
+     * Execute a tool in a sandboxed child process.
+     * Enforces all constraints from the ToolDefinition.
+     */
+    async execute(request) {
+        const start = Date.now();
+        const executionId = randomUUID().slice(0, 8);
+        const workDir = join(this.sandboxDir, executionId);
+        try {
+            // Create isolated working directory
+            await mkdir(workDir, { recursive: true });
+            // Write the sandbox runner script
+            const runnerPath = join(workDir, '_runner.mjs');
+            await writeFile(runnerPath, this.generateRunnerScript(request), 'utf-8');
+            // Fork a child process with constrained environment
+            const result = await this.forkAndRun(runnerPath, request.constraints, workDir);
+            return {
+                ...result,
+                durationMs: Date.now() - start,
+            };
+        }
+        catch (err) {
+            return {
+                status: 'error',
+                error: err instanceof Error ? err.message : String(err),
+                durationMs: Date.now() - start,
+            };
+        }
+        finally {
+            // Clean up the sandbox directory
+            await rm(workDir, { recursive: true, force: true }).catch(() => { });
+        }
+    }
+    /**
+     * Run a full test suite against a tool: happy path, malformed input,
+     * timeout behavior, and constraint compliance.
+     */
+    async runTestSuite(tool, toolSourceDir) {
+        const entryPoint = join(toolSourceDir, tool.source.entry_point);
+        // 1. Happy path: valid input based on tool interface
+        const happyInput = this.generateHappyPathInput(tool);
+        const happyResult = await this.runSingleTest(tool, entryPoint, 'default', happyInput, 'Happy path with valid input');
+        // 2. Malformed input: invalid types, missing required fields
+        const malformedInput = this.generateMalformedInput(tool);
+        const malformedResult = await this.runSingleTest(tool, entryPoint, 'default', malformedInput, 'Malformed input (missing fields, wrong types)');
+        // 3. Timeout behavior: run with a very short timeout
+        const timeoutConstraints = {
+            ...tool.constraints,
+            timeout_ms: 100, // very short — should trigger timeout handling
+        };
+        const timeoutResult = await this.runTimeoutTest(tool, entryPoint, timeoutConstraints);
+        // 4. Constraint compliance: verify sandbox constraints are respected
+        const complianceResult = await this.runConstraintComplianceTest(tool, entryPoint);
+        return {
+            happy_path: happyResult,
+            malformed_input: malformedResult,
+            timeout_behavior: timeoutResult,
+            constraint_compliance: complianceResult,
+        };
+    }
+    // ── Private: Process forking ──────────────────────────────
+    forkAndRun(runnerPath, constraints, workDir) {
+        return new Promise((resolvePromise) => {
+            const child = fork(runnerPath, [], {
+                cwd: workDir,
+                env: {
+                    NODE_ENV: 'sandbox',
+                    SANDBOX_WORK_DIR: workDir,
+                    SANDBOX_TIMEOUT_MS: String(constraints.timeout_ms),
+                    SANDBOX_MAX_MEMORY_MB: String(constraints.max_memory_mb),
+                    SANDBOX_ALLOWED_DOMAINS: JSON.stringify(constraints.network_access.allowlisted_domains),
+                    SANDBOX_NETWORK_ALLOWED: String(constraints.network_access.allowed),
+                    SANDBOX_READ_PATHS: JSON.stringify(constraints.filesystem_access.read_paths),
+                    SANDBOX_WRITE_PATHS: JSON.stringify(constraints.filesystem_access.write_paths),
+                    // Restrict PATH to minimal system binaries
+                    PATH: '/usr/bin:/bin',
+                },
+                // Resource limits
+                execArgv: [
+                    `--max-old-space-size=${constraints.max_memory_mb}`,
+                ],
+                stdio: ['pipe', 'pipe', 'pipe', 'ipc'],
+                timeout: constraints.timeout_ms + 1000, // grace period beyond tool timeout
+            });
+            let stdout = '';
+            let stderr = '';
+            let result = null;
+            child.stdout?.on('data', (data) => {
+                stdout += data.toString();
+            });
+            child.stderr?.on('data', (data) => {
+                stderr += data.toString();
+            });
+            // Receive structured result via IPC
+            child.on('message', (msg) => {
+                if (typeof msg === 'object' && msg !== null && 'status' in msg) {
+                    result = msg;
+                }
+            });
+            // Hard timeout
+            const timer = setTimeout(() => {
+                child.kill('SIGKILL');
+                resolvePromise({
+                    status: 'timeout',
+                    error: `Tool exceeded timeout of ${constraints.timeout_ms}ms`,
+                    durationMs: constraints.timeout_ms,
+                });
+            }, constraints.timeout_ms + 2000);
+            child.on('exit', (code, signal) => {
+                clearTimeout(timer);
+                if (result) {
+                    resolvePromise(result);
+                }
+                else if (signal === 'SIGKILL') {
+                    resolvePromise({
+                        status: 'timeout',
+                        error: `Process killed (signal: ${signal})`,
+                        durationMs: constraints.timeout_ms,
+                    });
+                }
+                else if (code !== 0) {
+                    resolvePromise({
+                        status: 'error',
+                        error: stderr || `Process exited with code ${code}`,
+                        durationMs: 0,
+                    });
+                }
+                else {
+                    // Exited cleanly but no IPC message — try parsing stdout
+                    try {
+                        const parsed = JSON.parse(stdout);
+                        resolvePromise({
+                            status: 'success',
+                            output: parsed,
+                            durationMs: 0,
+                        });
+                    }
+                    catch {
+                        resolvePromise({
+                            status: 'success',
+                            output: stdout,
+                            durationMs: 0,
+                        });
+                    }
+                }
+            });
+            child.on('error', (err) => {
+                clearTimeout(timer);
+                resolvePromise({
+                    status: 'error',
+                    error: err.message,
+                    durationMs: 0,
+                });
+            });
+        });
+    }
+    // ── Private: Runner script generation ─────────────────────
+    generateRunnerScript(request) {
+        // The runner script is executed in the child process.
+        // It imports the tool, calls the function, and sends the result via IPC.
+        return `
+import { pathToFileURL } from 'node:url';
+
+const TIMEOUT = parseInt(process.env.SANDBOX_TIMEOUT_MS ?? '30000', 10);
+const ENTRY_POINT = ${JSON.stringify(request.entryPoint)};
+const FUNCTION_NAME = ${JSON.stringify(request.functionName)};
+const INPUT = ${JSON.stringify(request.input)};
+
+// Set up timeout
+const timer = setTimeout(() => {
+  process.send?.({ status: 'timeout', error: 'Tool execution timed out' });
+  process.exit(1);
+}, TIMEOUT);
+
+async function run() {
+  try {
+    const toolModule = await import(pathToFileURL(ENTRY_POINT).href);
+    const fn = toolModule[FUNCTION_NAME] ?? toolModule.default;
+
+    if (typeof fn !== 'function') {
+      process.send?.({
+        status: 'error',
+        error: \`No exported function "\${FUNCTION_NAME}" found in tool module\`,
+      });
+      process.exit(1);
+    }
+
+    const output = await fn(INPUT);
+    clearTimeout(timer);
+
+    process.send?.({
+      status: 'success',
+      output,
+      memoryUsageMb: Math.round(process.memoryUsage().heapUsed / 1024 / 1024 * 100) / 100,
+    });
+    process.exit(0);
+  } catch (err) {
+    clearTimeout(timer);
+    process.send?.({
+      status: 'error',
+      error: err instanceof Error ? err.message : String(err),
+    });
+    process.exit(1);
+  }
+}
+
+run();
+`;
+    }
+    // ── Private: Test helpers ─────────────────────────────────
+    async runSingleTest(tool, entryPoint, functionName, input, description) {
+        const start = Date.now();
+        try {
+            const response = await this.execute({
+                toolId: tool.id,
+                entryPoint,
+                functionName,
+                input,
+                constraints: tool.constraints,
+            });
+            return {
+                status: response.status === 'success' ? 'pass'
+                    : response.status === 'timeout' ? 'timeout'
+                        : response.status === 'constraint_violation' ? 'fail'
+                            : 'error',
+                input_summary: description,
+                output_summary: response.output
+                    ? JSON.stringify(response.output).slice(0, 200)
+                    : response.error ?? 'no output',
+                duration_ms: Date.now() - start,
+                error: response.error,
+            };
+        }
+        catch (err) {
+            return {
+                status: 'error',
+                input_summary: description,
+                output_summary: '',
+                duration_ms: Date.now() - start,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    }
+    async runTimeoutTest(tool, entryPoint, constraints) {
+        const start = Date.now();
+        try {
+            const response = await this.execute({
+                toolId: tool.id,
+                entryPoint,
+                functionName: 'default',
+                input: this.generateHappyPathInput(tool),
+                constraints,
+            });
+            // Either it completes within 100ms (fast tool) or times out (expected)
+            // Both are acceptable behaviors
+            return {
+                status: 'pass',
+                input_summary: 'Timeout behavior test (100ms limit)',
+                output_summary: response.status === 'timeout'
+                    ? 'Tool timed out gracefully'
+                    : 'Tool completed within timeout',
+                duration_ms: Date.now() - start,
+            };
+        }
+        catch (err) {
+            return {
+                status: 'error',
+                input_summary: 'Timeout behavior test',
+                output_summary: '',
+                duration_ms: Date.now() - start,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    }
+    async runConstraintComplianceTest(tool, entryPoint) {
+        const start = Date.now();
+        // Verify source hash matches
+        try {
+            const sourceContent = await readFile(entryPoint, 'utf-8');
+            const { createHash } = await import('node:crypto');
+            const actualHash = createHash('sha256').update(sourceContent).digest('hex');
+            if (actualHash !== tool.source.source_hash) {
+                return {
+                    status: 'fail',
+                    input_summary: 'Constraint compliance: source integrity',
+                    output_summary: `Source hash mismatch. Expected: ${tool.source.source_hash}, Got: ${actualHash}`,
+                    duration_ms: Date.now() - start,
+                    error: 'Source integrity violation',
+                };
+            }
+            // Verify declared constraints match the tool type
+            if (tool.type === 'verification_helper' && tool.constraints.filesystem_access.write_paths.length > 0) {
+                return {
+                    status: 'fail',
+                    input_summary: 'Constraint compliance: verification_helper write access',
+                    output_summary: 'verification_helper tools must not have write access',
+                    duration_ms: Date.now() - start,
+                    error: 'verification_helper cannot have write paths',
+                };
+            }
+            if (!tool.constraints.network_access.allowed && tool.constraints.network_access.allowlisted_domains.length > 0) {
+                return {
+                    status: 'fail',
+                    input_summary: 'Constraint compliance: network inconsistency',
+                    output_summary: 'Network access disabled but allowlisted domains specified',
+                    duration_ms: Date.now() - start,
+                    error: 'Inconsistent network constraints',
+                };
+            }
+            return {
+                status: 'pass',
+                input_summary: 'Constraint compliance check',
+                output_summary: 'Source integrity verified, constraints consistent',
+                duration_ms: Date.now() - start,
+            };
+        }
+        catch (err) {
+            return {
+                status: 'error',
+                input_summary: 'Constraint compliance check',
+                output_summary: '',
+                duration_ms: Date.now() - start,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    }
+    generateHappyPathInput(tool) {
+        const input = {};
+        for (const param of tool.interface.inputs) {
+            if (!param.required)
+                continue;
+            // Generate plausible defaults based on type
+            switch (param.type) {
+                case 'string':
+                    input[param.name] = 'test-value';
+                    break;
+                case 'number':
+                    input[param.name] = 42;
+                    break;
+                case 'boolean':
+                    input[param.name] = true;
+                    break;
+                case 'string[]':
+                    input[param.name] = ['item1', 'item2'];
+                    break;
+                default:
+                    input[param.name] = 'test';
+                    break;
+            }
+        }
+        return input;
+    }
+    generateMalformedInput(tool) {
+        // Deliberately omit required fields and use wrong types
+        const input = {};
+        for (const param of tool.interface.inputs) {
+            if (param.required)
+                continue; // skip required — test missing fields
+            // Provide wrong types for optional fields
+            switch (param.type) {
+                case 'string':
+                    input[param.name] = 12345;
+                    break;
+                case 'number':
+                    input[param.name] = 'not-a-number';
+                    break;
+                case 'boolean':
+                    input[param.name] = 'not-a-bool';
+                    break;
+                default:
+                    input[param.name] = null;
+                    break;
+            }
+        }
+        return input;
+    }
+}
+//# sourceMappingURL=tool-sandbox.js.map

package/dist/runtime/tool-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-sandbox.js","sourceRoot":"","sources":["../../src/runtime/tool-sandbox.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,8CAA8C;AAC9C,oDAAoD;AACpD,iEAAiE;AACjE,+DAA+D;AAE/D,OAAO,EAAE,IAAI,EAAqB,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AA6BjC,8DAA8D;AAE9D,MAAM,OAAO,WAAW;IACd,UAAU,CAAS;IAE3B,YAAY,cAAuB;QACjC,IAAI,CAAC,UAAU,GAAG,cAAc,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;IACtE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,OAAuB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAEnD,IAAI,CAAC;YACH,oCAAoC;YACpC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE1C,kCAAkC;YAClC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAChD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;YAEzE,oDAAoD;YACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAClC,UAAU,EACV,OAAO,CAAC,WAAW,EACnB,OAAO,CACR,CAAC;YAEF,OAAO;gBACL,GAAG,MAAM;gBACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC/B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC/B,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,iCAAiC;YACjC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,IAAoB,EACpB,aAAqB;QAOrB,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEhE,qDAAqD;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAC1C,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EACvC,6BAA6B,CAC9B,CAAC;QAEF,6DAA6D;QAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAC9C,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAC3C,+CAA+C,CAChD,CAAC;QAEF,qDAAqD;QACrD,MAAM,kBAAkB,GAAoB;YAC1C,GAAG,IAAI,CAAC,WAAW;YACnB,UAAU,EAAE,GAAG,EAAE,+CAA+C;SACjE,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAC7C,IAAI,EAAE,UAAU,EAAE,kBAAkB,CACrC,CAAC;QAEF,qEAAqE;QACrE,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAC7D,IAAI,EAAE,UAAU,CACjB,CAAC;QAEF,OAAO;YACL,UAAU,EAAE,WAAW;YACvB,eAAe,EAAE,eAAe;YAChC,gBAAgB,EAAE,aAAa;YAC/B,qBAAqB,EAAE,gBAAgB;SACxC,CAAC;IACJ,CAAC;IAED,6DAA6D;IAErD,UAAU,CAChB,UAAkB,EAClB,WAA4B,EAC5B,OAAe;QAEf,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;YACpC,MAAM,KAAK,GAAiB,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE;gBAC/C,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE;oBACH,QAAQ,EAAE,SAAS;oBACnB,gBAAgB,EAAE,OAAO;oBACzB,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;oBAClD,qBAAqB,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC;oBACxD,uBAAuB,EAAE,IAAI,CAAC,SAAS,CACrC,WAAW,CAAC,cAAc,CAAC,mBAAmB,CAC/C;oBACD,uBAAuB,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC;oBACnE,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC;oBAC5E,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,iBAAiB,CAAC,WAAW,CAAC;oBAC9E,2CAA2C;oBAC3C,IAAI,EAAE,eAAe;iBACtB;gBACD,kBAAkB;gBAClB,QAAQ,EAAE;oBACR,wBAAwB,WAAW,CAAC,aAAa,EAAE;iBACpD;gBACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;gBACtC,OAAO,EAAE,WAAW,CAAC,UAAU,GAAG,IAAI,EAAE,mCAAmC;aAC5E,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAA2B,IAAI,CAAC;YAE1C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACxC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACxC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,oCAAoC;YACpC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,EAAE;gBACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;oBAC/D,MAAM,GAAG,GAAsB,CAAC;gBAClC,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,eAAe;YACf,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,cAAc,CAAC;oBACb,MAAM,EAAE,SAAS;oBACjB,KAAK,EAAE,4BAA4B,WAAW,CAAC,UAAU,IAAI;oBAC7D,UAAU,EAAE,WAAW,CAAC,UAAU;iBACnC,CAAC,CAAC;YACL,CAAC,EAAE,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;YAElC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAChC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAEpB,IAAI,MAAM,EAAE,CAAC;oBACX,cAAc,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAChC,cAAc,CAAC;wBACb,MAAM,EAAE,SAAS;wBACjB,KAAK,EAAE,2BAA2B,MAAM,GAAG;wBAC3C,UAAU,EAAE,WAAW,CAAC,UAAU;qBACnC,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,cAAc,CAAC;wBACb,MAAM,EAAE,OAAO;wBACf,KAAK,EAAE,MAAM,IAAI,4BAA4B,IAAI,EAAE;wBACnD,UAAU,EAAE,CAAC;qBACd,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,yDAAyD;oBACzD,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAClC,cAAc,CAAC;4BACb,MAAM,EAAE,SAAS;4BACjB,MAAM,EAAE,MAAM;4BACd,UAAU,EAAE,CAAC;yBACd,CAAC,CAAC;oBACL,CAAC;oBAAC,MAAM,CAAC;wBACP,cAAc,CAAC;4BACb,MAAM,EAAE,SAAS;4BACjB,MAAM,EAAE,MAAM;4BACd,UAAU,EAAE,CAAC;yBACd,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,cAAc,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,GAAG,CAAC,OAAO;oBAClB,UAAU,EAAE,CAAC;iBACd,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAErD,oBAAoB,CAAC,OAAuB;QAClD,sDAAsD;QACtD,yEAAyE;QACzE,OAAO;;;;sBAIW,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC;wBAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC;gBAC5C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyC5C,CAAC;IACA,CAAC;IAED,6DAA6D;IAErD,KAAK,CAAC,aAAa,CACzB,IAAoB,EACpB,UAAkB,EAClB,YAAoB,EACpB,KAAc,EACd,WAAmB;QAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;gBAClC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,UAAU;gBACV,YAAY;gBACZ,KAAK;gBACL,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;YAEH,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM;oBAC5C,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;wBAC3C,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC,CAAC,MAAM;4BACrD,CAAC,CAAC,OAAO;gBACX,aAAa,EAAE,WAAW;gBAC1B,cAAc,EAAE,QAAQ,CAAC,MAAM;oBAC7B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBAC/C,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,WAAW;gBACjC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,aAAa,EAAE,WAAW;gBAC1B,cAAc,EAAE,EAAE;gBAClB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC/B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,IAAoB,EACpB,UAAkB,EAClB,WAA4B;QAE5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;gBAClC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,UAAU;gBACV,YAAY,EAAE,SAAS;gBACvB,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;gBACxC,WAAW;aACZ,CAAC,CAAC;YAEH,uEAAuE;YACvE,gCAAgC;YAChC,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,qCAAqC;gBACpD,cAAc,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS;oBAC3C,CAAC,CAAC,2BAA2B;oBAC7B,CAAC,CAAC,+BAA+B;gBACnC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,aAAa,EAAE,uBAAuB;gBACtC,cAAc,EAAE,EAAE;gBAClB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC/B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,IAAoB,EACpB,UAAkB;QAElB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE5E,IAAI,UAAU,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAC3C,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,aAAa,EAAE,yCAAyC;oBACxD,cAAc,EAAE,mCAAmC,IAAI,CAAC,MAAM,CAAC,WAAW,UAAU,UAAU,EAAE;oBAChG,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC/B,KAAK,EAAE,4BAA4B;iBACpC,CAAC;YACJ,CAAC;YAED,kDAAkD;YAClD,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrG,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,aAAa,EAAE,yDAAyD;oBACxE,cAAc,EAAE,sDAAsD;oBACtE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC/B,KAAK,EAAE,6CAA6C;iBACrD,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/G,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,aAAa,EAAE,8CAA8C;oBAC7D,cAAc,EAAE,2DAA2D;oBAC3E,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC/B,KAAK,EAAE,kCAAkC;iBAC1C,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,6BAA6B;gBAC5C,cAAc,EAAE,mDAAmD;gBACnE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,aAAa,EAAE,6BAA6B;gBAC5C,cAAc,EAAE,EAAE;gBAClB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC/B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,sBAAsB,CAAC,IAAoB;QACjD,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,SAAS;YAC9B,4CAA4C;YAC5C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,QAAQ;oBAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC;oBAAC,MAAM;gBACvD,KAAK,QAAQ;oBAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;oBAAC,MAAM;gBAC7C,KAAK,SAAS;oBAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;oBAAC,MAAM;gBAChD,KAAK,UAAU;oBAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAAC,MAAM;gBAC/D;oBAAS,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;oBAAC,MAAM;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,sBAAsB,CAAC,IAAoB;QACjD,wDAAwD;QACxD,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,QAAQ;gBAAE,SAAS,CAAC,sCAAsC;YACpE,0CAA0C;YAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,QAAQ;oBAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;oBAAC,MAAM;gBAChD,KAAK,QAAQ;oBAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC;oBAAC,MAAM;gBACzD,KAAK,SAAS;oBAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC;oBAAC,MAAM;gBACxD;oBAAS,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;oBAAC,MAAM;YAC3C,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/runtime/tool-verifier.d.ts

@@ -0,0 +1,18 @@
+import { ToolSandbox } from './tool-sandbox.js';
+import type { ToolDefinition, ToolVerification } from './types.js';
+export declare class ToolVerifier {
+    private sandbox;
+    constructor(sandbox?: ToolSandbox);
+    /**
+     * Run full verification on a tool: code analysis, security scan,
+     * and sandbox tests. Returns a ToolVerification report.
+     */
+    verify(tool: ToolDefinition, toolSourceDir: string): Promise<ToolVerification>;
+    private verifyCode;
+    private scanSecurity;
+    private determineVerdict;
+    private maxRisk;
+    private inferClaimSeverity;
+    private generateReasoning;
+    private makeRejection;
+}