wotann 0.5.0 → 0.5.39

package/dist/utils/platform.js

@@ -0,0 +1,146 @@
+/**
+ * platform — single source of truth for OS-aware system calls.
+ *
+ * WOTANN runs on macOS, Linux, AND Windows. POSIX assumptions
+ * scattered across the codebase (hardcoded `bash`, `/bin/sh`,
+ * `which`, literal `/tmp`, `process.env.HOME`, `:` PATH separator)
+ * silently break on Windows. This module centralizes the
+ * platform branches so callers route everything through one
+ * helper instead of duplicating `process.platform === "win32"`
+ * checks at every call site.
+ *
+ * Quality bars:
+ *   - Pure functions (no module-level state, no env mutation)
+ *   - Frozen return objects for shape stability
+ *   - Tests live in tests/utils/platform.test.ts and exercise
+ *     win32/darwin/linux branches via explicit overrides
+ */
+import { homedir, tmpdir } from "node:os";
+import { delimiter as pathDelimiter } from "node:path";
+/**
+ * Resolve the appropriate shell for the current platform.
+ *
+ * On Windows, returns cmd.exe with /c so callers can pass a single
+ * command string. POSIX systems use /bin/sh -c by default; bash is
+ * preferred when explicitly available but /bin/sh is the POSIX
+ * lowest-common-denominator (avoids "bash not on PATH" failures on
+ * minimal containers).
+ *
+ * Callers that need bash specifically (e.g. for arrays, [[ ]],
+ * process substitution) should branch on `process.platform` AND
+ * verify `bash` is on PATH via `whichBinary("bash")` first.
+ */
+export function getPlatformShell(platformOverride) {
+    const p = platformOverride ?? process.platform;
+    if (p === "win32") {
+        return Object.freeze({
+            cmd: "cmd.exe",
+            args: Object.freeze(["/c"]),
+        });
+    }
+    return Object.freeze({
+        cmd: "/bin/sh",
+        args: Object.freeze(["-c"]),
+    });
+}
+/**
+ * Build the argv for executing a single shell command portably.
+ * Returns the full argv ready to pass to `execFile` / `spawn`.
+ */
+export function buildShellCommand(command, platformOverride) {
+    const shell = getPlatformShell(platformOverride);
+    return Object.freeze({
+        file: shell.cmd,
+        argv: Object.freeze([...shell.args, command]),
+    });
+}
+/**
+ * Return the OS-appropriate "which" binary name. Windows ships
+ * `where.exe`; POSIX has `which` on PATH by default.
+ *
+ * Callers should invoke this and check exit code rather than parsing
+ * stdout — the `where`/`which` output formats differ (where emits
+ * absolute paths separated by CRLF; which emits one path per line).
+ */
+export function whichBinary(platformOverride) {
+    const p = platformOverride ?? process.platform;
+    return p === "win32" ? "where" : "which";
+}
+/**
+ * PATH list separator. POSIX uses `:`, Windows uses `;`. Centralized
+ * here so callers never inline the literal — that's a class of bug
+ * the prior audit caught at src/sandbox/extended-backends.ts:176.
+ */
+export function getPathDelimiter(platformOverride) {
+    const p = platformOverride ?? process.platform;
+    return p === "win32" ? ";" : ":";
+}
+/**
+ * Re-export from `node:path` for callers that want the canonical
+ * separator without re-importing node:path. Identical to
+ * `getPathDelimiter()` on every modern Node.
+ */
+export const PATH_DELIMITER = pathDelimiter;
+/**
+ * Resolve the user's home directory, OS-aware. `process.env.HOME`
+ * is empty on Windows by default — Node's `os.homedir()` reads from
+ * USERPROFILE on Windows and HOME elsewhere.
+ */
+export function getHomeDir() {
+    return homedir();
+}
+/**
+ * Resolve the OS-appropriate temp directory. Hardcoded `/tmp`
+ * literals fail on Windows; `process.env.TMPDIR` is POSIX-only.
+ * Node's `os.tmpdir()` is the canonical source.
+ */
+export function getTempDir() {
+    return tmpdir();
+}
+/**
+ * Best-effort chmod wrapper. POSIX file modes are meaningless on
+ * Windows FAT/exFAT; the SDK throws EINVAL/ENOSYS on those layers.
+ * Wraps the sync chmod in a try/catch so callers don't have to.
+ *
+ * Returns true when chmod succeeded, false when it threw — callers
+ * that need to confirm POSIX-mode semantics should branch on the
+ * return value. For pure "let me try to make this executable"
+ * use-cases, the return value can be ignored.
+ */
+export function chmodBestEffort(fs, filePath, mode) {
+    try {
+        fs.chmodSync(filePath, mode);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Resolve the platform-specific name of a Node tooling binary. On
+ * Windows, npm/npx/yarn/pnpm install as `.cmd` shims (e.g. npx.cmd)
+ * which spawnSync/execFile MUST receive literally — bare "npx" ENOENTs.
+ * On POSIX the bare name resolves via PATH.
+ */
+export function nodeToolBinary(name, platformOverride) {
+    const p = platformOverride ?? process.platform;
+    return p === "win32" ? `${name}.cmd` : name;
+}
+/**
+ * Convenience predicate for branches that need to know "are we on
+ * Windows right now". Equivalent to `process.platform === "win32"`
+ * but accepts an override for tests.
+ */
+export function isWindows(platformOverride) {
+    const p = platformOverride ?? process.platform;
+    return p === "win32";
+}
+/**
+ * Convenience predicate for macOS. Used by macOS-only paths like
+ * the seatbelt sandbox executor.
+ */
+export function isMacOS(platformOverride) {
+    const p = platformOverride ?? process.platform;
+    return p === "darwin";
+}
+//# sourceMappingURL=platform.js.map

package/dist/utils/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/utils/platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,WAAW,CAAC;AAevD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,gBAAoC;IACnE,MAAM,CAAC,GAAG,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC/C,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,gBAAoC;IAEpC,MAAM,KAAK,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK,CAAC,GAAG;QACf,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,gBAAoC;IAC9D,MAAM,CAAC,GAAG,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC/C,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,gBAAoC;IACnE,MAAM,CAAC,GAAG,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC/C,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAW,aAAa,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,MAAM,EAAE,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,EAAuD,EACvD,QAAgB,EAChB,IAAY;IAEZ,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,IAA6C,EAC7C,gBAAoC;IAEpC,MAAM,CAAC,GAAG,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC/C,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,gBAAoC;IAC5D,MAAM,CAAC,GAAG,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC/C,OAAO,CAAC,KAAK,OAAO,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,gBAAoC;IAC1D,MAAM,CAAC,GAAG,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC/C,OAAO,CAAC,KAAK,QAAQ,CAAC;AACxB,CAAC"}

package/dist/verification/auto-verify-policy.d.ts

@@ -0,0 +1,107 @@
+/**
+ * auto-verify-policy — Per-turn risk classifier + automatic verifier
+ * elevation policy.
+ *
+ * The verifier engine in src/verification/verifier-engine.ts is OFF by
+ * default (DEFAULT_VERIFIER_CONFIG.enabled === false) and opt-in via
+ * WOTANN_VERIFIER=1 / --verify. The user wants secondary AI watching
+ * the primary BY DEFAULT for any turn where the cost of a mistake is
+ * meaningful.
+ *
+ * This module is the policy layer that decides — per turn — whether
+ * to run the verifier, and at which mode (fast/balanced/deep). The
+ * decision is a pure function of the turn's classified risk:
+ *
+ *   - low risk         → no verifier (cheap)
+ *   - medium risk      → fast (3 strategies, cheap judge)
+ *   - high risk        → balanced (4 strategies + Guardian)
+ *   - critical risk    → deep (8 strategies, full coverage)
+ *
+ * Risk is computed from the turn's content: tool-call shapes,
+ * destructive intent, payment / auth / production keywords, file-write
+ * scope, model uncertainty signals, and known dangerous patterns.
+ *
+ * The classifier is COMPLETELY VENDOR-AGNOSTIC. It works on text +
+ * structured tool-call shapes; it does NOT call any LLM itself.
+ *
+ * Quality bars:
+ *   - QB#1 immutable: every input + decision is readonly
+ *   - QB#3 honest: returns a tagged decision; never throws
+ *   - QB#7 stateless: pure function, no module-level state
+ *   - QB#11 sibling-site: composes existing VerifierMode from
+ *     verification/types.ts; doesn't redefine
+ *   - QB#19 zombie-free: this module is wired via lib.ts barrel +
+ *     intended consumer is the runtime's verifier-middleware path
+ *
+ * Source: derived from Anthropic's "human-in-the-loop for affirmative
+ * consent" guidance and OpenAI's pending_safety_checks pattern.
+ */
+import type { VerifierMode } from "./types.js";
+export type RiskLevel = "low" | "medium" | "high" | "critical";
+export interface TurnArtifact {
+    /** The user's task / prompt for this turn. */
+    readonly userTask: string;
+    /** The model's draft response (or final, if pre-execution). */
+    readonly draftResponse: string;
+    /** Optional structured tool-call payload — when present, increases
+     *  risk significantly because actions could modify the world. */
+    readonly toolCalls?: ReadonlyArray<{
+        readonly name: string;
+        readonly input: unknown;
+    }>;
+    /** Optional file paths the turn intends to write — increases risk. */
+    readonly writePaths?: readonly string[];
+    /** Optional model self-confidence in [0,1]. Lower = higher risk. */
+    readonly modelConfidence?: number;
+    /** Optional caller-supplied risk hints (e.g. "production-tag") that
+     *  push the classification up a tier. */
+    readonly hints?: readonly string[];
+}
+export interface AutoVerifyDecision {
+    readonly run: boolean;
+    readonly mode: VerifierMode;
+    readonly risk: RiskLevel;
+    readonly reasons: readonly string[];
+    /** A confidence score in [0,1] for the risk classification itself. */
+    readonly classifierConfidence: number;
+}
+export interface PolicyConfig {
+    /** When true, ALWAYS verify regardless of risk (paranoid mode). */
+    readonly alwaysVerify?: boolean;
+    /** When true, NEVER verify (test override). */
+    readonly neverVerify?: boolean;
+    /** Override the per-tier mode mapping. */
+    readonly modeOverride?: Readonly<Record<RiskLevel, VerifierMode>>;
+    /** Sampling rate for medium-risk turns (default 1.0 — always run). */
+    readonly mediumSamplingRate?: number;
+    /** Custom RNG for deterministic tests. Returns [0,1). */
+    readonly rng?: () => number;
+}
+/**
+ * Pure risk classifier — same input always produces same output.
+ *
+ * Returns the risk level + a list of human-readable reasons (each
+ * keyword / signal that contributed) + a classifier confidence in
+ * [0,1] (how sure the classifier is — derived from the number of
+ * concurring signals).
+ */
+export declare function classifyRisk(turn: TurnArtifact): {
+    readonly risk: RiskLevel;
+    readonly reasons: readonly string[];
+    readonly confidence: number;
+};
+/**
+ * Decide whether (and how) to verify a given turn.
+ *
+ * Pure function: same TurnArtifact + same PolicyConfig → same
+ * AutoVerifyDecision. RNG is injectable for medium-tier sampling.
+ */
+export declare function decideAutoVerify(turn: TurnArtifact, config?: PolicyConfig): AutoVerifyDecision;
+/** Convenience predicate. */
+export declare function shouldAutoVerify(turn: TurnArtifact, config?: PolicyConfig): boolean;
+/**
+ * Render the auto-verify decision as a human-readable one-liner — used
+ * in CLI / TUI surfaces to explain WHY the verifier kicked in.
+ */
+export declare function explainDecision(decision: AutoVerifyDecision): string;
+//# sourceMappingURL=auto-verify-policy.d.ts.map

package/dist/verification/auto-verify-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-verify-policy.d.ts","sourceRoot":"","sources":["../../src/verification/auto-verify-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;qEACiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;QACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;KACzB,CAAC,CAAC;IACH,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,oEAAoE;IACpE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;6CACyC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAClE,sEAAsE;IACtE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,yDAAyD;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAuID;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG;IAChD,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAoFA;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,YAAY,EAClB,MAAM,GAAE,YAAiB,GACxB,kBAAkB,CAuCpB;AAED,6BAA6B;AAC7B,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAEnF;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAMpE"}

package/dist/verification/auto-verify-policy.js

@@ -0,0 +1,309 @@
+/**
+ * auto-verify-policy — Per-turn risk classifier + automatic verifier
+ * elevation policy.
+ *
+ * The verifier engine in src/verification/verifier-engine.ts is OFF by
+ * default (DEFAULT_VERIFIER_CONFIG.enabled === false) and opt-in via
+ * WOTANN_VERIFIER=1 / --verify. The user wants secondary AI watching
+ * the primary BY DEFAULT for any turn where the cost of a mistake is
+ * meaningful.
+ *
+ * This module is the policy layer that decides — per turn — whether
+ * to run the verifier, and at which mode (fast/balanced/deep). The
+ * decision is a pure function of the turn's classified risk:
+ *
+ *   - low risk         → no verifier (cheap)
+ *   - medium risk      → fast (3 strategies, cheap judge)
+ *   - high risk        → balanced (4 strategies + Guardian)
+ *   - critical risk    → deep (8 strategies, full coverage)
+ *
+ * Risk is computed from the turn's content: tool-call shapes,
+ * destructive intent, payment / auth / production keywords, file-write
+ * scope, model uncertainty signals, and known dangerous patterns.
+ *
+ * The classifier is COMPLETELY VENDOR-AGNOSTIC. It works on text +
+ * structured tool-call shapes; it does NOT call any LLM itself.
+ *
+ * Quality bars:
+ *   - QB#1 immutable: every input + decision is readonly
+ *   - QB#3 honest: returns a tagged decision; never throws
+ *   - QB#7 stateless: pure function, no module-level state
+ *   - QB#11 sibling-site: composes existing VerifierMode from
+ *     verification/types.ts; doesn't redefine
+ *   - QB#19 zombie-free: this module is wired via lib.ts barrel +
+ *     intended consumer is the runtime's verifier-middleware path
+ *
+ * Source: derived from Anthropic's "human-in-the-loop for affirmative
+ * consent" guidance and OpenAI's pending_safety_checks pattern.
+ */
+// ── Risk-keyword corpora ─────────────────────────────────────────────
+/**
+ * Keywords that strongly suggest critical risk (irreversible /
+ * monetary / auth / production). Triggers `critical` immediately.
+ */
+const CRITICAL_KEYWORDS = Object.freeze([
+    "production",
+    "prod-",
+    "rm -rf /",
+    "drop table",
+    "drop database",
+    "truncate table",
+    "delete from",
+    "force-push",
+    "force push",
+    "git reset --hard",
+    "wire $",
+    "wire $$$",
+    "send money",
+    "transfer funds",
+    "rotate token",
+    "reset password",
+    "create admin",
+    "grant root",
+    "sudo dd",
+    "format /",
+    "shutdown -h now",
+]);
+/**
+ * Keywords that suggest high risk (state mutation, secret handling).
+ * Pushes risk to `high` if not already critical.
+ */
+const HIGH_KEYWORDS = Object.freeze([
+    "delete",
+    "remove",
+    "drop",
+    "truncate",
+    "uninstall",
+    "secret",
+    "api key",
+    "token",
+    "credential",
+    "password",
+    "ssh key",
+    "private key",
+    "cert",
+    "sign",
+    "deploy",
+    "release",
+    "publish",
+    "merge to main",
+    "merge to master",
+    "force",
+    "override",
+    "bypass",
+    "disable safety",
+    "ignore previous",
+    "run as root",
+    "chown",
+    "chmod 777",
+    "git rebase",
+]);
+/**
+ * Keywords that suggest medium risk (writes that are reversible but
+ * still modify the world).
+ */
+const MEDIUM_KEYWORDS = Object.freeze([
+    "write",
+    "modify",
+    "edit",
+    "update",
+    "rename",
+    "move",
+    "create",
+    "install",
+    "upgrade",
+    "commit",
+    "push",
+    "pull",
+    "checkout",
+]);
+/** Tool names that elevate risk by themselves. */
+const RISKY_TOOL_NAMES = new Set([
+    "bash",
+    "shell",
+    "exec",
+    "run_command",
+    "rm",
+    "delete_file",
+    "git_force_push",
+    "deploy",
+    "publish",
+    "send_email",
+    "wire_money",
+    "create_user",
+    "grant_role",
+    "rotate_secret",
+]);
+// ── Helpers ──────────────────────────────────────────────────────────
+function lower(s) {
+    return s.toLowerCase();
+}
+function containsAny(haystack, needles) {
+    const matches = [];
+    for (const n of needles) {
+        if (haystack.includes(n))
+            matches.push(n);
+    }
+    return matches;
+}
+function escalate(current, next) {
+    const order = ["low", "medium", "high", "critical"];
+    return order.indexOf(next) > order.indexOf(current) ? next : current;
+}
+// ── Default mode mapping ─────────────────────────────────────────────
+const DEFAULT_MODE_MAP = Object.freeze({
+    low: "off",
+    medium: "fast",
+    high: "balanced",
+    critical: "deep",
+});
+// ── Classifier ───────────────────────────────────────────────────────
+/**
+ * Pure risk classifier — same input always produces same output.
+ *
+ * Returns the risk level + a list of human-readable reasons (each
+ * keyword / signal that contributed) + a classifier confidence in
+ * [0,1] (how sure the classifier is — derived from the number of
+ * concurring signals).
+ */
+export function classifyRisk(turn) {
+    const reasons = [];
+    let risk = "low";
+    const haystack = `${lower(turn.userTask)}\n${lower(turn.draftResponse)}`;
+    // 1. Critical-keyword scan (pushes straight to critical).
+    const critMatches = containsAny(haystack, CRITICAL_KEYWORDS);
+    for (const m of critMatches)
+        reasons.push(`critical-keyword: "${m}"`);
+    if (critMatches.length > 0)
+        risk = escalate(risk, "critical");
+    // 2. High-keyword scan.
+    const highMatches = containsAny(haystack, HIGH_KEYWORDS);
+    for (const m of highMatches)
+        reasons.push(`high-keyword: "${m}"`);
+    if (highMatches.length > 0)
+        risk = escalate(risk, "high");
+    // 3. Medium-keyword scan.
+    const medMatches = containsAny(haystack, MEDIUM_KEYWORDS);
+    for (const m of medMatches)
+        reasons.push(`medium-keyword: "${m}"`);
+    if (medMatches.length > 0)
+        risk = escalate(risk, "medium");
+    // 4. Tool-call scan.
+    if (turn.toolCalls && turn.toolCalls.length > 0) {
+        risk = escalate(risk, "medium");
+        reasons.push(`tool-calls: ${turn.toolCalls.length}`);
+        for (const tc of turn.toolCalls) {
+            if (RISKY_TOOL_NAMES.has(tc.name)) {
+                risk = escalate(risk, "high");
+                reasons.push(`risky-tool: ${tc.name}`);
+            }
+        }
+    }
+    // 5. Write-path scan.
+    if (turn.writePaths && turn.writePaths.length > 0) {
+        risk = escalate(risk, "medium");
+        reasons.push(`write-paths: ${turn.writePaths.length}`);
+        for (const p of turn.writePaths) {
+            const lp = lower(p);
+            if (lp.startsWith("/etc/") ||
+                lp.startsWith("/usr/") ||
+                lp.startsWith("/system/") ||
+                lp.includes(".env") ||
+                lp.includes("secrets") ||
+                lp.includes("credentials")) {
+                risk = escalate(risk, "critical");
+                reasons.push(`sensitive-path: ${p}`);
+            }
+        }
+    }
+    // 6. Low model confidence.
+    if (typeof turn.modelConfidence === "number" && turn.modelConfidence < 0.5) {
+        risk = escalate(risk, "medium");
+        reasons.push(`low-confidence: ${turn.modelConfidence.toFixed(2)}`);
+    }
+    // 7. Caller hints.
+    if (turn.hints) {
+        for (const h of turn.hints) {
+            if (h === "production-tag" || h === "destructive" || h === "irreversible") {
+                risk = escalate(risk, "critical");
+                reasons.push(`hint: ${h}`);
+            }
+            else if (h === "auth" || h === "money" || h === "deploy") {
+                risk = escalate(risk, "high");
+                reasons.push(`hint: ${h}`);
+            }
+            else {
+                reasons.push(`hint: ${h}`);
+            }
+        }
+    }
+    // Confidence: derived from number of concurring signals. >=4 signals
+    // is high confidence; 1 is low.
+    const sigCount = reasons.filter((r) => !r.startsWith("hint:") || r.startsWith("hint: ")).length;
+    const confidence = Math.min(1, sigCount / 4);
+    return Object.freeze({
+        risk,
+        reasons: Object.freeze(reasons),
+        confidence,
+    });
+}
+// ── Decision API ─────────────────────────────────────────────────────
+/**
+ * Decide whether (and how) to verify a given turn.
+ *
+ * Pure function: same TurnArtifact + same PolicyConfig → same
+ * AutoVerifyDecision. RNG is injectable for medium-tier sampling.
+ */
+export function decideAutoVerify(turn, config = {}) {
+    if (config.neverVerify) {
+        return Object.freeze({
+            run: false,
+            mode: "off",
+            risk: "low",
+            reasons: Object.freeze(["policy: neverVerify"]),
+            classifierConfidence: 1,
+        });
+    }
+    const classified = classifyRisk(turn);
+    const modeMap = config.modeOverride ?? DEFAULT_MODE_MAP;
+    let mode = modeMap[classified.risk];
+    if (config.alwaysVerify && mode === "off")
+        mode = "fast";
+    let run = mode !== "off";
+    // Medium-tier sampling — caller can dial down to e.g. 0.3 to verify
+    // only 30% of medium-risk turns.
+    if (run && classified.risk === "medium") {
+        const samplingRate = config.mediumSamplingRate ?? 1.0;
+        if (samplingRate < 1.0) {
+            const rng = config.rng ?? Math.random;
+            if (rng() >= samplingRate) {
+                run = false;
+                mode = "off";
+            }
+        }
+    }
+    return Object.freeze({
+        run,
+        mode,
+        risk: classified.risk,
+        reasons: classified.reasons,
+        classifierConfidence: classified.confidence,
+    });
+}
+/** Convenience predicate. */
+export function shouldAutoVerify(turn, config) {
+    return decideAutoVerify(turn, config).run;
+}
+// ── Reporting ────────────────────────────────────────────────────────
+/**
+ * Render the auto-verify decision as a human-readable one-liner — used
+ * in CLI / TUI surfaces to explain WHY the verifier kicked in.
+ */
+export function explainDecision(decision) {
+    if (!decision.run) {
+        return `verifier: skipped (risk=${decision.risk})`;
+    }
+    const reasonSummary = decision.reasons.slice(0, 3).join("; ");
+    return `verifier: ${decision.mode} (risk=${decision.risk}, ${reasonSummary})`;
+}
+//# sourceMappingURL=auto-verify-policy.js.map

package/dist/verification/auto-verify-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-verify-policy.js","sourceRoot":"","sources":["../../src/verification/auto-verify-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAkDH,wEAAwE;AAExE;;;GAGG;AACH,MAAM,iBAAiB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACzD,YAAY;IACZ,OAAO;IACP,UAAU;IACV,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,kBAAkB;IAClB,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,SAAS;IACT,UAAU;IACV,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,aAAa,GAAsB,MAAM,CAAC,MAAM,CAAC;IACrD,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,UAAU;IACV,WAAW;IACX,QAAQ;IACR,SAAS;IACT,OAAO;IACP,YAAY;IACZ,UAAU;IACV,SAAS;IACT,aAAa;IACb,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,SAAS;IACT,eAAe;IACf,iBAAiB;IACjB,OAAO;IACP,UAAU;IACV,QAAQ;IACR,gBAAgB;IAChB,iBAAiB;IACjB,aAAa;IACb,OAAO;IACP,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,eAAe,GAAsB,MAAM,CAAC,MAAM,CAAC;IACvD,OAAO;IACP,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,SAAS;IACT,SAAS;IACT,QAAQ;IACR,MAAM;IACN,MAAM;IACN,UAAU;CACX,CAAC,CAAC;AAEH,kDAAkD;AAClD,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,MAAM;IACN,OAAO;IACP,MAAM;IACN,aAAa;IACb,IAAI;IACJ,aAAa;IACb,gBAAgB;IAChB,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,eAAe;CAChB,CAAC,CAAC;AAEH,wEAAwE;AAExE,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,OAA0B;IAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,OAAkB,EAAE,IAAe;IACnD,MAAM,KAAK,GAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC;AAED,wEAAwE;AAExE,MAAM,gBAAgB,GAA8C,MAAM,CAAC,MAAM,CAAC;IAChF,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,MAAM;CACjB,CAAC,CAAC;AAEH,wEAAwE;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAkB;IAK7C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAc,KAAK,CAAC;IAE5B,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;IAEzE,0DAA0D;IAC1D,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAE9D,wBAAwB;IACxB,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE1D,0BAA0B;IAC1B,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACnE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE3D,qBAAqB;IACrB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACpB,IACE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;gBACtB,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;gBACtB,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBACzB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnB,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACtB,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC1B,CAAC;gBACD,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAClC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC;QAC3E,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,mBAAmB;IACnB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,gBAAgB,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;gBAC1E,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAClC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;iBAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC3D,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,gCAAgC;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAChG,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IAE7C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAsB;QACpD,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAkB,EAClB,SAAuB,EAAE;IAEzB,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAsB;YACpE,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACxD,IAAI,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAEpC,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,KAAK,KAAK;QAAE,IAAI,GAAG,MAAM,CAAC;IAEzD,IAAI,GAAG,GAAG,IAAI,KAAK,KAAK,CAAC;IAEzB,oEAAoE;IACpE,iCAAiC;IACjC,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,MAAM,CAAC,kBAAkB,IAAI,GAAG,CAAC;QACtD,IAAI,YAAY,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC;YACtC,IAAI,GAAG,EAAE,IAAI,YAAY,EAAE,CAAC;gBAC1B,GAAG,GAAG,KAAK,CAAC;gBACZ,IAAI,GAAG,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG;QACH,IAAI;QACJ,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,oBAAoB,EAAE,UAAU,CAAC,UAAU;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,6BAA6B;AAC7B,MAAM,UAAU,gBAAgB,CAAC,IAAkB,EAAE,MAAqB;IACxE,OAAO,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED,wEAAwE;AAExE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,QAA4B;IAC1D,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAClB,OAAO,2BAA2B,QAAQ,CAAC,IAAI,GAAG,CAAC;IACrD,CAAC;IACD,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,aAAa,QAAQ,CAAC,IAAI,UAAU,QAAQ,CAAC,IAAI,KAAK,aAAa,GAAG,CAAC;AAChF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wotann",
-  "version": "0.5.0",
+  "version": "0.5.39",
   "description": "WOTANN — The All-Father of AI Agent Harnesses",
   "type": "module",
   "main": "dist/index.js",
@@ -33,6 +33,7 @@
   "homepage": "https://wotann.com",
   "scripts": {
     "build": "tsc && chmod +x dist/index.js",
+    "build:clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc && chmod +x dist/index.js",
     "dev": "tsx src/index.ts",
     "start": "node dist/index.js",
     "typecheck": "tsc --noEmit",
@@ -48,6 +49,7 @@
     "sounds:generate": "node scripts/generate-sound-cues.mjs",
     "sounds:check": "node scripts/generate-sound-cues.mjs --check-only",
     "prepare": "tsc && chmod +x dist/index.js",
+    "prepublishOnly": "npm run build:clean",
     "postinstall": "node -e \"try { require('node:fs').chmodSync('dist/index.js', 0o755); } catch {}\"",
     "wotann": "tsx src/index.ts",
     "test-provider": "tsx src/cli/test-provider.ts"
@@ -69,6 +71,7 @@
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "ink": "^6.8.0",
+    "ink-text-input": "^6.0.0",
     "isomorphic-dompurify": "^3.10.0",
     "magic-bytes.js": "^1.13.0",
     "react": "^19.2.4",