@sema-agent/core/dist/core/safety-merge-corpus.js

Stateless, task-oriented AI agent core

export const SAFETY_MERGE_CONFORMANCE_CORPUS = [
    {
        name: "deny-removed",
        intent: "removing an org-published toolDeny loosens (the tool becomes usable again)",
        prior: { toolDeny: ["Bash"] },
        next: {},
        loosens: true,
        reasons: ['removed toolDeny "Bash"'],
    },
    {
        name: "command-deny-removed",
        intent: "removing a shell command rule from toolDeny loosens (the command runs again)",
        prior: { toolDeny: ["Bash(rm:*)"] },
        next: { toolDeny: [] },
        loosens: true,
        reasons: ['removed toolDeny "Bash(rm:*)"'],
    },
    {
        name: "toolAllow-removed-all-allowed",
        intent: "dropping an allowlist entirely = all-allowed = the maximal loosen",
        prior: { toolAllow: ["Read"] },
        next: {},
        loosens: true,
        reasons: ["removed toolAllow allowlist (all allowed)"],
    },
    {
        name: "toolAllow-widened",
        intent: "adding a tool outside the org allowlist loosens",
        prior: { toolAllow: ["Read"] },
        next: { toolAllow: ["Read", "Bash"] },
        loosens: true,
        reasons: ['widened toolAllow with "Bash"'],
    },
    {
        name: "command-allow-widened",
        intent: "adding a shell command rule outside the org allowlist loosens",
        prior: { toolAllow: ["Read", "Bash(ls:*)"] },
        next: { toolAllow: ["Read", "Bash(ls:*)", "Bash(curl:*)"] },
        loosens: true,
        reasons: ['widened toolAllow with "Bash(curl:*)"'],
    },
    {
        name: "allowDirs-confinement-removed",
        intent: "removing path confinement (next has none) loosens to the whole filesystem",
        prior: { allowDirs: ["/repo"] },
        next: {},
        loosens: true,
        reasons: ["removed allowDirs confinement"],
    },
    {
        name: "allowDirs-widened-outside",
        intent: "adding a dir not lexically within any org dir loosens",
        prior: { allowDirs: ["/repo"] },
        next: { allowDirs: ["/repo", "/etc"] },
        loosens: true,
        reasons: ['widened allowDirs with "/etc"'],
    },
    {
        name: "multi-axis-loosen",
        intent: "a single override can loosen on multiple axes — all reasons surface",
        prior: { toolDeny: ["Bash"], allowDirs: ["/repo"] },
        next: { allowDirs: ["/repo", "/x"] },
        loosens: true,
        reasons: ['removed toolDeny "Bash"', 'widened allowDirs with "/x"'],
    },
    {
        name: "allowDirs-confinement-removed-empty-array",
        intent: "an EXPLICIT empty allowDirs [] removes confinement exactly like undefined (loosenReasons branches on .length===0) — center must treat [] and absent identically",
        prior: { allowDirs: ["/repo"] },
        next: { allowDirs: [] },
        loosens: true,
        reasons: ["removed allowDirs confinement"],
    },
    {
        name: "allowDirs-prefix-not-boundary-loosen",
        intent: "🔴 the classic path bug: /repository is NOT within /repo (containment is BOUNDARY-aware, not naive startsWith) → this LOOSENS; a forked center predicate using startsWith would wrongly accept it",
        prior: { allowDirs: ["/repo"] },
        next: { allowDirs: ["/repository"] },
        loosens: true,
        reasons: ['widened allowDirs with "/repository"'],
    },
    {
        name: "allowDirs-relative-dir-loosen",
        intent: "a relative dir is not within an absolute org dir → loosens (loosenReasons compares RAW inputs; normalization is the store's job, not the predicate's)",
        prior: { allowDirs: ["/repo"] },
        next: { allowDirs: ["repo"] },
        loosens: true,
        reasons: ['widened allowDirs with "repo"'],
    },
    {
        name: "multi-entry-deny-removed",
        intent: "removing multiple deny entries in one override emits one reason PER entry — pins that center must ACCUMULATE reasons, not short-circuit on the first",
        prior: { toolDeny: ["A", "B", "C"] },
        next: { toolDeny: ["B"] },
        loosens: true,
        reasons: ['removed toolDeny "A"', 'removed toolDeny "C"'],
    },
    {
        name: "deny-added",
        intent: "adding a deny only tightens",
        prior: {},
        next: { toolDeny: ["Bash"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "toolAllow-narrowed",
        intent: "removing an entry from an allowlist only tightens",
        prior: { toolAllow: ["Read", "Bash"] },
        next: { toolAllow: ["Read"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "allowlist-added-from-all",
        intent: "introducing an allowlist where there was none narrows from all-allowed (safe)",
        prior: {},
        next: { toolAllow: ["Read"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "allowDirs-narrowed-to-subdir",
        intent: "narrowing confinement to a subdir within the org dir is safe",
        prior: { allowDirs: ["/repo"] },
        next: { allowDirs: ["/repo/src"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "allowDirs-added-confinement",
        intent: "adding confinement where there was none (org had no allowDirs) only tightens",
        prior: {},
        next: { allowDirs: ["/repo"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "identical-noop",
        intent: "an identical override is a no-op (safe)",
        prior: { toolDeny: ["Bash"], allowDirs: ["/repo"] },
        next: { toolDeny: ["Bash"], allowDirs: ["/repo"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "empty-empty",
        intent: "no rules either side is safe",
        prior: {},
        next: {},
        loosens: false,
        reasons: [],
    },
    {
        name: "allowDirs-prior-empty-array-safe",
        intent: "an org-published EMPTY allowDirs [] imposes NO confinement (the .length>0 guard is false), so widening it is genuinely not a loosen — center must not treat [] as a confinement",
        prior: { allowDirs: [] },
        next: { allowDirs: ["/etc"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "allowDirs-trailing-slash-safe",
        intent: "/repo/ is within /repo (trailing-slash boundary normalization in lexWithin) → safe",
        prior: { allowDirs: ["/repo"] },
        next: { allowDirs: ["/repo/"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "allowDirs-root-prior-safe",
        intent: "an org dir of '/' contains everything (root special-case) → any narrower next is safe",
        prior: { allowDirs: ["/"] },
        next: { allowDirs: ["/anything"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "inert-deny-entry-removed-safe",
        intent: "removing a deny entry the grammar reads that names nothing (a wildcard peer, a `__` name with no protocol prefix) relaxes nothing — the comparison reads the EFFECTIVE entries on both sides",
        prior: { toolDeny: ["Bash", "mcp__*", "github__x"] },
        next: { toolDeny: ["Bash"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "unreadable-deny-prior-loosened",
        intent: "rules whose toolDeny holds an entry no rule grammar reads (an empty entry) cannot be read and refuse every call — an override that can be read loosens them",
        prior: { toolDeny: ["Bash", ""] },
        next: { toolDeny: ["Bash"] },
        loosens: true,
        reasons: ['the prior rules refuse every call — their toolDeny holds "" (grammar), which no grammar reads'],
    },
    {
        name: "unreadable-deny-next-safe",
        intent: "an override whose toolDeny holds an entry no rule grammar reads refuses every call — it loosens nothing, whatever else it drops",
        prior: { toolDeny: ["Bash"], allowDirs: ["/repo"] },
        next: { toolDeny: [""] },
        loosens: false,
        reasons: [],
    },
    {
        name: "inert-allow-entry-added-safe",
        intent: "adding an allowlist entry that reads as nothing admits nothing, so it widens nothing",
        prior: { toolAllow: ["Read"] },
        next: { toolAllow: ["Read", "mcp__*"] },
        loosens: false,
        reasons: [],
    },
];