Security Model

// AgentScript Pre-Scanner settings (automatic with CodeCall)
{
  regexMode: 'block',        // Block ALL regex literals
  maxInputSize: 50_000,      // 50KB limit
  maxNestingDepth: 30,       // Conservative nesting
  bidiMode: 'strict',        // Block all BiDi characters
}

import { createAgentScriptPreset } from 'ast-guard';

const preset = createAgentScriptPreset({
  // Whitelist-only globals
  allowedGlobals: [
    'callTool', 'getTool', 'codecallContext',
    'Math', 'JSON', 'Array', 'Object', 'String', 'Number', 'Date',
    'console', // optional, controlled by allowConsole
  ],

  // Only bounded loops allowed
  allowedLoops: {
    allowFor: true,      // for (let i = 0; i < n; i++)
    allowForOf: true,    // for (const x of array)
    allowWhile: false,   // ❌ blocked
    allowDoWhile: false, // ❌ blocked
    allowForIn: false,   // ❌ blocked (prototype walking)
  },

  // Arrow functions only (no recursion)
  allowArrowFunctions: true,
});

// ✅ Tool calls
const users = await callTool('users:list', { limit: 100 });

// ✅ Variables
const filtered = users.filter(u => u.active);
let count = 0;

// ✅ Bounded loops
for (let i = 0; i < users.length; i++) { count++; }
for (const user of users) { console.log(user.name); }

// ✅ Array methods with arrow functions
const names = users.map(u => u.name);
const total = users.reduce((sum, u) => sum + u.score, 0);

// ✅ Safe built-ins
const max = Math.max(1, 2, 3);
const parsed = JSON.parse('{"a":1}');
const keys = Object.keys(obj);

// ✅ Context access (read-only)
const tenant = codecallContext.tenantId;

// ✅ Return values
return { count, names, total };

// Input
const users = await callTool('users:list', {});
for (const user of users) {
  console.log(user.name);
}
return users.length;

// Transformed
async function __ag_main() {
  const users = await __safe_callTool('users:list', {});
  __safe_forOf(users, (user) => {
    __safe_console.log(user.name);
  });
  return users.length;
}

// ❌ BLOCKED by AST validation
const __ag_hack = 'foo';
let __safe_bypass = 123;

// This code triggers EXFIL_PATTERN + SENSITIVE_FIELD + EXCESSIVE_LIMIT
const users = await callTool('users:list', {
  limit: 100000,
  fields: ['email', 'password', 'apiKey']
});
await callTool('webhooks:send', { data: users });

// Score breakdown:
// - SENSITIVE_FIELD: +35 (password, apiKey)
// - EXCESSIVE_LIMIT: +25 (100000 > 10000)
// - EXFIL_PATTERN: +50 (list → send)
// Total: 110 → BLOCKED (critical risk)

import { createEnclave } from 'enclave-vm';

const enclave = createEnclave({
  scoringGate: {
    scorer: 'rule-based',    // 'disabled' | 'rule-based' | 'external-api'
    blockThreshold: 70,      // Block if score >= 70
    warnThreshold: 40,       // Warn if score >= 40
    failOpen: true,          // Allow on scorer errors (production default)
    cache: {
      enabled: true,
      ttlMs: 60000,          // Cache scores for 1 minute
      maxEntries: 1000,
    },
  },
});

const result = await enclave.run(code, { tools });

console.log(result.scoringResult);
// {
//   allowed: true,
//   warned: true,
//   totalScore: 45,
//   riskLevel: 'medium',
//   signals: [
//     { id: 'EXCESSIVE_LIMIT', score: 25, message: 'Limit 15000 > 10000' },
//     { id: 'WILDCARD_QUERY', score: 20, message: 'Wildcard query "*" detected' }
//   ],
//   latencyMs: 0.8,
//   cached: false
// }

interface ExtractedFeatures {
  // Tool call metadata
  toolCalls: Array<{
    name: string;           // Tool name (literal or 'DYNAMIC')
    argsPattern: string[];  // Argument keys/patterns
    inLoop: boolean;        // Called inside a loop?
    loopDepth: number;      // Nesting level
  }>;

  // Pattern signals
  patterns: {
    hasLoopedToolCalls: boolean;
    hasNestedLoops: boolean;
    maxLoopNesting: number;
    totalIterations: number; // Estimated from literals
  };

  // Numeric signals
  numerics: {
    maxLimit: number;       // Largest limit/count value
    totalStringLength: number;
    fanOutRisk: number;     // Loop count × tool calls
  };

  // Sensitive data signals
  sensitive: {
    fieldsAccessed: string[];  // password, token, etc.
    hasWildcard: boolean;
    hasBulkOperation: boolean;
  };

  // Code metrics
  metrics: {
    hash: string;           // SHA-256 for caching
    lineCount: number;
    complexity: number;     // Cyclomatic complexity
  };
}

import { RuleBasedScorer, ScoringRule } from 'enclave-vm';

const customRule: ScoringRule = {
  id: 'CUSTOM_PII_ACCESS',
  evaluate: (features) => {
    const piiFields = ['ssn', 'dob', 'address', 'phone'];
    const accessed = features.sensitive.fieldsAccessed
      .filter(f => piiFields.some(pii => f.includes(pii)));

    if (accessed.length > 0) {
      return {
        score: accessed.length * 15,
        description: `PII fields accessed: ${accessed.join(', ')}`,
        level: accessed.length > 2 ? 'high' : 'medium',
      };
    }
    return null;
  },
};

const scorer = new RuleBasedScorer({
  customRules: [customRule],
});

CodeCallPlugin.init({
  vm: {
    preset: 'secure',  // Uses defaults above
    timeoutMs: 5000,   // Override timeout
  },
});

CodeCallPlugin.init({
  vm: {
    preset: 'secure',  // Maps to SECURE level
    timeoutMs: 5000,   // Override specific values as needed
  },
});

import { Enclave } from 'enclave-vm';

const enclave = new Enclave({
  adapter: 'worker_threads',  // Enable Worker Pool
  workerPoolConfig: {
    minWorkers: 2,
    maxWorkers: 8,
    memoryLimitPerWorker: 256 * 1024 * 1024,  // 256MB
  },
});

// These strings in globals trigger validation errors
const DANGEROUS_PATTERNS = [
  'eval',
  'Function',
  'require',
  'import',
  'process',
  'global',
  'globalThis',
  'setTimeout',
  'setInterval',
  'setImmediate',
];

CodeCallPlugin.init({
  vm: {
    globals: {
      // ✅ Valid - primitive values
      tenantId: 'tenant-123',
      maxLimit: 1000,
      isProduction: true,

      // ✅ Valid - plain objects
      config: {
        apiVersion: 'v2',
        features: ['search', 'export'],
      },

      // ✅ Valid - arrays
      allowedRegions: ['us-east', 'eu-west'],
    },
  },
});

CodeCallPlugin.init({
  vm: {
    globals: {
      // ❌ Invalid - functions are stripped
      helper: (x) => x * 2,

      // ❌ Invalid - getters rejected
      computed: {
        get value() { return Date.now(); },
      },

      // ❌ Invalid - dangerous keys rejected
      __proto__: {},
      constructor: {},

      // ❌ Invalid - too deep (>10 levels)
      deeply: { nested: { objects: { will: { be: { rejected: {} } } } } },
    },
  },
});

// Inside codecall:execute script
// ❌ BLOCKED - Self-reference detected
const result = await callTool('codecall:execute', {
  script: 'return "nested"'
});
// Returns: { success: false, error: { code: 'SELF_REFERENCE_BLOCKED' } }

// ❌ Also blocked
await callTool('codecall:search', { query: 'users' });
await callTool('codecall:describe', { toolNames: ['users:list'] });
await callTool('codecall:invoke', { tool: 'users:list', input: {} });

// execute.tool.ts - First line of callTool handler
assertNotSelfReference(toolName);  // Throws if codecall:* tool

const DEFAULT_BLACKLIST = [
  'system:*',    // System administration tools
  'internal:*',  // Internal/private tools
  '__*',         // Internal implementation tools
];

CodeCallPlugin.init({
  toolAccess: {
    mode: 'blacklist',
    patterns: [
      'admin:*',       // Block all admin tools
      'users:delete',  // Block specific tool
      '*:export',      // Block all export operations
    ],
  },
});

CodeCallPlugin.init({
  toolAccess: {
    mode: 'whitelist',
    patterns: [
      'users:list',
      'users:get',
      'orders:list',
      // Only these 3 tools are accessible
    ],
  },
});

CodeCallPlugin.init({
  toolAccess: {
    mode: 'dynamic',
    evaluator: async (toolName, context) => {
      // Check tenant permissions
      const allowed = await checkPermission(
        context.tenantId,
        toolName
      );
      return {
        allowed,
        reason: allowed ? undefined : 'Tool not authorized for tenant',
      };
    },
  },
});

// Direct call from script
await callTool('users:list', {});  // depth: 1

// Tool calls another tool (if allowed)
// Inside users:list:
await callTool('cache:get', {});   // depth: 2

// Input types are converted to safe representations
Date        → ISO string
Error       → { name, message, code? }
RegExp      → string pattern
Map         → plain object
Set         → array
Buffer      → "[Buffer]"
ArrayBuffer → "[ArrayBuffer]"

// Script returns circular reference
const obj = { name: 'test' };
obj.self = obj;
return obj;

// Sanitized output
{
  "name": "test",
  "self": "[Circular]"
}

Bearer [token]     → Bearer [REDACTED]
Authorization: ... → Authorization: [REDACTED]
api_key=xxx        → api_key=[REDACTED]
password=xxx       → password=[REDACTED]

// Before sanitization (DANGEROUS - leaks infrastructure details)
{
  "error": {
    "message": "Cannot read property 'foo' of undefined",
    "stack": "TypeError: Cannot read property 'foo'\n    at processUser (/home/deploy/app/src/handlers/users.ts:42:15)\n    at /home/deploy/app/node_modules/@company/sdk/dist/index.js:156:23",
    "path": "/home/deploy/app/src/handlers/users.ts",
    "env": "production",
    "dbHost": "postgres.internal.company.com"
  }
}

// After sanitization (SAFE)
{
  "error": {
    "message": "Cannot read property 'foo' of undefined",
    "stack": "TypeError: Cannot read property 'foo'\n    at processUser (...)\n    at (...)",
    "code": "RUNTIME_ERROR"
  }
}

// Example error response
{
  "status": "illegal_access",
  "error": {
    "kind": "IllegalBuiltinAccess",
    "message": "Identifier 'eval' is not allowed in AgentScript"
  }
}