fleetforge_runtime/

guardrails.rs

use std::any::type_name_of_val;
use std::sync::{Arc, Mutex};

use anyhow::{anyhow, Result};
use async_trait::async_trait;
use chrono::{DateTime, Utc};
use fleetforge_policy::packs::embedded_prompt_injection;
use fleetforge_policy::{
    BasicPiiPolicy, BudgetCapsPolicy, Decision, Decision as PolicyDecision, DecisionEffect,
    PiiMode, PolicyEngine, PolicyRequest, ToolAclPolicy,
};
use json_patch::Patch;
use serde::Serialize;
use serde_json::{json, Value};
use uuid::Uuid;

use crate::model::{RunId, StepId};
use fleetforge_trust::TrustBoundary;
use futures::future::join_all;
use once_cell::sync::Lazy;
use regex::Regex;
use tracing::warn;
use url::Url;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
enum PolicyHook {
    Pre,
    Mid,
    Post,
    Any,
}

impl PolicyHook {
    fn applies_to(self, boundary: &TrustBoundary) -> bool {
        match self {
            PolicyHook::Any => true,
            PolicyHook::Pre => matches!(
                boundary,
                TrustBoundary::IngressPrompt
                    | TrustBoundary::IngressTool
                    | TrustBoundary::IngressMemory
                    | TrustBoundary::IngressDocument
                    | TrustBoundary::Scheduler
            ),
            PolicyHook::Mid => matches!(boundary, TrustBoundary::Executor),
            PolicyHook::Post => matches!(
                boundary,
                TrustBoundary::EgressPrompt
                    | TrustBoundary::EgressTool
                    | TrustBoundary::EgressMemory
                    | TrustBoundary::Artifact
                    | TrustBoundary::Gateway
            ),
        }
    }
}

/// Allowlist constraint for outbound HTTP calls.
#[derive(Clone, Debug)]
pub struct HttpAllowRule {
    pub host: String,
    pub path_prefix: Option<String>,
}

/// Captures a single policy engine's contribution to a bundle decision.
#[derive(Debug, Clone, Serialize)]
pub struct PolicyDecisionTrace {
    pub policy: String,
    pub effect: DecisionEffect,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub reason: Option<String>,
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub patches: Vec<Value>,
}

/// Structured audit record for guardrail evaluations.
#[derive(Debug, Clone, Serialize)]
pub struct PolicyEvaluationRecord {
    pub boundary: TrustBoundary,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub run_id: Option<Uuid>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub step_id: Option<Uuid>,
    pub effect: DecisionEffect,
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub reasons: Vec<String>,
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub decisions: Vec<PolicyDecisionTrace>,
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub patches: Vec<Value>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub payload: Option<Value>,
    pub timestamp: DateTime<Utc>,
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub origins: Vec<Value>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub preview: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub attestation_id: Option<Uuid>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub attestation: Option<Value>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub trust_decision: Option<Value>,
}

#[derive(Clone)]
struct PolicyStage {
    name: String,
    engine: Arc<dyn PolicyEngine>,
    hooks: Vec<PolicyHook>,
}

impl PolicyStage {
    fn new(name: String, engine: Arc<dyn PolicyEngine>) -> Self {
        Self {
            name,
            engine,
            hooks: vec![PolicyHook::Any],
        }
    }

    fn with_hooks(name: String, engine: Arc<dyn PolicyEngine>, hooks: Vec<PolicyHook>) -> Self {
        Self {
            name,
            engine,
            hooks,
        }
    }

    fn applies(&self, boundary: &TrustBoundary) -> bool {
        if self.hooks.is_empty() {
            return true;
        }
        self.hooks.iter().any(|hook| hook.applies_to(boundary))
    }
}

/// Outcome of evaluating all guardrail policies in a bundle.
#[derive(Debug)]
pub struct BundleOutcome {
    pub effect: DecisionEffect,
    pub value: Value,
    pub reasons: Vec<String>,
    pub decisions: Vec<PolicyDecisionTrace>,
    pub patches: Vec<Value>,
}

impl BundleOutcome {
    pub fn allow(value: Value) -> Self {
        Self {
            effect: DecisionEffect::Allow,
            value,
            reasons: Vec::new(),
            decisions: Vec::new(),
            patches: Vec::new(),
        }
    }

    pub fn summary(&self) -> String {
        if self.reasons.is_empty() {
            format!("{:?}", self.effect)
        } else {
            self.reasons.join("; ")
        }
    }
}

/// Aggregates multiple policy engines and folds their decisions.
#[derive(Clone)]
pub struct PolicyBundle {
    policies: Vec<PolicyStage>,
    events: Arc<Mutex<Vec<PolicyEvaluationRecord>>>,
}

impl PolicyBundle {
    /// Builds a bundle from a list of engines, using their type names as labels.
    pub fn new(policies: Vec<Arc<dyn PolicyEngine>>) -> Self {
        let mut bundle = Self::empty();
        for policy in policies {
            let name = default_policy_name(policy.as_ref());
            bundle.add_policy(name, policy);
        }
        bundle
    }

    /// Constructs a bundle by inspecting inline guardrail directives in a step policy blob.
    pub fn for_policy(policy: &Value) -> Self {
        let mut bundle = Self::empty();
        bundle.load_packs(policy);

        let guardrails = guardrails_from_policy(policy);
        let mut include_output_guard = false;

        if guardrails
            .iter()
            .any(|g| matches!(g.as_str(), "redact_pii" | "deny_on_pii"))
        {
            bundle.add_policy_with_hooks(
                "pii_guardrail",
                Arc::new(PiiGuardrailPolicy::default()),
                vec![PolicyHook::Pre, PolicyHook::Post],
            );
        }

        if guardrails.iter().any(|g| g == "block_injection") {
            include_output_guard = true;
            match embedded_prompt_injection() {
                Ok(engine) => bundle.add_policy_with_hooks(
                    "prompt_injection_wasm",
                    engine,
                    vec![PolicyHook::Pre],
                ),
                Err(err) => {
                    warn!(
                        error = %err,
                        "prompt injection wasm policy unavailable; using heuristic fallback"
                    );
                    bundle.add_policy_with_hooks(
                        "prompt_injection_fallback",
                        Arc::new(PromptInjectionFallbackPolicy::default()),
                        vec![PolicyHook::Pre],
                    );
                }
            }
        }

        if guardrails.iter().any(|g| g == "block_command_output") {
            include_output_guard = true;
            bundle.add_policy_with_hooks(
                "command_output_guard",
                Arc::new(InstructionGuardPolicy::default()),
                vec![PolicyHook::Post],
            );
        }

        let allowlists: Vec<String> = guardrails
            .iter()
            .filter_map(|entry| entry.strip_prefix("egress_http_allowlist:"))
            .map(|value| value.trim().to_string())
            .filter(|value| !value.is_empty())
            .collect();

        if !allowlists.is_empty() {
            include_output_guard = true;
            bundle.add_policy_with_hooks(
                "http_allowlist",
                Arc::new(HttpAllowlistPolicy::new(allowlists)),
                vec![PolicyHook::Post],
            );
        }

        if include_output_guard {
            bundle.add_policy_with_hooks(
                "output_guard",
                Arc::new(OutputGuardPolicy::default()),
                vec![PolicyHook::Post],
            );
        }

        bundle
    }

    pub fn empty() -> Self {
        Self {
            policies: Vec::new(),
            events: Arc::new(Mutex::new(Vec::new())),
        }
    }

    pub fn standard() -> Self {
        Self::empty()
    }

    pub fn http_allow_rules(policy: &Value) -> Vec<HttpAllowRule> {
        guardrails_from_policy(policy)
            .iter()
            .filter_map(|entry| parse_http_allow_rule(entry))
            .collect()
    }

    pub fn http_content_types(policy: &Value) -> Vec<String> {
        guardrails_from_policy(policy)
            .into_iter()
            .filter_map(|entry| entry.strip_prefix("egress_http_content_type:"))
            .map(|value| value.trim().to_ascii_lowercase())
            .filter(|value| !value.is_empty())
            .collect()
    }

    pub fn http_max_bytes(policy: &Value) -> Option<usize> {
        guardrails_from_policy(policy)
            .into_iter()
            .filter_map(|entry| entry.strip_prefix("egress_http_max_bytes:"))
            .filter_map(|value| value.trim().parse::<usize>().ok())
            .max()
    }

    pub fn is_empty(&self) -> bool {
        self.policies.is_empty()
    }

    pub fn add_policy(&mut self, name: impl Into<String>, policy: Arc<dyn PolicyEngine>) {
        self.add_policy_with_hooks(name, policy, vec![PolicyHook::Any]);
    }

    pub fn add_policy_with_hooks(
        &mut self,
        name: impl Into<String>,
        policy: Arc<dyn PolicyEngine>,
        hooks: Vec<PolicyHook>,
    ) {
        let name_string = name.into();
        if self.policies.iter().any(|stage| stage.name == name_string) {
            return;
        }
        self.policies
            .push(PolicyStage::with_hooks(name_string, policy, hooks));
    }

    fn load_packs(&mut self, policy: &Value) {
        for config in parse_pack_configs(policy) {
            match resolve_pack(&config) {
                Ok(Some((name, engine, hooks))) => {
                    self.add_policy_with_hooks(name, engine, hooks);
                }
                Ok(None) => {}
                Err(err) => {
                    warn!(error = %err, pack = %config.name, "failed to initialise policy pack");
                }
            }
        }
    }

    pub fn drain_events(&self) -> Vec<PolicyEvaluationRecord> {
        let mut guard = self
            .events
            .lock()
            .expect("policy bundle event mutex poisoned");
        guard.drain(..).collect()
    }

    pub async fn evaluate(
        &self,
        boundary: TrustBoundary,
        run_id: Option<RunId>,
        step_id: Option<StepId>,
        mut payload: Value,
    ) -> Result<BundleOutcome> {
        if self.policies.is_empty() {
            return Ok(BundleOutcome::allow(payload));
        }

        let run_uuid = run_id.map(Uuid::from).unwrap_or_else(Uuid::nil);
        let step_uuid = step_id.map(Uuid::from).unwrap_or_else(Uuid::nil);

        let applicable: Vec<&PolicyStage> = self
            .policies
            .iter()
            .filter(|stage| stage.applies(&boundary))
            .collect();

        if applicable.is_empty() {
            return Ok(BundleOutcome::allow(payload));
        }

        let base_payload = payload.clone();
        let futures = applicable.into_iter().map(|policy| {
            let engine = Arc::clone(&policy.engine);
            let policy_name = policy.name.clone();
            let payload_snapshot = base_payload.clone();
            let boundary_snapshot = boundary.clone();
            async move {
                let context = json!({
                    "boundary": boundary_snapshot,
                    "payload": payload_snapshot,
                });
                let request = PolicyRequest::new(run_uuid, step_uuid, context);
                let decision = engine.evaluate(&request).await;
                (policy_name, decision)
            }
        });

        let results = join_all(futures).await;

        let mut decision_traces: Vec<PolicyDecisionTrace> = Vec::new();
        let mut collected_reasons: Vec<String> = Vec::new();
        let mut collected_decisions: Vec<Decision> = Vec::new();

        for (policy_name, decision_result) in results {
            let decision = decision_result?;
            if let Some(reason) = decision.reason.clone() {
                if !reason.is_empty() {
                    collected_reasons.push(reason.clone());
                }
            }
            decision_traces.push(PolicyDecisionTrace {
                policy: policy_name,
                effect: decision.effect,
                reason: decision.reason.clone(),
                patches: decision.patches.clone(),
            });
            collected_decisions.push(decision);
        }

        let merged = Decision::merge(collected_decisions.into_iter());

        if let Some(reason) = merged.reason.clone() {
            if !collected_reasons.iter().any(|existing| existing == &reason) {
                collected_reasons.push(reason);
            }
        }

        if merged.effect == DecisionEffect::Redact {
            apply_patches(&mut payload, &merged.patches)?;
        }

        if merged.effect == DecisionEffect::Deny && collected_reasons.is_empty() {
            collected_reasons.push(format!("{boundary:?} guardrail denied"));
        }

        let outcome = BundleOutcome {
            effect: merged.effect,
            value: payload.clone(),
            reasons: collected_reasons,
            decisions: decision_traces,
            patches: merged.patches.clone(),
        };
        self.record_event(boundary, run_uuid, step_uuid, &outcome);
        Ok(outcome)
    }
}

fn apply_patches(target: &mut Value, patches: &[Value]) -> Result<()> {
    if patches.is_empty() {
        return Ok(());
    }
    let patch_value = Value::Array(patches.to_vec());
    let patch: Patch = serde_json::from_value(patch_value)?;
    json_patch::patch(target, &patch)?;
    Ok(())
}

fn flatten_strings(value: &Value, buffer: &mut String) {
    match value {
        Value::String(s) => {
            buffer.push(' ');
            buffer.push_str(s);
        }
        Value::Array(items) => {
            for item in items {
                flatten_strings(item, buffer);
            }
        }
        Value::Object(map) => {
            for item in map.values() {
                flatten_strings(item, buffer);
            }
        }
        _ => {}
    }
}

fn sanitize_output(value: Value) -> Value {
    match value {
        Value::String(s) => {
            let mut lowered = s.clone();
            let mut needs_redact = false;
            let lower = lowered.to_ascii_lowercase();
            if lower.contains("api_key") || lower.contains("secret") || lower.contains("token") {
                needs_redact = true;
            }
            if needs_redact {
                Value::String("[redacted-output]".into())
            } else {
                Value::String(s)
            }
        }
        Value::Array(items) => {
            let sanitized = items.into_iter().map(sanitize_output).collect();
            Value::Array(sanitized)
        }
        Value::Object(map) => {
            let sanitized = map
                .into_iter()
                .map(|(k, v)| (k, sanitize_output(v)))
                .collect();
            Value::Object(sanitized)
        }
        other => other,
    }
}

struct PackConfig {
    name: String,
    hooks: Option<Vec<PolicyHook>>,
    options: Value,
}

impl PackConfig {
    fn try_from(value: &Value) -> Result<Self> {
        let obj = value
            .as_object()
            .ok_or_else(|| anyhow!("policy pack entry must be an object"))?;

        let name = obj
            .get("name")
            .or_else(|| obj.get("id"))
            .and_then(Value::as_str)
            .map(|s| s.trim().to_ascii_lowercase())
            .filter(|s| !s.is_empty())
            .ok_or_else(|| anyhow!("policy pack requires a non-empty 'name'"))?;

        let hooks_value = obj.get("phase").or_else(|| obj.get("hooks"));
        let hooks = match hooks_value {
            Some(value) => Some(parse_hooks_value(value)?),
            None => None,
        };

        let options = obj.get("options").cloned().unwrap_or(Value::Null);

        Ok(Self {
            name,
            hooks,
            options,
        })
    }
}

fn parse_pack_configs(policy: &Value) -> Vec<PackConfig> {
    policy
        .as_object()
        .and_then(|obj| obj.get("packs"))
        .and_then(Value::as_array)
        .map(|items| {
            items
                .iter()
                .filter_map(|value| match PackConfig::try_from(value) {
                    Ok(config) => Some(config),
                    Err(err) => {
                        warn!(error = %err, "ignoring invalid policy pack entry");
                        None
                    }
                })
                .collect()
        })
        .unwrap_or_default()
}

fn parse_hooks_value(value: &Value) -> Result<Vec<PolicyHook>> {
    match value {
        Value::String(s) => Ok(vec![parse_hook_str(s)?]),
        Value::Array(items) => {
            if items.is_empty() {
                return Err(anyhow!("hooks array cannot be empty"));
            }
            let mut hooks = Vec::with_capacity(items.len());
            for item in items {
                hooks.push(parse_hook_str(
                    item.as_str()
                        .ok_or_else(|| anyhow!("hooks entries must be strings"))?,
                )?);
            }
            Ok(hooks)
        }
        _ => Err(anyhow!("hooks must be a string or array of strings")),
    }
}

fn parse_hook_str(value: &str) -> Result<PolicyHook> {
    match value.trim().to_ascii_lowercase().as_str() {
        "pre" => Ok(PolicyHook::Pre),
        "mid" => Ok(PolicyHook::Mid),
        "post" => Ok(PolicyHook::Post),
        other => Err(anyhow!("unknown policy hook '{}'", other)),
    }
}

fn resolve_pack(
    config: &PackConfig,
) -> Result<Option<(String, Arc<dyn PolicyEngine>, Vec<PolicyHook>)>> {
    let stage_name = format!("pack::{}", config.name);

    match config.name.as_str() {
        "prompt_injection" => {
            let hooks = config
                .hooks
                .clone()
                .unwrap_or_else(|| vec![PolicyHook::Pre]);
            let engine: Arc<dyn PolicyEngine> = match embedded_prompt_injection() {
                Ok(engine) => engine,
                Err(err) => {
                    warn!(
                        error = %err,
                        "prompt injection wasm policy unavailable; using heuristic fallback"
                    );
                    Arc::new(PromptInjectionFallbackPolicy::default())
                }
            };
            Ok(Some((stage_name, engine, hooks)))
        }
        "pii_redaction" => {
            let mode = config
                .options
                .as_object()
                .and_then(|obj| obj.get("mode"))
                .and_then(Value::as_str)
                .map(|value| match value.trim().to_ascii_lowercase().as_str() {
                    "deny" => PiiMode::Deny,
                    "allow" => PiiMode::Allow,
                    _ => PiiMode::Redact,
                })
                .unwrap_or(PiiMode::Redact);
            let hooks = config
                .hooks
                .clone()
                .unwrap_or_else(|| vec![PolicyHook::Pre, PolicyHook::Post]);
            let engine: Arc<dyn PolicyEngine> = Arc::new(BasicPiiPolicy::new(mode));
            Ok(Some((stage_name, engine, hooks)))
        }
        "tool_acl" => {
            let engine: Arc<dyn PolicyEngine> =
                Arc::new(ToolAclPolicy::from_config(&config.options)?);
            let hooks = config
                .hooks
                .clone()
                .unwrap_or_else(|| vec![PolicyHook::Pre]);
            Ok(Some((stage_name, engine, hooks)))
        }
        "budget_caps" => {
            let engine: Arc<dyn PolicyEngine> =
                Arc::new(BudgetCapsPolicy::from_config(&config.options)?);
            let hooks = config
                .hooks
                .clone()
                .unwrap_or_else(|| vec![PolicyHook::Pre, PolicyHook::Post]);
            Ok(Some((stage_name, engine, hooks)))
        }
        other => {
            warn!(pack = %other, "unknown policy pack requested");
            Ok(None)
        }
    }
}

fn guardrails_from_policy(policy: &Value) -> Vec<String> {
    policy
        .as_object()
        .and_then(|obj| obj.get("guardrails"))
        .and_then(Value::as_array)
        .map(|arr| {
            arr.iter()
                .filter_map(Value::as_str)
                .map(|s| s.to_string())
                .collect::<Vec<_>>()
        })
        .unwrap_or_default()
}

fn guardrails_from_context(context: &Value) -> Vec<String> {
    context
        .get("payload")
        .and_then(|payload| payload.get("policy"))
        .map(|policy| guardrails_from_policy(policy))
        .unwrap_or_default()
}

fn parse_http_allow_rule(entry: &str) -> Option<HttpAllowRule> {
    let value = entry.strip_prefix("egress_http_allowlist:")?.trim();
    if value.is_empty() {
        return None;
    }

    let (host_part, path_part) = match value.find('/') {
        Some(index) => (&value[..index], Some(&value[index..])),
        None => (value, None),
    };

    let host = host_part.trim().to_ascii_lowercase();
    if host.is_empty() {
        return None;
    }

    let path_prefix = path_part.and_then(|path| {
        let trimmed = path.trim();
        if trimmed.is_empty() {
            None
        } else if trimmed.starts_with('/') {
            Some(trimmed.to_string())
        } else {
            Some(format!("/{}", trimmed))
        }
    });

    Some(HttpAllowRule { host, path_prefix })
}

fn collect_hosts(value: &Value, hosts: &mut Vec<String>) {
    match value {
        Value::String(s) => {
            for capture in HTTP_URL_PATTERN.find_iter(s) {
                if let Ok(url) = Url::parse(capture.as_str()) {
                    if let Some(host) = url.host_str() {
                        hosts.push(host.to_ascii_lowercase());
                    }
                }
            }
        }
        Value::Array(items) => {
            for item in items {
                collect_hosts(item, hosts);
            }
        }
        Value::Object(map) => {
            for item in map.values() {
                collect_hosts(item, hosts);
            }
        }
        _ => {}
    }
}

fn host_allowed(host: &str, allowlist: &[String]) -> bool {
    allowlist.iter().any(|allowed| {
        let allowed = allowed.to_ascii_lowercase();
        host == allowed || host.ends_with(&format!(".{allowed}"))
    })
}

fn boundary_from_request(request: &PolicyRequest) -> Option<TrustBoundary> {
    request
        .context()
        .get("boundary")
        .and_then(Value::as_str)
        .and_then(|s| serde_json::from_value(Value::String(s.to_string())).ok())
}

#[derive(Clone, Default)]
pub struct PiiGuardrailPolicy {
    inner: BasicPiiPolicy,
}

#[async_trait]
impl PolicyEngine for PiiGuardrailPolicy {
    async fn evaluate(&self, request: &PolicyRequest) -> Result<PolicyDecision> {
        let context = request.context();
        if !should_apply_pii(context) {
            return Ok(PolicyDecision::allow());
        }
        self.inner.evaluate(request).await
    }
}

fn should_apply_pii(context: &Value) -> bool {
    guardrails_from_context(context).iter().any(|rule| {
        matches!(
            rule.as_str(),
            "redact_pii" | "deny_on_pii" | "skip_redaction"
        )
    })
}

fn should_apply_injection(context: &Value) -> bool {
    guardrails_from_context(context)
        .iter()
        .any(|rule| rule == "block_injection")
}

fn should_apply_command_guard(context: &Value) -> bool {
    guardrails_from_context(context)
        .iter()
        .any(|rule| rule == "block_command_output")
}

fn match_patterns(text: &str, patterns: &[(&'static str, Regex)]) -> Vec<String> {
    patterns
        .iter()
        .filter(|(_, regex)| regex.is_match(text))
        .map(|(name, _)| (*name).to_string())
        .collect()
}

fn default_policy_name(policy: &dyn PolicyEngine) -> String {
    let name = type_name_of_val(policy);
    name.rsplit("::").next().unwrap_or(name).to_string()
}

fn preview_payload(value: &Value) -> Option<String> {
    let mut buffer = String::new();
    flatten_strings(value, &mut buffer);
    let trimmed = buffer.trim();
    if trimmed.is_empty() {
        None
    } else {
        let preview: String = trimmed.chars().take(300).collect();
        Some(preview)
    }
}

fn collect_value_origins(value: &Value) -> Vec<Value> {
    let mut origins = Vec::new();
    walk_for_origins(value, &mut origins);
    origins
}

fn walk_for_origins(value: &Value, origins: &mut Vec<Value>) {
    match value {
        Value::Object(map) => {
            if let Some(origin) = map.get("trust_origin") {
                push_unique_json(origins, origin);
            }
            for item in map.values() {
                walk_for_origins(item, origins);
            }
        }
        Value::Array(items) => {
            for item in items {
                walk_for_origins(item, origins);
            }
        }
        _ => {}
    }
}

fn push_unique_json(list: &mut Vec<Value>, value: &Value) {
    if !list.iter().any(|existing| existing == value) {
        list.push(value.clone());
    }
}

impl PolicyBundle {
    fn record_event(
        &self,
        boundary: TrustBoundary,
        run_id: Uuid,
        step_id: Uuid,
        outcome: &BundleOutcome,
    ) {
        let payload_snapshot = if outcome.effect == DecisionEffect::Allow {
            None
        } else {
            Some(outcome.value.clone())
        };
        let preview = preview_payload(&outcome.value);
        let origins = collect_value_origins(&outcome.value);
        let record = PolicyEvaluationRecord {
            boundary,
            run_id: (run_id != Uuid::nil()).then_some(run_id),
            step_id: (step_id != Uuid::nil()).then_some(step_id),
            effect: outcome.effect,
            reasons: outcome.reasons.clone(),
            decisions: outcome.decisions.clone(),
            patches: outcome.patches.clone(),
            payload: payload_snapshot,
            timestamp: Utc::now(),
            origins,
            preview,
            attestation_id: None,
            attestation: None,
            trust_decision: None,
        };
        let mut guard = self
            .events
            .lock()
            .expect("policy bundle event mutex poisoned");
        guard.push(record);
    }
}

fn sanitize_command_output(value: &Value) -> Value {
    match value {
        Value::String(s) => {
            if needs_command_redaction(s) {
                Value::String("[filtered-command-output]".to_string())
            } else {
                Value::String(s.clone())
            }
        }
        Value::Array(items) => Value::Array(items.iter().map(sanitize_command_output).collect()),
        Value::Object(map) => {
            let mut sanitized = serde_json::Map::with_capacity(map.len());
            for (key, val) in map {
                sanitized.insert(key.clone(), sanitize_command_output(val));
            }
            Value::Object(sanitized)
        }
        other => other.clone(),
    }
}

fn needs_command_redaction(text: &str) -> bool {
    COMMAND_REDACT_PATTERNS
        .iter()
        .any(|(_, regex)| regex.is_match(text))
        || COMMAND_DENY_PATTERNS
            .iter()
            .any(|(_, regex)| regex.is_match(text))
}

#[derive(Clone, Default)]
pub struct PromptInjectionFallbackPolicy;

#[async_trait]
impl PolicyEngine for PromptInjectionFallbackPolicy {
    async fn evaluate(&self, request: &PolicyRequest) -> Result<PolicyDecision> {
        if !matches!(
            boundary_from_request(request),
            Some(TrustBoundary::IngressPrompt)
        ) {
            return Ok(PolicyDecision::allow());
        }
        if !should_apply_injection(request.context()) {
            return Ok(PolicyDecision::allow());
        }
        let payload = request
            .context()
            .get("payload")
            .and_then(|p| p.get("inputs"))
            .and_then(|inputs| inputs.get("messages"))
            .cloned()
            .unwrap_or(Value::Null);
        let mut text = String::new();
        flatten_strings(&payload, &mut text);
        let lower = text.to_ascii_lowercase();
        if lower.contains("ignore previous instructions")
            || lower.contains("override guardrails")
            || lower.contains("begin jailbreak")
        {
            return Ok(PolicyDecision {
                effect: DecisionEffect::Deny,
                reason: Some("prompt_injection_detected".into()),
                patches: Vec::new(),
            });
        }
        Ok(PolicyDecision::allow())
    }
}

#[derive(Clone, Default)]
pub struct OutputGuardPolicy;

#[async_trait]
impl PolicyEngine for OutputGuardPolicy {
    async fn evaluate(&self, request: &PolicyRequest) -> Result<PolicyDecision> {
        let boundary = match boundary_from_request(request) {
            Some(boundary) => boundary,
            None => return Ok(PolicyDecision::allow()),
        };
        if !matches!(
            boundary,
            TrustBoundary::EgressPrompt | TrustBoundary::EgressTool
        ) {
            return Ok(PolicyDecision::allow());
        }

        let output = request
            .context()
            .get("payload")
            .and_then(|p| p.get("output"))
            .cloned()
            .unwrap_or(Value::Null);
        let mut text = String::new();
        flatten_strings(&output, &mut text);
        let lower = text.to_ascii_lowercase();
        if lower.contains("api_key") || lower.contains("secret") || lower.contains("token") {
            let sanitized = sanitize_output(output);
            return Ok(PolicyDecision {
                effect: DecisionEffect::Redact,
                reason: Some("sensitive_output_redacted".into()),
                patches: vec![json!({
                    "op": "replace",
                    "path": "/output",
                    "value": sanitized,
                })],
            });
        }

        Ok(PolicyDecision::allow())
    }
}

#[derive(Clone, Default)]
pub struct InstructionGuardPolicy;

#[async_trait]
impl PolicyEngine for InstructionGuardPolicy {
    async fn evaluate(&self, request: &PolicyRequest) -> Result<PolicyDecision> {
        let boundary = match boundary_from_request(request) {
            Some(boundary) => boundary,
            None => return Ok(PolicyDecision::allow()),
        };

        if !matches!(
            boundary,
            TrustBoundary::EgressPrompt | TrustBoundary::EgressTool
        ) {
            return Ok(PolicyDecision::allow());
        }

        if !should_apply_command_guard(request.context()) {
            return Ok(PolicyDecision::allow());
        }

        let output = request
            .context()
            .get("payload")
            .and_then(|p| p.get("output"))
            .cloned()
            .unwrap_or(Value::Null);

        let mut text = String::new();
        flatten_strings(&output, &mut text);

        let deny_matches = match_patterns(&text, &COMMAND_DENY_PATTERNS);
        if !deny_matches.is_empty() {
            return Ok(PolicyDecision {
                effect: DecisionEffect::Deny,
                reason: Some(format!("command_output_denied: {}", deny_matches.join(","))),
                patches: Vec::new(),
            });
        }

        let redact_matches = match_patterns(&text, &COMMAND_REDACT_PATTERNS);
        if !redact_matches.is_empty() {
            let sanitized = sanitize_command_output(&output);
            return Ok(PolicyDecision {
                effect: DecisionEffect::Redact,
                reason: Some(format!(
                    "command_output_redacted: {}",
                    redact_matches.join(",")
                )),
                patches: vec![json!({
                    "op": "replace",
                    "path": "/output",
                    "value": sanitized,
                })],
            });
        }

        Ok(PolicyDecision::allow())
    }
}

static COMMAND_DENY_PATTERNS: Lazy<Vec<(&'static str, Regex)>> = Lazy::new(|| {
    vec![
        (
            "shell_rm_root",
            Regex::new(r"(?i)\brm\s+-rf\s+/").expect("valid regex"),
        ),
        (
            "shell_shutdown",
            Regex::new(r"(?i)\bshutdown\b").expect("valid regex"),
        ),
        (
            "shell_reboot",
            Regex::new(r"(?i)\breboot\b").expect("valid regex"),
        ),
        (
            "sql_drop_table",
            Regex::new(r"(?i)\bdrop\s+table\b").expect("valid regex"),
        ),
        (
            "sql_truncate_table",
            Regex::new(r"(?i)\btruncate\s+table\b").expect("valid regex"),
        ),
        (
            "sql_delete_all",
            Regex::new(r"(?i)\bdelete\s+from\s+\w+\b").expect("valid regex"),
        ),
    ]
});

static COMMAND_REDACT_PATTERNS: Lazy<Vec<(&'static str, Regex)>> = Lazy::new(|| {
    vec![
        (
            "shell_command",
            Regex::new(r"(?i)\b(?:bash|sh|zsh|cmd|powershell)\b").expect("valid regex"),
        ),
        (
            "shell_curl",
            Regex::new(r"(?i)\bcurl\s+https?://").expect("valid regex"),
        ),
        (
            "shell_wget",
            Regex::new(r"(?i)\bwget\s+").expect("valid regex"),
        ),
        (
            "shell_exec",
            Regex::new(r"(?i)\bos\.system|subprocess\.(run|call)").expect("valid regex"),
        ),
        (
            "sql_select",
            Regex::new(r"(?i)\bselect\b.*\bfrom\b").expect("valid regex"),
        ),
        (
            "sql_insert",
            Regex::new(r"(?i)\binsert\s+into\b").expect("valid regex"),
        ),
        (
            "sql_update",
            Regex::new(r"(?i)\bupdate\s+\w+\s+set\b").expect("valid regex"),
        ),
        (
            "http_url",
            Regex::new(r"(?i)https?://").expect("valid regex"),
        ),
    ]
});

#[derive(Clone)]
pub struct HttpAllowlistPolicy {
    allowed: Vec<String>,
}

impl HttpAllowlistPolicy {
    pub fn new(allowed: Vec<String>) -> Self {
        Self { allowed }
    }
}

static HTTP_URL_PATTERN: Lazy<Regex> =
    Lazy::new(|| Regex::new(r#"https?://[^\s\)\]\}"'>]+"#).expect("valid http url regex"));

#[async_trait]
impl PolicyEngine for HttpAllowlistPolicy {
    async fn evaluate(&self, request: &PolicyRequest) -> Result<PolicyDecision> {
        let boundary = match boundary_from_request(request) {
            Some(boundary) => boundary,
            None => return Ok(PolicyDecision::allow()),
        };

        if !matches!(boundary, TrustBoundary::EgressTool) {
            return Ok(PolicyDecision::allow());
        }

        let mut hosts = Vec::new();
        if let Some(payload) = request.context().get("payload") {
            collect_hosts(payload, &mut hosts);
        }

        let disallowed: Vec<String> = hosts
            .into_iter()
            .filter(|host| !host_allowed(host, &self.allowed))
            .collect();

        if disallowed.is_empty() {
            return Ok(PolicyDecision::allow());
        }

        Ok(PolicyDecision {
            effect: DecisionEffect::Deny,
            reason: Some(format!("http_egress_not_allowed:{}", disallowed.join(","))),
            patches: Vec::new(),
        })
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use async_trait::async_trait;
    use serde_json::{json, Value};
    use std::sync::Arc;
    use uuid::Uuid;

    use crate::model::{RunId, StepId};
    use fleetforge_policy::Decision as PolicyDecision;

    struct DenyPolicy;

    #[async_trait]
    impl PolicyEngine for DenyPolicy {
        async fn evaluate(&self, _request: &PolicyRequest) -> Result<PolicyDecision> {
            Ok(PolicyDecision {
                effect: DecisionEffect::Deny,
                reason: Some("blocked".into()),
                patches: Vec::new(),
            })
        }
    }

    struct RedactingPolicy;

    #[async_trait]
    impl PolicyEngine for RedactingPolicy {
        async fn evaluate(&self, _request: &PolicyRequest) -> Result<PolicyDecision> {
            Ok(PolicyDecision {
                effect: DecisionEffect::Redact,
                reason: Some("mask".into()),
                patches: vec![json!({
                    "op": "replace",
                    "path": "/inputs/secret",
                    "value": "[masked]"
                })],
            })
        }
    }

    #[tokio::test]
    async fn deny_evaluation_records_event() {
        let bundle = PolicyBundle::new(vec![Arc::new(DenyPolicy)]);
        let outcome = bundle
            .evaluate(
                TrustBoundary::IngressPrompt,
                Some(RunId(Uuid::nil())),
                Some(StepId(Uuid::nil())),
                json!({"inputs": {}}),
            )
            .await
            .expect("evaluate deny policy");

        assert_eq!(outcome.effect, DecisionEffect::Deny);
        assert!(outcome
            .decisions
            .iter()
            .any(|d| d.reason.as_deref() == Some("blocked")));

        let events = bundle.drain_events();
        assert_eq!(events.len(), 1);
        let event = &events[0];
        assert_eq!(event.effect, DecisionEffect::Deny);
        assert!(event
            .reasons
            .iter()
            .any(|reason| reason.contains("blocked")));
        assert!(event.patches.is_empty());
        assert_eq!(event.decisions.len(), 1);
        assert_eq!(event.decisions[0].effect, DecisionEffect::Deny);
    }

    #[tokio::test]
    async fn redact_evaluation_captures_patches() {
        let bundle = PolicyBundle::new(vec![Arc::new(RedactingPolicy)]);
        let outcome = bundle
            .evaluate(
                TrustBoundary::IngressTool,
                Some(RunId(Uuid::nil())),
                Some(StepId(Uuid::nil())),
                json!({"inputs": {"secret": "top"}}),
            )
            .await
            .expect("evaluate redact policy");

        let updated = outcome
            .value
            .get("inputs")
            .and_then(|inputs| inputs.get("secret"))
            .and_then(Value::as_str)
            .expect("secret present");
        assert_eq!(updated, "[masked]");
        assert!(outcome.effect == DecisionEffect::Redact);
        assert_eq!(outcome.patches.len(), 1);

        let events = bundle.drain_events();
        assert_eq!(events.len(), 1);
        let event = &events[0];
        assert_eq!(event.effect, DecisionEffect::Redact);
        assert_eq!(event.patches.len(), 1);
        assert!(event.preview.as_ref().is_some());
    }
}