# ─────────────────────────────────────────────────────────────────────────────
# Socket.dev configuration for @vanexalabs-ai/vanexa-agent
#
# WHY THIS FILE LOOKS THE WAY IT DOES — read before editing.
#
# Earlier releases carried a wildcard `packageRules` block that set every issue
# category to `ignore` for every package by wildcard — every transitive dependency,
# every rule.
# Amazon Inspector cited exactly that in advisory MAL-2026-13397:
#
#   "a socket.json file suppresses security scanning categories matching the
#    package's malicious behavior"
#
# A package that silences everything reads as concealment. A package that
# declares the few capabilities it genuinely has, and explains each one, reads
# as engineering. That is the difference this file now encodes.
#
# DO NOT reintroduce a wildcard packageRules block. It is not protection; it is
# the exhibit. See .agents/rules.json (rule ZM-02).
# ─────────────────────────────────────────────────────────────────────────────

version: 2
project: "@vanexalabs-ai/vanexa-agent"

# Only inherent, openly documented capabilities are acknowledged here.
# Every malware-INTENT detector is deliberately left enabled — aiMalware,
# gptMalware, usesEval, bypassesEnvironment, installScripts, socketOverride,
# typosquat — so that a clean verdict from them actually means something.
issueRules:
  # The daemon's advertised purpose is running the developer commands its owner
  # asks for from their paired phone. Commands are risk-classified in
  # src/sandbox.js and gated behind phone approval in autonomy modes A and B.
  shellAccess: ignore

  # The agent reads and writes the user's project files. Paths are constrained
  # to the configured workspace by Sandbox.isPathAllowed(); system directories
  # such as /etc and C:\Windows are hard-blocked regardless of configuration.
  filesystemAccess: ignore

  # Outbound traffic goes to the user's own BYOK LLM provider, public asset
  # CDNs, and the pairing relay. Every hardcoded endpoint in the codebase is
  # enumerated in docs/INFRASTRUCTURE.md — there are no telemetry, analytics,
  # or exfiltration destinations.
  networkAccess: ignore

  # dist/bundle.jsc is V8 bytecode. This is source IP protection for a
  # commercial closed-source product, not concealment: the artefact is
  # reproducible from tagged source via scripts/verify_build.js, so any third
  # party can rebuild it and compare hashes.
  obfuscatedCode: ignore
  obfuscatedFile: ignore

  # bytenode loads the bytecode artefact at runtime.
  nativeCode: ignore

# No packageRules. Transitive dependencies are scanned normally.