Local Agent Policy Checker (lib/client-policy.ts)

Determines whether a client context is permitted to run local agent controls based on auth method, localhost status, capabilities, or client mode; also produces a human-readable restriction message.

// Source: https://github.com/BradGroux/veritas-kanban | License: MIT | Copyright 2026 Digital Meld
// Provided via justclaw.it.com; keep this notice with the code.
import type { ClientAuthContext } from '@veritas-kanban/shared';

const LOCAL_AGENT_CAPABILITIES = new Set([
  'desktop:local',
  'agent:run:local',
  'agent:run:unrestricted',
  'local-agent:run',
]);

const LOCAL_CLIENT_MODES = new Set(['desktop-local', 'cli']);

export function clientAllowsLocalAgentControls(authContext: ClientAuthContext | null): boolean {
  if (!authContext) return true;
  if (authContext.authMethod === 'localhost-bypass') return true;
  if (authContext.isLocalhost) return true;

  const capabilities = authContext.capabilities ?? [];
  if (capabilities.some((capability) => LOCAL_AGENT_CAPABILITIES.has(capa

... (truncated -- full source via MCP)