@aitne/daemon 0.1.2 → 0.1.4

package/dist/core/backends/claude-tool-collection.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Claude tool surface — pure helpers split out of `claude-code-core.ts` as
+ * part of the file-split plan (Tier 2, §8). Owns five responsibilities:
+ *
+ *  - `getAllowedTools` — assemble the SDK `allowedTools` list from the
+ *    configured default + the runtime override + any delegated- and native-
+ *    integration tools the registry exposes.
+ *  - `getDelegatedClaudeTools` — read the current `integrations` registry
+ *    state and project it through `computeDelegatedClaudeTools`. Returns
+ *    `[]` when the MCP context is not yet wired or on DB read failure.
+ *  - `getNativeClaudeTools` — same shape as `getDelegatedClaudeTools` but
+ *    projects through `computeNativeClaudeTools` (native-mode parallel).
+ *  - `getSessionDeniedTools` — DELEGATED-MODE-V2-DESIGN.md §4.3.3 — expand
+ *    per-integration `deniedTools` into namespaced tool names that the SDK
+ *    rejects via `disallowedTools` regardless of the allow list.
+ *  - `buildSecurityHooks` — build the PreToolUse hook record that enforces
+ *    curl localhost-only, jq env/file-flag denials, context-dir chokepoint,
+ *    vault write attribution, and the absolute-block audit layer.
+ *
+ * Pattern A (file-split-plan §5): each function reads its dependencies via
+ * an explicit argument record rather than `this.<field>`. The pure shape
+ * means these can be unit tested without instantiating `ClaudeCodeCore`,
+ * and lets tests inspect the hook closures directly. Thin shims on
+ * `ClaudeCodeCore` (`private getAllowedTools(...) { return ... }`) remain
+ * for the transitional period (file-split-plan §15).
+ */
+import type { HookInput, HookJSONOutput } from "@anthropic-ai/claude-agent-sdk";
+import type Database from "better-sqlite3";
+import type { AgentConfig } from "../../config.js";
+import type { AgentWriteTracker } from "../../safety/agent-write-tracker.js";
+/** Default allowed-tools list when the dashboard override is unset. */
+export declare const CLAUDE_DEFAULT_ALLOWED_TOOLS: readonly ["Read", "Glob", "Grep", "Write", "Edit", "Skill", "Bash(curl *)", "Bash(git *)", "Bash(jq *)"];
+/**
+ * Allowed tools whitelist for dontAsk permission mode.
+ *
+ * `delegatedTools` and `nativeTools` are UNION'd onto the returned list —
+ * even when `allowedToolsOverride` is set. This is a deliberate deviation
+ * from the override's otherwise-absolute "replace everything" contract (see
+ * `CRITICAL_OVERRIDE_TOOLS` in `claude-code-core.ts`, which warns but does
+ * not union). Rationale: delegated / native modes are runtime-configurable
+ * axes orthogonal to the dashboard's tool-customization override. If a user
+ * set the override before flipping an integration, silently dropping the
+ * registry-declared connector tools would break mail/calendar with a
+ * misleading "permission denied" DM. Union semantics keep the override's
+ * curation intent while letting either mode widen the surface to whatever
+ * the registry already advertised.
+ *
+ * Native and delegated lists are accepted separately (rather than a single
+ * `extraMcpTools` parameter) so callers — and tests — surface the
+ * provenance of every widening: an audit log entry with
+ * `delegatedToolCount` and `nativeToolCount` makes a misconfigured flip
+ * diagnosable without re-running the resolver.
+ */
+export declare function getAllowedTools(config: Pick<AgentConfig, "allowedToolsOverride">, webSearchEnabled: boolean, delegatedTools?: readonly string[], nativeTools?: readonly string[]): string[];
+/**
+ * Read the integrations record from the wired MCP context and project it
+ * through the `computeDelegatedClaudeTools` allowlist computation. Returns
+ * `[]` when the context is not yet wired (tests / startup ordering) or on
+ * DB read failure — the latter is logged as a warning so a corrupt
+ * integrations table is visible without halting the session.
+ */
+export declare function getDelegatedClaudeTools(mcpContext: {
+    db: Database.Database;
+} | undefined): readonly string[];
+/**
+ * Sibling of `getDelegatedClaudeTools` — projects integrations record
+ * through `computeNativeClaudeTools`. Returns `[]` when the context is
+ * not yet wired or on DB read failure, matching the conservative pattern
+ * used by the delegated counterpart.
+ *
+ * Required because the SDK's `dontAsk` permission mode silently denies
+ * tools not in `allowedTools`. Native-mode skill bodies instruct the
+ * agent to call connector MCP tools directly (e.g.
+ * `mcp__claude_ai_Gmail__search_threads`), so the registry-declared tool
+ * names for every `mode === "native" && nativeBackend === "claude"` row
+ * must be pre-authorized.
+ */
+export declare function getNativeClaudeTools(mcpContext: {
+    db: Database.Database;
+} | undefined): readonly string[];
+/**
+ * DELEGATED-MODE-V2-DESIGN.md §4.3.3 — same-backend deny enforcement at
+ * the SDK boundary. For every integration whose `delegatedBackend === "claude"`,
+ * expand `state.deniedTools` against the connector's known tools and emit
+ * the namespaced names (`mcp__claude_ai_<X>__<tool>`). The SDK refuses any
+ * tool listed in `disallowedTools` regardless of `allowedTools` — hard
+ * enforcement.
+ *
+ * Returns `[]` when context isn't wired (tests / pre-startup) and on read
+ * failures, matching the conservative pattern used by
+ * `getDelegatedClaudeTools`.
+ */
+export declare function getSessionDeniedTools(mcpContext: {
+    db: Database.Database;
+} | undefined): readonly string[];
+/**
+ * Dependencies for `buildSecurityHooks`. `writeTracker` is optional because
+ * tests construct lightweight cores without one; the vault-write
+ * pre-marking is skipped in that case.
+ *
+ * `mcpContext` is passed as a thunk rather than a value so the
+ * absolute-block audit hook reads the live reference at fire time,
+ * matching the original `this.mcpContext?.db` semantics of
+ * `claude-code-core.ts`. The hook is built once per `executeOnce`
+ * call but fires many times during the SDK turn — in production
+ * `setMcpContext` is only invoked at startup so the values are
+ * equivalent, but the thunk preserves the original semantics for
+ * any future reordering of the lifecycle. `config` and `writeTracker`
+ * are readonly / constructor-set on `ClaudeCodeCore` and safe to
+ * capture by value.
+ */
+export interface SecurityHooksDeps {
+    readonly config: AgentConfig;
+    readonly writeTracker?: AgentWriteTracker | undefined;
+    readonly getMcpContext?: () => {
+        db: Database.Database;
+    } | undefined;
+}
+/**
+ * Security hooks:
+ *   1. Bash(curl *) — restrict to localhost Daemon API, block connection-override flags. (strict only)
+ *   2. Bash(jq *)  — block file-access flags and the `env` filter (process env exfiltration). (strict only)
+ *   3. Write/Edit  — block writes into the session helper dir and context dir, mark vault writes.
+ *
+ * In allow mode the curl and jq hooks are dropped, but the Write/Edit hook
+ * stays: the context-dir chokepoint exists for memory integrity (today-write
+ * lock, md_file_snapshots, CONTEXT_WRITE_PERMISSIONS), not permissions.
+ */
+export declare function buildSecurityHooks(deps: SecurityHooksDeps, allowMode?: boolean): {
+    PreToolUse: {
+        matcher: string;
+        hooks: ((input: HookInput) => Promise<HookJSONOutput>)[];
+    }[];
+};
+//# sourceMappingURL=claude-tool-collection.d.ts.map

package/dist/core/backends/claude-tool-collection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-tool-collection.d.ts","sourceRoot":"","sources":["../../../src/core/backends/claude-tool-collection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAKhF,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAInD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AA2E7E,uEAAuE;AACvE,eAAO,MAAM,4BAA4B,0GAU/B,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,EACjD,gBAAgB,EAAE,OAAO,EACzB,cAAc,GAAE,SAAS,MAAM,EAAO,EACtC,WAAW,GAAE,SAAS,MAAM,EAAO,GAClC,MAAM,EAAE,CASV;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE;IAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;CAAE,GAAG,SAAS,GAChD,SAAS,MAAM,EAAE,CAYnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE;IAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;CAAE,GAAG,SAAS,GAChD,SAAS,MAAM,EAAE,CAYnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE;IAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;CAAE,GAAG,SAAS,GAChD,SAAS,MAAM,EAAE,CAiBnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM;QAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;KAAE,GAAG,SAAS,CAAC;CACtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,EAAE,SAAS,UAAQ;;;wBA+YlE,SAAS,KACf,OAAO,CAAC,cAAc,CAAC;;EA4P3B"}