@bevel-software/platform-core-backend 0.28.1 → 0.30.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/agent-guide/access-control.md +15 -0
- package/agent-guide/skills.md +8 -0
- package/dist/__tests__/test-repositories.d.ts +3 -0
- package/dist/__tests__/test-repositories.d.ts.map +1 -0
- package/dist/__tests__/test-repositories.js +18 -0
- package/dist/__tests__/test-repositories.js.map +1 -0
- package/dist/core/catalog-revision.d.ts.map +1 -1
- package/dist/core/catalog-revision.js +4 -2
- package/dist/core/catalog-revision.js.map +1 -1
- package/dist/core/compose-embed.d.ts +35 -0
- package/dist/core/compose-embed.d.ts.map +1 -0
- package/dist/core/compose-embed.js +14 -0
- package/dist/core/compose-embed.js.map +1 -0
- package/dist/core/core-ports.d.ts +10 -0
- package/dist/core/core-ports.d.ts.map +1 -1
- package/dist/core/core-ports.js.map +1 -1
- package/dist/core/create-core-server.d.ts.map +1 -1
- package/dist/core/create-core-server.js +8 -2
- package/dist/core/create-core-server.js.map +1 -1
- package/dist/core/create-core-services.d.ts +4 -1
- package/dist/core/create-core-services.d.ts.map +1 -1
- package/dist/core/create-core-services.js +57 -18
- package/dist/core/create-core-services.js.map +1 -1
- package/dist/core/lifecycle.d.ts +19 -6
- package/dist/core/lifecycle.d.ts.map +1 -1
- package/dist/core/lifecycle.js +17 -6
- package/dist/core/lifecycle.js.map +1 -1
- package/dist/modules/access/access-control.interface.d.ts +20 -0
- package/dist/modules/access/access-control.interface.d.ts.map +1 -1
- package/dist/modules/access/access-control.service.d.ts +68 -15
- package/dist/modules/access/access-control.service.d.ts.map +1 -1
- package/dist/modules/access/access-control.service.js +282 -58
- package/dist/modules/access/access-control.service.js.map +1 -1
- package/dist/modules/access/access.routes.d.ts.map +1 -1
- package/dist/modules/access/access.routes.js +20 -6
- package/dist/modules/access/access.routes.js.map +1 -1
- package/dist/modules/agent-instructions/shared-file-rules.d.ts +1 -1
- package/dist/modules/agent-instructions/shared-file-rules.js +1 -1
- package/dist/modules/auth/index.d.ts +15 -0
- package/dist/modules/auth/index.d.ts.map +1 -0
- package/dist/modules/auth/index.js +20 -0
- package/dist/modules/auth/index.js.map +1 -0
- package/dist/modules/diff/diff.service.d.ts.map +1 -1
- package/dist/modules/diff/diff.service.js +7 -1
- package/dist/modules/diff/diff.service.js.map +1 -1
- package/dist/modules/embed/embed.interface.d.ts +22 -0
- package/dist/modules/embed/embed.interface.d.ts.map +1 -1
- package/dist/modules/embed/embed.service.d.ts +28 -14
- package/dist/modules/embed/embed.service.d.ts.map +1 -1
- package/dist/modules/embed/embed.service.js +38 -17
- package/dist/modules/embed/embed.service.js.map +1 -1
- package/dist/modules/embed/embed.tools.d.ts.map +1 -1
- package/dist/modules/embed/embed.tools.js +10 -2
- package/dist/modules/embed/embed.tools.js.map +1 -1
- package/dist/modules/kb-fs/git-dir.d.ts +21 -0
- package/dist/modules/kb-fs/git-dir.d.ts.map +1 -0
- package/dist/modules/kb-fs/git-dir.js +58 -0
- package/dist/modules/kb-fs/git-dir.js.map +1 -0
- package/dist/modules/kb-fs/index.d.ts +9 -0
- package/dist/modules/kb-fs/index.d.ts.map +1 -0
- package/dist/modules/kb-fs/index.js +3 -0
- package/dist/modules/kb-fs/index.js.map +1 -0
- package/dist/modules/kb-fs/ref-files.d.ts +63 -0
- package/dist/modules/kb-fs/ref-files.d.ts.map +1 -0
- package/dist/modules/kb-fs/ref-files.js +249 -0
- package/dist/modules/kb-fs/ref-files.js.map +1 -0
- package/dist/modules/plugins/join-request-jobs.service.d.ts.map +1 -1
- package/dist/modules/plugins/join-request-jobs.service.js +43 -8
- package/dist/modules/plugins/join-request-jobs.service.js.map +1 -1
- package/dist/modules/plugins/teams.routes.d.ts +4 -0
- package/dist/modules/plugins/teams.routes.d.ts.map +1 -1
- package/dist/modules/plugins/teams.routes.js +9 -1
- package/dist/modules/plugins/teams.routes.js.map +1 -1
- package/dist/modules/skills/skills.contract.d.ts.map +1 -1
- package/dist/modules/skills/skills.tools.d.ts +8 -1
- package/dist/modules/skills/skills.tools.d.ts.map +1 -1
- package/dist/modules/skills/skills.tools.js +115 -11
- package/dist/modules/skills/skills.tools.js.map +1 -1
- package/dist/modules/tool-auth/internal-token.service.d.ts +1 -1
- package/dist/modules/tool-auth/tool-auth.middleware.d.ts +1 -2
- package/dist/modules/tool-auth/tool-auth.middleware.d.ts.map +1 -1
- package/dist/modules/tool-auth/tool-auth.middleware.js +1 -2
- package/dist/modules/tool-auth/tool-auth.middleware.js.map +1 -1
- package/dist/modules/tool-helpers/default-branch-write.d.ts +69 -0
- package/dist/modules/tool-helpers/default-branch-write.d.ts.map +1 -0
- package/dist/modules/tool-helpers/default-branch-write.js +63 -0
- package/dist/modules/tool-helpers/default-branch-write.js.map +1 -0
- package/dist/modules/tool-helpers/index.d.ts +1 -0
- package/dist/modules/tool-helpers/index.d.ts.map +1 -1
- package/dist/modules/tool-helpers/index.js +1 -0
- package/dist/modules/tool-helpers/index.js.map +1 -1
- package/dist/modules/tool-helpers/tool-handler.d.ts +2 -2
- package/dist/modules/tool-helpers/tool.contract.d.ts +2 -2
- package/dist/modules/workflow/file-lock.service.d.ts +27 -5
- package/dist/modules/workflow/file-lock.service.d.ts.map +1 -1
- package/dist/modules/workflow/file-lock.service.js +70 -18
- package/dist/modules/workflow/file-lock.service.js.map +1 -1
- package/dist/modules/workflow/git/git.service.d.ts +42 -0
- package/dist/modules/workflow/git/git.service.d.ts.map +1 -1
- package/dist/modules/workflow/git/git.service.js +201 -24
- package/dist/modules/workflow/git/git.service.js.map +1 -1
- package/dist/modules/workflow/index.d.ts +8 -0
- package/dist/modules/workflow/index.d.ts.map +1 -0
- package/dist/modules/workflow/index.js +8 -0
- package/dist/modules/workflow/index.js.map +1 -0
- package/dist/modules/workflow/pending-commits.service.d.ts +2 -17
- package/dist/modules/workflow/pending-commits.service.d.ts.map +1 -1
- package/dist/modules/workflow/pending-commits.service.js +4 -24
- package/dist/modules/workflow/pending-commits.service.js.map +1 -1
- package/dist/modules/workflow/workflow-hooks.d.ts +1 -1
- package/dist/modules/workflow/workflow.routes.d.ts.map +1 -1
- package/dist/modules/workflow/workflow.routes.js +20 -1
- package/dist/modules/workflow/workflow.routes.js.map +1 -1
- package/dist/modules/workflow/workflow.service.d.ts.map +1 -1
- package/dist/modules/workflow/workflow.service.js +5 -3
- package/dist/modules/workflow/workflow.service.js.map +1 -1
- package/dist/modules/workspace/agent-access.gate.d.ts +2 -2
- package/dist/modules/workspace/agent-access.gate.js +2 -2
- package/dist/modules/workspace/bounded-matcher.d.ts +79 -0
- package/dist/modules/workspace/bounded-matcher.d.ts.map +1 -0
- package/dist/modules/workspace/bounded-matcher.js +261 -0
- package/dist/modules/workspace/bounded-matcher.js.map +1 -0
- package/dist/modules/workspace/fetch-instant.d.ts +9 -0
- package/dist/modules/workspace/fetch-instant.d.ts.map +1 -0
- package/dist/modules/workspace/fetch-instant.js +13 -0
- package/dist/modules/workspace/fetch-instant.js.map +1 -0
- package/dist/modules/workspace/index.d.ts +17 -0
- package/dist/modules/workspace/index.d.ts.map +1 -0
- package/dist/modules/workspace/index.js +16 -0
- package/dist/modules/workspace/index.js.map +1 -0
- package/dist/modules/workspace/kb-repository.contract.d.ts +124 -0
- package/dist/modules/workspace/kb-repository.contract.d.ts.map +1 -0
- package/dist/modules/workspace/kb-repository.contract.js +19 -0
- package/dist/modules/workspace/kb-repository.contract.js.map +1 -0
- package/dist/modules/workspace/kb-repository.d.ts +236 -0
- package/dist/modules/workspace/kb-repository.d.ts.map +1 -0
- package/dist/modules/workspace/kb-repository.js +811 -0
- package/dist/modules/workspace/kb-repository.js.map +1 -0
- package/dist/modules/workspace/pattern-matcher.contract.d.ts +50 -0
- package/dist/modules/workspace/pattern-matcher.contract.d.ts.map +1 -0
- package/dist/modules/workspace/pattern-matcher.contract.js +27 -0
- package/dist/modules/workspace/pattern-matcher.contract.js.map +1 -0
- package/dist/modules/workspace/routine-write-policy.d.ts +0 -7
- package/dist/modules/workspace/routine-write-policy.d.ts.map +1 -1
- package/dist/modules/workspace/routine-write-policy.js +0 -5
- package/dist/modules/workspace/routine-write-policy.js.map +1 -1
- package/dist/modules/workspace/set-aside-clone.d.ts +40 -0
- package/dist/modules/workspace/set-aside-clone.d.ts.map +1 -1
- package/dist/modules/workspace/set-aside-clone.js +139 -0
- package/dist/modules/workspace/set-aside-clone.js.map +1 -1
- package/dist/modules/workspace/startup/kb-startup-runner.d.ts +99 -0
- package/dist/modules/workspace/startup/kb-startup-runner.d.ts.map +1 -1
- package/dist/modules/workspace/startup/kb-startup-runner.js +407 -29
- package/dist/modules/workspace/startup/kb-startup-runner.js.map +1 -1
- package/dist/modules/workspace/workspace.service.d.ts +68 -32
- package/dist/modules/workspace/workspace.service.d.ts.map +1 -1
- package/dist/modules/workspace/workspace.service.js +240 -161
- package/dist/modules/workspace/workspace.service.js.map +1 -1
- package/dist/modules/workspace/workspace.tools.d.ts +13 -4
- package/dist/modules/workspace/workspace.tools.d.ts.map +1 -1
- package/dist/modules/workspace/workspace.tools.js +268 -356
- package/dist/modules/workspace/workspace.tools.js.map +1 -1
- package/dist/shared/workspace-id.d.ts +17 -0
- package/dist/shared/workspace-id.d.ts.map +1 -1
- package/dist/shared/workspace-id.js +24 -0
- package/dist/shared/workspace-id.js.map +1 -1
- package/dist/test-setup.js +4 -0
- package/dist/test-setup.js.map +1 -1
- package/mcp-app/page.html +142 -8
- package/package.json +3 -3
- package/src/__tests__/test-repositories.ts +22 -0
- package/src/__tests__/workspace-service.ts +69 -0
- package/src/core/__tests__/compose-embed.test.ts +65 -0
- package/src/core/__tests__/lifecycle.test.ts +45 -26
- package/src/core/catalog-revision.ts +4 -2
- package/src/core/compose-embed.ts +50 -0
- package/src/core/core-ports.ts +10 -0
- package/src/core/create-core-server.ts +8 -2
- package/src/core/create-core-services.ts +63 -24
- package/src/core/lifecycle.ts +34 -12
- package/src/modules/access/__tests__/access-control.atref-cache.test.ts +443 -25
- package/src/modules/access/__tests__/access-control.group-read.test.ts +73 -0
- package/src/modules/access/__tests__/access.routes.group-grant.test.ts +66 -0
- package/src/modules/access/__tests__/access.routes.unknown-email.test.ts +2 -0
- package/src/modules/access/access-control.interface.ts +22 -0
- package/src/modules/access/access-control.service.ts +302 -58
- package/src/modules/access/access.routes.ts +22 -6
- package/src/modules/agent-instructions/shared-file-rules.ts +1 -1
- package/src/modules/auth/index.ts +29 -0
- package/src/modules/diff/__tests__/diff.service.seed-atomicity.test.ts +2 -1
- package/src/modules/diff/__tests__/diff.service.test.ts +2 -1
- package/src/modules/diff/__tests__/diff.service.worktree.test.ts +76 -0
- package/src/modules/diff/diff.service.ts +6 -4
- package/src/modules/embed/__tests__/embed.service.test.ts +76 -3
- package/src/modules/embed/__tests__/embed.tools.test.ts +29 -0
- package/src/modules/embed/embed.interface.ts +24 -0
- package/src/modules/embed/embed.service.ts +44 -19
- package/src/modules/embed/embed.tools.ts +10 -2
- package/src/modules/kb-fs/__tests__/git-dir.test.ts +77 -0
- package/src/modules/kb-fs/__tests__/ref-files.test.ts +338 -0
- package/src/modules/kb-fs/git-dir.ts +53 -0
- package/src/modules/kb-fs/index.ts +8 -0
- package/src/modules/kb-fs/ref-files.ts +279 -0
- package/src/modules/plugins/__tests__/join-request-jobs.service.test.ts +73 -6
- package/src/modules/plugins/__tests__/teams.routes.test.ts +55 -0
- package/src/modules/plugins/join-request-jobs.service.ts +45 -8
- package/src/modules/plugins/teams.routes.ts +14 -1
- package/src/modules/settings/__tests__/setup.routes.layout-phase.test.ts +2 -2
- package/src/modules/settings/__tests__/setup.routes.managed-phase.test.ts +2 -2
- package/src/modules/skills/__tests__/branch-skills.tools.test.ts +1 -1
- package/src/modules/skills/skills.contract.ts +4 -0
- package/src/modules/skills/skills.tools.ts +120 -10
- package/src/modules/tool-auth/internal-token.service.ts +1 -1
- package/src/modules/tool-auth/tool-auth.middleware.ts +1 -2
- package/src/modules/tool-helpers/__tests__/branch-declaration.test.ts +2 -2
- package/src/modules/tool-helpers/__tests__/can-write.tools.test.ts +581 -0
- package/src/modules/tool-helpers/default-branch-write.ts +90 -0
- package/src/modules/tool-helpers/index.ts +5 -0
- package/src/modules/tool-helpers/tool-handler.ts +2 -2
- package/src/modules/tool-helpers/tool.contract.ts +2 -2
- package/src/modules/tool-registry/__tests__/tool-description-length.test.ts +42 -3
- package/src/modules/workflow/__tests__/fake-file-lock-db.ts +13 -2
- package/src/modules/workflow/__tests__/workflow.routes.lock-path.test.ts +168 -1
- package/src/modules/workflow/__tests__/workflow.service.delete-branch.test.ts +102 -6
- package/src/modules/workflow/file-lock.service.ts +79 -18
- package/src/modules/workflow/git/__tests__/git.service.changedPathsMemo.test.ts +175 -0
- package/src/modules/workflow/git/__tests__/git.service.readFileAtRef.test.ts +42 -0
- package/src/modules/workflow/git/__tests__/git.service.worktrees.test.ts +284 -0
- package/src/modules/workflow/git/git.service.ts +207 -22
- package/src/modules/workflow/index.ts +7 -0
- package/src/modules/workflow/pending-commits.service.ts +4 -23
- package/src/modules/workflow/workflow-hooks.ts +1 -1
- package/src/modules/workflow/workflow.routes.ts +24 -1
- package/src/modules/workflow/workflow.service.ts +3 -2
- package/src/modules/workspace/__tests__/agent-downloads.test.ts +2 -2
- package/src/modules/workspace/__tests__/bounded-matcher.test.ts +213 -0
- package/src/modules/workspace/__tests__/git-internals.security.test.ts +22 -7
- package/src/modules/workspace/__tests__/kb-repository.test.ts +481 -0
- package/src/modules/workspace/__tests__/rest-tool-arguments.test.ts +14 -0
- package/src/modules/workspace/__tests__/routine-write-policy.test.ts +0 -11
- package/src/modules/workspace/__tests__/workspace-paths-inside-the-repo.test.ts +2 -2
- package/src/modules/workspace/__tests__/workspace.routes.folder-zip-access.test.ts +2 -2
- package/src/modules/workspace/__tests__/workspace.routes.folders.test.ts +4 -3
- package/src/modules/workspace/__tests__/workspace.service.any-workspace-credentials.test.ts +2 -2
- package/src/modules/workspace/__tests__/workspace.service.ensure-remotes-fetched.test.ts +2 -2
- package/src/modules/workspace/__tests__/workspace.service.forget-clone-races.test.ts +12 -5
- package/src/modules/workspace/__tests__/workspace.service.list-cloned.test.ts +6 -6
- package/src/modules/workspace/__tests__/workspace.service.move-never-overwrites.test.ts +2 -1
- package/src/modules/workspace/__tests__/workspace.service.read-filter.test.ts +2 -1
- package/src/modules/workspace/__tests__/workspace.service.replaced-repository.test.ts +2 -1
- package/src/modules/workspace/__tests__/workspace.service.test.ts +24 -23
- package/src/modules/workspace/__tests__/workspace.service.unknown-branch.test.ts +2 -1
- package/src/modules/workspace/__tests__/workspace.service.worktrees.test.ts +620 -0
- package/src/modules/workspace/__tests__/workspace.tools.agents-file.test.ts +15 -1
- package/src/modules/workspace/__tests__/workspace.tools.branch-errors.test.ts +71 -5
- package/src/modules/workspace/__tests__/workspace.tools.test.ts +174 -309
- package/src/modules/workspace/agent-access.gate.ts +2 -2
- package/src/modules/workspace/bounded-matcher.ts +328 -0
- package/src/modules/workspace/fetch-instant.ts +13 -0
- package/src/modules/workspace/index.ts +26 -0
- package/src/modules/workspace/kb-repository.contract.ts +124 -0
- package/src/modules/workspace/kb-repository.ts +844 -0
- package/src/modules/workspace/pattern-matcher.contract.ts +69 -0
- package/src/modules/workspace/routine-write-policy.ts +0 -15
- package/src/modules/workspace/set-aside-clone.ts +140 -0
- package/src/modules/workspace/startup/__tests__/kb-startup-runner.degraded.test.ts +3 -2
- package/src/modules/workspace/startup/__tests__/kb-startup-runner.test.ts +12 -10
- package/src/modules/workspace/startup/__tests__/kb-startup-runner.worktrees.test.ts +613 -0
- package/src/modules/workspace/startup/kb-startup-runner.ts +422 -29
- package/src/modules/workspace/startup/steps/__tests__/steps.test.ts +4 -3
- package/src/modules/workspace/workspace.service.ts +247 -169
- package/src/modules/workspace/workspace.tools.ts +299 -385
- package/src/shared/workspace-id.ts +24 -0
- package/src/test-setup.ts +5 -0
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"teams.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/teams.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAU9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,mBAAmB,EAAsB,MAAM,uBAAuB,CAAC;AAErF
|
|
1
|
+
{"version":3,"file":"teams.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/teams.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAU9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,mBAAmB,EAAsB,MAAM,uBAAuB,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mBAAmB;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kBAAkB;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,+FAA+F;AAC/F,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,cAAc,EAC7B,WAAW,EAAE,mBAAmB,EAChC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAC/C,WAAW,EAAE,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;AACzD,0GAA0G;AAC1G,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,oBAAoB,GAAG,QAAQ,CAAC,GACnD,OAAO,CAAC,MAAM,CA6EhB"}
|
|
@@ -53,10 +53,18 @@ kb) {
|
|
|
53
53
|
tools: tools.filter((t) => reads(t.path) && callerReads(t.path)).map((t) => t.slug),
|
|
54
54
|
};
|
|
55
55
|
};
|
|
56
|
+
// Which groups to list: the resolver's one answer to who sees which
|
|
57
|
+
// group (every group for an admin, only their own for anyone else), the
|
|
58
|
+
// same the share dialog offers and a grant may name. A group's NAME is
|
|
59
|
+
// information too: a deployment that gives each client, author or
|
|
60
|
+
// customer a group of their own would otherwise show every member the
|
|
61
|
+
// whole roster, even though the slices of groups they are not in come
|
|
62
|
+
// back empty.
|
|
63
|
+
const listed = await accessControl.visibleGroups(wsId, email, groups);
|
|
56
64
|
const teams = [
|
|
57
65
|
slice(EVERYONE_TEAM, await accessControl.canReadAsEveryoneBatch(wsId, probes)),
|
|
58
66
|
];
|
|
59
|
-
for (const name of
|
|
67
|
+
for (const name of listed) {
|
|
60
68
|
const team = await accessControl.canReadAsGroupBatch(wsId, name, probes);
|
|
61
69
|
if (team === null)
|
|
62
70
|
continue; // gone between the two reads — nothing to say
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"teams.routes.js","sourceRoot":"","sources":["../../../src/modules/plugins/teams.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,YAAY,GAEb,MAAM,iCAAiC,CAAC;
|
|
1
|
+
{"version":3,"file":"teams.routes.js","sourceRoot":"","sources":["../../../src/modules/plugins/teams.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,YAAY,GAEb,MAAM,iCAAiC,CAAC;AA6CzC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAExC,MAAM,UAAU,iBAAiB,CAC/B,aAA6B,EAC7B,WAAgC,EAChC,YAA+C,EAC/C,WAAyD;AACzD,0GAA0G;AAC1G,EAAoD;IAEpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC;YACrC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACnE,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC;gBAChC,WAAW,CAAC,OAAO,EAAE;gBACrB,YAAY,CAAC,UAAU,EAAE;gBACzB,WAAW,CAAC,gBAAgB,EAAE;aAC/B,CAAC,CAAC;YACH,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,kEAAkE;YAClE,YAAY;YACZ,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;YACzB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC/F,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACxE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,cAAc,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAEjG,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YAC1D,MAAM,gBAAgB,GAAG,CAAC,CAAqB,EAAE,EAAE,CACjD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAEtE,qEAAqE;YACrE,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,QAA8B,EAAc,EAAE;gBACzE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;gBACtD,OAAO;oBACL,IAAI;oBACJ,OAAO,EAAE,OAAO;yBACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC;yBAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;oBACrB,MAAM,EAAE,MAAM;yBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;yBACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBACpF,CAAC;YACJ,CAAC,CAAC;YAEF,oEAAoE;YACpE,wEAAwE;YACxE,uEAAuE;YACvE,kEAAkE;YAClE,sEAAsE;YACtE,sEAAsE;YACtE,cAAc;YACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAEtE,MAAM,KAAK,GAAiB;gBAC1B,KAAK,CAAC,aAAa,EAAE,MAAM,aAAa,CAAC,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;aAC/E,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBACzE,IAAI,IAAI,KAAK,IAAI;oBAAE,SAAS,CAAC,8CAA8C;gBAC3E,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAChC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,YAAY,CAAC;AAC7D,MAAM,SAAS,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,GAAG,SAAS,WAAW,CAAC;AACjE,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,MAAgB,EAAE,EAAE;IAC9D,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,MAAM,KAAK,IAAI,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"skills.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/skills/skills.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"skills.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/skills/skills.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CAKjB;AAED,MAAM,WAAW,KAAM,SAAQ,YAAY;IACzC,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gGAAgG;IAChG,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,WAAW,GAAG,WAAW,GAAG,cAAc,CAAA;CAAE;AAClE;;;;;;GAMG;GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1G,6EAA6E;IAC7E,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClG,8DAA8D;IAC9D,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACrF;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACrF;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7G;;;;OAIG;IACH,UAAU,IAAI,IAAI,CAAC;CACpB"}
|
|
@@ -3,6 +3,7 @@ import type { IToolRegistry } from '../tool-registry/tool.contract.js';
|
|
|
3
3
|
import type { ToolHandlerFactory } from '../tool-helpers/tool-handler.js';
|
|
4
4
|
import type { ISkillService } from './skills.contract.js';
|
|
5
5
|
import type { IAllowedToolsChecker } from './allowed-tools-check.js';
|
|
6
|
+
import { type DefaultBranchWriteDeps } from '../tool-helpers/index.js';
|
|
6
7
|
/**
|
|
7
8
|
* Registers the two skill tools (both surfaces) and hosts their endpoints.
|
|
8
9
|
*
|
|
@@ -21,5 +22,11 @@ import type { IAllowedToolsChecker } from './allowed-tools-check.js';
|
|
|
21
22
|
*/
|
|
22
23
|
export declare function registerSkillsTools(registry: IToolRegistry, router: Router, toolAuth: RequestHandler, toolHandler: ToolHandlerFactory, skillService: ISkillService,
|
|
23
24
|
/** When given, a loaded skill carries `warnings` for `allowed-tools` entries that name no visible tool. */
|
|
24
|
-
allowedTools?: IAllowedToolsChecker
|
|
25
|
+
allowedTools?: IAllowedToolsChecker,
|
|
26
|
+
/**
|
|
27
|
+
* Where `canWrite` is judged: the access layer and the default branch's
|
|
28
|
+
* workspace. Without it every verdict is `false` — the safe answer, which
|
|
29
|
+
* sends the agent to a change request rather than a direct write.
|
|
30
|
+
*/
|
|
31
|
+
writeVerdicts?: DefaultBranchWriteDeps): void;
|
|
25
32
|
//# sourceMappingURL=skills.tools.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"skills.tools.d.ts","sourceRoot":"","sources":["../../../src/modules/skills/skills.tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,mCAAmC,CAAC;AAM7F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;
|
|
1
|
+
{"version":3,"file":"skills.tools.d.ts","sourceRoot":"","sources":["../../../src/modules/skills/skills.tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,mCAAmC,CAAC;AAM7F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAgD,KAAK,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAiDrH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,aAAa;AAC3B,2GAA2G;AAC3G,YAAY,CAAC,EAAE,oBAAoB;AACnC;;;;GAIG;AACH,aAAa,CAAC,EAAE,sBAAsB,GACrC,IAAI,CA8GN"}
|
|
@@ -5,6 +5,7 @@ import { ToolError } from '../tool-helpers/tool.contract.js';
|
|
|
5
5
|
import { toolDef } from '../tool-helpers/tool-def.js';
|
|
6
6
|
import { bodyEnvelope, declareRouteTool } from '../tool-helpers/route-tool-schemas.js';
|
|
7
7
|
import { EXTERNAL_KB_MANUAL_NAME } from '../tool-manuals/tool-manuals.contract.js';
|
|
8
|
+
import { CAN_WRITE_CLAUSE, defaultBranchWriteVerdicts } from '../tool-helpers/index.js';
|
|
8
9
|
/**
|
|
9
10
|
* The optional `branch` both skill tools declare. Optional on purpose, unlike
|
|
10
11
|
* the required `branch` of the KB file tools: a skill read is answered by the
|
|
@@ -64,7 +65,54 @@ const GET_SKILL_INPUTS = {
|
|
|
64
65
|
*/
|
|
65
66
|
export function registerSkillsTools(registry, router, toolAuth, toolHandler, skillService,
|
|
66
67
|
/** When given, a loaded skill carries `warnings` for `allowed-tools` entries that name no visible tool. */
|
|
67
|
-
allowedTools
|
|
68
|
+
allowedTools,
|
|
69
|
+
/**
|
|
70
|
+
* Where `canWrite` is judged: the access layer and the default branch's
|
|
71
|
+
* workspace. Without it every verdict is `false` — the safe answer, which
|
|
72
|
+
* sends the agent to a change request rather than a direct write.
|
|
73
|
+
*/
|
|
74
|
+
writeVerdicts) {
|
|
75
|
+
/**
|
|
76
|
+
* Whether the caller may commit each repo-relative path directly on the
|
|
77
|
+
* default branch — one batch per call, whichever branch was read (see
|
|
78
|
+
* `defaultBranchWriteVerdicts`).
|
|
79
|
+
*/
|
|
80
|
+
const verdictsFor = (ctx, paths, at) => writeVerdicts
|
|
81
|
+
? defaultBranchWriteVerdicts(writeVerdicts, ctx, paths, { ref: at })
|
|
82
|
+
: Promise.resolve(new Map(paths.map((p) => [p, false])));
|
|
83
|
+
/**
|
|
84
|
+
* Every repo-relative file `get_skill`'s `canWrite` covers: the skill's
|
|
85
|
+
* folder as COMMITTED on the default branch (`HEAD` of its clone), which is
|
|
86
|
+
* what a direct write is judged against — never the working tree, where a
|
|
87
|
+
* bundled file deleted but not yet committed would drop out of the verdict
|
|
88
|
+
* while `HEAD` still forbids changing it. A skill is committed there when
|
|
89
|
+
* its `SKILL.md` is — a folder of that name holding other tracked files is
|
|
90
|
+
* not the skill, and its files are not the skill's. A skill not committed
|
|
91
|
+
* there exists only on the branch read, and is judged by its files there,
|
|
92
|
+
* where they would land. The files are listed at ONE commit — the one
|
|
93
|
+
* `HEAD` names when asked, answered beside them — and the verdict is judged
|
|
94
|
+
* at that same commit, so a commit landing between the two cannot pair one
|
|
95
|
+
* snapshot's files with another's rules. Null — judged `false` — when
|
|
96
|
+
* `HEAD` names no commit or the listing fails (fail closed), and without
|
|
97
|
+
* one when the verdict cannot be anything but `false`.
|
|
98
|
+
*/
|
|
99
|
+
const skillFilesOnDefault = async (ctx, loaded) => {
|
|
100
|
+
if (!writeVerdicts?.committedFiles || ctx.scope !== 'write')
|
|
101
|
+
return null;
|
|
102
|
+
const workspaceId = writeVerdicts.defaultWorkspaceId();
|
|
103
|
+
let at;
|
|
104
|
+
let committed;
|
|
105
|
+
try {
|
|
106
|
+
at = await writeVerdicts.committedFiles.commitAtRef(workspaceId, 'HEAD');
|
|
107
|
+
if (!at)
|
|
108
|
+
return null;
|
|
109
|
+
committed = await writeVerdicts.committedFiles.listFilesAtRef(workspaceId, at, loaded.path);
|
|
110
|
+
}
|
|
111
|
+
catch {
|
|
112
|
+
return null;
|
|
113
|
+
}
|
|
114
|
+
return { paths: committed.includes(skillMdOf(loaded)) ? committed : [skillMdOf(loaded), ...loaded.files], at };
|
|
115
|
+
};
|
|
68
116
|
registry.registerExternalTool((ctx) => buildListSkillsDef(skillService, ctx.userEmail));
|
|
69
117
|
registry.registerInternalTool((ctx) => buildListSkillsDef(skillService, ctx.userEmail));
|
|
70
118
|
registry.registerExternalTool((ctx) => buildGetSkillDef(skillService, ctx.userEmail));
|
|
@@ -74,9 +122,14 @@ allowedTools) {
|
|
|
74
122
|
// call that lands before the first listing must be checked against them too.
|
|
75
123
|
declareRouteTool('list_skills', LIST_SKILLS_INPUTS);
|
|
76
124
|
declareRouteTool('get_skill', GET_SKILL_INPUTS);
|
|
77
|
-
router.post('/agent/tools/list_skills', toolAuth, toolHandler(async (args, ctx) =>
|
|
78
|
-
skills
|
|
79
|
-
|
|
125
|
+
router.post('/agent/tools/list_skills', toolAuth, toolHandler(async (args, ctx) => {
|
|
126
|
+
const skills = await skillService.listSkills(ctx.user.email, { branch: branchArg(args) });
|
|
127
|
+
// Judged on each skill's SKILL.md, by the default branch's rules — a
|
|
128
|
+
// skill only on a draft is judged where it would land. Each verdict goes
|
|
129
|
+
// onto a COPY: the summaries may be the catalog shared across users.
|
|
130
|
+
const verdicts = await verdictsFor(ctx, skills.map(skillMdOf));
|
|
131
|
+
return { skills: skills.map((s) => ({ ...s, canWrite: verdicts.get(skillMdOf(s)) === true })) };
|
|
132
|
+
}));
|
|
80
133
|
router.post('/agent/tools/get_skill', toolAuth, toolHandler(async (args, ctx) => {
|
|
81
134
|
const name = typeof args.name === 'string' ? args.name : '';
|
|
82
135
|
const file = typeof args.file === 'string' ? args.file : undefined;
|
|
@@ -88,16 +141,38 @@ allowedTools) {
|
|
|
88
141
|
// skill's history, a `branch` is a draft nobody has released — asked for
|
|
89
142
|
// together, neither answer is the one the caller meant, and guessing
|
|
90
143
|
// would serve instructions under a label that does not describe them.
|
|
91
|
-
|
|
144
|
+
const versioned = version !== undefined && version.trim().length > 0;
|
|
145
|
+
if (branch !== undefined && versioned) {
|
|
92
146
|
throw new ToolError('get_skill takes `branch` or `version`, not both: `branch` loads the skill as that draft has it ' +
|
|
93
147
|
'now, `version` loads a version the released skill declared. Pass one of them.', 400);
|
|
94
148
|
}
|
|
95
149
|
const result = await skillService.getSkill(ctx.user.email, name, file, { version, branch });
|
|
96
|
-
if (!
|
|
150
|
+
if (!result.ok)
|
|
97
151
|
return result;
|
|
98
|
-
|
|
152
|
+
if (result.kind === 'file') {
|
|
153
|
+
const verdicts = await verdictsFor(ctx, [result.file.path]);
|
|
154
|
+
return { ...result, file: { ...result.file, canWrite: verdicts.get(result.file.path) === true } };
|
|
155
|
+
}
|
|
156
|
+
// The whole skill: true only when every one of its files may be written —
|
|
157
|
+
// the files the skill has COMMITTED on the default branch, so a draft, an
|
|
158
|
+
// older version, or a deletion not yet committed that drops a
|
|
159
|
+
// write-denied bundled file does not turn the verdict true. A skill only
|
|
160
|
+
// on the draft is judged by its draft files, where they would land.
|
|
161
|
+
const committed = await skillFilesOnDefault(ctx, result.skill);
|
|
162
|
+
const verdicts = committed === null ? new Map() : await verdictsFor(ctx, committed.paths, committed.at);
|
|
163
|
+
const skill = {
|
|
164
|
+
...result.skill,
|
|
165
|
+
canWrite: committed !== null && committed.paths.every((p) => verdicts.get(p) === true),
|
|
166
|
+
};
|
|
167
|
+
if (!allowedTools)
|
|
168
|
+
return { ...result, skill };
|
|
169
|
+
return { ...result, skill, warnings: await allowedTools.check(ctx.user.email, result.skill.allowedTools) };
|
|
99
170
|
}));
|
|
100
171
|
}
|
|
172
|
+
/** The repo-relative `SKILL.md` of a skill, which `list_skills` judges it by. */
|
|
173
|
+
function skillMdOf(skill) {
|
|
174
|
+
return `${skill.path}/SKILL.md`;
|
|
175
|
+
}
|
|
101
176
|
/**
|
|
102
177
|
* The `branch` a tool call named, or undefined when it named none (the
|
|
103
178
|
* released catalog). A non-string or blank value is NOT a branch: it is taken
|
|
@@ -166,7 +241,9 @@ const LIST_SKILLS_DESCRIPTION = 'List the available skills (reusable specialist
|
|
|
166
241
|
'Discover what skills exist before specialist work, then `get_skill` to load one. ' +
|
|
167
242
|
'Pass `branch` to list the skills as they are on a draft branch instead of the released set — ' +
|
|
168
243
|
'what you need to try a skill you just wrote there; each skill that differs from the released ' +
|
|
169
|
-
'one comes back with `unmerged: true` and that branch, meaning nobody has approved it. '
|
|
244
|
+
'one comes back with `unmerged: true` and that branch, meaning nobody has approved it. ' +
|
|
245
|
+
'Each skill carries `canWrite`: whether you may change its SKILL.md directly on the default branch. ' +
|
|
246
|
+
`${CAN_WRITE_CLAUSE} `;
|
|
170
247
|
async function buildListSkillsDef(skillService, userEmail) {
|
|
171
248
|
return toolDef({
|
|
172
249
|
name: 'list_skills',
|
|
@@ -197,6 +274,13 @@ async function buildListSkillsDef(skillService, userEmail) {
|
|
|
197
274
|
'(it exists only on that branch, or was changed there): nobody has approved what it says.',
|
|
198
275
|
},
|
|
199
276
|
branch: { type: 'string', description: 'With `unmerged`: the branch the skill was read from.' },
|
|
277
|
+
canWrite: {
|
|
278
|
+
type: 'boolean',
|
|
279
|
+
description: 'Whether you may commit a change to its SKILL.md directly on the default branch, under that ' +
|
|
280
|
+
'branch\'s access rules — the same answer whichever branch you listed. `false`: use a branch ' +
|
|
281
|
+
'and a change request; `file_stat` with `explainAccess` says why — and, when you can manage that ' +
|
|
282
|
+
'path\'s access, who can approve.',
|
|
283
|
+
},
|
|
200
284
|
},
|
|
201
285
|
},
|
|
202
286
|
},
|
|
@@ -208,7 +292,9 @@ async function buildListSkillsDef(skillService, userEmail) {
|
|
|
208
292
|
const GET_SKILL_DESCRIPTION = 'Load a skill by name: returns its full instructions (SKILL.md body) to follow, plus the skill ' +
|
|
209
293
|
'folder path and the list of bundled files. Pass `file` to fetch a bundled file’s content ' +
|
|
210
294
|
'(e.g. a script) instead of the body. Loads the latest copy unless `version` names an earlier ' +
|
|
211
|
-
'one the skill declared, or `branch` names a draft to load it from. '
|
|
295
|
+
'one the skill declared, or `branch` names a draft to load it from. ' +
|
|
296
|
+
'The skill (or `file`) carries `canWrite`: whether you may change all of it directly on the default branch. ' +
|
|
297
|
+
`${CAN_WRITE_CLAUSE} `;
|
|
212
298
|
async function buildGetSkillDef(skillService, userEmail) {
|
|
213
299
|
return toolDef({
|
|
214
300
|
name: 'get_skill',
|
|
@@ -225,12 +311,30 @@ async function buildGetSkillDef(skillService, userEmail) {
|
|
|
225
311
|
description: 'The loaded skill: name, description, body, files, …. Read from a `branch` that changed it, ' +
|
|
226
312
|
'it also carries `unmerged: true` and that branch, and its `body` BEGINS with one line ' +
|
|
227
313
|
'saying the skill comes from that unmerged branch and is not approved — treat it as a ' +
|
|
228
|
-
'proposal you are testing, not as approved instructions.'
|
|
314
|
+
'proposal you are testing, not as approved instructions. `canWrite` is true only when you may ' +
|
|
315
|
+
'commit a change to EVERY file of the skill (SKILL.md and each bundled file) directly on the ' +
|
|
316
|
+
'default branch, whichever branch you read.',
|
|
317
|
+
properties: {
|
|
318
|
+
canWrite: {
|
|
319
|
+
type: 'boolean',
|
|
320
|
+
description: 'Whether you may commit a change to every file of the skill (SKILL.md and each bundled file) ' +
|
|
321
|
+
'directly on the default branch, under that branch\'s access rules — the same answer whichever ' +
|
|
322
|
+
'branch you read.',
|
|
323
|
+
},
|
|
324
|
+
},
|
|
229
325
|
},
|
|
230
326
|
file: {
|
|
231
327
|
type: 'object',
|
|
232
328
|
description: 'A bundled file: name, file, path, content — plus `unmerged` and `branch` when it came off ' +
|
|
233
|
-
'a branch that changed the skill (the note stays beside the content, never inside it)
|
|
329
|
+
'a branch that changed the skill (the note stays beside the content, never inside it) — and ' +
|
|
330
|
+
'`canWrite` for that file on the default branch.',
|
|
331
|
+
properties: {
|
|
332
|
+
canWrite: {
|
|
333
|
+
type: 'boolean',
|
|
334
|
+
description: 'Whether you may commit a change to this file directly on the default branch, under that ' +
|
|
335
|
+
'branch\'s access rules — the same answer whichever branch you read.',
|
|
336
|
+
},
|
|
337
|
+
},
|
|
234
338
|
},
|
|
235
339
|
warnings: {
|
|
236
340
|
type: 'array',
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"skills.tools.js","sourceRoot":"","sources":["../../../src/modules/skills/skills.tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAE7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAoB,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAGvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;
|
|
1
|
+
{"version":3,"file":"skills.tools.js","sourceRoot":"","sources":["../../../src/modules/skills/skills.tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAE7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAoB,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAGvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAA+B,MAAM,0BAA0B,CAAC;AAErH;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG;IAC1B,IAAI,EAAE,QAAiB;IACvB,WAAW,EACT,8FAA8F;QAC9F,0FAA0F;QAC1F,sFAAsF;CACzF,CAAC;AAEF,gGAAgG;AAChG,MAAM,kBAAkB,GAAG;IACzB,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;IAC3C,oBAAoB,EAAE,KAAK;CAC5B,CAAC;AAEF,yFAAyF;AACzF,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE;QACzG,IAAI,EAAE;YACJ,IAAI,EAAE,QAAiB;YACvB,WAAW,EACT,2FAA2F;gBAC3F,wCAAwC;SAC3C;QACD,OAAO,EAAE;YACP,IAAI,EAAE,QAAiB;YACvB,WAAW,EACT,0FAA0F;gBAC1F,6GAA6G;gBAC7G,kGAAkG;gBAClG,uFAAuF;gBACvF,uDAAuD;SAC1D;QACD,MAAM,EAAE,mBAAmB;KAC5B;IACD,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,oBAAoB,EAAE,KAAK;CAC5B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAuB,EACvB,MAAc,EACd,QAAwB,EACxB,WAA+B,EAC/B,YAA2B;AAC3B,2GAA2G;AAC3G,YAAmC;AACnC;;;;GAIG;AACH,aAAsC;IAEtC;;;;OAIG;IACH,MAAM,WAAW,GAAG,CAAC,GAAgB,EAAE,KAAe,EAAE,EAAW,EAAiC,EAAE,CACpG,aAAa;QACX,CAAC,CAAC,0BAA0B,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACpE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D;;;;;;;;;;;;;;;OAeG;IACH,MAAM,mBAAmB,GAAG,KAAK,EAC/B,GAAgB,EAChB,MAAyC,EACQ,EAAE;QACnD,IAAI,CAAC,aAAa,EAAE,cAAc,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACzE,MAAM,WAAW,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACvD,IAAI,EAAiB,CAAC;QACtB,IAAI,SAAmB,CAAC;QACxB,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACrB,SAAS,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;IACjH,CAAC,CAAC;IAEF,QAAQ,CAAC,oBAAoB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACxF,QAAQ,CAAC,oBAAoB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACxF,QAAQ,CAAC,oBAAoB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACtF,QAAQ,CAAC,oBAAoB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACtF,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,gBAAgB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IACpD,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAEhD,MAAM,CAAC,IAAI,CACT,0BAA0B,EAC1B,QAAQ,EACR,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,GAAgB,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1F,qEAAqE;QACrE,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAClG,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,QAAQ,EACR,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,GAAgB,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QAC5C,qEAAqE;QACrE,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,SAAS,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS,IAAI,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CACjB,iGAAiG;gBAC/F,+EAA+E,EACjF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACpG,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,8DAA8D;QAC9D,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACzH,MAAM,KAAK,GAAG;YACZ,GAAG,MAAM,CAAC,KAAK;YACf,QAAQ,EAAE,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;SACvF,CAAC;QACF,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC;QAC/C,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IAC7G,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,KAAuB;IACxC,OAAO,GAAG,KAAK,CAAC,IAAI,WAAW,CAAC;AAClC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAA6B;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAAC,YAA2B,EAAE,SAA6B,EAAE,MAAc;IAC3G,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,oCAAoC,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CACrC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,GAAG,KAAK,+BAA+B,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5F,MAAM,IAAI,GAAG,8BAA8B,CAAC;IAC5C,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC/C,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAChD,IAAI,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM;YAAE,MAAM;QAC5D,MAAM,IAAI,KAAK,CAAC;QAChB,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;YACvB,CAAC,CAAC,uDAAuD;YACzD,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,0DAA0D,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAkB,EAAE,KAAa;IACvE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,uBAAuB,IAAI,IAAI,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7F,OAAO,oBAAoB,GAAG,IAAI,GAAG,oBAAoB,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;AACtF,CAAC;AAED,MAAM,uBAAuB,GAC3B,mGAAmG;IACnG,gGAAgG;IAChG,kDAAkD;IAClD,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,qGAAqG;IACrG,GAAG,gBAAgB,GAAG,CAAC;AAEzB,KAAK,UAAU,kBAAkB,CAAC,YAA2B,EAAE,SAAkB;IAC/E,OAAO,OAAO,CAAC;QACb,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,uBAAuB;YACvB,CAAC,MAAM,mBAAmB,CAAC,YAAY,EAAE,SAAS,EAAE,gBAAgB,CAAC,aAAa,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACpI,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,OAAO;oBACb,WAAW,EAAE,mBAAmB;oBAChC,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;4BACxB,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;4BAC/B,OAAO,EAAE;gCACP,IAAI,EAAE,QAAQ;gCACd,WAAW,EACT,0FAA0F;oCAC1F,0EAA0E;6BAC7E;4BACD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;4BACxB,QAAQ,EAAE;gCACR,IAAI,EAAE,SAAS;gCACf,WAAW,EACT,wFAAwF;oCACxF,0FAA0F;6BAC7F;4BACD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sDAAsD,EAAE;4BAC/F,QAAQ,EAAE;gCACR,IAAI,EAAE,SAAS;gCACf,WAAW,EACT,6FAA6F;oCAC7F,8FAA8F;oCAC9F,kGAAkG;oCAClG,kCAAkC;6BACrC;yBACF;qBACF;iBACF;aACF;SACF;QACD,IAAI,EAAE,CAAC,QAAQ,CAAC;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,qBAAqB,GACzB,gGAAgG;IAChG,2FAA2F;IAC3F,+FAA+F;IAC/F,qEAAqE;IACrE,6GAA6G;IAC7G,GAAG,gBAAgB,GAAG,CAAC;AAEzB,KAAK,UAAU,gBAAgB,CAAC,YAA2B,EAAE,SAAkB;IAC7E,OAAO,OAAO,CAAC;QACb,IAAI,EAAE,WAAW;QACjB,WAAW,EACT,qBAAqB;YACrB,CAAC,MAAM,mBAAmB,CAAC,YAAY,EAAE,SAAS,EAAE,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC9H,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,4FAA4F;YACzG,UAAU,EAAE;gBACV,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,6FAA6F;wBAC7F,wFAAwF;wBACxF,uFAAuF;wBACvF,+FAA+F;wBAC/F,8FAA8F;wBAC9F,4CAA4C;oBAC9C,UAAU,EAAE;wBACV,QAAQ,EAAE;4BACR,IAAI,EAAE,SAAS;4BACf,WAAW,EACT,8FAA8F;gCAC9F,gGAAgG;gCAChG,kBAAkB;yBACrB;qBACF;iBACF;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,4FAA4F;wBAC5F,6FAA6F;wBAC7F,iDAAiD;oBACnD,UAAU,EAAE;wBACV,QAAQ,EAAE;4BACR,IAAI,EAAE,SAAS;4BACf,WAAW,EACT,0FAA0F;gCAC1F,qEAAqE;yBACxE;qBACF;iBACF;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO;oBACb,WAAW,EACT,kGAAkG;wBAClG,qEAAqE;oBACvE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC1B;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,4FAA4F;iBAC1G;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,+EAA+E;iBAC7F;aACF;SACF;QACD,IAAI,EAAE,CAAC,QAAQ,CAAC;KACjB,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -31,7 +31,7 @@ export interface InternalTokenClaim {
|
|
|
31
31
|
* connection key to pass through). The verifier resolves such tokens to
|
|
32
32
|
* `source: 'external'`: the caller IS an external agent, and must be treated
|
|
33
33
|
* like one everywhere — admitted to external-only surfaces (`start_session`,
|
|
34
|
-
* `ask`), refused from internal-only ones (`
|
|
34
|
+
* `ask`), refused from internal-only ones (`switch_branch`, …), and
|
|
35
35
|
* expected to carry `sessionId` on the tool body, not in the token.
|
|
36
36
|
*/
|
|
37
37
|
externalProxy?: boolean;
|
|
@@ -51,8 +51,7 @@ declare global {
|
|
|
51
51
|
* Gate that admits ONLY in-process callers (those bearing an internal HMAC
|
|
52
52
|
* token). Mount it AFTER `toolAuth` on every internal-only surface — the
|
|
53
53
|
* internal tool catalog and the routes of tools registered with
|
|
54
|
-
* `registerInternalTool` but NOT `registerExternalTool` (e.g. `
|
|
55
|
-
* `switch_branch`, the `sharepoint_*` reads). `toolAuth` alone is not enough:
|
|
54
|
+
* `registerInternalTool` but NOT `registerExternalTool` (e.g. `switch_branch`, the `sharepoint_*` reads). `toolAuth` alone is not enough:
|
|
56
55
|
* an external connection key authenticates successfully, so without this gate it
|
|
57
56
|
* could invoke an internal-only route directly by guessing its name. The route
|
|
58
57
|
* MUST stay mounted (our own agent reaches it over the same loopback HTTP), so
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tool-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAI/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAOnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gJAAgJ;IAChJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iLAAiL;IACjL,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;SACrB;KACF;CACF;AAID
|
|
1
|
+
{"version":3,"file":"tool-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAI/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAOnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gJAAgJ;IAChJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iLAAiL;IACjL,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;SACrB;KACF;CACF;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB;AAC1C;;;;;;;GAOG;AACH,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,GACvC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,YAAY,CAAC,CA6CtD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,EAC1C,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,GACvC,cAAc,CAwBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,EAC1C,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,gBAAgB,CAAC,GAC5D,cAAc,CAgDhB"}
|
|
@@ -7,8 +7,7 @@ const WWW_AUTH = 'Bearer realm="bevel-tools"';
|
|
|
7
7
|
* Gate that admits ONLY in-process callers (those bearing an internal HMAC
|
|
8
8
|
* token). Mount it AFTER `toolAuth` on every internal-only surface — the
|
|
9
9
|
* internal tool catalog and the routes of tools registered with
|
|
10
|
-
* `registerInternalTool` but NOT `registerExternalTool` (e.g. `
|
|
11
|
-
* `switch_branch`, the `sharepoint_*` reads). `toolAuth` alone is not enough:
|
|
10
|
+
* `registerInternalTool` but NOT `registerExternalTool` (e.g. `switch_branch`, the `sharepoint_*` reads). `toolAuth` alone is not enough:
|
|
12
11
|
* an external connection key authenticates successfully, so without this gate it
|
|
13
12
|
* could invoke an internal-only route directly by guessing its name. The route
|
|
14
13
|
* MUST stay mounted (our own agent reaches it over the same loopback HTTP), so
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tool-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAG5B,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAE7F,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,qCAAqC,GACtC,MAAM,+BAA+B,CAAC;AAkDvC,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C
|
|
1
|
+
{"version":3,"file":"tool-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAG5B,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAE7F,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,qCAAqC,GACtC,MAAM,+BAA+B,CAAC;AAkDvC,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAYF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,qBAA6C,EAC7C,oBAA0C;AAC1C;;;;;;;GAOG;AACH,QAAwC;IAExC,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAC/G,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QAE3B,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;YAC5F,IAAI,QAAQ,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,KAAK,CAAC,aAAa;gBACxB,CAAC,CAAC;oBACE,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE;wBACJ,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnE,KAAK,EAAE,OAAO;qBACf;iBACF;gBACH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;QACvJ,CAAC;QAED,wGAAwG;QACxG,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YACzH,CAAC;YACD,6EAA6E;YAC7E,IAAI,MAAM,qBAAqB,CAAC,yBAAyB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,2BAA2B,EAAE,SAAS,EAAE,qCAAqC,EAAE,CAAC;YAC5H,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,gCAAgC,EAAE,CAAC;QAC1H,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,qBAA6C,EAC7C,oBAA0C,EAC1C,QAAwC;IAExC,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;IAC1F,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;oBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;gBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,qBAA6C,EAC7C,oBAA0C,EAC1C,WAA6D;IAE7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAC7F,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE3D,4EAA4E;QAC5E,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/G,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;wBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;oBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC3B,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,4DAA4D;YAC5D,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;gBAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC7D,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,69 @@
|
|
|
1
|
+
import type { IAccessControl } from '../access/access-control.interface.js';
|
|
2
|
+
import type { ToolContext } from './tool.contract.js';
|
|
3
|
+
/**
|
|
4
|
+
* What the read tools need to say whether a change can land directly: the
|
|
5
|
+
* access layer and the default branch's workspace. A function for the
|
|
6
|
+
* workspace, not a value, because first-run setup may name the default branch
|
|
7
|
+
* after the tools are mounted.
|
|
8
|
+
*/
|
|
9
|
+
export interface DefaultBranchWriteDeps {
|
|
10
|
+
accessControl: Pick<IAccessControl, 'canWriteBatchAtRef'>;
|
|
11
|
+
defaultWorkspaceId: () => string;
|
|
12
|
+
/**
|
|
13
|
+
* The files under a folder as COMMITTED at a ref of a workspace, repo-root
|
|
14
|
+
* relative — what `get_skill`'s whole-skill verdict covers: the skill's
|
|
15
|
+
* files as the default branch's `HEAD` has them, not as its working tree
|
|
16
|
+
* has them, so a bundled file deleted on disk but not yet committed is
|
|
17
|
+
* still judged. Absent, `get_skill` answers `false` for the whole skill.
|
|
18
|
+
*/
|
|
19
|
+
committedFiles?: {
|
|
20
|
+
/** The commit `ref` names right now, or null when it names none (an unborn HEAD). */
|
|
21
|
+
commitAtRef(workspaceId: string, ref: string): Promise<string | null>;
|
|
22
|
+
listFilesAtRef(workspaceId: string, ref: string, folder: string): Promise<string[]>;
|
|
23
|
+
};
|
|
24
|
+
}
|
|
25
|
+
/**
|
|
26
|
+
* The `canWrite` verdicts `list_skills`, `get_skill`, `list_files` and
|
|
27
|
+
* `read_file` report: whether the caller may commit a change to each
|
|
28
|
+
* repo-relative path DIRECTLY on the default branch, under the access rules
|
|
29
|
+
* COMMITTED there. `false` means "make the change on a branch and open a
|
|
30
|
+
* change request", never "you cannot write at all" — on a draft, anyone who
|
|
31
|
+
* may read a path may write it, so "writable on the branch read" would say
|
|
32
|
+
* yes exactly where a direct write is later refused.
|
|
33
|
+
*
|
|
34
|
+
* Always judged against the default branch, whichever branch the call read:
|
|
35
|
+
* that is where a direct change lands. And judged at that clone's `HEAD`, the
|
|
36
|
+
* way the direct write itself is gated (`assertCanWriteAtRef` in the git
|
|
37
|
+
* service), not from the rules as the working tree has them: a grant written
|
|
38
|
+
* to disk but not yet committed — a queued save, an edit in flight — would
|
|
39
|
+
* otherwise say `true` for a write that is then refused. ONE batched check
|
|
40
|
+
* per call.
|
|
41
|
+
*
|
|
42
|
+
* Fails closed: a read-only credential gets `false` for every path without
|
|
43
|
+
* the access layer being asked; a check that throws, or a path the answer
|
|
44
|
+
* leaves out, is `false`. Read the result with `=== true`. The one answer
|
|
45
|
+
* that is not closed is the gate's own: `null` — no rules at `HEAD` yet, a
|
|
46
|
+
* knowledge base being set up — is where the direct write is allowed
|
|
47
|
+
* (bootstrap, `assertCanWriteAtRef`), so every path is `true` there; a
|
|
48
|
+
* `false` would send the agent to a change request the gate does not ask
|
|
49
|
+
* for.
|
|
50
|
+
*
|
|
51
|
+
* Per caller and never cached here: a verdict belongs to one caller's answer,
|
|
52
|
+
* not to anything shared across users.
|
|
53
|
+
*/
|
|
54
|
+
export declare function defaultBranchWriteVerdicts(deps: DefaultBranchWriteDeps, ctx: Pick<ToolContext, 'scope' | 'user'>, paths: readonly string[],
|
|
55
|
+
/**
|
|
56
|
+
* The commit to judge at, when the caller has already pinned one — a
|
|
57
|
+
* caller that read a file set at a commit judges it at THAT commit, so a
|
|
58
|
+
* commit landing in between cannot pair one snapshot's files with
|
|
59
|
+
* another's rules. Default: `HEAD` of the default branch's clone.
|
|
60
|
+
*/
|
|
61
|
+
opts?: {
|
|
62
|
+
ref?: string;
|
|
63
|
+
}): Promise<Map<string, boolean>>;
|
|
64
|
+
/**
|
|
65
|
+
* The clause each of the four tools carries in its description. Said the
|
|
66
|
+
* same way everywhere so an agent reading any one of them learns the rule.
|
|
67
|
+
*/
|
|
68
|
+
export declare const CAN_WRITE_CLAUSE = "`canWrite: false` means use a branch and a change request, never a direct write; a read-only connection can do neither.";
|
|
69
|
+
//# sourceMappingURL=default-branch-write.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"default-branch-write.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/default-branch-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,IAAI,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;IAC1D,kBAAkB,EAAE,MAAM,MAAM,CAAC;IACjC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QACf,qFAAqF;QACrF,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACtE,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;KACrF,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,sBAAsB,EAC5B,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,CAAC,EACxC,KAAK,EAAE,SAAS,MAAM,EAAE;AACxB;;;;;GAKG;AACH,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgB/B;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,4HAC8F,CAAC"}
|
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The `canWrite` verdicts `list_skills`, `get_skill`, `list_files` and
|
|
3
|
+
* `read_file` report: whether the caller may commit a change to each
|
|
4
|
+
* repo-relative path DIRECTLY on the default branch, under the access rules
|
|
5
|
+
* COMMITTED there. `false` means "make the change on a branch and open a
|
|
6
|
+
* change request", never "you cannot write at all" — on a draft, anyone who
|
|
7
|
+
* may read a path may write it, so "writable on the branch read" would say
|
|
8
|
+
* yes exactly where a direct write is later refused.
|
|
9
|
+
*
|
|
10
|
+
* Always judged against the default branch, whichever branch the call read:
|
|
11
|
+
* that is where a direct change lands. And judged at that clone's `HEAD`, the
|
|
12
|
+
* way the direct write itself is gated (`assertCanWriteAtRef` in the git
|
|
13
|
+
* service), not from the rules as the working tree has them: a grant written
|
|
14
|
+
* to disk but not yet committed — a queued save, an edit in flight — would
|
|
15
|
+
* otherwise say `true` for a write that is then refused. ONE batched check
|
|
16
|
+
* per call.
|
|
17
|
+
*
|
|
18
|
+
* Fails closed: a read-only credential gets `false` for every path without
|
|
19
|
+
* the access layer being asked; a check that throws, or a path the answer
|
|
20
|
+
* leaves out, is `false`. Read the result with `=== true`. The one answer
|
|
21
|
+
* that is not closed is the gate's own: `null` — no rules at `HEAD` yet, a
|
|
22
|
+
* knowledge base being set up — is where the direct write is allowed
|
|
23
|
+
* (bootstrap, `assertCanWriteAtRef`), so every path is `true` there; a
|
|
24
|
+
* `false` would send the agent to a change request the gate does not ask
|
|
25
|
+
* for.
|
|
26
|
+
*
|
|
27
|
+
* Per caller and never cached here: a verdict belongs to one caller's answer,
|
|
28
|
+
* not to anything shared across users.
|
|
29
|
+
*/
|
|
30
|
+
export async function defaultBranchWriteVerdicts(deps, ctx, paths,
|
|
31
|
+
/**
|
|
32
|
+
* The commit to judge at, when the caller has already pinned one — a
|
|
33
|
+
* caller that read a file set at a commit judges it at THAT commit, so a
|
|
34
|
+
* commit landing in between cannot pair one snapshot's files with
|
|
35
|
+
* another's rules. Default: `HEAD` of the default branch's clone.
|
|
36
|
+
*/
|
|
37
|
+
opts = {}) {
|
|
38
|
+
const verdicts = new Map(paths.map((p) => [p, false]));
|
|
39
|
+
if (ctx.scope !== 'write' || paths.length === 0)
|
|
40
|
+
return verdicts;
|
|
41
|
+
try {
|
|
42
|
+
const answer = await deps.accessControl.canWriteBatchAtRef(deps.defaultWorkspaceId(), opts.ref ?? 'HEAD', ctx.user.email, [
|
|
43
|
+
...new Set(paths),
|
|
44
|
+
]);
|
|
45
|
+
// Bootstrap: no rules at HEAD, and the gate lets the write through.
|
|
46
|
+
if (!answer)
|
|
47
|
+
return new Map(paths.map((p) => [p, true]));
|
|
48
|
+
for (const p of paths)
|
|
49
|
+
verdicts.set(p, answer.get(p) === true);
|
|
50
|
+
}
|
|
51
|
+
catch {
|
|
52
|
+
// A verdict that cannot be computed is `false`: the agent then proposes
|
|
53
|
+
// the change, which can land; a wrong `true` would offer a direct write
|
|
54
|
+
// that is refused.
|
|
55
|
+
}
|
|
56
|
+
return verdicts;
|
|
57
|
+
}
|
|
58
|
+
/**
|
|
59
|
+
* The clause each of the four tools carries in its description. Said the
|
|
60
|
+
* same way everywhere so an agent reading any one of them learns the rule.
|
|
61
|
+
*/
|
|
62
|
+
export const CAN_WRITE_CLAUSE = '`canWrite: false` means use a branch and a change request, never a direct write; a read-only connection can do neither.';
|
|
63
|
+
//# sourceMappingURL=default-branch-write.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"default-branch-write.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/default-branch-write.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAA4B,EAC5B,GAAwC,EACxC,KAAwB;AACxB;;;;;GAKG;AACH,OAAyB,EAAE;IAE3B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE;YACxH,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC;SAClB,CAAC,CAAC;QACH,oEAAoE;QACpE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,wEAAwE;QACxE,mBAAmB;IACrB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,yHAAyH,CAAC"}
|
|
@@ -43,4 +43,5 @@ export { createToolValidator, type ValidateToken, type ToolValidatorDeps } from
|
|
|
43
43
|
export { toolDef, BRANCH_INPUT, DEFAULTED_BRANCH_INPUT, type ToolDefSpec, type BranchDeclaration, } from './tool-def.js';
|
|
44
44
|
export { ToolError, hasHttpStatus, type ToolContext, type ToolHandler } from './tool.contract.js';
|
|
45
45
|
export type { JsonSchema, UtcpTool } from '../tool-registry/tool.contract.js';
|
|
46
|
+
export { CAN_WRITE_CLAUSE, defaultBranchWriteVerdicts, type DefaultBranchWriteDeps, } from './default-branch-write.js';
|
|
46
47
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EACL,OAAO,EACP,YAAY,EACZ,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAClG,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EACL,OAAO,EACP,YAAY,EACZ,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAClG,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,2BAA2B,CAAC"}
|
|
@@ -42,4 +42,5 @@
|
|
|
42
42
|
export { createToolValidator } from './validate-token.js';
|
|
43
43
|
export { toolDef, BRANCH_INPUT, DEFAULTED_BRANCH_INPUT, } from './tool-def.js';
|
|
44
44
|
export { ToolError, hasHttpStatus } from './tool.contract.js';
|
|
45
|
+
export { CAN_WRITE_CLAUSE, defaultBranchWriteVerdicts, } from './default-branch-write.js';
|
|
45
46
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,mBAAmB,EAA8C,MAAM,qBAAqB,CAAC;AACtG,OAAO,EACL,OAAO,EACP,YAAY,EACZ,sBAAsB,GAGvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAsC,MAAM,oBAAoB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,mBAAmB,EAA8C,MAAM,qBAAqB,CAAC;AACtG,OAAO,EACL,OAAO,EACP,YAAY,EACZ,sBAAsB,GAGvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAsC,MAAM,oBAAoB,CAAC;AAElG,OAAO,EACL,gBAAgB,EAChB,0BAA0B,GAE3B,MAAM,2BAA2B,CAAC"}
|
|
@@ -16,8 +16,8 @@ export interface ToolHandlerOptions {
|
|
|
16
16
|
writeScope?: boolean;
|
|
17
17
|
/**
|
|
18
18
|
* How this route treats `branch`, when it must differ from what its
|
|
19
|
-
* `toolDef` recorded
|
|
20
|
-
*
|
|
19
|
+
* `toolDef` recorded (`own`: the handler resolves it itself rather than
|
|
20
|
+
* being refused).
|
|
21
21
|
*/
|
|
22
22
|
branch?: BranchHandling;
|
|
23
23
|
}
|
|
@@ -37,8 +37,8 @@ export interface ToolContext {
|
|
|
37
37
|
sessionId?: string;
|
|
38
38
|
/**
|
|
39
39
|
* The branch the in-process agent's workspace is focused on, from its internal
|
|
40
|
-
* token.
|
|
41
|
-
*
|
|
40
|
+
* token. A tool may fall back to it when the model omits `branch` (`list_tool_setup`
|
|
41
|
+
* reads the focused branch's setup), so the in-app chat agent acts on its own
|
|
42
42
|
* workspace even on a branch-less call. Only set for `source: 'internal'`;
|
|
43
43
|
* external callers must name the branch explicitly (a present-but-invalid value
|
|
44
44
|
* still fails closed regardless of this).
|