@cello-protocol/gateway 0.0.12 → 0.0.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bin/cello-gateway.js +74 -17
- package/dist/bin/cello-gateway.js.map +1 -1
- package/dist/client.d.ts +12 -1
- package/dist/client.d.ts.map +1 -1
- package/dist/client.js +30 -0
- package/dist/client.js.map +1 -1
- package/dist/config/config-store.d.ts +24 -1
- package/dist/config/config-store.d.ts.map +1 -1
- package/dist/config/config-store.js +9 -2
- package/dist/config/config-store.js.map +1 -1
- package/dist/detect/index.d.ts +9 -5
- package/dist/detect/index.d.ts.map +1 -1
- package/dist/detect/index.js +9 -5
- package/dist/detect/index.js.map +1 -1
- package/dist/detect/pii.d.ts.map +1 -1
- package/dist/detect/pii.js +43 -1
- package/dist/detect/pii.js.map +1 -1
- package/dist/detect/rate-limit.d.ts +0 -12
- package/dist/detect/rate-limit.d.ts.map +1 -1
- package/dist/detect/rate-limit.js +16 -1
- package/dist/detect/rate-limit.js.map +1 -1
- package/dist/index.d.ts +3 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -2
- package/dist/index.js.map +1 -1
- package/dist/passthrough.d.ts +11 -6
- package/dist/passthrough.d.ts.map +1 -1
- package/dist/passthrough.js +10 -5
- package/dist/passthrough.js.map +1 -1
- package/dist/records/record-store.d.ts +26 -1
- package/dist/records/record-store.d.ts.map +1 -1
- package/dist/records/record-store.js +9 -2
- package/dist/records/record-store.js.map +1 -1
- package/dist/screen/affordance.d.ts +32 -0
- package/dist/screen/affordance.d.ts.map +1 -0
- package/dist/screen/affordance.js +37 -0
- package/dist/screen/affordance.js.map +1 -0
- package/dist/screen/inbound.d.ts.map +1 -1
- package/dist/screen/inbound.js +6 -2
- package/dist/screen/inbound.js.map +1 -1
- package/dist/screen/outbound.d.ts.map +1 -1
- package/dist/screen/outbound.js +15 -4
- package/dist/screen/outbound.js.map +1 -1
- package/dist/spawn.d.ts.map +1 -1
- package/dist/spawn.js +33 -5
- package/dist/spawn.js.map +1 -1
- package/dist/store/encrypted-db.d.ts +12 -2
- package/dist/store/encrypted-db.d.ts.map +1 -1
- package/dist/store/encrypted-db.js +73 -10
- package/dist/store/encrypted-db.js.map +1 -1
- package/dist/testing.d.ts +14 -0
- package/dist/testing.d.ts.map +1 -0
- package/dist/testing.js +14 -0
- package/dist/testing.js.map +1 -0
- package/dist/types.d.ts +10 -0
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js.map +1 -1
- package/package.json +6 -2
|
@@ -18,8 +18,27 @@ import { initLinearRegex } from "../detect/linear-regex.js";
|
|
|
18
18
|
import { compileInjectionPatterns } from "../detect/injection-patterns.js";
|
|
19
19
|
import { compileSecretRules } from "../detect/secrets.js";
|
|
20
20
|
import { GatewayConfigStore } from "../config/config-store.js";
|
|
21
|
+
import { stderrStoreEventSink } from "../store/encrypted-db.js";
|
|
21
22
|
import { GatewayRecordStore } from "../records/record-store.js";
|
|
22
23
|
import { createHash } from "node:crypto";
|
|
24
|
+
/**
|
|
25
|
+
* Fold the WAL into the main database without CLOSING the connection.
|
|
26
|
+
*
|
|
27
|
+
* `PRAGMA wal_checkpoint(TRUNCATE)` writes committed frames back into `gateway.db` and empties the
|
|
28
|
+
* log. Unlike `close()`, it does not unlink `-wal`/`-shm` out from under the daemon's long-lived
|
|
29
|
+
* handles — which is the whole point (review F1/F2). Best-effort by design: a failed checkpoint
|
|
30
|
+
* loses nothing, because the records are already committed and the next reader recovers the WAL.
|
|
31
|
+
*/
|
|
32
|
+
function checkpointStore(...stores) {
|
|
33
|
+
for (const s of stores) {
|
|
34
|
+
try {
|
|
35
|
+
s?.checkpoint?.();
|
|
36
|
+
}
|
|
37
|
+
catch (err) {
|
|
38
|
+
process.stderr.write(`cello-gateway: checkpoint failed: ${err instanceof Error ? err.message : String(err)}\n`);
|
|
39
|
+
}
|
|
40
|
+
}
|
|
41
|
+
}
|
|
23
42
|
async function main() {
|
|
24
43
|
const socketPath = process.env["CELLO_GATEWAY_SOCKET"];
|
|
25
44
|
if (!socketPath) {
|
|
@@ -40,8 +59,13 @@ async function main() {
|
|
|
40
59
|
// security records, keyed by the daemon's key file — the daemon's spawn plumbing passes the two
|
|
41
60
|
// paths (M9C-D8: a key FILE path, never key bytes). Both stores fail closed: a missing or wrong
|
|
42
61
|
// key throws GatewayStoreError, which exits the process rather than screening unconfigured.
|
|
43
|
-
|
|
44
|
-
|
|
62
|
+
// `|| undefined` so the guard below and the two call sites read the SAME value. Testing
|
|
63
|
+
// `=== undefined` here while the call sites test truthiness let CELLO_GATEWAY_STORE_DB="" pass
|
|
64
|
+
// the guard and then silently produce NO stores — screening every message with no audit trail
|
|
65
|
+
// and no config governance, while printing READY as if healthy. An empty string is exactly what
|
|
66
|
+
// a path computation that returned nothing interpolates to.
|
|
67
|
+
const storeDbPath = process.env["CELLO_GATEWAY_STORE_DB"] || undefined;
|
|
68
|
+
const storeKeyFile = process.env["CELLO_GATEWAY_STORE_KEY_FILE"] || undefined;
|
|
45
69
|
if ((storeDbPath === undefined) !== (storeKeyFile === undefined)) {
|
|
46
70
|
// Half-configured storage is a plumbing bug, not a degraded mode to run through: it would
|
|
47
71
|
// silently drop either the operator's config or the whole audit trail.
|
|
@@ -49,26 +73,34 @@ async function main() {
|
|
|
49
73
|
process.exit(2);
|
|
50
74
|
return;
|
|
51
75
|
}
|
|
52
|
-
// M9-CFG-001 (INV-4): the gateway owns its config
|
|
53
|
-
//
|
|
54
|
-
//
|
|
55
|
-
//
|
|
56
|
-
|
|
57
|
-
|
|
76
|
+
// M9-CFG-001 (INV-4) + DOD-M9C-ENV-1 (policy D-5): the gateway owns its config, and the STORE IS
|
|
77
|
+
// THE ONLY SOURCE. There is deliberately no environment fallback for any policy value.
|
|
78
|
+
//
|
|
79
|
+
// There used to be four: CELLO_GATEWAY_AUTONOMOUS_OVERRIDE, _PII_WHITELIST,
|
|
80
|
+
// _RATE_MAX_PER_WINDOW and _RATE_WINDOW_MS sat UNDER the store as defaults. Each one could loosen
|
|
81
|
+
// a guard with no confirmation, no versioned row, and no hash-chained fingerprint — the entire
|
|
82
|
+
// tighten-free / loosen-confirmed mechanism bypassed by anyone who could set a variable. A gate
|
|
83
|
+
// with a published bypass is not a gate. They are gone; `cello config set` is the way in, and it
|
|
84
|
+
// asks a human before it weakens anything.
|
|
85
|
+
//
|
|
86
|
+
// Each key still falls back to its TIGHTEST value when the store has not set it (empty whitelist,
|
|
87
|
+
// override off, no rate cap), so an absent or empty config never silently loosens.
|
|
88
|
+
const config = storeDbPath && storeKeyFile ? new GatewayConfigStore(storeDbPath, storeKeyFile, stderrStoreEventSink) : undefined;
|
|
89
|
+
const cfg = (key, tightestDefault) => {
|
|
58
90
|
const v = config?.get(key);
|
|
59
|
-
return v !== undefined ? v :
|
|
91
|
+
return v !== undefined ? v : tightestDefault;
|
|
60
92
|
};
|
|
61
|
-
const piiWhitelist = cfg("pii_whitelist",
|
|
93
|
+
const piiWhitelist = cfg("pii_whitelist", []);
|
|
62
94
|
// autonomous_override defaults OFF — the agent's only autonomous lever over a PII warn is `redact`;
|
|
63
95
|
// allowing a value out is a human action (loosening the store requires confirmation).
|
|
64
|
-
const autonomousOverride = cfg("autonomous_override",
|
|
96
|
+
const autonomousOverride = cfg("autonomous_override", false);
|
|
65
97
|
// OUT-004 per-agent outbound rate cap. A positive cap enables it. NOTE: "no cap" is the LOOSEST state,
|
|
66
98
|
// not the tightest — so rate-limiting is OFF by default (the operator opts in to a cap). If a cap IS
|
|
67
99
|
// set but the window is missing/invalid, do NOT silently disable the cap (code-review M1) — fall back
|
|
68
100
|
// to a sane default window so a configured limit is never lost.
|
|
69
101
|
const DEFAULT_RATE_WINDOW_MS = 60_000;
|
|
70
|
-
const rateMax = Number(cfg("rate_max_per_window",
|
|
71
|
-
const rawWindow = Number(cfg("rate_window_ms",
|
|
102
|
+
const rateMax = Number(cfg("rate_max_per_window", 0));
|
|
103
|
+
const rawWindow = Number(cfg("rate_window_ms", DEFAULT_RATE_WINDOW_MS));
|
|
72
104
|
const rateWindowMs = Number.isFinite(rawWindow) && rawWindow > 0 ? rawWindow : DEFAULT_RATE_WINDOW_MS;
|
|
73
105
|
const rateLimit = Number.isFinite(rateMax) && rateMax > 0
|
|
74
106
|
? { maxPerWindow: rateMax, windowMs: rateWindowMs }
|
|
@@ -79,7 +111,7 @@ async function main() {
|
|
|
79
111
|
// tamper-evidence, in the same encrypted store as the config (M9C-D9). The verdict's disposition
|
|
80
112
|
// maps to the record: allow → clean (a clean pass IS recorded — an absent record is itself
|
|
81
113
|
// evidence of suppression), redact/block/warn verbatim.
|
|
82
|
-
const records = storeDbPath && storeKeyFile ? new GatewayRecordStore(storeDbPath, storeKeyFile) : undefined;
|
|
114
|
+
const records = storeDbPath && storeKeyFile ? new GatewayRecordStore(storeDbPath, storeKeyFile, stderrStoreEventSink) : undefined;
|
|
83
115
|
const recordOutcome = (direction, v, content, correlationId) => {
|
|
84
116
|
if (!records)
|
|
85
117
|
return;
|
|
@@ -169,17 +201,42 @@ async function main() {
|
|
|
169
201
|
return;
|
|
170
202
|
stopping = true;
|
|
171
203
|
void handle.stop().then(() => {
|
|
172
|
-
|
|
173
|
-
|
|
204
|
+
// DO NOT close() these. Review F1/F2, reproduced against @signalapp/sqlcipher 3.3.5: ANY
|
|
205
|
+
// connection's close unlinks `-wal`/`-shm` — not just the last one. The daemon holds long-
|
|
206
|
+
// lived handles on this same file, and `restartSecurityGateway` SIGTERMs this process on
|
|
207
|
+
// every successful `cello config set`. So closing here left the daemon's handle permanently
|
|
208
|
+
// stale: `cello policy log` under-reported for the rest of that daemon's life while still
|
|
209
|
+
// reporting chainValid:true, and the next config write through the stale handle returned ok
|
|
210
|
+
// and left the store SQLITE_CORRUPT.
|
|
211
|
+
//
|
|
212
|
+
// Checkpoint instead: fold the WAL into the main file so nothing is lost, and let process
|
|
213
|
+
// exit release the descriptors. Exit unlinks nothing that another process is still using.
|
|
214
|
+
checkpointStore(config, records);
|
|
174
215
|
process.stderr.write(`cello-gateway: stopped (${signal})\n`);
|
|
175
216
|
process.exit(0);
|
|
176
217
|
});
|
|
177
218
|
};
|
|
178
219
|
process.on("SIGTERM", () => shutdown("SIGTERM"));
|
|
179
220
|
process.on("SIGINT", () => shutdown("SIGINT"));
|
|
221
|
+
// PARENT DEATH SWITCH (review F5). The daemon spawns this process with a piped stdin and never
|
|
222
|
+
// writes to it; when the daemon dies — including the ways that skip its shutdown path entirely,
|
|
223
|
+
// SIGKILL and crashes — the kernel closes the pipe and this fires. Without it the gateway
|
|
224
|
+
// outlives its daemon holding the store's write lock, and the next daemon comes up permanently
|
|
225
|
+
// fail-closed against a lock nobody can explain.
|
|
226
|
+
process.stdin.on("end", () => shutdown("parent_exited"));
|
|
227
|
+
process.stdin.on("close", () => shutdown("parent_exited"));
|
|
228
|
+
process.stdin.resume();
|
|
180
229
|
}
|
|
181
230
|
main().catch((err) => {
|
|
182
|
-
|
|
231
|
+
// Print the CODE and the GUIDANCE, not just the message. The guidance is the only part that
|
|
232
|
+
// tells the operator what to do, and dropping it was how "your key file is missing" reached
|
|
233
|
+
// them as "sidecar exited before ready (code 1)".
|
|
234
|
+
const code = err?.code;
|
|
235
|
+
const guidance = err?.guidance;
|
|
236
|
+
const message = err instanceof Error ? err.message : String(err);
|
|
237
|
+
process.stderr.write(`cello-gateway: fatal${code ? ` [${code}]` : ""} ${message}\n`);
|
|
238
|
+
if (guidance)
|
|
239
|
+
process.stderr.write(`cello-gateway: ${guidance}\n`);
|
|
183
240
|
process.exit(1);
|
|
184
241
|
});
|
|
185
242
|
//# sourceMappingURL=cello-gateway.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cello-gateway.js","sourceRoot":"","sources":["../../src/bin/cello-gateway.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAA0B,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAEhE,gGAAgG;IAChG,6FAA6F;IAC7F,6DAA6D;IAC7D,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,wBAAwB,EAAE,CAAC;IAC3B,kBAAkB,EAAE,CAAC;IAErB,4FAA4F;IAC5F,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"cello-gateway.js","sourceRoot":"","sources":["../../src/bin/cello-gateway.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAA0B,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAG,MAAsD;IAChF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC;YAAC,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC;QAAC,CAAC;QAC1B,OAAO,GAAG,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IAClI,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAEhE,gGAAgG;IAChG,6FAA6F;IAC7F,6DAA6D;IAC7D,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,wBAAwB,EAAE,CAAC;IAC3B,kBAAkB,EAAE,CAAC;IAErB,4FAA4F;IAC5F,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,wFAAwF;IACxF,+FAA+F;IAC/F,8FAA8F;IAC9F,gGAAgG;IAChG,4DAA4D;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,SAAS,CAAC;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,SAAS,CAAC;IAC9E,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,EAAE,CAAC;QACjE,0FAA0F;QAC1F,uEAAuE;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+FAA+F,CAAC,CAAC;QACtH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,iGAAiG;IACjG,uFAAuF;IACvF,EAAE;IACF,4EAA4E;IAC5E,kGAAkG;IAClG,+FAA+F;IAC/F,gGAAgG;IAChG,iGAAiG;IACjG,2CAA2C;IAC3C,EAAE;IACF,kGAAkG;IAClG,mFAAmF;IACnF,MAAM,MAAM,GAAG,WAAW,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,WAAW,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjI,MAAM,GAAG,GAAG,CAAI,GAAW,EAAE,eAAkB,EAAK,EAAE;QACpD,MAAM,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAE,CAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACtD,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,CAAW,eAAe,EAAE,EAAE,CAAC,CAAC;IACxD,oGAAoG;IACpG,sFAAsF;IACtF,MAAM,kBAAkB,GAAG,GAAG,CAAU,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACtE,uGAAuG;IACvG,qGAAqG;IACrG,sGAAsG;IACtG,gEAAgE;IAChE,MAAM,sBAAsB,GAAG,MAAM,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAS,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAS,gBAAgB,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACtG,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QACvD,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjH,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IAEtC,yFAAyF;IACzF,iGAAiG;IACjG,2FAA2F;IAC3F,wDAAwD;IACxD,MAAM,OAAO,GAAG,WAAW,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,WAAW,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClI,MAAM,aAAa,GAAG,CAAC,SAAiC,EAAE,CAAgB,EAAE,OAAmB,EAAE,aAAsB,EAAQ,EAAE;QAC/H,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,WAAW,GAAsB,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3F,gGAAgG;QAChG,oGAAoG;QACpG,iGAAiG;QACjG,MAAM,MAAM,GAAG,WAAW,KAAK,OAAO;YACpC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QAC5G,OAAO,CAAC,MAAM,CAAC;YACb,SAAS;YACT,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,6DAA6D;SACzH,CAAC,CAAC;IACL,CAAC,CAAC;IACF,0GAA0G;IAC1G,MAAM,uBAAuB,GAAG,CAAC,SAAiC,EAAE,CAAgB,EAAE,OAAmB,EAAE,aAAsB,EAAQ,EAAE;QACzI,IAAI,CAAC;YAAC,aAAa,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QAAC,CAAC;QAC5D,OAAO,GAAG,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IACpJ,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,UAAU;QACV,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,EAA0B,EAAE;YAC5C,6FAA6F;YAC7F,kGAAkG;YAClG,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE;wBACrC,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,GAAG,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnG,CAAC,CAAC;oBACH,MAAM,OAAO,GAAkB;wBAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvD,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9D,CAAC;oBACF,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;oBACnE,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,6FAA6F;gBAC7F,+FAA+F;gBAC/F,oGAAoG;gBACpG,MAAM,OAAO,GAAkB;oBAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC;gBACF,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,+FAA+F;gBAC/F,gGAAgG;gBAChG,2EAA2E;gBAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,GAAG,CAAC,SAAS,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC9H,MAAM,OAAO,GAAkB;oBAC7B,WAAW,EAAE,OAAO;oBACpB,MAAM,EAAE,cAAc;oBACtB,QAAQ,EAAE,2EAA2E;wBACnF,wDAAwD;iBAC3D,CAAC;gBACF,uBAAuB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAChF,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,mBAAmB,IAAI,UAAU,iBAAiB,MAAM,IAAI,CAAC,CAAC;IAEtF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YAC3B,yFAAyF;YACzF,2FAA2F;YAC3F,yFAAyF;YACzF,4FAA4F;YAC5F,0FAA0F;YAC1F,4FAA4F;YAC5F,qCAAqC;YACrC,EAAE;YACF,0FAA0F;YAC1F,0FAA0F;YAC1F,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,KAAK,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/C,+FAA+F;IAC/F,gGAAgG;IAChG,0FAA0F;IAC1F,+FAA+F;IAC/F,iDAAiD;IACjD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,4FAA4F;IAC5F,4FAA4F;IAC5F,kDAAkD;IAClD,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,CAAC;IACrD,MAAM,QAAQ,GAAI,GAAoC,EAAE,QAAQ,CAAC;IACjE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,CAAC;IACrF,IAAI,QAAQ;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,QAAQ,IAAI,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
package/dist/client.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { type ScreenContext, type ScreenVerdict, type SecurityGatewayClient } from "./types.js";
|
|
1
|
+
import { type GatewayMode, type ScreenContext, type ScreenVerdict, type SecurityGatewayClient } from "./types.js";
|
|
2
2
|
import type { GatewayLogger } from "./server.js";
|
|
3
3
|
export interface LocalSidecarGatewayClientOptions {
|
|
4
4
|
socketPath: string;
|
|
@@ -8,7 +8,18 @@ export interface LocalSidecarGatewayClientOptions {
|
|
|
8
8
|
}
|
|
9
9
|
export declare class LocalSidecarGatewayClient implements SecurityGatewayClient {
|
|
10
10
|
#private;
|
|
11
|
+
/**
|
|
12
|
+
* `enforcing` — and it stays `enforcing` even when the socket is down, because a client whose
|
|
13
|
+
* gateway is unreachable does not start allowing content: it fails closed (`gateway_unavailable`).
|
|
14
|
+
* The mode describes what this client DOES with content, not whether the socket happens to be up.
|
|
15
|
+
*/
|
|
16
|
+
readonly mode: GatewayMode;
|
|
11
17
|
constructor(opts: LocalSidecarGatewayClientOptions);
|
|
18
|
+
/**
|
|
19
|
+
* Record why the sidecar could not be started, so every later refusal names THAT rather than the
|
|
20
|
+
* generic unreachable label. Called by the composition root when the spawn fails.
|
|
21
|
+
*/
|
|
22
|
+
setUnavailableCause(reason: string, guidance: string): void;
|
|
12
23
|
screenOutbound(content: Uint8Array, ctx: ScreenContext): Promise<ScreenVerdict>;
|
|
13
24
|
screenInbound(content: Uint8Array, ctx: ScreenContext): Promise<ScreenVerdict>;
|
|
14
25
|
close(): Promise<void>;
|
package/dist/client.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAyC,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAyC,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACzJ,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAYjD,MAAM,WAAW,gCAAgC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,qBAAa,yBAA0B,YAAW,qBAAqB;;IACrE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAe;gBAsB7B,IAAI,EAAE,gCAAgC;IAMlD;;;OAGG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAI3D,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAI/E,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAIxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAmJ7B"}
|
package/dist/client.js
CHANGED
|
@@ -15,6 +15,12 @@ import { failClosedVerdict, GOVERNANCE_TIMEOUT } from "./types.js";
|
|
|
15
15
|
const NOOP_LOGGER = { info() { }, warn() { }, error() { } };
|
|
16
16
|
const DEFAULT_DEADLINE_MS = 5_000;
|
|
17
17
|
export class LocalSidecarGatewayClient {
|
|
18
|
+
/**
|
|
19
|
+
* `enforcing` — and it stays `enforcing` even when the socket is down, because a client whose
|
|
20
|
+
* gateway is unreachable does not start allowing content: it fails closed (`gateway_unavailable`).
|
|
21
|
+
* The mode describes what this client DOES with content, not whether the socket happens to be up.
|
|
22
|
+
*/
|
|
23
|
+
mode = "enforcing";
|
|
18
24
|
#socketPath;
|
|
19
25
|
#deadlineMs;
|
|
20
26
|
#logger;
|
|
@@ -23,11 +29,29 @@ export class LocalSidecarGatewayClient {
|
|
|
23
29
|
#pending = new Map();
|
|
24
30
|
#nextId = 1;
|
|
25
31
|
#closed = false;
|
|
32
|
+
/**
|
|
33
|
+
* Why the gateway is unreachable, when the composition root already knows (review F2).
|
|
34
|
+
*
|
|
35
|
+
* Without this, a sidecar that never started surfaced as `gateway_unavailable` on every message
|
|
36
|
+
* — an exit-point label that says "the transport failed, check the gateway is running and
|
|
37
|
+
* retry". But the gateway is not running and never will be, retrying can never work, and the
|
|
38
|
+
* actual cause (a missing key file, a store locked by an orphan, a leftover plaintext store, a
|
|
39
|
+
* missing binary) was logged once at boot and then thrown away. The spawner already captures
|
|
40
|
+
* the child's coded, guided stderr; this is where it survives to the operator.
|
|
41
|
+
*/
|
|
42
|
+
#unavailable;
|
|
26
43
|
constructor(opts) {
|
|
27
44
|
this.#socketPath = opts.socketPath;
|
|
28
45
|
this.#deadlineMs = opts.deadlineMs ?? DEFAULT_DEADLINE_MS;
|
|
29
46
|
this.#logger = opts.logger ?? NOOP_LOGGER;
|
|
30
47
|
}
|
|
48
|
+
/**
|
|
49
|
+
* Record why the sidecar could not be started, so every later refusal names THAT rather than the
|
|
50
|
+
* generic unreachable label. Called by the composition root when the spawn fails.
|
|
51
|
+
*/
|
|
52
|
+
setUnavailableCause(reason, guidance) {
|
|
53
|
+
this.#unavailable = { reason, guidance };
|
|
54
|
+
}
|
|
31
55
|
screenOutbound(content, ctx) {
|
|
32
56
|
return this.#screen(SCREEN_OUTBOUND, content, ctx);
|
|
33
57
|
}
|
|
@@ -60,6 +84,12 @@ export class LocalSidecarGatewayClient {
|
|
|
60
84
|
direction,
|
|
61
85
|
error: err instanceof Error ? err.message : String(err),
|
|
62
86
|
});
|
|
87
|
+
// The known cause wins over the generic one (F2): "your daemon key file is missing" sends
|
|
88
|
+
// the operator to the right place; "the gateway could not be reached, retry" does not.
|
|
89
|
+
if (this.#unavailable) {
|
|
90
|
+
const verdict = failClosedVerdict(direction, this.#unavailable.reason);
|
|
91
|
+
return { ...verdict, guidance: this.#unavailable.guidance };
|
|
92
|
+
}
|
|
63
93
|
return failClosedVerdict(direction);
|
|
64
94
|
}
|
|
65
95
|
const id = this.#nextId++;
|
package/dist/client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAe,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,GAIf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAe,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,GAIf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAwF,MAAM,YAAY,CAAC;AAGzJ,MAAM,WAAW,GAAkB,EAAE,IAAI,KAAI,CAAC,EAAE,IAAI,KAAI,CAAC,EAAE,KAAK,KAAI,CAAC,EAAE,CAAC;AACxE,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAgBlC,MAAM,OAAO,yBAAyB;IACpC;;;;OAIG;IACM,IAAI,GAAgB,WAAW,CAAC;IAChC,WAAW,CAAS;IACpB,WAAW,CAAS;IACpB,OAAO,CAAgB;IAChC,OAAO,GAAkB,IAAI,CAAC;IAC9B,WAAW,GAA2B,IAAI,CAAC;IAC3C,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IACtC,OAAO,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,KAAK,CAAC;IAEhB;;;;;;;;;OASG;IACH,YAAY,CAAmD;IAE/D,YAAY,IAAsC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,MAAc,EAAE,QAAgB;QAClD,IAAI,CAAC,YAAY,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,OAAmB,EAAE,GAAkB;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,aAAa,CAAC,OAAmB,EAAE,GAAkB;QACnD,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,4EAA4E;QAC5E,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAoB,EAAE,OAAmB,EAAE,GAAkB;QACzE,MAAM,SAAS,GAAG,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAEtD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBAC1C,SAAS;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,0FAA0F;YAC1F,uFAAuF;YACvF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBACvE,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC9D,CAAC;YACD,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAsB;YACjC,EAAE;YACF,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAChD,GAAG,EAAE;gBACH,SAAS;gBACT,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChF,GAAG,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG;SACF,CAAC;QAEF,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;oBACzF,uFAAuF;oBACvF,0EAA0E;oBAC1E,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACrB,IAAI,OAAQ,KAAgC,CAAC,KAAK,KAAK,UAAU;gBAAG,KAA+B,CAAC,KAAK,EAAE,CAAC;YAC5G,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE;wBACxC,SAAS;wBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD,CAAC,CAAC;oBACH,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB;QACd,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAE9C,IAAI,CAAC,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACvC,qFAAqF;YACrF,iGAAiG;YACjG,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;gBACnC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC;YAC7E,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACrB,IAAI,OAAQ,YAAuC,CAAC,KAAK,KAAK,UAAU;gBAAG,YAAsC,CAAC,KAAK,EAAE,CAAC;YAC1H,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;gBAC7B,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;gBACxB,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3B,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBAEpB,MAAM,OAAO,GAAG,IAAI,YAAY,CAC9B,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAyB,CAAC,EACpD,CAAC,GAAG,EAAE,EAAE;oBACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,CAAC,CACF,CAAC;gBACF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxD,iFAAiF;gBACjF,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;wBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;oBAC/C,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAClC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;wBACtB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;oBAC5C,CAAC;oBACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACxB,CAAC,CAAC;gBACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC5B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACpG,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,WAAW,CAAC,GAAuB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,iCAAiC;QACvD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAE5B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC;QACzB,MAAM,OAAO,GAAkB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjE,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YACjC,oFAAoF;YACpF,+BAA+B;YAC/B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxG,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5D,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5D,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;CACF"}
|
|
@@ -1,3 +1,21 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* M9-CFG-001 — the gateway's versioned config store (INV-4 as amended by M9C-D2).
|
|
3
|
+
*
|
|
4
|
+
* The store is append-only and versioned, and enforces the §7 governance asymmetry:
|
|
5
|
+
*
|
|
6
|
+
* - TIGHTENING a guard (making the gateway MORE restrictive) is free — no confirmation.
|
|
7
|
+
* - LOOSENING a guard (making it LESS restrictive — enabling autonomous override, adding a value to
|
|
8
|
+
* the PII whitelist, raising/removing the rate cap, allowing another language) requires an explicit
|
|
9
|
+
* `confirmed` flag. Without it the change is REJECTED and not versioned. (The human confirmation
|
|
10
|
+
* is the CLI prompt — the portal passkey later; this store is the enforcement point.)
|
|
11
|
+
*
|
|
12
|
+
* Every applied change appends a row whose `fingerprint` is hash-chained to the previous version, so
|
|
13
|
+
* the change history is tamper-evident and ready to attest to the directory in Phase 2 (M9-ATTEST-001).
|
|
14
|
+
*
|
|
15
|
+
* Encryption-at-rest (DOD-M9C-STORE-1): the store lives in the gateway's SQLCipher file, opened with
|
|
16
|
+
* the daemon's key via a key FILE path — fail-closed, no plaintext fallback (see store/encrypted-db.ts).
|
|
17
|
+
*/
|
|
18
|
+
import { type StoreEventSink } from "../store/encrypted-db.js";
|
|
1
19
|
/** Whether a config change makes the gateway more restrictive (tighten), less (loosen), or neither. */
|
|
2
20
|
export type ConfigDirection = "tighten" | "loosen" | "neutral";
|
|
3
21
|
export type SetResult = {
|
|
@@ -21,7 +39,7 @@ export declare class GatewayConfigStore {
|
|
|
21
39
|
#private;
|
|
22
40
|
/** Opens (creating if absent) the encrypted store at `dbPath`, keyed by the raw 32-byte key in
|
|
23
41
|
* `keyFilePath` — the daemon's own key file (M9C-D8/D9). Throws GatewayStoreError fail-closed. */
|
|
24
|
-
constructor(dbPath: string, keyFilePath: string);
|
|
42
|
+
constructor(dbPath: string, keyFilePath: string, onEvent?: StoreEventSink);
|
|
25
43
|
/** Set `key` to `value`. Loosening requires `opts.confirmed`; tightening/neutral is free. The FIRST
|
|
26
44
|
* set of a key is classified against the per-key TIGHTEST baseline, not treated as free (B1). */
|
|
27
45
|
set(key: string, value: unknown, opts?: {
|
|
@@ -39,6 +57,11 @@ export declare class GatewayConfigStore {
|
|
|
39
57
|
* the local half (code-review M3, recorded).
|
|
40
58
|
*/
|
|
41
59
|
verifyChain(key: string): boolean;
|
|
60
|
+
/**
|
|
61
|
+
* Fold the WAL back into the main file WITHOUT closing (review F1/F2). Closing unlinks
|
|
62
|
+
* `-wal`/`-shm` for every process sharing the file, including the daemon's long-lived handles.
|
|
63
|
+
*/
|
|
64
|
+
checkpoint(): void;
|
|
42
65
|
close(): void;
|
|
43
66
|
}
|
|
44
67
|
//# sourceMappingURL=config-store.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAsC,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAGnG,uGAAuG;AACvG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/D,MAAM,MAAM,SAAS,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,QAAQ,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,eAAe,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AA4FD,qBAAa,kBAAkB;;IAI7B;uGACmG;gBACvF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc;IAKzE;sGACkG;IAClG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,SAAS;IA2C/E,+EAA+E;IAC/E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAKzB,oEAAoE;IACpE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,EAAE;IAaxC;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAcjC;;;OAGG;IACH,UAAU,IAAI,IAAI;IAIlB,KAAK,IAAI,IAAI;CAWd"}
|
|
@@ -97,8 +97,8 @@ export class GatewayConfigStore {
|
|
|
97
97
|
#closed = false;
|
|
98
98
|
/** Opens (creating if absent) the encrypted store at `dbPath`, keyed by the raw 32-byte key in
|
|
99
99
|
* `keyFilePath` — the daemon's own key file (M9C-D8/D9). Throws GatewayStoreError fail-closed. */
|
|
100
|
-
constructor(dbPath, keyFilePath) {
|
|
101
|
-
this.#db = openEncryptedStoreDb(dbPath, keyFilePath);
|
|
100
|
+
constructor(dbPath, keyFilePath, onEvent) {
|
|
101
|
+
this.#db = openEncryptedStoreDb(dbPath, keyFilePath, onEvent);
|
|
102
102
|
this.#db.exec(DDL);
|
|
103
103
|
}
|
|
104
104
|
/** Set `key` to `value`. Loosening requires `opts.confirmed`; tightening/neutral is free. The FIRST
|
|
@@ -181,6 +181,13 @@ export class GatewayConfigStore {
|
|
|
181
181
|
}
|
|
182
182
|
return true;
|
|
183
183
|
}
|
|
184
|
+
/**
|
|
185
|
+
* Fold the WAL back into the main file WITHOUT closing (review F1/F2). Closing unlinks
|
|
186
|
+
* `-wal`/`-shm` for every process sharing the file, including the daemon's long-lived handles.
|
|
187
|
+
*/
|
|
188
|
+
checkpoint() {
|
|
189
|
+
this.#db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
|
|
190
|
+
}
|
|
184
191
|
close() {
|
|
185
192
|
if (this.#closed)
|
|
186
193
|
return; // idempotent — a double close (e.g. test teardown after an explicit close) is a no-op
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,
|
|
1
|
+
{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAqC,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqBzC,MAAM,OAAO,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACpF,gGAAgG;AAChG,SAAS,mBAAmB,CAAC,IAAa,EAAE,IAAa;IACvD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,KAAK;QAAE,OAAO,QAAQ,CAAC,CAAC,mDAAmD;IAC/E,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uGAAuG;AACvG,MAAM,WAAW,GAA+B;IAC9C,kFAAkF;IAClF,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,oEAAoE;IACpE,aAAa,EAAE,mBAAmB;IAClC,mCAAmC;IACnC,cAAc,EAAE,mBAAmB;IACnC,0EAA0E;IAC1E,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,CAAC,CAAU,EAAU,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvG,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IACD,qGAAqG;IACrG,wGAAwG;IACxG,cAAc,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,QAAQ,GAA4B;IACxC,mBAAmB,EAAE,KAAK,EAAO,kCAAkC;IACnE,aAAa,EAAE,EAAc,EAAI,0BAA0B;IAC3D,cAAc,EAAE,CAAC,OAAO,CAAC,EAAQ,sEAAsE;IACvG,mBAAmB,EAAE,CAAC,EAAW,oEAAoE;IACrG,cAAc,EAAE,MAAM,EAAW,gEAAgE;CAClG,CAAC;AAEF,0GAA0G;AAC1G,MAAM,UAAU,GAA4C;IAC1D,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS;IAClD,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;IAChF,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACjF,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;CAC5E,CAAC;AAEF,2GAA2G;AAC3G,SAAS,aAAa,CACpB,GAAW,EACX,OAAe,EACf,SAAiB,EACjB,SAAiB,EACjB,SAAiB,EACjB,eAAuB;IAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,IAAI,SAAS,IAAI,SAAS,IAAI,SAAS,IAAI,eAAe,EAAE,CAAC;SACrF,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,GAAG,GAAG;;;;;;;;;;;;CAYX,CAAC;AAEF,MAAM,OAAO,kBAAkB;IACpB,GAAG,CAAU;IACtB,OAAO,GAAG,KAAK,CAAC;IAEhB;uGACmG;IACnG,YAAY,MAAc,EAAE,WAAmB,EAAE,OAAwB;QACvE,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED;sGACkG;IAClG,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,OAAgC,EAAE;QACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEhH,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpC,uGAAuG;QACvG,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtF,MAAM,SAAS,GAAoB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAE9D,IAAI,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC1E,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,eAAe,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC;QAClD,qGAAqG;QACrG,uGAAuG;QACvG,+FAA+F;QAC/F,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAElG,oGAAoG;QACpG,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;;2CAEiC,CAClC;iBACA,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAChG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACvD,CAAC;IAED,+EAA+E;IAC/E,GAAG,CAAC,GAAW;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,oEAAoE;IACpE,OAAO,CAAC,GAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,uHAAuH,CAAC;aAChI,GAAG,CAAC,GAAG,CAA8G,CAAC;QACzH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAY;YAC1C,SAAS,EAAE,CAAC,CAAC,SAA4B;YACzC,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,CAAC;YAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,GAAW;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,yIAAyI,CAAC;aAClJ,GAAG,CAAC,GAAG,CAAwI,CAAC;QACnJ,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,gBAAgB,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC;YACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACxG,IAAI,QAAQ,KAAK,CAAC,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC7C,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,sFAAsF;QAChH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,OAAO,IAAI,CAAC,GAAG;aACZ,OAAO,CAAC,0GAA0G,CAAC;aACnH,GAAG,CAAC,GAAG,CAA6E,CAAC;IAC1F,CAAC;CACF"}
|
package/dist/detect/index.d.ts
CHANGED
|
@@ -6,11 +6,15 @@
|
|
|
6
6
|
* consumes THIS entry point and never the package barrel.
|
|
7
7
|
*
|
|
8
8
|
* WHY A SEPARATE ENTRY POINT AT ALL. `src/index.ts` re-exports `GatewayConfigStore` and
|
|
9
|
-
* `GatewayRecordStore`,
|
|
10
|
-
*
|
|
11
|
-
*
|
|
12
|
-
*
|
|
13
|
-
*
|
|
9
|
+
* `GatewayRecordStore`, which reach `@signalapp/sqlcipher` — a NATIVE prebuilt binary — alongside
|
|
10
|
+
* the gateway HTTP server and the sidecar spawner. A barrel import from the portal would evaluate
|
|
11
|
+
* all of that inside a Next.js Fargate app. The package `exports` map previously offered only
|
|
12
|
+
* `"."`, so there was no deep-import escape; this is that escape, made deliberate and narrow.
|
|
13
|
+
*
|
|
14
|
+
* Note the danger changed shape but not size on 2026-07-29 (`DOD-M9C-STORE-1`): the stores used to
|
|
15
|
+
* import `node:sqlite` statically, and now load SQLCipher through `createRequire` inside a
|
|
16
|
+
* function — so a scanner looking for a static import would no longer SEE it. The structural
|
|
17
|
+
* assertions that name the store files by name are what still guard this boundary.
|
|
14
18
|
*
|
|
15
19
|
* WHAT IS DELIBERATELY ABSENT, and it is the more important half:
|
|
16
20
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACvI,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}
|
package/dist/detect/index.js
CHANGED
|
@@ -6,11 +6,15 @@
|
|
|
6
6
|
* consumes THIS entry point and never the package barrel.
|
|
7
7
|
*
|
|
8
8
|
* WHY A SEPARATE ENTRY POINT AT ALL. `src/index.ts` re-exports `GatewayConfigStore` and
|
|
9
|
-
* `GatewayRecordStore`,
|
|
10
|
-
*
|
|
11
|
-
*
|
|
12
|
-
*
|
|
13
|
-
*
|
|
9
|
+
* `GatewayRecordStore`, which reach `@signalapp/sqlcipher` — a NATIVE prebuilt binary — alongside
|
|
10
|
+
* the gateway HTTP server and the sidecar spawner. A barrel import from the portal would evaluate
|
|
11
|
+
* all of that inside a Next.js Fargate app. The package `exports` map previously offered only
|
|
12
|
+
* `"."`, so there was no deep-import escape; this is that escape, made deliberate and narrow.
|
|
13
|
+
*
|
|
14
|
+
* Note the danger changed shape but not size on 2026-07-29 (`DOD-M9C-STORE-1`): the stores used to
|
|
15
|
+
* import `node:sqlite` statically, and now load SQLCipher through `createRequire` inside a
|
|
16
|
+
* function — so a scanner looking for a static import would no longer SEE it. The structural
|
|
17
|
+
* assertions that name the store files by name are what still guard this boundary.
|
|
14
18
|
*
|
|
15
19
|
* WHAT IS DELIBERATELY ABSENT, and it is the more important half:
|
|
16
20
|
*
|
package/dist/detect/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACvI,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC"}
|
package/dist/detect/pii.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pii.d.ts","sourceRoot":"","sources":["../../src/detect/pii.ts"],"names":[],"mappings":"AAeA,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,iBAAiB,GAAG,WAAW,CAAC;AAE/F,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC7B,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,6FAA6F;IAC7F,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iGAAiG;IACjG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iHAAiH;IACjH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;
|
|
1
|
+
{"version":3,"file":"pii.d.ts","sourceRoot":"","sources":["../../src/detect/pii.ts"],"names":[],"mappings":"AAeA,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,iBAAiB,GAAG,WAAW,CAAC;AAE/F,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC7B,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,6FAA6F;IAC7F,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iGAAiG;IACjG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iHAAiH;IACjH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoFD,qBAAa,mBAAmB;;gBAOlB,IAAI,EAAE,kBAAkB;IAUpC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS;CA8C1D"}
|
package/dist/detect/pii.js
CHANGED
|
@@ -17,6 +17,48 @@ const IP_RE = /\b(?:\d{1,3}\.){3}\d{1,3}\b/g;
|
|
|
17
17
|
const SSN_RE = /\b\d{3}-\d{2}-\d{4}\b/g;
|
|
18
18
|
const CC_RE = /\b(?:\d[ -]?){13,19}\b/g;
|
|
19
19
|
const PHONE_RE = /\+?\d[\d\s().-]{7,}\d/g;
|
|
20
|
+
/**
|
|
21
|
+
* A DATE IS NOT A PHONE NUMBER, and agents write dates constantly.
|
|
22
|
+
*
|
|
23
|
+
* `PHONE_RE` includes `-` in its character class, so `2026-07-29` matches it — and because the PII
|
|
24
|
+
* disposition is WARN, the message is NOT SENT until the operator resolves the flag. Reported from
|
|
25
|
+
* live use within hours of the enforcing flip (2026-07-29): an agent citing a date had its message
|
|
26
|
+
* refused twice and could not clear it itself, because `allow_once` is gated on
|
|
27
|
+
* `autonomous_override`, which is off by default and settable only by a human at a terminal.
|
|
28
|
+
*
|
|
29
|
+
* The exclusions below are shapes that CANNOT be a phone number, so nothing real is weakened:
|
|
30
|
+
* - ISO 8601 dates and datetimes — `2026-07-29`, `2026-07-29T18:33:51`.
|
|
31
|
+
* - Digit runs longer than 15, which exceeds the E.164 maximum.
|
|
32
|
+
*
|
|
33
|
+
* Deliberately NOT excluded: bare 11-13 digit runs like a commit number or an epoch timestamp.
|
|
34
|
+
* Those overlap the legitimate phone range (a country-code number is 11 digits), and silently
|
|
35
|
+
* passing them would weaken the guard to fix an annoyance. They still warn, and that is the correct
|
|
36
|
+
* trade — but it is why the operator escape hatch has to work.
|
|
37
|
+
*/
|
|
38
|
+
const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2})?)?/;
|
|
39
|
+
/**
|
|
40
|
+
* A date is not a phone number — but a date FOLLOWED BY one is still a phone number.
|
|
41
|
+
*
|
|
42
|
+
* `PHONE_RE`'s character class contains space, `-`, `(`, `)` and `.`, so `2026-07-29 415-555-2671`
|
|
43
|
+
* is ONE greedy match. The first version of this predicate tested `ISO_DATE_RE` (start-anchored,
|
|
44
|
+
* no `$`) against the whole match and discarded it — so prefixing eleven characters walked a real
|
|
45
|
+
* phone number straight past the guard. Review finding F3, and it was a security regression I
|
|
46
|
+
* introduced while fixing a false positive.
|
|
47
|
+
*
|
|
48
|
+
* So: strip a leading ISO date if there is one, then judge WHAT REMAINS. A bare date has nothing
|
|
49
|
+
* left and is not a phone; a date plus a number still has the number.
|
|
50
|
+
*
|
|
51
|
+
* The former ">15 digits cannot be a phone" rule is GONE (F4): `4155552671000000` is a real
|
|
52
|
+
* number with six zeros stapled on, and it passed. The reported false positive was dates, never
|
|
53
|
+
* long ids, so the rule bought nothing and cost a covert channel.
|
|
54
|
+
*/
|
|
55
|
+
function isPlausiblePhone(value) {
|
|
56
|
+
const trimmed = value.trim();
|
|
57
|
+
const remainder = trimmed.replace(ISO_DATE_RE, "");
|
|
58
|
+
// Nothing but a date -> not a phone. Anything left -> judge the remainder on its own merits.
|
|
59
|
+
const digits = remainder.replace(/\D/g, "");
|
|
60
|
+
return digits.length >= 7;
|
|
61
|
+
}
|
|
20
62
|
function flagIdFor(category, value) {
|
|
21
63
|
return createHash("sha256").update(`${category}:${value}`).digest("hex").slice(0, 12);
|
|
22
64
|
}
|
|
@@ -80,7 +122,7 @@ export class OutboundPIIScreener {
|
|
|
80
122
|
collect(IP_RE, "pii:ip", 1, validIp);
|
|
81
123
|
collect(SSN_RE, "pii:ssn", 2, () => true);
|
|
82
124
|
collect(CC_RE, "pii:credit_card", 3, (v) => luhnValid(v.replace(/[^0-9]/g, "")));
|
|
83
|
-
collect(PHONE_RE, "pii:phone", 4,
|
|
125
|
+
collect(PHONE_RE, "pii:phone", 4, isPlausiblePhone);
|
|
84
126
|
// Resolve overlaps: a higher-priority (more specific) match wins its character span.
|
|
85
127
|
candidates.sort((a, b) => a.priority - b.priority || a.start - b.start);
|
|
86
128
|
const taken = [];
|
package/dist/detect/pii.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pii.js","sourceRoot":"","sources":["../../src/detect/pii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA6BzC,MAAM,QAAQ,GAAG,iDAAiD,CAAC;AACnE,MAAM,KAAK,GAAG,8BAA8B,CAAC;AAC7C,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,KAAK,GAAG,yBAAyB,CAAC;AACxC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAE1C,SAAS,SAAS,CAAC,QAAgB,EAAE,KAAa;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,GAAG,EAAE,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACvC,GAAG,IAAI,CAAC,CAAC;QACT,GAAG,GAAG,CAAC,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACvH,CAAC;AAED,SAAS,cAAc,CAAC,CAAS,IAAY,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACtE,SAAS,cAAc,CAAC,CAAS,IAAY,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,SAAS,qBAAqB,CAAC,QAAqB,EAAE,KAAa;IACjE,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,mBAAmB;IACrB,UAAU,CAAc;IACxB,cAAc,CAAS;IACvB,oBAAoB,CAAS;IACtC,iGAAiG;IACxF,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE3D,YAAY,IAAwB;QAClC,kGAAkG;QAClG,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC;YACxB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC;YACrC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAClE,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,CAAC,OAAmB,EAAE,SAAiB;QAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAExE,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,QAAqB,EAAE,QAAgB,EAAE,MAA8B,EAAE,EAAE;YACtG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAC7B,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,
|
|
1
|
+
{"version":3,"file":"pii.js","sourceRoot":"","sources":["../../src/detect/pii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA6BzC,MAAM,QAAQ,GAAG,iDAAiD,CAAC;AACnE,MAAM,KAAK,GAAG,8BAA8B,CAAC;AAC7C,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,KAAK,GAAG,yBAAyB,CAAC;AACxC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAE1C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,GAAG,mDAAmD,CAAC;AAExE;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACnD,6FAA6F;IAC7F,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,KAAa;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,GAAG,EAAE,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACvC,GAAG,IAAI,CAAC,CAAC;QACT,GAAG,GAAG,CAAC,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACvH,CAAC;AAED,SAAS,cAAc,CAAC,CAAS,IAAY,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACtE,SAAS,cAAc,CAAC,CAAS,IAAY,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,SAAS,qBAAqB,CAAC,QAAqB,EAAE,KAAa;IACjE,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,mBAAmB;IACrB,UAAU,CAAc;IACxB,cAAc,CAAS;IACvB,oBAAoB,CAAS;IACtC,iGAAiG;IACxF,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE3D,YAAY,IAAwB;QAClC,kGAAkG;QAClG,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC;YACxB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC;YACrC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAClE,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,CAAC,OAAmB,EAAE,SAAiB;QAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAExE,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,QAAqB,EAAE,QAAgB,EAAE,MAA8B,EAAE,EAAE;YACtG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAC7B,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAEpD,qFAAqF;QACrF,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAgB,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;gBAAE,SAAS;YAC/D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QAED,iFAAiF;QACjF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,SAAS;YAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAE/E,6CAA6C;QAC7C,IAAI,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QACxF,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,oBAAoB,CAAC;QACxF,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACpF,CAAC;CACF"}
|
|
@@ -1,15 +1,3 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* M9-OUT-004 — per-agent-identity outbound rate limiting.
|
|
3
|
-
*
|
|
4
|
-
* A sliding-window counter keyed on the AGENT IDENTITY (peer-id / agent name), never a source IP —
|
|
5
|
-
* so a compromised or runaway agent cannot flood a peer or use volume as an exfiltration channel,
|
|
6
|
-
* while a normal agent's traffic is never throttled or delayed. Pure in-memory, deterministic with
|
|
7
|
-
* an injectable clock.
|
|
8
|
-
*
|
|
9
|
-
* The cap is a configured value (M9-CFG-001 owns the config; this is the enforcement). A throttled
|
|
10
|
-
* verdict carries a distinct `rate_limited` reason and a retry-after, surfaced to the agent through
|
|
11
|
-
* the outbound seam's never-hang feedback (M9-CORE-001 / M9-FEED-001).
|
|
12
|
-
*/
|
|
13
1
|
export interface RateLimitConfig {
|
|
14
2
|
/** Max messages allowed per agent within the window. */
|
|
15
3
|
maxPerWindow: number;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/detect/rate-limit.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/detect/rate-limit.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAmB;;gBAMlB,MAAM,EAAE,eAAe,EAAE,GAAG,GAAE,MAAM,MAAyB;IAWzE;;;;;OAKG;IACH,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB;IAqB7C,kGAAkG;IAClG,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI;IAOnC;;;OAGG;IACH,KAAK,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB;CAK/C"}
|