@cello-protocol/gateway 0.0.14 → 0.0.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bin/cello-gateway.js +28 -14
- package/dist/bin/cello-gateway.js.map +1 -1
- package/dist/client.d.ts.map +1 -1
- package/dist/client.js +6 -2
- package/dist/client.js.map +1 -1
- package/dist/config/config-store.d.ts +9 -5
- package/dist/config/config-store.d.ts.map +1 -1
- package/dist/config/config-store.js +22 -7
- package/dist/config/config-store.js.map +1 -1
- package/dist/detect/index.d.ts +1 -1
- package/dist/detect/index.js +1 -1
- package/dist/detect/sanitize.d.ts +0 -13
- package/dist/detect/sanitize.d.ts.map +1 -1
- package/dist/detect/sanitize.js +12 -2
- package/dist/detect/sanitize.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +6 -1
- package/dist/index.js.map +1 -1
- package/dist/records/record-store.d.ts +10 -4
- package/dist/records/record-store.d.ts.map +1 -1
- package/dist/records/record-store.js +24 -5
- package/dist/records/record-store.js.map +1 -1
- package/dist/screen/affordance.d.ts +31 -0
- package/dist/screen/affordance.d.ts.map +1 -1
- package/dist/screen/affordance.js +35 -2
- package/dist/screen/affordance.js.map +1 -1
- package/dist/screen/outbound.d.ts.map +1 -1
- package/dist/screen/outbound.js +3 -1
- package/dist/screen/outbound.js.map +1 -1
- package/dist/server.d.ts +0 -2
- package/dist/server.d.ts.map +1 -1
- package/dist/server.js +16 -31
- package/dist/server.js.map +1 -1
- package/dist/spawn.d.ts +0 -2
- package/dist/spawn.d.ts.map +1 -1
- package/dist/spawn.js +1 -2
- package/dist/spawn.js.map +1 -1
- package/dist/store/encrypted-db.d.ts.map +1 -1
- package/dist/store/encrypted-db.js +12 -6
- package/dist/store/encrypted-db.js.map +1 -1
- package/dist/testing.d.ts +1 -1
- package/dist/testing.js +1 -1
- package/dist/types.d.ts +1 -1
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js +6 -2
- package/dist/types.js.map +1 -1
- package/package.json +1 -1
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
* M9-REC-001 — local security-pass records.
|
|
3
3
|
*
|
|
4
4
|
* The gateway records what it did to EVERY message it screens — clean / redacted / blocked / warned —
|
|
5
|
-
* in the gateway's SQLCipher store, opened with the daemon's key (DOD-
|
|
5
|
+
* in the gateway's SQLCipher store, opened with the daemon's key (DOD-M9B-STORE-1; INV-4 as amended).
|
|
6
6
|
* Each record is hash-chained to the
|
|
7
7
|
* prior one (a per-record fingerprint over the record fields + the previous fingerprint), so a NAIVELY
|
|
8
8
|
* edited, deleted (mid-chain), or reordered record breaks the chain and `verifyChain()` returns false.
|
|
@@ -42,10 +42,23 @@ export class GatewayRecordStore {
|
|
|
42
42
|
#db;
|
|
43
43
|
#closed = false;
|
|
44
44
|
/** Opens (creating if absent) the encrypted store at `dbPath`, keyed by the raw 32-byte key in
|
|
45
|
-
* `keyFilePath` — the daemon's own key file (
|
|
45
|
+
* `keyFilePath` — the daemon's own key file (M9B-D8/D9). Throws GatewayStoreError fail-closed. */
|
|
46
46
|
constructor(dbPath, keyFilePath, onEvent) {
|
|
47
47
|
this.#db = openEncryptedStoreDb(dbPath, keyFilePath, onEvent);
|
|
48
|
-
|
|
48
|
+
try {
|
|
49
|
+
this.#db.exec(DDL);
|
|
50
|
+
}
|
|
51
|
+
catch (err) {
|
|
52
|
+
// Review F8: the connection is already open at this point. A DDL throw — SQLITE_BUSY past the
|
|
53
|
+
// busy_timeout is reachable on a file shared with the sidecar — used to leak the native handle
|
|
54
|
+
// and cache nothing, so every retry opened another one. An fd leak against a lock-sensitive
|
|
55
|
+
// file is a slow way to make the whole store unopenable.
|
|
56
|
+
try {
|
|
57
|
+
this.#db.close();
|
|
58
|
+
}
|
|
59
|
+
catch { /* the throw below is the real error */ }
|
|
60
|
+
throw err;
|
|
61
|
+
}
|
|
49
62
|
}
|
|
50
63
|
/** Append a security-pass record for one screened message, hash-chained to the prior record. */
|
|
51
64
|
record(input) {
|
|
@@ -122,8 +135,14 @@ export class GatewayRecordStore {
|
|
|
122
135
|
return true;
|
|
123
136
|
}
|
|
124
137
|
/**
|
|
125
|
-
* Fold the WAL back into the main file WITHOUT closing (review F1/F2).
|
|
126
|
-
*
|
|
138
|
+
* Fold the WAL back into the main file WITHOUT closing (review F1/F2).
|
|
139
|
+
*
|
|
140
|
+
* The rule, MEASURED (review M1, 2026-07-30) and not inferred: the LAST connection to close
|
|
141
|
+
* unlinks `-wal`/`-shm`; a non-last close does not, and loses nothing. That still makes closing
|
|
142
|
+
* here wrong, because this process is SIGTERMed on every `cello config set` — at which point the
|
|
143
|
+
* sidecar is the only holder besides the daemon, and during the restart window a per-call daemon
|
|
144
|
+
* handle IS the last one. Checkpointing sidesteps the question entirely: nothing is unlinked,
|
|
145
|
+
* nothing is lost, and process exit releases the descriptors.
|
|
127
146
|
*/
|
|
128
147
|
checkpoint() {
|
|
129
148
|
this.#db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"record-store.js","sourceRoot":"","sources":["../../src/records/record-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,oBAAoB,EAAqC,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAoBzC,MAAM,GAAG,GAAG;;;;;;;;;;;;CAYX,CAAC;AAEF,0FAA0F;AAC1F,SAAS,aAAa,CACpB,GAAW,EACX,SAAiB,EACjB,WAAmB,EACnB,WAAmB,EACnB,MAAc,EACd,aAAqB,EACrB,eAAuB;IAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,GAAG,IAAI,SAAS,IAAI,WAAW,IAAI,WAAW,IAAI,MAAM,IAAI,aAAa,IAAI,eAAe,EAAE,CAAC;SACzG,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,GAAG,CAAU;IACtB,OAAO,GAAG,KAAK,CAAC;IAEhB;uGACmG;IACnG,YAAY,MAAc,EAAE,WAAmB,EAAE,OAAwB;QACvE,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"record-store.js","sourceRoot":"","sources":["../../src/records/record-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,oBAAoB,EAAqC,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAoBzC,MAAM,GAAG,GAAG;;;;;;;;;;;;CAYX,CAAC;AAEF,0FAA0F;AAC1F,SAAS,aAAa,CACpB,GAAW,EACX,SAAiB,EACjB,WAAmB,EACnB,WAAmB,EACnB,MAAc,EACd,aAAqB,EACrB,eAAuB;IAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,GAAG,IAAI,SAAS,IAAI,WAAW,IAAI,WAAW,IAAI,MAAM,IAAI,aAAa,IAAI,eAAe,EAAE,CAAC;SACzG,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,GAAG,CAAU;IACtB,OAAO,GAAG,KAAK,CAAC;IAEhB;uGACmG;IACnG,YAAY,MAAc,EAAE,WAAmB,EAAE,OAAwB;QACvE,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8FAA8F;YAC9F,+FAA+F;YAC/F,4FAA4F;YAC5F,yDAAyD;YACzD,IAAI,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;YAC3E,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,MAAM,CAAC,KAAkB;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,iGAAiG;QACjG,oEAAoE;QACpE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjC,IAAI,GAAW,CAAC;QAChB,IAAI,eAAuB,CAAC;QAC5B,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7B,eAAe,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC;YAC5C,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;YAChI,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;;8CAEoC,CACrC;iBACA,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YACpI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO;YACL,GAAG;YACH,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,WAAW;YACX,UAAU;SACX,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,GAAG;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,2IAA2I,CAAC;aACpJ,GAAG,EAA4K,CAAC;QACnL,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,SAAS,EAAE,CAAC,CAAC,SAA4B;YACzC,WAAW,EAAE,CAAC,CAAC,WAAgC;YAC/C,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,CAAC,CAAC,WAAW;SAC1B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,EAAmB,CAAC;QAClG,OAAO,GAAG,CAAC,CAAC,CAAC;IACf,CAAC;IAED,yGAAyG;IACzG,WAAW;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,gJAAgJ,CAAC;aACzJ,GAAG,EAAiL,CAAC;QACxL,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,gBAAgB,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC,CAAC,kCAAkC;YAC5F,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC/H,IAAI,QAAQ,KAAK,CAAC,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC,CAAC,kBAAkB;YAChE,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;OASG;IACH,UAAU;QACR,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,GAAG;aACZ,OAAO,CAAC,yEAAyE,CAAC;aAClF,GAAG,EAAsD,CAAC;IAC/D,CAAC;CACF"}
|
|
@@ -19,7 +19,38 @@
|
|
|
19
19
|
* worse than the silence this replaces — the agent burns turns hunting for it.
|
|
20
20
|
* - Never echo the flagged VALUE back. The guidance is rendered into an LLM's context; repeating
|
|
21
21
|
* a secret to explain that it was redacted would undo the redaction.
|
|
22
|
+
* - MARK every block with the provenance marker (review F10). This text is imperative, contains
|
|
23
|
+
* shell commands, and lands in the same context as inbound counterparty content — so a
|
|
24
|
+
* counterparty could mimic it and have an agent relay "run this" to its operator as though the
|
|
25
|
+
* security layer had asked. The marker says where it came from. It is not a cryptographic
|
|
26
|
+
* boundary (nothing in an LLM's context is), but an agent that knows the layer speaks with a
|
|
27
|
+
* fixed marker has something to check.
|
|
22
28
|
*/
|
|
29
|
+
/**
|
|
30
|
+
* Where this text came from.
|
|
31
|
+
*
|
|
32
|
+
* WHAT MAKES THIS MEANINGFUL IS THE STRIP, NOT THE STRING (review H2). A marker a counterparty can
|
|
33
|
+
* also write proves nothing — the first version of this comment claimed "a counterparty cannot claim
|
|
34
|
+
* to be the local security layer" while the marker was absent from `LITERAL_MARKERS`, the very
|
|
35
|
+
* mechanism in this package that removes privileged-turn markers from inbound text. It was therefore
|
|
36
|
+
* exactly as forgeable as `[SYSTEM]` would have been without that list.
|
|
37
|
+
*
|
|
38
|
+
* It is now stripped from inbound content by `sanitizeInbound` (case-insensitively, with a
|
|
39
|
+
* `special_tokens` note — and that note is itself the evidence someone tried). So the property is:
|
|
40
|
+
* **inbound text cannot carry this marker, therefore its presence means the local layer emitted it.**
|
|
41
|
+
*
|
|
42
|
+
* Position is deliberately NOT part of the contract — `daemon.ts` prepends its own context to
|
|
43
|
+
* guidance, so requiring byte 0 would be a rule the system breaks on its most common path. The
|
|
44
|
+
* contract is CONTAINMENT: `withProvenance` guarantees every agent-visible guidance contains it.
|
|
45
|
+
*/
|
|
46
|
+
export declare const AFFORDANCE_PREFIX = "[cello security layer, local]";
|
|
47
|
+
/**
|
|
48
|
+
* Guarantee a guidance block carries the marker. Idempotent on CONTAINMENT, not on prefix, so a
|
|
49
|
+
* block that already embeds it (every `operatorCanRun` / `noOperatorOverride` string) is untouched
|
|
50
|
+
* rather than double-marked. Applied at the `GatewayClient` boundary — the single point every
|
|
51
|
+
* agent-visible verdict crosses — so no individual guidance producer has to remember.
|
|
52
|
+
*/
|
|
53
|
+
export declare function withProvenance(text: string): string;
|
|
23
54
|
/** The five keys `cello config` exposes. Anything not here has no operator knob — say so instead. */
|
|
24
55
|
export type AdjustableGuard = "pii_whitelist" | "autonomous_override" | "language_allow" | "rate_max_per_window" | "rate_window_ms";
|
|
25
56
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"affordance.d.ts","sourceRoot":"","sources":["../../src/screen/affordance.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"affordance.d.ts","sourceRoot":"","sources":["../../src/screen/affordance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,kCAAkC,CAAC;AAEjE;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,qGAAqG;AACrG,MAAM,MAAM,eAAe,GACvB,eAAe,GACf,qBAAqB,GACrB,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,CAAC;AAErB;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAM9E;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD"}
|
|
@@ -19,19 +19,52 @@
|
|
|
19
19
|
* worse than the silence this replaces — the agent burns turns hunting for it.
|
|
20
20
|
* - Never echo the flagged VALUE back. The guidance is rendered into an LLM's context; repeating
|
|
21
21
|
* a secret to explain that it was redacted would undo the redaction.
|
|
22
|
+
* - MARK every block with the provenance marker (review F10). This text is imperative, contains
|
|
23
|
+
* shell commands, and lands in the same context as inbound counterparty content — so a
|
|
24
|
+
* counterparty could mimic it and have an agent relay "run this" to its operator as though the
|
|
25
|
+
* security layer had asked. The marker says where it came from. It is not a cryptographic
|
|
26
|
+
* boundary (nothing in an LLM's context is), but an agent that knows the layer speaks with a
|
|
27
|
+
* fixed marker has something to check.
|
|
22
28
|
*/
|
|
29
|
+
/**
|
|
30
|
+
* Where this text came from.
|
|
31
|
+
*
|
|
32
|
+
* WHAT MAKES THIS MEANINGFUL IS THE STRIP, NOT THE STRING (review H2). A marker a counterparty can
|
|
33
|
+
* also write proves nothing — the first version of this comment claimed "a counterparty cannot claim
|
|
34
|
+
* to be the local security layer" while the marker was absent from `LITERAL_MARKERS`, the very
|
|
35
|
+
* mechanism in this package that removes privileged-turn markers from inbound text. It was therefore
|
|
36
|
+
* exactly as forgeable as `[SYSTEM]` would have been without that list.
|
|
37
|
+
*
|
|
38
|
+
* It is now stripped from inbound content by `sanitizeInbound` (case-insensitively, with a
|
|
39
|
+
* `special_tokens` note — and that note is itself the evidence someone tried). So the property is:
|
|
40
|
+
* **inbound text cannot carry this marker, therefore its presence means the local layer emitted it.**
|
|
41
|
+
*
|
|
42
|
+
* Position is deliberately NOT part of the contract — `daemon.ts` prepends its own context to
|
|
43
|
+
* guidance, so requiring byte 0 would be a rule the system breaks on its most common path. The
|
|
44
|
+
* contract is CONTAINMENT: `withProvenance` guarantees every agent-visible guidance contains it.
|
|
45
|
+
*/
|
|
46
|
+
export const AFFORDANCE_PREFIX = "[cello security layer, local]";
|
|
47
|
+
/**
|
|
48
|
+
* Guarantee a guidance block carries the marker. Idempotent on CONTAINMENT, not on prefix, so a
|
|
49
|
+
* block that already embeds it (every `operatorCanRun` / `noOperatorOverride` string) is untouched
|
|
50
|
+
* rather than double-marked. Applied at the `GatewayClient` boundary — the single point every
|
|
51
|
+
* agent-visible verdict crosses — so no individual guidance producer has to remember.
|
|
52
|
+
*/
|
|
53
|
+
export function withProvenance(text) {
|
|
54
|
+
return text.includes(AFFORDANCE_PREFIX) ? text : `${AFFORDANCE_PREFIX} ${text}`;
|
|
55
|
+
}
|
|
23
56
|
/**
|
|
24
57
|
* The operator's line for a guard that CAN be adjusted. `argHint` is a shape, never a real flagged
|
|
25
58
|
* value — see the no-echo rule above.
|
|
26
59
|
*/
|
|
27
60
|
export function operatorCanRun(guard, argHint) {
|
|
28
|
-
return (
|
|
61
|
+
return (`${AFFORDANCE_PREFIX} IF THIS IS WRONG, relay this to your operator to run in their terminal. DO NOT run it ` +
|
|
29
62
|
`yourself and do not try to work around the guard:\n cello config set ${guard} ${argHint}\n` +
|
|
30
63
|
`It asks them to confirm once. To see exactly what fired: cello policy log`);
|
|
31
64
|
}
|
|
32
65
|
/** For a guard with no knob. Better a plain "no" than an invented command. */
|
|
33
66
|
export function noOperatorOverride(what) {
|
|
34
|
-
return (
|
|
67
|
+
return (`${AFFORDANCE_PREFIX} This guard is not adjustable — there is no setting that turns it off, deliberately. ${what} ` +
|
|
35
68
|
`To see exactly what fired: cello policy log`);
|
|
36
69
|
}
|
|
37
70
|
//# sourceMappingURL=affordance.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"affordance.js","sourceRoot":"","sources":["../../src/screen/affordance.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"affordance.js","sourceRoot":"","sources":["../../src/screen/affordance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,IAAI,IAAI,EAAE,CAAC;AAClF,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAsB,EAAE,OAAe;IACpE,OAAO,CACL,GAAG,iBAAiB,yFAAyF;QAC7G,yEAAyE,KAAK,IAAI,OAAO,IAAI;QAC7F,2EAA2E,CAC5E,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,CACL,GAAG,iBAAiB,wFAAwF,IAAI,GAAG;QACnH,6CAA6C,CAC9C,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"outbound.d.ts","sourceRoot":"","sources":["../../src/screen/outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"outbound.d.ts","sourceRoot":"","sources":["../../src/screen/outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAKpF,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEvE,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,WAAW,eAAe;IAC9B,yFAAyF;IACzF,WAAW,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IACnD,iGAAiG;IACjG,OAAO,EAAE,UAAU,CAAC;IACpB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oEAAoE;IACpE,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC1D;AAKD,qBAAa,gBAAgB;;gBAKf,IAAI,GAAE,uBAA4B;IAU9C,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,qBAAqB,GAAG,eAAe;CAwKzE;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAEtD"}
|
package/dist/screen/outbound.js
CHANGED
|
@@ -12,6 +12,7 @@
|
|
|
12
12
|
* `redact` stage once its binding is chosen.
|
|
13
13
|
*/
|
|
14
14
|
import { OutboundRateLimiter } from "../detect/rate-limit.js";
|
|
15
|
+
import { AFFORDANCE_PREFIX } from "./affordance.js";
|
|
15
16
|
import { OutboundPIIScreener } from "../detect/pii.js";
|
|
16
17
|
import { screenOutboundExfil } from "../detect/exfil.js";
|
|
17
18
|
import { redactSecrets } from "../detect/secrets.js";
|
|
@@ -171,7 +172,8 @@ export class OutboundScreener {
|
|
|
171
172
|
// or gives up, or invents a workaround. It cannot run the loosening commands itself (that is
|
|
172
173
|
// the point of the gate), but it CAN relay them, and relaying an exact command is the
|
|
173
174
|
// difference between a stuck operator and a two-second fix.
|
|
174
|
-
guidance:
|
|
175
|
+
guidance: `${AFFORDANCE_PREFIX} NOT SENT. ${rejected.length} item(s) cannot be allowed ` +
|
|
176
|
+
`autonomously because ` +
|
|
175
177
|
`autonomous_override is OFF.\n` +
|
|
176
178
|
`WHAT YOU CAN DO NOW: re-send with those flag(s) set to "redact" — the value is replaced ` +
|
|
177
179
|
`by a typed placeholder and the message goes.\n` +
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"outbound.js","sourceRoot":"","sources":["../../src/screen/outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,mBAAmB,EAAwB,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAiB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAyCrD,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAChE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAEvC,MAAM,OAAO,gBAAgB;IAClB,YAAY,CAAuB;IACnC,IAAI,CAAsB;IAC1B,mBAAmB,CAAU;IAEtC,YAAY,OAAgC,EAAE;QAC5C,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1F,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,kBAAkB,IAAI,KAAK,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,IAAI,mBAAmB,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;YAClC,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,IAAI,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3G,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,OAAmB,EAAE,GAA0B;QACpD,4FAA4F;QAC5F,gGAAgG;QAChG,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;gBACf,OAAO;oBACL,WAAW,EAAE,OAAO;oBACpB,OAAO;oBACP,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,cAAc,EAAE,iCAAiC;oBACtE,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,QAAQ,IAAI,oBAAoB,EAAE,CAAC;iBAC7H,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAsB,EAAE,CAAC;QAErC,4FAA4F;QAC5F,gGAAgG;QAChG,0DAA0D;QAC1D,IAAI,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QACvC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAC5I,CAAC;QAED,mGAAmG;QACnG,MAAM,EAAE,GAAG,mBAAmB,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YAC/B,8FAA8F;YAC9F,iGAAiG;YACjG,iFAAiF;YACjF,OAAO;gBACL,WAAW,EAAE,OAAO;gBACpB,OAAO;gBACP,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM;gBAC9B,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,OAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;aAC1H,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,WAAW,GAAG,EAAE,CAAC,IAAI,CAAC;QAEtB,8FAA8F;QAC9F,oGAAoG;QACpG,oGAAoG;QACpG,gGAAgG;QAChG,mGAAmG;QACnG,qGAAqG;QACrG,wDAAwD;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9E,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACvE,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpB,2FAA2F;gBAC3F,8FAA8F;gBAC9F,yFAAyF;gBACzF,+FAA+F;gBAC/F,mEAAmE;gBACnE,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBACxE,OAAO;oBACL,WAAW,EAAE,MAAM;oBACnB,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;oBACrE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC;oBAC3C,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC;YACJ,CAAC;YACD,2FAA2F;YAC3F,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAChC,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAC1E,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,QAAQ,oCAAoC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBACvK,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;gBAC/C,8FAA8F;gBAC9F,0FAA0F;gBAC1F,6FAA6F;gBAC7F,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,6BAA6B,EAAE,MAAM,EAAE,6CAA6C,CAAC,CAAC,QAAQ,kCAAkC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACtN,CAAC;YACD,8FAA8F;QAChG,CAAC;QAED,oGAAoG;QACpG,oGAAoG;QACpG,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC;QACtF,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAExF,6FAA6F;QAC7F,uFAAuF;QACvF,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CACT,KAAiB,EACjB,SAAyD;QASzD,MAAM,SAAS,GAAG,CAAC,CAAW,EAAmB,EAAE,CACjD,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAE3H,qGAAqG;QACrG,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;QAClH,CAAC;QAED,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAe,EAAE,CAAC;QACjC,MAAM,qBAAqB,GAAe,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,kDAAkD;YAC7F,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACjD,gGAAgG;YAChG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,YAAY;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBACrC,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC,CAAC,8CAA8C;QAC3G,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,kGAAkG;YAClG,kGAAkG;YAClG,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;gBACnC,2FAA2F;gBAC3F,6FAA6F;gBAC7F,6FAA6F;gBAC7F,sFAAsF;gBACtF,4DAA4D;gBAC5D,QAAQ,EACN,
|
|
1
|
+
{"version":3,"file":"outbound.js","sourceRoot":"","sources":["../../src/screen/outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,mBAAmB,EAAwB,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAiB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAyCrD,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAChE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAEvC,MAAM,OAAO,gBAAgB;IAClB,YAAY,CAAuB;IACnC,IAAI,CAAsB;IAC1B,mBAAmB,CAAU;IAEtC,YAAY,OAAgC,EAAE;QAC5C,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1F,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,kBAAkB,IAAI,KAAK,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,IAAI,mBAAmB,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;YAClC,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,IAAI,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3G,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,OAAmB,EAAE,GAA0B;QACpD,4FAA4F;QAC5F,gGAAgG;QAChG,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;gBACf,OAAO;oBACL,WAAW,EAAE,OAAO;oBACpB,OAAO;oBACP,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,cAAc,EAAE,iCAAiC;oBACtE,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,QAAQ,IAAI,oBAAoB,EAAE,CAAC;iBAC7H,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAsB,EAAE,CAAC;QAErC,4FAA4F;QAC5F,gGAAgG;QAChG,0DAA0D;QAC1D,IAAI,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QACvC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAC5I,CAAC;QAED,mGAAmG;QACnG,MAAM,EAAE,GAAG,mBAAmB,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YAC/B,8FAA8F;YAC9F,iGAAiG;YACjG,iFAAiF;YACjF,OAAO;gBACL,WAAW,EAAE,OAAO;gBACpB,OAAO;gBACP,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM;gBAC9B,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,OAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;aAC1H,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,WAAW,GAAG,EAAE,CAAC,IAAI,CAAC;QAEtB,8FAA8F;QAC9F,oGAAoG;QACpG,oGAAoG;QACpG,gGAAgG;QAChG,mGAAmG;QACnG,qGAAqG;QACrG,wDAAwD;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9E,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACvE,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpB,2FAA2F;gBAC3F,8FAA8F;gBAC9F,yFAAyF;gBACzF,+FAA+F;gBAC/F,mEAAmE;gBACnE,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBACxE,OAAO;oBACL,WAAW,EAAE,MAAM;oBACnB,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;oBACrE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC;oBAC3C,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC;YACJ,CAAC;YACD,2FAA2F;YAC3F,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAChC,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAC1E,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,QAAQ,oCAAoC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBACvK,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;gBAC/C,8FAA8F;gBAC9F,0FAA0F;gBAC1F,6FAA6F;gBAC7F,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,6BAA6B,EAAE,MAAM,EAAE,6CAA6C,CAAC,CAAC,QAAQ,kCAAkC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACtN,CAAC;YACD,8FAA8F;QAChG,CAAC;QAED,oGAAoG;QACpG,oGAAoG;QACpG,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC;QACtF,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAExF,6FAA6F;QAC7F,uFAAuF;QACvF,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CACT,KAAiB,EACjB,SAAyD;QASzD,MAAM,SAAS,GAAG,CAAC,CAAW,EAAmB,EAAE,CACjD,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAE3H,qGAAqG;QACrG,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;QAClH,CAAC;QAED,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAe,EAAE,CAAC;QACjC,MAAM,qBAAqB,GAAe,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,kDAAkD;YAC7F,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACjD,gGAAgG;YAChG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,YAAY;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBACrC,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC,CAAC,8CAA8C;QAC3G,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,kGAAkG;YAClG,kGAAkG;YAClG,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;gBACnC,2FAA2F;gBAC3F,6FAA6F;gBAC7F,6FAA6F;gBAC7F,sFAAsF;gBACtF,4DAA4D;gBAC5D,QAAQ,EACN,GAAG,iBAAiB,cAAc,QAAQ,CAAC,MAAM,6BAA6B;oBAC9E,uBAAuB;oBACvB,+BAA+B;oBAC/B,0FAA0F;oBAC1F,gDAAgD;oBAChD,0FAA0F;oBAC1F,qFAAqF;oBACrF,uFAAuF;oBACvF,+DAA+D;oBAC/D,uFAAuF;oBACvF,kFAAkF;gBACpF,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE;aACrD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACrF,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,CAAkB;IAC5C,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC"}
|
package/dist/server.d.ts
CHANGED
|
@@ -19,8 +19,6 @@ export interface GatewayLogger {
|
|
|
19
19
|
}
|
|
20
20
|
export interface GatewayServerOptions {
|
|
21
21
|
socketPath: string;
|
|
22
|
-
/** When set, one JSON line per screen request is appended here (the gateway's request log). */
|
|
23
|
-
requestLogPath?: string;
|
|
24
22
|
/** The screen function. Defaults to pass-through (always allow). */
|
|
25
23
|
screen?: GatewayScreenFn;
|
|
26
24
|
logger?: GatewayLogger;
|
package/dist/server.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErF,kGAAkG;AAClG,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE;QACJ,SAAS,EAAE,eAAe,CAAC;QAC3B,OAAO,EAAE,UAAU,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iGAAiG;QACjG,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;KAC1D,GAAG,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC5C;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3D;AAQD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAID,6EAA6E;AAC7E,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8FlG"}
|
package/dist/server.js
CHANGED
|
@@ -3,13 +3,19 @@
|
|
|
3
3
|
*
|
|
4
4
|
* Listens on a Unix domain socket, accepts length-prefixed JSON screen requests, runs them
|
|
5
5
|
* through a screen function (M9-CORE-001 ships the pass-through default; later stories inject
|
|
6
|
-
* the detection pipeline here), and
|
|
7
|
-
*
|
|
8
|
-
*
|
|
6
|
+
* the detection pipeline here), and replies with the verdict.
|
|
7
|
+
*
|
|
8
|
+
* PROOF THAT SCREENING HAPPENED lives in the ENCRYPTED record store, not here. This server used to
|
|
9
|
+
* append a plaintext request-log line per request, and the integration tests read that file; it was
|
|
10
|
+
* deleted because it duplicated the record store's audit trail outside SQLCipher (M8C
|
|
11
|
+
* `DOD-CRYPTO-AT-REST-1`). The tests now read the record store, which is the stronger assertion.
|
|
12
|
+
* The write-before-reply ORDERING that mattered is preserved where the records are actually written
|
|
13
|
+
* — `bin/cello-gateway.ts` calls `recordOutcome` synchronously before returning the verdict, so the
|
|
14
|
+
* daemon cannot act on a verdict the gateway never recorded, and a record-write throw becomes a
|
|
15
|
+
* fail-closed `screen_error` block.
|
|
9
16
|
*/
|
|
10
17
|
import { createServer } from "node:net";
|
|
11
|
-
import {
|
|
12
|
-
import { createHash } from "node:crypto";
|
|
18
|
+
import { rm } from "node:fs/promises";
|
|
13
19
|
import { FrameDecoder, encodeFrame, SCREEN_OUTBOUND } from "./protocol.js";
|
|
14
20
|
const NOOP_LOGGER = {
|
|
15
21
|
info() { },
|
|
@@ -21,7 +27,7 @@ const ALLOW_ALL = () => ({ disposition: "allow" });
|
|
|
21
27
|
export async function createGatewayServer(opts) {
|
|
22
28
|
const screen = opts.screen ?? ALLOW_ALL;
|
|
23
29
|
const logger = opts.logger ?? NOOP_LOGGER;
|
|
24
|
-
const { socketPath
|
|
30
|
+
const { socketPath } = opts;
|
|
25
31
|
// A stale socket file from a crashed prior run makes listen() fail with EADDRINUSE. Remove it.
|
|
26
32
|
await rm(socketPath, { force: true });
|
|
27
33
|
// Track live connections so stop() can close them. net.Server.close() stops accepting but
|
|
@@ -41,31 +47,10 @@ export async function createGatewayServer(opts) {
|
|
|
41
47
|
async function handleRequest(req, socket) {
|
|
42
48
|
const direction = req.method === SCREEN_OUTBOUND ? "outbound" : "inbound";
|
|
43
49
|
const content = Buffer.from(req.content, "base64");
|
|
44
|
-
//
|
|
45
|
-
//
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
ts: Date.now(),
|
|
49
|
-
id: req.id,
|
|
50
|
-
method: req.method,
|
|
51
|
-
direction,
|
|
52
|
-
agentName: req.ctx.agentName,
|
|
53
|
-
sessionId: req.ctx.sessionId,
|
|
54
|
-
correlationId: req.ctx.correlationId,
|
|
55
|
-
bytes: content.length,
|
|
56
|
-
// A fingerprint of the exact bytes screened — proof-of-screening that binds identity,
|
|
57
|
-
// not just length, so a test (or audit) can confirm the gateway saw THIS content.
|
|
58
|
-
contentSha256: createHash("sha256").update(content).digest("hex"),
|
|
59
|
-
});
|
|
60
|
-
try {
|
|
61
|
-
await appendFile(requestLogPath, line + "\n");
|
|
62
|
-
}
|
|
63
|
-
catch (err) {
|
|
64
|
-
logger.error("gateway.request_log.append.failed", {
|
|
65
|
-
error: err instanceof Error ? err.message : String(err),
|
|
66
|
-
});
|
|
67
|
-
}
|
|
68
|
-
}
|
|
50
|
+
// The record-before-reply ordering is NOT enforced here — this server only routes to `screen`.
|
|
51
|
+
// It is enforced by the injected screen fn in `bin/cello-gateway.ts`, which records the outcome
|
|
52
|
+
// synchronously before returning. Stated rather than deleted because the constraint is real and
|
|
53
|
+
// load-bearing; the plaintext log that used to implement it here is gone, not the requirement.
|
|
69
54
|
let verdict;
|
|
70
55
|
try {
|
|
71
56
|
verdict = await screen({
|
package/dist/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAA4B,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAwB3E,MAAM,WAAW,GAAkB;IACjC,IAAI,KAAI,CAAC;IACT,IAAI,KAAI,CAAC;IACT,KAAK,KAAI,CAAC;CACX,CAAC;AAcF,MAAM,SAAS,GAAoB,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAEpE,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAA0B;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAC1C,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAE5B,+FAA+F;IAC/F,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtC,0FAA0F;IAC1F,8FAA8F;IAC9F,2DAA2D;IAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,MAAc,EAAE,EAAE;QACrD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,YAAY,CAC9B,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,aAAa,CAAC,GAAwB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAClE,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACnE,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC,CACF,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,aAAa,CAAC,GAAsB,EAAE,MAAc;QACjE,MAAM,SAAS,GAAoB,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEnD,+FAA+F;QAC/F,gGAAgG;QAChG,gGAAgG;QAChG,+FAA+F;QAC/F,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC;gBACrB,SAAS;gBACT,OAAO;gBACP,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS;gBAC5B,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS;gBAC5B,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa;gBACpC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3G,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBACpC,SAAS;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,GAAG;gBACR,WAAW,EAAE,OAAO;gBACpB,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,2EAA2E;oBACnF,wDAAwD;aAC3D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAuB;YACnC,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,OAAO,EAAE;gBACP,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,oFAAoF;gBACpF,oEAAoE;gBACpE,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtG,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1E;SACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;YAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,KAAK,CAAC,IAAI;YACR,kFAAkF;YAClF,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACrC,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/spawn.d.ts
CHANGED
|
@@ -10,8 +10,6 @@ import { type ChildProcess } from "node:child_process";
|
|
|
10
10
|
export declare const GATEWAY_READY_TOKEN = "GATEWAY_READY";
|
|
11
11
|
export interface SpawnGatewayOptions {
|
|
12
12
|
socketPath: string;
|
|
13
|
-
/** When set, the gateway appends one request-log line per screen request here. */
|
|
14
|
-
requestLogPath?: string;
|
|
15
13
|
/**
|
|
16
14
|
* The gateway entry to run. Defaults to this package's built dist bin
|
|
17
15
|
* (dist/bin/cello-gateway.js) run with node — the production path.
|
package/dist/spawn.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"spawn.d.ts","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9D,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB
|
|
1
|
+
{"version":3,"file":"spawn.d.ts","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9D,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AASD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4F5F"}
|
package/dist/spawn.js
CHANGED
|
@@ -20,7 +20,7 @@ export async function spawnGatewaySidecar(opts) {
|
|
|
20
20
|
// stdin is a PIPE, not "ignore", and it is the child's death switch (review F5). A daemon that
|
|
21
21
|
// dies without running its shutdown path — SIGKILL, a crash, the OOM killer — leaves the
|
|
22
22
|
// gateway alive holding the encrypted store's write lock. The NEXT daemon's gateway then hits
|
|
23
|
-
// `store_locked`, exits before ready, and with no auto-restart (
|
|
23
|
+
// `store_locked`, exits before ready, and with no auto-restart (M9B-D14) that daemon spends its
|
|
24
24
|
// whole life fail-closed on one boot log line. When the parent dies the kernel closes this
|
|
25
25
|
// pipe, and the child exits on the `end` event.
|
|
26
26
|
stdio: ["pipe", "pipe", "pipe"],
|
|
@@ -28,7 +28,6 @@ export async function spawnGatewaySidecar(opts) {
|
|
|
28
28
|
...process.env,
|
|
29
29
|
...opts.env,
|
|
30
30
|
CELLO_GATEWAY_SOCKET: opts.socketPath,
|
|
31
|
-
...(opts.requestLogPath ? { CELLO_GATEWAY_REQUEST_LOG: opts.requestLogPath } : {}),
|
|
32
31
|
},
|
|
33
32
|
});
|
|
34
33
|
const readyTimeoutMs = opts.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS;
|
package/dist/spawn.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAsBnD,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC,SAAS,gBAAgB;IACvB,4CAA4C;IAC5C,OAAO,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE;QAC7C,+FAA+F;QAC/F,yFAAyF;QACzF,8FAA8F;QAC9F,gGAAgG;QAChG,2FAA2F;QAC3F,gDAAgD;QAChD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,GAAG,IAAI,CAAC,GAAG;YACX,oBAAoB,EAAE,IAAI,CAAC,UAAU;SACtC;KACF,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAEvE,iGAAiG;IACjG,yFAAyF;IACzF,4FAA4F;IAC5F,uFAAuF;IACvF,+FAA+F;IAC/F,4FAA4F;IAC5F,wFAAwF;IACxF,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,MAAM,eAAe,GAAG,KAAK,CAAC;IAC9B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,UAAU,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IACH,0FAA0F;IAC1F,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE,CAClD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,6BAA6B,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAE3F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,+CAA+C,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC;QACxG,CAAC,EAAE,cAAc,CAAC,CAAC;QAEnB,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE;YACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACzD,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACpC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,OAAe,EAAQ,EAAE;YACrC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,6CAA6C,IAAI,GAAG,CAAC,CAAC,CAAC;QACzF,+FAA+F;QAC/F,iCAAiC;QACjC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,yCAAyC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,OAAO,EAAE,KAAK;QACd,KAAK,CAAC,IAAI;YACR,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO;YACjE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,2FAA2F;YAC3F,sCAAsC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACnC,IAAI,UAAqD,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC3C,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC5E,IAAI,OAAQ,UAAqC,CAAC,KAAK,KAAK,UAAU;oBAAG,UAAoC,CAAC,KAAK,EAAE,CAAC;YACxH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACvC,CAAC;oBAAS,CAAC;gBACT,IAAI,UAAU;oBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"encrypted-db.d.ts","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AA8CA,MAAM,MAAM,qBAAqB,GAC7B,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,cAAc,GACd,0BAA0B,GAC1B,mBAAmB,CAAC;AAExB,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM3E;AA0BD,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAC1F,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACnC,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAC;IACrC,KAAK,IAAI,IAAI,CAAC;CACf;AAkCD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AAEvF,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,EAAE,
|
|
1
|
+
{"version":3,"file":"encrypted-db.d.ts","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AA8CA,MAAM,MAAM,qBAAqB,GAC7B,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,cAAc,GACd,0BAA0B,GAC1B,mBAAmB,CAAC;AAExB,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM3E;AA0BD,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAC1F,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACnC,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAC;IACrC,KAAK,IAAI,IAAI,CAAC;CACf;AAkCD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AAEvF,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,EAAE,cAQlC,CAAC;AAsCF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAwF3G"}
|
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* The gateway's encrypted store engine (DOD-
|
|
2
|
+
* The gateway's encrypted store engine (DOD-M9B-STORE-1, INV-4 as amended).
|
|
3
3
|
*
|
|
4
|
-
* One SQLCipher file holds BOTH gateway stores (config versions + security records —
|
|
5
|
-
* keyed by the daemon's key: the caller hands over the KEY FILE PATH (
|
|
4
|
+
* One SQLCipher file holds BOTH gateway stores (config versions + security records — M9B-D9),
|
|
5
|
+
* keyed by the daemon's key: the caller hands over the KEY FILE PATH (M9B-D8 — never key bytes in
|
|
6
6
|
* env or argv), and this module reads the same raw 32-byte key file the daemon uses for its own
|
|
7
7
|
* database. Same key, same backup set — that is policy D-3's "one key, covered by backup".
|
|
8
8
|
*
|
|
9
9
|
* FAILS CLOSED. A missing key file, a malformed key, or a key that does not decrypt the file each
|
|
10
10
|
* refuse with a distinct code. There is no plaintext fallback and no plaintext read path: no
|
|
11
|
-
* production plaintext gateway store has ever existed (
|
|
11
|
+
* production plaintext gateway store has ever existed (M9B-D7), so nothing here consults one.
|
|
12
12
|
*
|
|
13
13
|
* This deliberately does NOT import from core/daemon (the dependency points the other way); the
|
|
14
14
|
* ~50 lines shared with the daemon's opener are the price of the package boundary. WAL is enabled
|
|
@@ -87,7 +87,13 @@ class AdaptedDb {
|
|
|
87
87
|
}
|
|
88
88
|
/** The gateway bin's sink: one structured line on stderr, never stdout. */
|
|
89
89
|
export const stderrStoreEventSink = (event, context) => {
|
|
90
|
-
process
|
|
90
|
+
// CELLO_GATEWAY_CORRELATION_ID is set by the daemon ONLY when this process was spawned as part of
|
|
91
|
+
// a larger flow — today, a `cello config set` that had to restart the sidecar to apply (review
|
|
92
|
+
// M2). Stamping it here is what lets an operator tie `gateway.config.applied` to the store lines
|
|
93
|
+
// of the process that restart produced; without it the two sit next to each other in the log with
|
|
94
|
+
// nothing connecting them. Absent on a normal boot, because there is no flow to correlate with.
|
|
95
|
+
const correlationId = process.env.CELLO_GATEWAY_CORRELATION_ID;
|
|
96
|
+
process.stderr.write(`${JSON.stringify({ level: "info", event, ...context, ...(correlationId ? { correlationId } : {}) })}\n`);
|
|
91
97
|
};
|
|
92
98
|
function loadEngine() {
|
|
93
99
|
const require = createRequire(import.meta.url);
|
|
@@ -144,7 +150,7 @@ export function openEncryptedStoreDb(dbPath, keyFilePath, onEvent) {
|
|
|
144
150
|
const keyHex = Buffer.from(key).toString("hex");
|
|
145
151
|
inner.pragma(`key = "x'${keyHex}'"`);
|
|
146
152
|
// busy_timeout FIRST — before the verify read and before the WAL pragma, both of which take
|
|
147
|
-
// locks. This file is shared with the daemon (
|
|
153
|
+
// locks. This file is shared with the daemon (M9B-D9), so a contended startup is ordinary, and
|
|
148
154
|
// with the SQLite default timeout of 0 the very first contended open returns SQLITE_BUSY
|
|
149
155
|
// instantly — which the verify-read catch below would then report as a wrong key. Setting it
|
|
150
156
|
// last (as this did) turns lock contention into "your key is wrong. Restore it from backup."
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"encrypted-db.js","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAElF,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,kCAAkC;AAE9D;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9G,SAAS,qBAAqB,CAAC,MAAc;IAC3C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAC7C,CAAC;AAUD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IACrC,2EAA2E;IAClE,QAAQ,CAAS;IAC1B,YAAY,IAA2B,EAAE,OAAe,EAAE,QAAgB;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAsCD,MAAM,gBAAgB;IACX,MAAM,CAAkB;IACjC,YAAY,KAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,SAAS;IACJ,MAAM,CAAiB;IAChC,YAAY,KAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAW;QACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAWD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"encrypted-db.js","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAElF,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,kCAAkC;AAE9D;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9G,SAAS,qBAAqB,CAAC,MAAc;IAC3C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAC7C,CAAC;AAUD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IACrC,2EAA2E;IAClE,QAAQ,CAAS;IAC1B,YAAY,IAA2B,EAAE,OAAe,EAAE,QAAgB;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAsCD,MAAM,gBAAgB;IACX,MAAM,CAAkB;IACjC,YAAY,KAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,SAAS;IACJ,MAAM,CAAiB;IAChC,YAAY,KAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAW;QACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAWD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACrE,kGAAkG;IAClG,+FAA+F;IAC/F,iGAAiG;IACjG,kGAAkG;IAClG,gGAAgG;IAChG,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACjI,CAAC,CAAC;AAEF,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,sBAAsB,CAAiB,CAAC;IACzD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,wCAAwC,MAAM,EAAE,EAChD,iGAAiG,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB;IACvC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,uCAAuC,WAAW,EAAE,EACpD,8FAA8F;YAC5F,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,6BAA6B,GAAG,CAAC,MAAM,oBAAoB,eAAe,EAAE,EAC5E,mBAAmB,WAAW,wCAAwC,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAmB,EAAE,OAAwB;IAChG,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,OAAgC,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAEtC,2FAA2F;IAC3F,4FAA4F;IAC5F,+FAA+F;IAC/F,qCAAqC;IACrC,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAiB,CACzB,sBAAsB,EACtB,eAAe,MAAM,oCAAoC,EACzD,0FAA0F;YACxF,0FAA0F;YAC1F,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;IAEzC,IAAI,KAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,EAAE,uCAAuC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,qFAAqF;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,KAAK,CAAC,MAAM,CAAC,YAAY,MAAM,IAAI,CAAC,CAAC;IAErC,4FAA4F;IAC5F,+FAA+F;IAC/F,yFAAyF;IACzF,6FAA6F;IAC7F,6FAA6F;IAC7F,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAEpC,IAAI,CAAC;QACH,KAAK,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,4FAA4F;QAC5F,2FAA2F;QAC3F,2FAA2F;QAC3F,yFAAyF;QACzF,mFAAmF;QACnF,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,+CAA+C,MAAM,GAAG,EACxD,0FAA0F;gBACxF,gFAAgF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,iBAAiB,CACzB,oBAAoB,EACpB,wDAAwD,MAAM,GAAG,EACjE,0FAA0F;YACxF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,8FAA8F;IAC9F,+FAA+F;IAC/F,4FAA4F;IAC5F,uCAAuC;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,IAAI,KAAK,KAAK;YAAE,IAAI,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,iGAAiG;IACjG,iGAAiG;IACjG,IAAI,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAEhE,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}
|
package/dist/testing.d.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* TEST-ONLY exports. Reachable as `@cello-protocol/gateway/testing`, deliberately NOT from the
|
|
3
|
-
* package barrel (DOD-
|
|
3
|
+
* package barrel (DOD-M9B-WIRE-1: "the stub moves to test-only visibility").
|
|
4
4
|
*
|
|
5
5
|
* `PassthroughGatewayClient` screens nothing and allows everything. It was the daemon's DEFAULT
|
|
6
6
|
* once, and because no production caller ever overrode it, the entire security layer shipped inert
|
package/dist/testing.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* TEST-ONLY exports. Reachable as `@cello-protocol/gateway/testing`, deliberately NOT from the
|
|
3
|
-
* package barrel (DOD-
|
|
3
|
+
* package barrel (DOD-M9B-WIRE-1: "the stub moves to test-only visibility").
|
|
4
4
|
*
|
|
5
5
|
* `PassthroughGatewayClient` screens nothing and allows everything. It was the daemon's DEFAULT
|
|
6
6
|
* once, and because no production caller ever overrode it, the entire security layer shipped inert
|
package/dist/types.d.ts
CHANGED
|
@@ -106,7 +106,7 @@ export interface ScreenVerdict {
|
|
|
106
106
|
export type GatewayMode = "enforcing" | "passthrough";
|
|
107
107
|
export interface SecurityGatewayClient {
|
|
108
108
|
/**
|
|
109
|
-
* Declared by the implementation, never computed by the caller (
|
|
109
|
+
* Declared by the implementation, never computed by the caller (M9B-D11). The daemon announces
|
|
110
110
|
* this at boot, and it is the field an operator greps to know whether their agent is screened —
|
|
111
111
|
* so it must come from the object that will actually do (or not do) the screening. The defect
|
|
112
112
|
* this closes: the daemon used to announce `config.securityGateway ? "sidecar" : "passthrough"`,
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,qEAAqE;AACrE,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtE,yGAAyG;AACzG,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,eAAe,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,oGAAoG;AACpG,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,aAAa,CAAC;AAEtD,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAChF,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAChF;AAED,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD;0EAC0E;AAC1E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,GAAE,MAA4B,GAAG,aAAa,CAkBjH"}
|
package/dist/types.js
CHANGED
|
@@ -11,6 +11,7 @@
|
|
|
11
11
|
* configured-but-unreachable gateway returns. No detector is wired yet, and the redact/warn
|
|
12
12
|
* dispositions are declared but never produced.
|
|
13
13
|
*/
|
|
14
|
+
import { withProvenance } from "./screen/affordance.js";
|
|
14
15
|
/** The reason code a fail-closed verdict carries when the gateway cannot be reached. */
|
|
15
16
|
export const GATEWAY_UNAVAILABLE = "gateway_unavailable";
|
|
16
17
|
/** The reason a fail-closed verdict carries when the gateway is reachable but the screening
|
|
@@ -28,11 +29,14 @@ export function failClosedVerdict(direction, reason = GATEWAY_UNAVAILABLE) {
|
|
|
28
29
|
return {
|
|
29
30
|
disposition: "block",
|
|
30
31
|
reason,
|
|
31
|
-
|
|
32
|
+
// withProvenance, not a bare string: this is the MOST-EMITTED guidance in the layer (every
|
|
33
|
+
// gateway-down message), so it was the one a counterparty could imitate most credibly while
|
|
34
|
+
// F10 marked only the affordance blocks (review H3).
|
|
35
|
+
guidance: withProvenance(direction === "outbound"
|
|
32
36
|
? `Fail-closed: ${cause}, so this message was NOT sent. Nothing left the machine. ` +
|
|
33
37
|
"Check that the gateway sidecar is running, then retry."
|
|
34
38
|
: `Fail-closed: ${cause}, so inbound content was not delivered to the agent. It was left ` +
|
|
35
|
-
"unacknowledged, so the sender redelivers it on a later attempt — screened once the gateway responds.",
|
|
39
|
+
"unacknowledged, so the sender redelivers it on a later attempt — screened once the gateway responds."),
|
|
36
40
|
};
|
|
37
41
|
}
|
|
38
42
|
//# sourceMappingURL=types.js.map
|
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAoHxD,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AACzD;0EAC0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAA0B,EAAE,SAAiB,mBAAmB;IAChG,MAAM,KAAK,GAAG,MAAM,KAAK,kBAAkB;QACzC,CAAC,CAAC,6EAA6E;QAC/E,CAAC,CAAC,2CAA2C,CAAC;IAChD,OAAO;QACL,WAAW,EAAE,OAAO;QACpB,MAAM;QACN,2FAA2F;QAC3F,4FAA4F;QAC5F,qDAAqD;QACrD,QAAQ,EAAE,cAAc,CACtB,SAAS,KAAK,UAAU;YACtB,CAAC,CAAC,gBAAgB,KAAK,4DAA4D;gBACjF,wDAAwD;YAC1D,CAAC,CAAC,gBAAgB,KAAK,mEAAmE;gBACxF,sGAAsG,CAC3G;KACF,CAAC;AACJ,CAAC"}
|