@corenel/harness 0.22.0 → 0.24.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +48 -0
- package/dist/approvals/service.d.ts +3 -0
- package/dist/approvals/service.d.ts.map +1 -1
- package/dist/approvals/service.js +13 -0
- package/dist/approvals/service.js.map +1 -1
- package/dist/approvals/suggest.js +1 -1
- package/dist/approvals/suggest.js.map +1 -1
- package/dist/chat/engine.d.ts +3 -0
- package/dist/chat/engine.d.ts.map +1 -1
- package/dist/chat/engine.js +10 -6
- package/dist/chat/engine.js.map +1 -1
- package/dist/chat/types.d.ts +1 -0
- package/dist/chat/types.d.ts.map +1 -1
- package/dist/core/loop.d.ts.map +1 -1
- package/dist/core/loop.js +138 -81
- package/dist/core/loop.js.map +1 -1
- package/dist/core/spawn.d.ts +3 -1
- package/dist/core/spawn.d.ts.map +1 -1
- package/dist/core/spawn.js +16 -1
- package/dist/core/spawn.js.map +1 -1
- package/dist/dag/executeNode.js +4 -4
- package/dist/dag/executeNode.js.map +1 -1
- package/dist/guardrail/builtins.d.ts.map +1 -1
- package/dist/guardrail/builtins.js +2 -0
- package/dist/guardrail/builtins.js.map +1 -1
- package/dist/guardrail/guardrail.d.ts +9 -0
- package/dist/guardrail/guardrail.d.ts.map +1 -1
- package/dist/guardrail/guardrail.js +13 -0
- package/dist/guardrail/guardrail.js.map +1 -1
- package/dist/guardrail/index.d.ts +3 -3
- package/dist/guardrail/index.d.ts.map +1 -1
- package/dist/guardrail/index.js +2 -2
- package/dist/guardrail/index.js.map +1 -1
- package/dist/guardrail/permission-service.d.ts +44 -3
- package/dist/guardrail/permission-service.d.ts.map +1 -1
- package/dist/guardrail/permission-service.js +58 -11
- package/dist/guardrail/permission-service.js.map +1 -1
- package/dist/guardrail/store.d.ts +4 -0
- package/dist/guardrail/store.d.ts.map +1 -1
- package/dist/guardrail/store.js +6 -0
- package/dist/guardrail/store.js.map +1 -1
- package/dist/prompts/config.d.ts +6 -2
- package/dist/prompts/config.d.ts.map +1 -1
- package/dist/prompts/config.js +6 -3
- package/dist/prompts/config.js.map +1 -1
- package/dist/prompts/host.d.ts +3 -2
- package/dist/prompts/host.d.ts.map +1 -1
- package/dist/prompts/host.js.map +1 -1
- package/dist/prompts/index.d.ts +8 -1
- package/dist/prompts/index.d.ts.map +1 -1
- package/dist/prompts/index.js +9 -7
- package/dist/prompts/index.js.map +1 -1
- package/dist/prompts/library/defaults.generated.d.ts.map +1 -1
- package/dist/prompts/library/defaults.generated.js +15 -14
- package/dist/prompts/library/defaults.generated.js.map +1 -1
- package/dist/prompts/systemPrompts.d.ts +3 -0
- package/dist/prompts/systemPrompts.d.ts.map +1 -1
- package/dist/prompts/systemPrompts.js +1 -1
- package/dist/prompts/systemPrompts.js.map +1 -1
- package/dist/sessions/fileSessionStore.d.ts.map +1 -1
- package/dist/sessions/fileSessionStore.js +18 -4
- package/dist/sessions/fileSessionStore.js.map +1 -1
- package/dist/sessions/jsonl.d.ts +1 -0
- package/dist/sessions/jsonl.d.ts.map +1 -1
- package/dist/sessions/jsonl.js +10 -0
- package/dist/sessions/jsonl.js.map +1 -1
- package/dist/sidecar/accessTestRig.d.ts +9 -2
- package/dist/sidecar/accessTestRig.d.ts.map +1 -1
- package/dist/sidecar/accessTestRig.js +13 -6
- package/dist/sidecar/accessTestRig.js.map +1 -1
- package/dist/sidecar/host.d.ts +96 -10
- package/dist/sidecar/host.d.ts.map +1 -1
- package/dist/sidecar/host.js +328 -6
- package/dist/sidecar/host.js.map +1 -1
- package/dist/sidecar/memberGate.d.ts.map +1 -1
- package/dist/sidecar/memberGate.js +17 -0
- package/dist/sidecar/memberGate.js.map +1 -1
- package/dist/sidecar/server.d.ts +171 -6
- package/dist/sidecar/server.d.ts.map +1 -1
- package/dist/sidecar/server.js +793 -65
- package/dist/sidecar/server.js.map +1 -1
- package/dist/skills.d.ts +9 -1
- package/dist/skills.d.ts.map +1 -1
- package/dist/skills.js +22 -8
- package/dist/skills.js.map +1 -1
- package/dist/templateGuard.d.ts +21 -0
- package/dist/templateGuard.d.ts.map +1 -0
- package/dist/templateGuard.js +150 -0
- package/dist/templateGuard.js.map +1 -0
- package/dist/tools/builtins.d.ts +1 -0
- package/dist/tools/builtins.d.ts.map +1 -1
- package/dist/tools/builtins.js +33 -3
- package/dist/tools/builtins.js.map +1 -1
- package/dist/tools/callAgent.d.ts +6 -2
- package/dist/tools/callAgent.d.ts.map +1 -1
- package/dist/tools/callAgent.js +7 -3
- package/dist/tools/callAgent.js.map +1 -1
- package/dist/tools/files.d.ts.map +1 -1
- package/dist/tools/files.js +4 -0
- package/dist/tools/files.js.map +1 -1
- package/dist/tools/namespaces.d.ts +1 -1
- package/dist/tools/namespaces.d.ts.map +1 -1
- package/dist/tools/namespaces.js +6 -2
- package/dist/tools/namespaces.js.map +1 -1
- package/dist/tools/sessions.d.ts.map +1 -1
- package/dist/tools/sessions.js +1 -0
- package/dist/tools/sessions.js.map +1 -1
- package/dist/tools/skillTool.d.ts +29 -0
- package/dist/tools/skillTool.d.ts.map +1 -1
- package/dist/tools/skillTool.js +73 -10
- package/dist/tools/skillTool.js.map +1 -1
- package/dist/tools/web.d.ts.map +1 -1
- package/dist/tools/web.js +19 -5
- package/dist/tools/web.js.map +1 -1
- package/dist/tools/workflowTool.d.ts +2 -18
- package/dist/tools/workflowTool.d.ts.map +1 -1
- package/dist/tools/workflowTool.js.map +1 -1
- package/package.json +3 -3
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"executeNode.js","sourceRoot":"","sources":["../../dag/executeNode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;4EAY4E;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA8ClD;oFACoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,gBAAgB,EAAE,iBAAiB,EAAE,YAAY;IACjD,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW;IACtD,eAAe,EAAE,eAAe,EAAE,QAAQ;
|
|
1
|
+
{"version":3,"file":"executeNode.js","sourceRoot":"","sources":["../../dag/executeNode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;4EAY4E;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA8ClD;oFACoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,gBAAgB,EAAE,iBAAiB,EAAE,YAAY;IACjD,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW;IACtD,eAAe,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS;CACtD,CAAC;AAEF;;kDAEkD;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,GAAoB,EAAE,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAEpG;+EAC+E;AAC/E,MAAM,UAAU,YAAY,CAAC,GAAgB,EAAE,KAA2B,EAAE,GAAgB;IAC1F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC1E,IAAI,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;mFACmF;AACnF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,MAAkC;IAClF,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACpD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,GAAG,GAAG,2DAA2D,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7F,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED;gEACgE;AAChE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAmB,EAAE,IAAiB;IAClE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAC9C,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnE,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAiC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY;YACtC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,cAAc,EAAE;YACnE,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM;YACN,OAAO,EAAE,CAAC,CAAa,EAAE,EAAE;gBACzB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;oBAAE,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC;gBACtC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7D,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,MAAM,GAAe,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QACrG,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAE,CAAW,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAA8B;IAC7E,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../../guardrail/builtins.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,6EAA6E;AAC7E,eAAO,MAAM,eAAe,EAAE,MAe7B,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,EAAE,
|
|
1
|
+
{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../../guardrail/builtins.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,6EAA6E;AAC7E,eAAO,MAAM,eAAe,EAAE,MAe7B,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,EAAE,MAsC9B,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,EAAE,MAY/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAInD,CAAC"}
|
|
@@ -38,12 +38,14 @@ export const READ_ONLY_POLICY = {
|
|
|
38
38
|
// side effect, denied outright under read-only regardless of their own permission.
|
|
39
39
|
'shell:*',
|
|
40
40
|
'memory:save_memory', 'memory:kv_set', 'memory:forget_memory',
|
|
41
|
+
'knowledge:knowledge_write', 'knowledge:knowledge_setup',
|
|
41
42
|
'system:*',
|
|
42
43
|
],
|
|
43
44
|
},
|
|
44
45
|
permissions: {
|
|
45
46
|
'fs:write_file': 'deny', 'fs:create_file': 'deny', 'fs:delete_file': 'deny', 'fs:rename_file': 'deny',
|
|
46
47
|
'memory:save_memory': 'deny', 'memory:kv_set': 'deny', 'memory:forget_memory': 'deny',
|
|
48
|
+
'knowledge:knowledge_write': 'deny', 'knowledge:knowledge_setup': 'deny',
|
|
47
49
|
'system:*': 'deny',
|
|
48
50
|
},
|
|
49
51
|
// Backstop: any other mutating tool (a dynamic MCP/skill write the deny list
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"builtins.js","sourceRoot":"","sources":["../../guardrail/builtins.ts"],"names":[],"mappings":"AAQA,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAW;IACrC,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,6DAA6D;IAC1E,WAAW,EAAE,MAAM;IACnB,0EAA0E;IAC1E,oEAAoE;IACpE,qEAAqE;IACrE,uDAAuD;IACvD,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE;QACX,qBAAqB,EAAE,OAAO,EAAE,8DAA8D;QAC9F,UAAU,EAAE,MAAM,EAAE,gDAAgD;KACrE;IACD,+EAA+E;CAChF,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAW;IACtC,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,4DAA4D;IACzE,WAAW,EAAE,MAAM;IACnB,QAAQ,EAAE,EAAE,EAAE,kFAAkF;IAChG,KAAK,EAAE;QACL,IAAI,EAAE;YACJ,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB;YACrE,4EAA4E;YAC5E,iEAAiE;YACjE,sEAAsE;YACtE,2DAA2D;YAC3D,2DAA2D;YAC3D,oBAAoB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,oBAAoB;YACnF,yEAAyE;YACzE,kDAAkD;YAClD,mBAAmB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,iBAAiB;YACtG,wEAAwE;YACxE,mFAAmF;YACnF,SAAS;YACT,oBAAoB,EAAE,eAAe,EAAE,sBAAsB;YAC7D,UAAU;SACX;KACF;IACD,WAAW,EAAE;QACX,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM;QACrG,oBAAoB,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM;QACrF,UAAU,EAAE,MAAM;KACnB;IACD,6EAA6E;IAC7E,uEAAuE;IACvE,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,eAAe,EAAE,MAAM;CACxB,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAW;IACvC,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,iFAAiF;IAC9F,WAAW,EAAE,MAAM;IACnB,4EAA4E;IAC5E,kEAAkE;IAClE,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE;QACX,UAAU,EAAE,KAAK,EAAE,0DAA0D;KAC9E;IACD,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,QAAQ,EAAE,eAAe;IACzB,WAAW,EAAE,gBAAgB;IAC7B,UAAU,EAAE,iBAAiB;CAC9B,CAAC"}
|
|
1
|
+
{"version":3,"file":"builtins.js","sourceRoot":"","sources":["../../guardrail/builtins.ts"],"names":[],"mappings":"AAQA,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAW;IACrC,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,6DAA6D;IAC1E,WAAW,EAAE,MAAM;IACnB,0EAA0E;IAC1E,oEAAoE;IACpE,qEAAqE;IACrE,uDAAuD;IACvD,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE;QACX,qBAAqB,EAAE,OAAO,EAAE,8DAA8D;QAC9F,UAAU,EAAE,MAAM,EAAE,gDAAgD;KACrE;IACD,+EAA+E;CAChF,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAW;IACtC,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,4DAA4D;IACzE,WAAW,EAAE,MAAM;IACnB,QAAQ,EAAE,EAAE,EAAE,kFAAkF;IAChG,KAAK,EAAE;QACL,IAAI,EAAE;YACJ,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB;YACrE,4EAA4E;YAC5E,iEAAiE;YACjE,sEAAsE;YACtE,2DAA2D;YAC3D,2DAA2D;YAC3D,oBAAoB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,oBAAoB;YACnF,yEAAyE;YACzE,kDAAkD;YAClD,mBAAmB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,iBAAiB;YACtG,wEAAwE;YACxE,mFAAmF;YACnF,SAAS;YACT,oBAAoB,EAAE,eAAe,EAAE,sBAAsB;YAC7D,2BAA2B,EAAE,2BAA2B;YACxD,UAAU;SACX;KACF;IACD,WAAW,EAAE;QACX,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM;QACrG,oBAAoB,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM;QACrF,2BAA2B,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM;QACxE,UAAU,EAAE,MAAM;KACnB;IACD,6EAA6E;IAC7E,uEAAuE;IACvE,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,eAAe,EAAE,MAAM;CACxB,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAW;IACvC,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,iFAAiF;IAC9F,WAAW,EAAE,MAAM;IACnB,4EAA4E;IAC5E,kEAAkE;IAClE,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE;QACX,UAAU,EAAE,KAAK,EAAE,0DAA0D;KAC9E;IACD,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,QAAQ,EAAE,eAAe;IACzB,WAAW,EAAE,gBAAgB;IAC7B,UAAU,EAAE,iBAAiB;CAC9B,CAAC"}
|
|
@@ -26,6 +26,15 @@ export declare function toolGateAdmits(policy: Policy, call: {
|
|
|
26
26
|
name: string;
|
|
27
27
|
address?: string;
|
|
28
28
|
}): boolean;
|
|
29
|
+
/** Does the policy name this tool itself, as a grant: an entry in
|
|
30
|
+
* `tools.allow`, or a `permissions` key whose level is not deny, that is
|
|
31
|
+
* exactly its wire name or its address (`mcp:<server>/<tool>`), and the
|
|
32
|
+
* `tools` gate admits it. A wildcard never counts (`mcp:*`, `mcp:o365/*`): a
|
|
33
|
+
* tool a host offers only by grant must be named one by one. */
|
|
34
|
+
export declare function policyGrantsTool(policy: Policy, tool: {
|
|
35
|
+
name: string;
|
|
36
|
+
address?: string;
|
|
37
|
+
}): boolean;
|
|
29
38
|
export declare function initialState(): GuardrailState;
|
|
30
39
|
/** Turn-budget check, evaluated at the start of each turn. */
|
|
31
40
|
export declare function evaluateTurnStart(policy: Policy, state: GuardrailState): GuardrailDecision;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guardrail.d.ts","sourceRoot":"","sources":["../../guardrail/guardrail.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAkC,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE9G,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB;2EACuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AASD;;uEAEuE;AACvE,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAIhG;AAED;;;gFAGgF;AAChF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAMhG;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAgBD,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,iBAAiB,CAK1F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,eAAe,GACpB,iBAAiB,CAkBnB;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,SAAS,EAAE,CAKrF"}
|
|
1
|
+
{"version":3,"file":"guardrail.d.ts","sourceRoot":"","sources":["../../guardrail/guardrail.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAkC,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE9G,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB;2EACuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AASD;;uEAEuE;AACvE,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAIhG;AAED;;;gFAGgF;AAChF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAMhG;AAED;;;;gEAIgE;AAChE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAKlG;AAED,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAgBD,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,iBAAiB,CAK1F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,eAAe,GACpB,iBAAiB,CAkBnB;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,SAAS,EAAE,CAKrF"}
|
|
@@ -30,6 +30,19 @@ export function toolGateAdmits(policy, call) {
|
|
|
30
30
|
return false;
|
|
31
31
|
return !allow.length || callMatches(subject, allow);
|
|
32
32
|
}
|
|
33
|
+
/** Does the policy name this tool itself, as a grant: an entry in
|
|
34
|
+
* `tools.allow`, or a `permissions` key whose level is not deny, that is
|
|
35
|
+
* exactly its wire name or its address (`mcp:<server>/<tool>`), and the
|
|
36
|
+
* `tools` gate admits it. A wildcard never counts (`mcp:*`, `mcp:o365/*`): a
|
|
37
|
+
* tool a host offers only by grant must be named one by one. */
|
|
38
|
+
export function policyGrantsTool(policy, tool) {
|
|
39
|
+
if (!toolGateAdmits(policy, tool))
|
|
40
|
+
return false;
|
|
41
|
+
const names = (entry) => entry === tool.name || (!!tool.address && entry === tool.address);
|
|
42
|
+
if ((policy.tools?.allow ?? []).some(names))
|
|
43
|
+
return true;
|
|
44
|
+
return Object.entries(policy.permissions ?? {}).some(([key, level]) => level !== 'deny' && names(key));
|
|
45
|
+
}
|
|
33
46
|
export function initialState() {
|
|
34
47
|
return { turn: 0, toolCalls: 0, calledTools: new Set() };
|
|
35
48
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guardrail.js","sourceRoot":"","sources":["../../guardrail/guardrail.ts"],"names":[],"mappings":"AAAA;;8EAE8E;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAiBxC,6EAA6E;AAC7E,SAAS,WAAW,CAAC,IAAqB,EAAE,KAAwB;IAClE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;uEAEuE;AACvE,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAwC;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IACtC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED;;;gFAGgF;AAChF,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAwC;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;AACtC,CAAC;AAED,SAAS,OAAO,CACd,IAAmB,EACnB,OAAe,EACf,MAAuB,EACvB,IAAa;IAEb,MAAM,SAAS,GAAc,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,KAAqB;IACrE,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC,WAAW,EAAE,qBAAqB,MAAM,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,KAAqB,EACrB,IAAqB;IAErB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,cAAc,EAAE,+BAA+B,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAEtC,IAAI,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,aAAa,EAAE,0BAA0B,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,kBAAkB,EAAE,2BAA2B,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QACnF,OAAO,OAAO,CAAC,gBAAgB,EAAE,yBAAyB,MAAM,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,KAAqB;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC/B,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5G,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,UAAkB,EAAE,MAAmB;IAC9D,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC"}
|
|
1
|
+
{"version":3,"file":"guardrail.js","sourceRoot":"","sources":["../../guardrail/guardrail.ts"],"names":[],"mappings":"AAAA;;8EAE8E;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAiBxC,6EAA6E;AAC7E,SAAS,WAAW,CAAC,IAAqB,EAAE,KAAwB;IAClE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;uEAEuE;AACvE,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAwC;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IACtC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED;;;gFAGgF;AAChF,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAwC;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC;AAED;;;;gEAIgE;AAChE,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAwC;IACvF,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5G,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;AACtC,CAAC;AAED,SAAS,OAAO,CACd,IAAmB,EACnB,OAAe,EACf,MAAuB,EACvB,IAAa;IAEb,MAAM,SAAS,GAAc,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,KAAqB;IACrE,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC,WAAW,EAAE,qBAAqB,MAAM,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,KAAqB,EACrB,IAAqB;IAErB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,cAAc,EAAE,+BAA+B,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAEtC,IAAI,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,aAAa,EAAE,0BAA0B,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,kBAAkB,EAAE,2BAA2B,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QACnF,OAAO,OAAO,CAAC,gBAAgB,EAAE,yBAAyB,MAAM,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,KAAqB;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC/B,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5G,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,UAAkB,EAAE,MAAmB;IAC9D,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC"}
|
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
export * from '@corenel/protocol';
|
|
2
2
|
export { matchesAnyGlob, globToRegex } from './glob';
|
|
3
|
-
export { initialState, evaluateTurnStart, evaluateToolCall, evaluateCompletion, toolGateCovers, toolGateAdmits, type GuardrailState, type ToolCallSubject, } from './guardrail';
|
|
4
|
-
export { PermissionService, mostRestrictive, strictestUnattended, policyNamesTool, type PermissionSubject, type PermissionPrompt, type PermissionServiceOptions, type CheckOptions, } from './permission-service';
|
|
3
|
+
export { initialState, evaluateTurnStart, evaluateToolCall, evaluateCompletion, toolGateCovers, toolGateAdmits, policyGrantsTool, type GuardrailState, type ToolCallSubject, } from './guardrail';
|
|
4
|
+
export { PermissionService, mostRestrictive, strictestUnattended, policyNamesTool, type PermissionSubject, type PermissionPrompt, type PermissionServiceOptions, type CheckOptions, type StandingLookup, type StandingLookupAt, } from './permission-service';
|
|
5
5
|
export { STANDARD_POLICY, READ_ONLY_POLICY, AUTONOMOUS_POLICY, BUILTIN_POLICIES } from './builtins';
|
|
6
6
|
export { validatePolicy, type PolicyValidationResult } from './validate';
|
|
7
7
|
export { policyToYaml, policyFromYaml } from './serialize';
|
|
8
|
-
export { listPolicies, getPolicy, isBuiltinPolicy, saveCustomPolicy, deleteCustomPolicy, getSelectedPolicyName, setSelectedPolicyName, resolveSelectedPolicy, type PolicyEntry, type PolicySaveResult, } from './store';
|
|
8
|
+
export { listPolicies, getPolicy, isBuiltinPolicy, isPolicyNameTaken, saveCustomPolicy, deleteCustomPolicy, getSelectedPolicyName, setSelectedPolicyName, resolveSelectedPolicy, type PolicyEntry, type PolicySaveResult, } from './store';
|
|
9
9
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../guardrail/index.ts"],"names":[],"mappings":"AAEA,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,YAAY,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../guardrail/index.ts"],"names":[],"mappings":"AAEA,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EACL,YAAY,EACZ,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,SAAS,CAAC"}
|
package/dist/guardrail/index.js
CHANGED
|
@@ -2,10 +2,10 @@
|
|
|
2
2
|
* guardrail (hard gates) + permission service (per-tool oversight) + built-ins. */
|
|
3
3
|
export * from '@corenel/protocol';
|
|
4
4
|
export { matchesAnyGlob, globToRegex } from './glob.js';
|
|
5
|
-
export { initialState, evaluateTurnStart, evaluateToolCall, evaluateCompletion, toolGateCovers, toolGateAdmits, } from './guardrail.js';
|
|
5
|
+
export { initialState, evaluateTurnStart, evaluateToolCall, evaluateCompletion, toolGateCovers, toolGateAdmits, policyGrantsTool, } from './guardrail.js';
|
|
6
6
|
export { PermissionService, mostRestrictive, strictestUnattended, policyNamesTool, } from './permission-service.js';
|
|
7
7
|
export { STANDARD_POLICY, READ_ONLY_POLICY, AUTONOMOUS_POLICY, BUILTIN_POLICIES } from './builtins.js';
|
|
8
8
|
export { validatePolicy } from './validate.js';
|
|
9
9
|
export { policyToYaml, policyFromYaml } from './serialize.js';
|
|
10
|
-
export { listPolicies, getPolicy, isBuiltinPolicy, saveCustomPolicy, deleteCustomPolicy, getSelectedPolicyName, setSelectedPolicyName, resolveSelectedPolicy, } from './store.js';
|
|
10
|
+
export { listPolicies, getPolicy, isBuiltinPolicy, isPolicyNameTaken, saveCustomPolicy, deleteCustomPolicy, getSelectedPolicyName, setSelectedPolicyName, resolveSelectedPolicy, } from './store.js';
|
|
11
11
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../guardrail/index.ts"],"names":[],"mappings":"AAAA;mFACmF;AACnF,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,cAAc,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../guardrail/index.ts"],"names":[],"mappings":"AAAA;mFACmF;AACnF,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,gBAAgB,GAGjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,GAOhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpG,OAAO,EAAE,cAAc,EAA+B,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EACL,YAAY,EACZ,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,GAGtB,MAAM,SAAS,CAAC"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type { Policy, PermissionLevel, PermissionCeiling, PermissionDecision, DecisionEvent, PromptAnswer, PromptRequest,
|
|
1
|
+
import type { Policy, PermissionLevel, PermissionCeiling, PermissionDecision, DecisionEvent, PromptAnswer, PromptRequest, ApprovalDetail, ApprovalSubject, UnattendedMode } from '@corenel/protocol';
|
|
2
2
|
/** Minimal tool shape the resolver needs (a subset of AgentTool). */
|
|
3
3
|
export interface PermissionSubject {
|
|
4
4
|
name: string;
|
|
@@ -21,6 +21,18 @@ export interface PermissionPrompt {
|
|
|
21
21
|
* (a session auto-answer, a daemon timeout) return a PromptAnswer. */
|
|
22
22
|
ask(req: PromptRequest): Promise<PermissionDecision | PromptAnswer>;
|
|
23
23
|
}
|
|
24
|
+
/** Where a standing lookup comes from: `nodeId` names the delegated child (a
|
|
25
|
+
* spawned sub-agent or a call_agent callee) whose check it is; absent for the
|
|
26
|
+
* root run. */
|
|
27
|
+
export interface StandingLookupAt {
|
|
28
|
+
nodeId?: string;
|
|
29
|
+
}
|
|
30
|
+
/** A standing-approval lookup (@corenel/protocol StandingApprovals) that may
|
|
31
|
+
* also be told which delegated child is asking, so a host can hold children
|
|
32
|
+
* to stricter rules. A plain StandingApprovals is one. */
|
|
33
|
+
export interface StandingLookup {
|
|
34
|
+
matches(subject: ApprovalSubject, at?: StandingLookupAt): Promise<boolean>;
|
|
35
|
+
}
|
|
24
36
|
export interface PermissionServiceOptions {
|
|
25
37
|
policy: Policy;
|
|
26
38
|
prompt?: PermissionPrompt;
|
|
@@ -32,10 +44,23 @@ export interface PermissionServiceOptions {
|
|
|
32
44
|
ceiling?: PermissionCeiling;
|
|
33
45
|
/** Consulted only at the 'ask' branch, after sessionAllow, and never when
|
|
34
46
|
* the ceiling itself requires an ask. A throw/reject counts as no match. */
|
|
35
|
-
standing?:
|
|
47
|
+
standing?: StandingLookup;
|
|
36
48
|
/** Observer for every decision. Called after the decision is final and never
|
|
37
49
|
* awaited; a throw is swallowed. It cannot change the decision. */
|
|
38
50
|
onDecision?: (e: DecisionEvent) => void;
|
|
51
|
+
/** The ask-every-time mode (a run that holds text from a project's own
|
|
52
|
+
* files: an outside callee, or a conversation that loaded a project skill).
|
|
53
|
+
* Read at every check; a throw counts as true. While it answers true:
|
|
54
|
+
* - a person decides each ask: no session allow and no standing rule
|
|
55
|
+
* answers, as for a checkpoint;
|
|
56
|
+
* - a tool the policy would ALLOW still asks when it can change something
|
|
57
|
+
* or reach outside: every mutating tool (a write to the agent's own
|
|
58
|
+
* memory or key store included: `roomSafe` is no exemption here, since a
|
|
59
|
+
* saved memory is in the system prompt of every later chat),
|
|
60
|
+
* every command tool, every MCP tool and `web_search`
|
|
61
|
+
* (`asksInEveryTimeMode`). With no prompt to ask, that is a deny.
|
|
62
|
+
* A plain read stays allowed, and a `deny` stays a deny. */
|
|
63
|
+
everyTime?: () => boolean;
|
|
39
64
|
}
|
|
40
65
|
export interface CheckOptions {
|
|
41
66
|
/** The spawned child this check is for (stamped onto the DecisionEvent). */
|
|
@@ -51,6 +76,12 @@ export interface CheckOptions {
|
|
|
51
76
|
}
|
|
52
77
|
/** How long the prompt waits for a tool's approval details. */
|
|
53
78
|
export declare const DETAIL_TIMEOUT_MS = 15000;
|
|
79
|
+
/** The tools a policy `allow` does not cover in the ask-every-time mode
|
|
80
|
+
* (PermissionServiceOptions.everyTime): anything that changes something, the
|
|
81
|
+
* agent's own memory and key store included, anything that runs a command, any MCP tool
|
|
82
|
+
* (a connection the person set to "Don't ask before using" included), and
|
|
83
|
+
* `web_search`, which could carry what the run has read out in a query. */
|
|
84
|
+
export declare function asksInEveryTimeMode(tool: PermissionSubject): boolean;
|
|
54
85
|
/** Does any `permissions` rule in this policy -- bare name, address,
|
|
55
86
|
* namespace glob or `*` -- apply to this tool, the way the enforcer matches
|
|
56
87
|
* (see matchLevel)? False only when the policy is silent about it. */
|
|
@@ -70,7 +101,10 @@ export declare class PermissionService {
|
|
|
70
101
|
private readonly sessionAllow;
|
|
71
102
|
private readonly standing?;
|
|
72
103
|
private readonly onDecision?;
|
|
104
|
+
private readonly everyTime?;
|
|
73
105
|
constructor(opts: PermissionServiceOptions);
|
|
106
|
+
/** The host's every-time switch, failing toward the person. */
|
|
107
|
+
private asksEveryTime;
|
|
74
108
|
/** Pre-approve a tool-name glob for the rest of the session (an "ask" becomes "allow"). */
|
|
75
109
|
preApprove(toolGlob: string): void;
|
|
76
110
|
reset(): void;
|
|
@@ -90,12 +124,19 @@ export declare class PermissionService {
|
|
|
90
124
|
* ceiling only ever RESTRICTS, so an `allow` in it cannot raise a `deny` base.
|
|
91
125
|
* Keep this list in step with `resolveBaseLevel` below; position is the design
|
|
92
126
|
* there, so a stale summary here is worse than none.
|
|
127
|
+
* Last, the ask-every-time mode raises an `allow` to `ask` for the tools in
|
|
128
|
+
* `asksInEveryTimeMode`; the answer is the level `check` will act on, so a
|
|
129
|
+
* caller that batches "allow" calls never batches one that will ask.
|
|
93
130
|
*/
|
|
94
131
|
resolveLevel(tool: PermissionSubject): PermissionLevel;
|
|
132
|
+
/** `level`, or `ask` when the policy allows a changing tool in the ask-every-time mode. */
|
|
133
|
+
private raised;
|
|
95
134
|
private resolveBaseLevel;
|
|
96
135
|
private resolveCeilingLevel;
|
|
97
136
|
private decide;
|
|
98
|
-
/** Fail toward the human: a lookup failure is "no match", never "allow".
|
|
137
|
+
/** Fail toward the human: a lookup failure is "no match", never "allow".
|
|
138
|
+
* `nodeId` (the child the check is for, CheckOptions.nodeId) goes with the
|
|
139
|
+
* lookup, so a host can hold a delegated child to stricter rules. */
|
|
99
140
|
private standingMatches;
|
|
100
141
|
private report;
|
|
101
142
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permission-service.d.ts","sourceRoot":"","sources":["../../guardrail/permission-service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EACnD,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,
|
|
1
|
+
{"version":3,"file":"permission-service.d.ts","sourceRoot":"","sources":["../../guardrail/permission-service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EACnD,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EACvG,MAAM,mBAAmB,CAAC;AAK3B,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb;uFACmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;kEAI8D;IAC9D,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B;0EACsE;IACtE,GAAG,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,GAAG,YAAY,CAAC,CAAC;CACrE;AAED;;eAEe;AACf,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;0DAE0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,eAAe,CAAC;IACrC,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,eAAe,CAAC;IACrC,sDAAsD;IACtD,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;uEACmE;IACnE,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,aAAa,KAAK,IAAI,CAAC;IACxC;;;;;;;;;;;gEAW4D;IAC5D,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9C;;sEAEkE;IAClE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,QAAS,CAAC;AAkBxC;;;;2EAI2E;AAC3E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAKpE;AA8BD;;sEAEsE;AACtE,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAEhF;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,eAAe,CAEvF;AAMD;;2EAE2E;AAC3E,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,cAAc,GAAG,cAAc,CAExF;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAkB;IACrD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAkB;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAoB;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAgB;gBAE/B,IAAI,EAAE,wBAAwB;IAW1C,+DAA+D;IAC/D,OAAO,CAAC,aAAa;IAKrB,2FAA2F;IAC3F,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAIlC,KAAK,IAAI,IAAI;IAIb;;0EAEsE;IAChE,KAAK,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoBtG;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,IAAI,EAAE,iBAAiB,GAAG,eAAe;IAItD,2FAA2F;IAC3F,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,gBAAgB;IA0CxB,OAAO,CAAC,mBAAmB;YAQb,MAAM;IAoDpB;;yEAEqE;YACvD,eAAe;IAU7B,OAAO,CAAC,MAAM;CAQf"}
|
|
@@ -8,7 +8,7 @@ import { matchesAnyGlob } from './glob.js';
|
|
|
8
8
|
import { isCheckpointTool, denialNote, needsHuman } from '@corenel/protocol';
|
|
9
9
|
// A direct file import, not the approvals barrel, so the guardrail does not
|
|
10
10
|
// pull the whole approvals module.
|
|
11
|
-
import { isNeverStanding } from '../approvals/shellTools.js';
|
|
11
|
+
import { isNeverStanding, isShellTool } from '../approvals/shellTools.js';
|
|
12
12
|
/** How long the prompt waits for a tool's approval details. */
|
|
13
13
|
export const DETAIL_TIMEOUT_MS = 15000;
|
|
14
14
|
async function boundedDetail(detailOf) {
|
|
@@ -28,6 +28,20 @@ async function boundedDetail(detailOf) {
|
|
|
28
28
|
}
|
|
29
29
|
}
|
|
30
30
|
const LEVEL_RANK = { allow: 0, ask: 1, owner: 2, deny: 3 };
|
|
31
|
+
/** The tools a policy `allow` does not cover in the ask-every-time mode
|
|
32
|
+
* (PermissionServiceOptions.everyTime): anything that changes something, the
|
|
33
|
+
* agent's own memory and key store included, anything that runs a command, any MCP tool
|
|
34
|
+
* (a connection the person set to "Don't ask before using" included), and
|
|
35
|
+
* `web_search`, which could carry what the run has read out in a query. */
|
|
36
|
+
export function asksInEveryTimeMode(tool) {
|
|
37
|
+
if (tool.mutates === true)
|
|
38
|
+
return true;
|
|
39
|
+
if (isShellTool({ name: tool.name, ...(tool.address ? { address: tool.address } : {}) }))
|
|
40
|
+
return true;
|
|
41
|
+
if (tool.address?.startsWith('mcp:') || /^mcp__/.test(tool.name))
|
|
42
|
+
return true;
|
|
43
|
+
return tool.name === 'web_search' || tool.address === 'web:web_search';
|
|
44
|
+
}
|
|
31
45
|
/** Match a glob against a tool's address (if any) and its bare name. */
|
|
32
46
|
function subjectMatches(tool, glob) {
|
|
33
47
|
if (tool.address && matchesAnyGlob(tool.address, [glob]))
|
|
@@ -127,6 +141,12 @@ export class PermissionService {
|
|
|
127
141
|
writable: true,
|
|
128
142
|
value: void 0
|
|
129
143
|
});
|
|
144
|
+
Object.defineProperty(this, "everyTime", {
|
|
145
|
+
enumerable: true,
|
|
146
|
+
configurable: true,
|
|
147
|
+
writable: true,
|
|
148
|
+
value: void 0
|
|
149
|
+
});
|
|
130
150
|
this.policy = opts.policy;
|
|
131
151
|
if (opts.prompt)
|
|
132
152
|
this.prompt = opts.prompt;
|
|
@@ -138,6 +158,19 @@ export class PermissionService {
|
|
|
138
158
|
this.standing = opts.standing;
|
|
139
159
|
if (opts.onDecision)
|
|
140
160
|
this.onDecision = opts.onDecision;
|
|
161
|
+
if (opts.everyTime)
|
|
162
|
+
this.everyTime = opts.everyTime;
|
|
163
|
+
}
|
|
164
|
+
/** The host's every-time switch, failing toward the person. */
|
|
165
|
+
asksEveryTime() {
|
|
166
|
+
if (!this.everyTime)
|
|
167
|
+
return false;
|
|
168
|
+
try {
|
|
169
|
+
return this.everyTime() === true;
|
|
170
|
+
}
|
|
171
|
+
catch {
|
|
172
|
+
return true;
|
|
173
|
+
}
|
|
141
174
|
}
|
|
142
175
|
/** Pre-approve a tool-name glob for the rest of the session (an "ask" becomes "allow"). */
|
|
143
176
|
preApprove(toolGlob) {
|
|
@@ -152,8 +185,8 @@ export class PermissionService {
|
|
|
152
185
|
async check(tool, input, opts) {
|
|
153
186
|
const baseLevel = this.resolveBaseLevel(tool);
|
|
154
187
|
const ceilingLevel = this.resolveCeilingLevel(tool);
|
|
155
|
-
const level = mostRestrictive(baseLevel, ceilingLevel);
|
|
156
|
-
const { decision, by, answerRef, note, answeredBy, routedTo } = await this.decide(level, baseLevel, ceilingLevel, tool, input, opts?.detail);
|
|
188
|
+
const level = this.raised(tool, mostRestrictive(baseLevel, ceilingLevel));
|
|
189
|
+
const { decision, by, answerRef, note, answeredBy, routedTo } = await this.decide(level, baseLevel, ceilingLevel, tool, input, opts?.detail, opts?.nodeId);
|
|
157
190
|
this.report({
|
|
158
191
|
subject: { name: tool.name, ...(tool.address ? { address: tool.address } : {}), ...(tool.mutates !== undefined ? { mutates: tool.mutates } : {}) },
|
|
159
192
|
input, level, baseLevel, ceilingLevel, decision, by,
|
|
@@ -183,9 +216,16 @@ export class PermissionService {
|
|
|
183
216
|
* ceiling only ever RESTRICTS, so an `allow` in it cannot raise a `deny` base.
|
|
184
217
|
* Keep this list in step with `resolveBaseLevel` below; position is the design
|
|
185
218
|
* there, so a stale summary here is worse than none.
|
|
219
|
+
* Last, the ask-every-time mode raises an `allow` to `ask` for the tools in
|
|
220
|
+
* `asksInEveryTimeMode`; the answer is the level `check` will act on, so a
|
|
221
|
+
* caller that batches "allow" calls never batches one that will ask.
|
|
186
222
|
*/
|
|
187
223
|
resolveLevel(tool) {
|
|
188
|
-
return mostRestrictive(this.resolveBaseLevel(tool), this.resolveCeilingLevel(tool));
|
|
224
|
+
return this.raised(tool, mostRestrictive(this.resolveBaseLevel(tool), this.resolveCeilingLevel(tool)));
|
|
225
|
+
}
|
|
226
|
+
/** `level`, or `ask` when the policy allows a changing tool in the ask-every-time mode. */
|
|
227
|
+
raised(tool, level) {
|
|
228
|
+
return level === 'allow' && asksInEveryTimeMode(tool) && this.asksEveryTime() ? 'ask' : level;
|
|
189
229
|
}
|
|
190
230
|
resolveBaseLevel(tool) {
|
|
191
231
|
const matched = this.policy.permissions && matchLevel(tool, this.policy.permissions);
|
|
@@ -243,7 +283,7 @@ export class PermissionService {
|
|
|
243
283
|
return matched;
|
|
244
284
|
return c.defaultLevel ?? 'allow';
|
|
245
285
|
}
|
|
246
|
-
async decide(level, baseLevel, ceilingLevel, tool, input, detailOf) {
|
|
286
|
+
async decide(level, baseLevel, ceilingLevel, tool, input, detailOf, nodeId) {
|
|
247
287
|
if (level === 'allow')
|
|
248
288
|
return { decision: 'allow', by: 'policy' };
|
|
249
289
|
if (level === 'deny') {
|
|
@@ -256,12 +296,14 @@ export class PermissionService {
|
|
|
256
296
|
// An OWNER-level tool is the same (spec 2026-10-01 Part C, D7/D8): its
|
|
257
297
|
// owner decides every call.
|
|
258
298
|
const ownerLevel = level === 'owner';
|
|
259
|
-
|
|
299
|
+
// The host's switch (PermissionServiceOptions.everyTime) does the same for every tool.
|
|
300
|
+
const everyTime = this.asksEveryTime();
|
|
301
|
+
const once = isCheckpointTool(tool) || ownerLevel || everyTime;
|
|
260
302
|
// The ceiling imposed the ask when it alone requires a person.
|
|
261
303
|
const ceilingAsks = needsHuman(ceilingLevel);
|
|
262
304
|
if (!once && this.sessionAllow.size && matchesAnyGlob(tool.name, [...this.sessionAllow]))
|
|
263
305
|
return { decision: 'allow', by: 'session' };
|
|
264
|
-
if (!once && this.standing && !ceilingAsks && (await this.standingMatches(tool)))
|
|
306
|
+
if (!once && this.standing && !ceilingAsks && (await this.standingMatches(tool, nodeId)))
|
|
265
307
|
return { decision: 'allow', by: 'standing' };
|
|
266
308
|
if (!this.prompt)
|
|
267
309
|
return { decision: 'deny', by: 'no-prompt' };
|
|
@@ -270,7 +312,7 @@ export class PermissionService {
|
|
|
270
312
|
// Never eligible when the ceiling imposed the ask (spec section 2.3), the
|
|
271
313
|
// tool runs arbitrary commands, it is a checkpoint (approvals/shellTools.ts),
|
|
272
314
|
// or it is owner-level.
|
|
273
|
-
const standingEligible = !ownerLevel && !ceilingAsks && !isNeverStanding(subject);
|
|
315
|
+
const standingEligible = !ownerLevel && !ceilingAsks && !everyTime && !isNeverStanding(subject);
|
|
274
316
|
const answer = await this.prompt.ask({
|
|
275
317
|
tool: tool.name, input, ...(detail ? { detail } : {}), subject, standingEligible,
|
|
276
318
|
...(ownerLevel ? { level: 'owner' } : {}),
|
|
@@ -289,10 +331,15 @@ export class PermissionService {
|
|
|
289
331
|
...(answer.routedTo ? { routedTo: answer.routedTo } : {}),
|
|
290
332
|
};
|
|
291
333
|
}
|
|
292
|
-
/** Fail toward the human: a lookup failure is "no match", never "allow".
|
|
293
|
-
|
|
334
|
+
/** Fail toward the human: a lookup failure is "no match", never "allow".
|
|
335
|
+
* `nodeId` (the child the check is for, CheckOptions.nodeId) goes with the
|
|
336
|
+
* lookup, so a host can hold a delegated child to stricter rules. */
|
|
337
|
+
async standingMatches(tool, nodeId) {
|
|
294
338
|
try {
|
|
295
|
-
|
|
339
|
+
const standing = this.standing;
|
|
340
|
+
if (!standing)
|
|
341
|
+
return false;
|
|
342
|
+
return (await (nodeId ? standing.matches(tool, { nodeId }) : standing.matches(tool))) === true;
|
|
296
343
|
}
|
|
297
344
|
catch {
|
|
298
345
|
return false;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permission-service.js","sourceRoot":"","sources":["../../guardrail/permission-service.ts"],"names":[],"mappings":"AAAA;;;;;wEAKwE;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAK7E,4EAA4E;AAC5E,mCAAmC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"permission-service.js","sourceRoot":"","sources":["../../guardrail/permission-service.ts"],"names":[],"mappings":"AAAA;;;;;wEAKwE;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAK7E,4EAA4E;AAC5E,mCAAmC;AACnC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAmFvE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAM,CAAC;AAExC,KAAK,UAAU,aAAa,CAAC,QAA8C;IACzE,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,QAAQ,EAAE;YACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;SAChG,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAoC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAE5F;;;;2EAI2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACtG,IAAI,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,OAAO,KAAK,gBAAgB,CAAC;AACzE,CAAC;AAED,wEAAwE;AACxE,SAAS,cAAc,CAAC,IAAuB,EAAE,IAAY;IAC3D,IAAI,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;6CAE6C;AAC7C,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;AACpD,CAAC;AAED;;oCAEoC;AACpC,SAAS,UAAU,CAAC,IAAuB,EAAE,KAAsC;IACjF,IAAI,IAAiC,CAAC;IACtC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;YAAC,SAAS,GAAG,KAAK,CAAC;YAAC,IAAI,GAAG,KAAK,CAAC;QAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;sEAEsE;AACtE,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAuB;IACrE,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC;AACpF,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,CAAkB,EAAE,CAAkB;IACpE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;qBACqB;AACrB,MAAM,eAAe,GAAmC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAEvF;;2EAE2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,CAAiB,EAAE,CAAiB;IACtE,OAAO,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,OAAO,iBAAiB;IAW5B,YAAY,IAA8B;QAVzB;;;;;WAAe;QACf;;;;;WAA0B;QAC1B;;;;;WAAoC;QACpC;;;;;WAAoC;QACpC;;;;;WAA4B;QAC5B;;;;mBAAe,IAAI,GAAG,EAAU;WAAC;QACjC;;;;;WAA0B;QAC1B;;;;;WAAwC;QACxC;;;;;WAA0B;QAGzC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3C,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,OAAO,CAAC;QAC7D,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,KAAK,CAAC;QAC3D,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9C,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjD,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACvD,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACtD,CAAC;IAED,+DAA+D;IACvD,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IAClE,CAAC;IAED,2FAA2F;IAC3F,UAAU,CAAC,QAAgB;QACzB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED;;0EAEsE;IACtE,KAAK,CAAC,KAAK,CAAC,IAAuB,EAAE,KAAc,EAAE,IAAmB;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1E,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3J,IAAI,CAAC,MAAM,CAAC;YACV,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAClJ,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,IAAI,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,IAAuB;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,2FAA2F;IACnF,MAAM,CAAC,IAAuB,EAAE,KAAsB;QAC5D,OAAO,KAAK,KAAK,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAChG,CAAC;IAEO,gBAAgB,CAAC,IAAuB;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrF,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;gFA2BwE;QACxE,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;QAClD,4EAA4E;QAC5E,+EAA+E;QAC/E,6FAA6F;QAC7F,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QACpF,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACxE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjD,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAEO,mBAAmB,CAAC,IAAuB;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,IAAI,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,OAAO,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,KAAsB,EACtB,SAA0B,EAC1B,YAA6B,EAC7B,IAAuB,EACvB,KAAc,EACd,QAA+C,EAC/C,MAAe;QAEf,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;QAClE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,KAAK,MAAM,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1G,CAAC;QACD,+CAA+C;QAC/C,sEAAsE;QACtE,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,4BAA4B;QAC5B,MAAM,UAAU,GAAG,KAAK,KAAK,OAAO,CAAC;QACrC,uFAAuF;QACvF,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,UAAU,IAAI,SAAS,CAAC;QAC/D,+DAA+D;QAC/D,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;QACtI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;QACvI,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1J,0EAA0E;QAC1E,8EAA8E;QAC9E,wBAAwB;QACxB,MAAM,gBAAgB,GAAG,CAAC,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,gBAAgB;YAChF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE;YACxC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED;;yEAEqE;IAC7D,KAAK,CAAC,eAAe,CAAC,IAAuB,EAAE,MAAe;QACpE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC/B,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QACjG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,CAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAC7B,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;CACF"}
|
|
@@ -9,6 +9,10 @@ export declare function isBuiltinPolicy(name: string): boolean;
|
|
|
9
9
|
export declare function listPolicies(): PolicyEntry[];
|
|
10
10
|
/** Resolve a policy by name. Built-ins win; falls back to a stored custom. */
|
|
11
11
|
export declare function getPolicy(name: string): Policy | undefined;
|
|
12
|
+
/** True when `name` is a built-in or is held in the stored custom map, even
|
|
13
|
+
* by an entry this build cannot parse (which getPolicy hides). A caller
|
|
14
|
+
* picking a fresh name checks this so a save never overwrites such an entry. */
|
|
15
|
+
export declare function isPolicyNameTaken(name: string): boolean;
|
|
12
16
|
export interface PolicySaveResult {
|
|
13
17
|
ok: boolean;
|
|
14
18
|
errors: string[];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../guardrail/store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAOhD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAkCD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,gFAAgF;AAChF,wBAAgB,YAAY,IAAI,WAAW,EAAE,CAU5C;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED,MAAM,WAAW,gBAAgB;IAAG,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE;AAEnE;uCACuC;AACvC,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAa5D;AAED,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOxD;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,IAAI,MAAM,CAM9C;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C"}
|
|
1
|
+
{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../guardrail/store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAOhD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAkCD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,gFAAgF;AAChF,wBAAgB,YAAY,IAAI,WAAW,EAAE,CAU5C;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;gFAEgF;AAChF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,MAAM,WAAW,gBAAgB;IAAG,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE;AAEnE;uCACuC;AACvC,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAa5D;AAED,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOxD;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,IAAI,MAAM,CAM9C;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C"}
|
package/dist/guardrail/store.js
CHANGED
|
@@ -58,6 +58,12 @@ export function getPolicy(name) {
|
|
|
58
58
|
return BUILTIN_POLICIES[name];
|
|
59
59
|
return readCustom()[name];
|
|
60
60
|
}
|
|
61
|
+
/** True when `name` is a built-in or is held in the stored custom map, even
|
|
62
|
+
* by an entry this build cannot parse (which getPolicy hides). A caller
|
|
63
|
+
* picking a fresh name checks this so a save never overwrites such an entry. */
|
|
64
|
+
export function isPolicyNameTaken(name) {
|
|
65
|
+
return isBuiltinPolicy(name) || Object.prototype.hasOwnProperty.call(readRaw(), name);
|
|
66
|
+
}
|
|
61
67
|
/** Persist a custom policy. Rejects built-in names (rename to save a copy) and
|
|
62
68
|
* any policy that fails validation. */
|
|
63
69
|
export function saveCustomPolicy(p) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"store.js","sourceRoot":"","sources":["../../guardrail/store.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,SAAS,GAAG,8BAA8B,CAAC;AACjD,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAQ9C;;;uEAGuE;AACvE,SAAS,OAAO;IACd,MAAM,GAAG,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAI,GAA+B,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;+DAC+D;AAC/D,SAAS,UAAU;IACjB,MAAM,GAAG,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,GAA4B;IAC5C,IAAI,CAAC;QAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAkB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI;KACpD,CAAC,CAAC,CAAC;IACJ,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAkB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC/C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;SACxC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAID;uCACuC;AACvC,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/D,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,wDAAwD,CAAC,EAAE,CAAC;IAC5G,CAAC;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,mCAAmC;IACnC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAClC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACxB,OAAO,eAAe,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC;QAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB;IACnC,OAAO,SAAS,CAAC,qBAAqB,EAAE,CAAC,IAAI,eAAe,CAAC;AAC/D,CAAC"}
|
|
1
|
+
{"version":3,"file":"store.js","sourceRoot":"","sources":["../../guardrail/store.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,SAAS,GAAG,8BAA8B,CAAC;AACjD,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAQ9C;;;uEAGuE;AACvE,SAAS,OAAO;IACd,MAAM,GAAG,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAI,GAA+B,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;+DAC+D;AAC/D,SAAS,UAAU;IACjB,MAAM,GAAG,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,GAA4B;IAC5C,IAAI,CAAC;QAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAkB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI;KACpD,CAAC,CAAC,CAAC;IACJ,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAkB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC/C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;SACxC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;gFAEgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;AACxF,CAAC;AAID;uCACuC;AACvC,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/D,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,wDAAwD,CAAC,EAAE,CAAC;IAC5G,CAAC;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,mCAAmC;IACnC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAClC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACxB,OAAO,eAAe,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC;QAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB;IACnC,OAAO,SAAS,CAAC,qBAAqB,EAAE,CAAC,IAAI,eAAe,CAAC;AAC/D,CAAC"}
|
package/dist/prompts/config.d.ts
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { type FileService } from '@corenel/protocol';
|
|
1
2
|
export type ConfigDecision = 'in-sync' | 'fast-forward' | 'conflict' | 'review' | 'local-only';
|
|
2
3
|
/** The 3-way decision for one file from content hashes: current (user's), latest
|
|
3
4
|
* (shipped default), and baseline (last-synced default; undefined = untracked). */
|
|
@@ -57,8 +58,11 @@ export declare function applyConfigMerge(path: string, merged: string): Promise<
|
|
|
57
58
|
/** Replace every pending update with its shipped default. */
|
|
58
59
|
export declare function replaceAllConfigUpdates(): Promise<void>;
|
|
59
60
|
/** Read a config file, falling back to the shipped default when missing/empty —
|
|
60
|
-
* so compose() is never blocked on seeding and never returns an empty prompt.
|
|
61
|
-
|
|
61
|
+
* so compose() is never blocked on seeding and never returns an empty prompt.
|
|
62
|
+
* `config` is the config workspace to read, for a caller bound to one host's
|
|
63
|
+
* config (a run kept for a machine that is not the selected one); omitted =
|
|
64
|
+
* the host's (promptHost().workspace). */
|
|
65
|
+
export declare function readConfig(path: string, config?: FileService): Promise<string>;
|
|
62
66
|
/** Restore a config file to its shipped default (or remove it if not shipped). */
|
|
63
67
|
export declare function resetConfig(path: string): Promise<void>;
|
|
64
68
|
/** One authored config file, for a UI that browses the config workspace. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../prompts/config.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../prompts/config.ts"],"names":[],"mappings":"AAOA,OAAO,EAAwC,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA8B3F,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,cAAc,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAC;AAC/F;mFACmF;AACnF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAK7G;AAmDD;;;gEAGgE;AAChE,wBAAgB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAA2B;AAEtE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAA0B;AAoB/E,2DAA2D;AAC3D,wBAAgB,sBAAsB,IAAI,IAAI,CAAwC;AAwEtF,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,QAAQ,CAAC;AACvD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb;sEACkE;IAClE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;iCACiC;AACjC,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAkBjE;AAED;;2DAE2D;AAC3D,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW/F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASlF;AAED,6DAA6D;AAC7D,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE7D;AAED;;;;0CAI0C;AAC1C,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAOpF;AAED,kFAAkF;AAClF,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7D;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,UAAU,EAAE,OAAO,CAAC;CACrB;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAiBlE;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9E;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,qEAAqE;AACrE,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAI1D;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,MAAM,WAAW,YAAY;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE;AAEhF;6CAC6C;AAC7C,wBAAsB,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAa5D;AAGD,MAAM,WAAW,SAAS;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAI9F;;;0EAG0E;AAC1E,wBAAsB,SAAS,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAgBtD;AAKD,4DAA4D;AAC5D,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIjF;AAED,6BAA6B;AAC7B,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7D;AAGD,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AACD,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEnD"}
|
package/dist/prompts/config.js
CHANGED
|
@@ -308,11 +308,14 @@ export async function replaceAllConfigUpdates() {
|
|
|
308
308
|
await applyConfigUpdate(u.path, 'replace');
|
|
309
309
|
}
|
|
310
310
|
/** Read a config file, falling back to the shipped default when missing/empty —
|
|
311
|
-
* so compose() is never blocked on seeding and never returns an empty prompt.
|
|
312
|
-
|
|
311
|
+
* so compose() is never blocked on seeding and never returns an empty prompt.
|
|
312
|
+
* `config` is the config workspace to read, for a caller bound to one host's
|
|
313
|
+
* config (a run kept for a machine that is not the selected one); omitted =
|
|
314
|
+
* the host's (promptHost().workspace). */
|
|
315
|
+
export async function readConfig(path, config) {
|
|
313
316
|
const p = normalizeFilePath(path);
|
|
314
317
|
try {
|
|
315
|
-
return await promptHost().workspace.read(p);
|
|
318
|
+
return await (config ?? promptHost().workspace).read(p);
|
|
316
319
|
}
|
|
317
320
|
catch {
|
|
318
321
|
return CONFIG_DEFAULTS[p] ?? '';
|