@framers/agentos 0.12.4 → 0.12.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api/generateText.d.ts +12 -0
- package/dist/api/generateText.d.ts.map +1 -1
- package/dist/api/generateText.js +20 -6
- package/dist/api/generateText.js.map +1 -1
- package/dist/api/streamText.d.ts.map +1 -1
- package/dist/api/streamText.js +6 -3
- package/dist/api/streamText.js.map +1 -1
- package/dist/cognition/emergent/ComposableToolBuilder.d.ts.map +1 -1
- package/dist/cognition/emergent/ComposableToolBuilder.js +16 -8
- package/dist/cognition/emergent/ComposableToolBuilder.js.map +1 -1
- package/dist/cognition/emergent/EffectsStore.d.ts +58 -0
- package/dist/cognition/emergent/EffectsStore.d.ts.map +1 -0
- package/dist/cognition/emergent/EffectsStore.js +96 -0
- package/dist/cognition/emergent/EffectsStore.js.map +1 -0
- package/dist/cognition/emergent/EmergentCapabilityEngine.d.ts +22 -2
- package/dist/cognition/emergent/EmergentCapabilityEngine.d.ts.map +1 -1
- package/dist/cognition/emergent/EmergentCapabilityEngine.js +128 -19
- package/dist/cognition/emergent/EmergentCapabilityEngine.js.map +1 -1
- package/dist/cognition/emergent/EmergentJudge.d.ts +1 -1
- package/dist/cognition/emergent/EmergentJudge.d.ts.map +1 -1
- package/dist/cognition/emergent/EmergentToolRegistry.d.ts +12 -3
- package/dist/cognition/emergent/EmergentToolRegistry.d.ts.map +1 -1
- package/dist/cognition/emergent/EmergentToolRegistry.js +51 -4
- package/dist/cognition/emergent/EmergentToolRegistry.js.map +1 -1
- package/dist/cognition/emergent/ForgeToolMetaTool.d.ts.map +1 -1
- package/dist/cognition/emergent/ForgeToolMetaTool.js +4 -1
- package/dist/cognition/emergent/ForgeToolMetaTool.js.map +1 -1
- package/dist/cognition/emergent/SandboxedToolForge.d.ts +55 -51
- package/dist/cognition/emergent/SandboxedToolForge.d.ts.map +1 -1
- package/dist/cognition/emergent/SandboxedToolForge.js +103 -109
- package/dist/cognition/emergent/SandboxedToolForge.js.map +1 -1
- package/dist/cognition/emergent/ToolPackage.d.ts +2 -2
- package/dist/cognition/emergent/ToolPackage.d.ts.map +1 -1
- package/dist/cognition/emergent/broker/CapabilityBroker.d.ts +58 -0
- package/dist/cognition/emergent/broker/CapabilityBroker.d.ts.map +1 -0
- package/dist/cognition/emergent/broker/CapabilityBroker.js +288 -0
- package/dist/cognition/emergent/broker/CapabilityBroker.js.map +1 -0
- package/dist/cognition/emergent/broker/fetch.d.ts +44 -0
- package/dist/cognition/emergent/broker/fetch.d.ts.map +1 -0
- package/dist/cognition/emergent/broker/fetch.js +197 -0
- package/dist/cognition/emergent/broker/fetch.js.map +1 -0
- package/dist/cognition/emergent/broker/fs-read.d.ts +63 -0
- package/dist/cognition/emergent/broker/fs-read.d.ts.map +1 -0
- package/dist/cognition/emergent/broker/fs-read.js +133 -0
- package/dist/cognition/emergent/broker/fs-read.js.map +1 -0
- package/dist/cognition/emergent/broker/refusal.d.ts +10 -0
- package/dist/cognition/emergent/broker/refusal.d.ts.map +1 -0
- package/dist/cognition/emergent/broker/refusal.js +13 -0
- package/dist/cognition/emergent/broker/refusal.js.map +1 -0
- package/dist/cognition/emergent/ceiling.d.ts +75 -0
- package/dist/cognition/emergent/ceiling.d.ts.map +1 -0
- package/dist/cognition/emergent/ceiling.js +166 -0
- package/dist/cognition/emergent/ceiling.js.map +1 -0
- package/dist/cognition/emergent/index.d.ts +2 -0
- package/dist/cognition/emergent/index.d.ts.map +1 -1
- package/dist/cognition/emergent/index.js +1 -0
- package/dist/cognition/emergent/index.js.map +1 -1
- package/dist/cognition/emergent/types.d.ts +75 -2
- package/dist/cognition/emergent/types.d.ts.map +1 -1
- package/dist/cognition/emergent/types.js.map +1 -1
- package/dist/cognition/substrate/IGMI.d.ts +3 -0
- package/dist/cognition/substrate/IGMI.d.ts.map +1 -1
- package/dist/cognition/substrate/IGMI.js.map +1 -1
- package/dist/core/llm/providers/implementations/OpenRouterProvider.d.ts.map +1 -1
- package/dist/core/llm/providers/implementations/OpenRouterProvider.js +34 -13
- package/dist/core/llm/providers/implementations/OpenRouterProvider.js.map +1 -1
- package/dist/core/tools/ITool.d.ts +45 -0
- package/dist/core/tools/ITool.d.ts.map +1 -1
- package/dist/core/tools/ToolOrchestrator.d.ts.map +1 -1
- package/dist/core/tools/ToolOrchestrator.js +4 -8
- package/dist/core/tools/ToolOrchestrator.js.map +1 -1
- package/dist/io/media/images/imageToBuffer.d.ts.map +1 -1
- package/dist/io/media/images/imageToBuffer.js +6 -4
- package/dist/io/media/images/imageToBuffer.js.map +1 -1
- package/package.json +1 -1
|
@@ -26,17 +26,25 @@
|
|
|
26
26
|
* the sandbox call. For real per-isolate memory limits, an isolated-vm soft
|
|
27
27
|
* dependency would be required (deferred until hosted multi-tenant ships).
|
|
28
28
|
*
|
|
29
|
-
* Allowlisted APIs (each requires explicit opt-in
|
|
29
|
+
* Allowlisted APIs (each requires explicit opt-in; a list may name `fs.read`,
|
|
30
|
+
* the catalogue name, or `fs.readFile`, the function it injects):
|
|
30
31
|
* - `fetch` — HTTP requests; {@link SandboxedToolForgeConfig.fetchDomainAllowlist} checks the first URL's host when set.
|
|
31
32
|
* - `fs.readFile` — Read-only file access, max 1 MB, restricted to the
|
|
32
33
|
* configured roots after symlink resolution (a link inside a root cannot
|
|
33
34
|
* be used to reach a file outside one).
|
|
34
35
|
* - `crypto` — Hashing and HMAC only (`createHash`, `createHmac`).
|
|
36
|
+
*
|
|
37
|
+
* Under a ceiling (`EmergentConfig.capabilities`) the engine attaches a
|
|
38
|
+
* `CapabilityBroker`: the injected functions are then the broker's, scoped
|
|
39
|
+
* by the ceiling and checked per call, and this forge's own
|
|
40
|
+
* `fetchDomainAllowlist` and `fsReadRoots` are not used.
|
|
35
41
|
*/
|
|
36
42
|
import { createHash, createHmac, randomUUID } from 'node:crypto';
|
|
37
43
|
import { readFile, realpath } from 'node:fs/promises';
|
|
38
44
|
import * as path from 'node:path';
|
|
39
45
|
import { CodeSandbox } from '../../safety/sandbox/executor/CodeSandbox.js';
|
|
46
|
+
import { normalizeAllowlist } from './capabilities.js';
|
|
47
|
+
import { ReadRoots, withinRoots } from './broker/fs-read.js';
|
|
40
48
|
/**
|
|
41
49
|
* Sentinel marker prefixed onto the JSON-serialized forge result inside the
|
|
42
50
|
* sandbox's stdout. Lets the caller separate the forge result from any
|
|
@@ -108,57 +116,41 @@ export class SandboxedToolForge {
|
|
|
108
116
|
* defaults (128 MB memory, 5000 ms timeout, no domain restrictions).
|
|
109
117
|
*/
|
|
110
118
|
constructor(config) {
|
|
111
|
-
/**
|
|
112
|
-
* Real path of each configured root, resolved lazily and cached PER ROOT.
|
|
113
|
-
*
|
|
114
|
-
* Both sides of a containment check have to be real paths: a configured
|
|
115
|
-
* root is frequently itself a link (on macOS `/tmp` is a link to
|
|
116
|
-
* `/private/tmp`), so comparing a resolved file against an unresolved root
|
|
117
|
-
* would deny perfectly legitimate reads.
|
|
118
|
-
*
|
|
119
|
-
* Per root, not per set: a set-wide cache that is dropped whenever ANY
|
|
120
|
-
* root fails to resolve would re-resolve the roots that DID succeed, and a
|
|
121
|
-
* root symlink repointed in between would then be followed to its new
|
|
122
|
-
* target — losing the pinning this cache exists to provide.
|
|
123
|
-
*/
|
|
124
|
-
this.realFsReadRootCache = new Map();
|
|
125
119
|
this.memoryMB = config?.memoryMB ?? 128;
|
|
126
120
|
this.timeoutMs = config?.timeoutMs ?? 5000;
|
|
127
121
|
this.fetchDomainAllowlist = (config?.fetchDomainAllowlist ?? []).map((d) => d.toLowerCase());
|
|
128
122
|
this.fsReadRoots = (config?.fsReadRoots ?? [process.cwd()]).map((root) => path.resolve(root));
|
|
123
|
+
this.readRoots = new ReadRoots(this.fsReadRoots);
|
|
129
124
|
this.codeSandbox = new CodeSandbox({ timeoutMs: this.timeoutMs });
|
|
130
125
|
}
|
|
131
|
-
// --------------------------------------------------------------------------
|
|
132
|
-
// PUBLIC: validateCode
|
|
133
|
-
// --------------------------------------------------------------------------
|
|
134
126
|
/**
|
|
135
|
-
*
|
|
136
|
-
*
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
*
|
|
148
|
-
*
|
|
149
|
-
*
|
|
150
|
-
* @param allowlist - The set of APIs the code is permitted to use.
|
|
151
|
-
* @returns An object with `valid: true` if no violations were found, or
|
|
152
|
-
* `valid: false` with a `violations` array describing each flagged pattern.
|
|
127
|
+
* The options this forge runs with, defaults applied. The engine reads them
|
|
128
|
+
* to check a host-built forge against a ceiling.
|
|
129
|
+
*/
|
|
130
|
+
effectiveOptions() {
|
|
131
|
+
return {
|
|
132
|
+
memoryMB: this.memoryMB,
|
|
133
|
+
timeoutMs: this.timeoutMs,
|
|
134
|
+
fetchDomainAllowlist: [...this.fetchDomainAllowlist],
|
|
135
|
+
fsReadRoots: [...this.fsReadRoots],
|
|
136
|
+
};
|
|
137
|
+
}
|
|
138
|
+
/**
|
|
139
|
+
* Under a ceiling the engine attaches its broker: from then on the
|
|
140
|
+
* functions injected into forged code are the broker's, and every
|
|
141
|
+
* execution needs a call handle. A forge serves one broker.
|
|
153
142
|
*
|
|
154
|
-
* @
|
|
155
|
-
* ```ts
|
|
156
|
-
* const forge = new SandboxedToolForge();
|
|
157
|
-
* const result = forge.validateCode('eval("exploit")', []);
|
|
158
|
-
* // result.valid === false
|
|
159
|
-
* // result.violations === ['eval() is forbidden']
|
|
160
|
-
* ```
|
|
143
|
+
* @throws Error when a different broker is already attached.
|
|
161
144
|
*/
|
|
145
|
+
attachBroker(broker) {
|
|
146
|
+
if (this.broker && this.broker !== broker) {
|
|
147
|
+
throw new Error('broker_already_attached: a forge under a ceiling serves one engine');
|
|
148
|
+
}
|
|
149
|
+
this.broker = broker;
|
|
150
|
+
}
|
|
151
|
+
// --------------------------------------------------------------------------
|
|
152
|
+
// PRIVATE: describeSyntaxError
|
|
153
|
+
// --------------------------------------------------------------------------
|
|
162
154
|
/**
|
|
163
155
|
* Translate a raw V8 SyntaxError message into a concrete hint that
|
|
164
156
|
* points the LLM (or the retry loop) at the likely cause. Returns
|
|
@@ -166,34 +158,6 @@ export class SandboxedToolForge {
|
|
|
166
158
|
* the raw message in that case. The hints map to the 4 most common
|
|
167
159
|
* LLM forge mistakes observed in production.
|
|
168
160
|
*/
|
|
169
|
-
resolveReadRoots() {
|
|
170
|
-
return Promise.all(this.fsReadRoots.map((root) => this.resolveReadRoot(root)));
|
|
171
|
-
}
|
|
172
|
-
/**
|
|
173
|
-
* Resolve one configured root, pinning the first success.
|
|
174
|
-
*
|
|
175
|
-
* A resolved root is pinned for the life of the forge, deliberately:
|
|
176
|
-
* re-resolving it per read would let a root symlink be repointed
|
|
177
|
-
* underneath a running sandbox, which is the move this containment check
|
|
178
|
-
* exists to stop. A caller that needs to follow a retargeted root builds a
|
|
179
|
-
* new forge. A FAILED resolution is not pinned, so a root that becomes
|
|
180
|
-
* readable later is picked up — and because each root is cached on its
|
|
181
|
-
* own, one unreadable root can never un-pin a sibling that resolved.
|
|
182
|
-
*/
|
|
183
|
-
resolveReadRoot(root) {
|
|
184
|
-
const cached = this.realFsReadRootCache.get(root);
|
|
185
|
-
if (cached !== undefined)
|
|
186
|
-
return cached;
|
|
187
|
-
const pending = realpath(root).catch(() => {
|
|
188
|
-
// Drop the failure so the next read retries this root. Its lexical
|
|
189
|
-
// form never matches a real path, so an unresolvable root cannot
|
|
190
|
-
// widen the sandbox while it stays unreadable.
|
|
191
|
-
this.realFsReadRootCache.delete(root);
|
|
192
|
-
return root;
|
|
193
|
-
});
|
|
194
|
-
this.realFsReadRootCache.set(root, pending);
|
|
195
|
-
return pending;
|
|
196
|
-
}
|
|
197
161
|
describeSyntaxError(message) {
|
|
198
162
|
const m = message || '';
|
|
199
163
|
if (/Unexpected token 'const'/.test(m) || /Unexpected token 'let'/.test(m)) {
|
|
@@ -218,30 +182,62 @@ export class SandboxedToolForge {
|
|
|
218
182
|
}
|
|
219
183
|
return '';
|
|
220
184
|
}
|
|
185
|
+
// --------------------------------------------------------------------------
|
|
186
|
+
// PUBLIC: validateCode
|
|
187
|
+
// --------------------------------------------------------------------------
|
|
188
|
+
/**
|
|
189
|
+
* Static analysis of code — reject dangerous patterns before execution.
|
|
190
|
+
*
|
|
191
|
+
* Scans the source string for banned API usage patterns using regex
|
|
192
|
+
* matching. The list is read in catalogue names first (`fs.readFile`
|
|
193
|
+
* stands for `fs.read`), so a list naming either one allows `fs.` access.
|
|
194
|
+
*
|
|
195
|
+
* Checked patterns (always banned):
|
|
196
|
+
* - `eval()`, `new Function()`, `require()`, `import`, `process.*`
|
|
197
|
+
* - `child_process`, `fs.write*`, `fs.unlink`, `fs.rm`, `fs.rmdir`
|
|
198
|
+
*
|
|
199
|
+
* Conditionally banned (when the list does not grant them):
|
|
200
|
+
* - `fetch(` — without `fetch`
|
|
201
|
+
* - `fs.*` — without `fs.read` (or its alias `fs.readFile`)
|
|
202
|
+
* - `crypto.*` — without `crypto`
|
|
203
|
+
*
|
|
204
|
+
* @param code - The raw source code string to validate.
|
|
205
|
+
* @param allowlist - The capabilities the code may use, in either name.
|
|
206
|
+
* @returns `valid: true` with no violations, or `valid: false` with a
|
|
207
|
+
* `violations` array describing each flagged pattern.
|
|
208
|
+
*
|
|
209
|
+
* @example
|
|
210
|
+
* ```ts
|
|
211
|
+
* const forge = new SandboxedToolForge();
|
|
212
|
+
* const result = forge.validateCode('eval("exploit")', []);
|
|
213
|
+
* // result.valid === false
|
|
214
|
+
* // result.violations === ['eval() is forbidden']
|
|
215
|
+
* ```
|
|
216
|
+
*/
|
|
221
217
|
validateCode(code, allowlist) {
|
|
222
218
|
const violations = [];
|
|
219
|
+
const granted = normalizeAllowlist(allowlist).capabilities;
|
|
223
220
|
// Check always-banned patterns.
|
|
224
221
|
for (const [pattern, message] of ALWAYS_BANNED) {
|
|
225
222
|
if (pattern.test(code)) {
|
|
226
223
|
violations.push(message);
|
|
227
224
|
}
|
|
228
225
|
}
|
|
229
|
-
// Conditionally ban `fetch(` when not
|
|
230
|
-
if (!
|
|
226
|
+
// Conditionally ban `fetch(` when not granted.
|
|
227
|
+
if (!granted.includes('fetch') && /\bfetch\s*\(/.test(code)) {
|
|
231
228
|
violations.push('fetch() is not in the allowlist');
|
|
232
229
|
}
|
|
233
|
-
//
|
|
234
|
-
//
|
|
235
|
-
|
|
236
|
-
if (!allowlist.includes('fs.readFile') && /\bfs\s*\./.test(code)) {
|
|
230
|
+
// Without fs.read, ban any fs reference (writes, unlinks and removals
|
|
231
|
+
// were caught above).
|
|
232
|
+
if (!granted.includes('fs.read') && /\bfs\s*\./.test(code)) {
|
|
237
233
|
// Only add if we haven't already flagged a more specific fs violation.
|
|
238
234
|
const hasFsViolation = violations.some((v) => v.startsWith('fs.'));
|
|
239
235
|
if (!hasFsViolation) {
|
|
240
236
|
violations.push('fs access is not in the allowlist');
|
|
241
237
|
}
|
|
242
238
|
}
|
|
243
|
-
// Conditionally ban `crypto` when not
|
|
244
|
-
if (!
|
|
239
|
+
// Conditionally ban `crypto` when not granted.
|
|
240
|
+
if (!granted.includes('crypto') && /\bcrypto\s*\./.test(code)) {
|
|
245
241
|
violations.push('crypto access is not in the allowlist');
|
|
246
242
|
}
|
|
247
243
|
return violations.length === 0 ? { valid: true, violations: [] } : { valid: false, violations };
|
|
@@ -286,6 +282,16 @@ export class SandboxedToolForge {
|
|
|
286
282
|
async execute(request) {
|
|
287
283
|
const timeout = request.timeoutMs ?? this.timeoutMs;
|
|
288
284
|
const startTime = performance.now();
|
|
285
|
+
// Under a ceiling every run carries its call handle: the broker keys what
|
|
286
|
+
// is in flight by it and refuses capability calls once it has ended.
|
|
287
|
+
if (this.broker && !request.call) {
|
|
288
|
+
return {
|
|
289
|
+
success: false,
|
|
290
|
+
error: 'call_handle_required: under a ceiling every execution carries a call handle (request.call)',
|
|
291
|
+
executionTimeMs: Math.round(performance.now() - startTime),
|
|
292
|
+
memoryUsedBytes: 0,
|
|
293
|
+
};
|
|
294
|
+
}
|
|
289
295
|
// Step 1: Static validation (regex blocklist).
|
|
290
296
|
const validation = this.validateCode(request.code, request.allowlist);
|
|
291
297
|
if (!validation.valid) {
|
|
@@ -333,10 +339,14 @@ export class SandboxedToolForge {
|
|
|
333
339
|
const __out = await __entry(${JSON.stringify(request.input)});
|
|
334
340
|
return ${JSON.stringify(FORGE_RESULT_MARKER)} + (__out === undefined ? 'undefined' : JSON.stringify(__out));
|
|
335
341
|
`;
|
|
336
|
-
// Step 4:
|
|
337
|
-
//
|
|
338
|
-
//
|
|
339
|
-
|
|
342
|
+
// Step 4: The injected functions, for the list read in catalogue names.
|
|
343
|
+
// Under a ceiling they are the broker's, scoped and checked per call;
|
|
344
|
+
// otherwise this forge's own. CodeSandbox provides the safe builtins and
|
|
345
|
+
// removes the dangerous globals.
|
|
346
|
+
const granted = normalizeAllowlist(request.allowlist).capabilities;
|
|
347
|
+
const extraGlobals = this.broker && request.call
|
|
348
|
+
? this.broker.functionsFor(granted, request.call)
|
|
349
|
+
: this.buildExtraGlobals(granted);
|
|
340
350
|
// Step 5: Heap snapshot before delegation. Best-effort observability
|
|
341
351
|
// (over-approximates because other event-loop activity allocates too).
|
|
342
352
|
// Not preemptive enforcement; node:vm cannot enforce memory limits.
|
|
@@ -398,15 +408,16 @@ export class SandboxedToolForge {
|
|
|
398
408
|
// PRIVATE: buildExtraGlobals
|
|
399
409
|
// --------------------------------------------------------------------------
|
|
400
410
|
/**
|
|
401
|
-
*
|
|
402
|
-
*
|
|
403
|
-
*
|
|
404
|
-
*
|
|
411
|
+
* The legacy path's injected functions (no ceiling), for a list in
|
|
412
|
+
* catalogue names: `fetch` checks only the first URL's host against
|
|
413
|
+
* `fetchDomainAllowlist` and follows redirects; `fs.readFile` reads under
|
|
414
|
+
* `fsReadRoots` with a 1 MB limit; `crypto` is unscoped. CodeSandbox
|
|
415
|
+
* provides JSON/Math/Date/etc. and the removed process/globalThis/require.
|
|
405
416
|
*/
|
|
406
|
-
buildExtraGlobals(
|
|
417
|
+
buildExtraGlobals(granted) {
|
|
407
418
|
/* eslint-disable @typescript-eslint/no-explicit-any */
|
|
408
419
|
const extras = {};
|
|
409
|
-
if (
|
|
420
|
+
if (granted.includes('fetch')) {
|
|
410
421
|
const domainAllowlist = this.fetchDomainAllowlist;
|
|
411
422
|
extras.fetch = async (urlOrRequest, init) => {
|
|
412
423
|
const urlStr = typeof urlOrRequest === 'string' ? urlOrRequest : urlOrRequest.url;
|
|
@@ -418,27 +429,10 @@ export class SandboxedToolForge {
|
|
|
418
429
|
return globalThis.fetch(urlStr, init);
|
|
419
430
|
};
|
|
420
431
|
}
|
|
421
|
-
if (
|
|
432
|
+
if (granted.includes('fs.read')) {
|
|
422
433
|
extras.fs = {
|
|
423
434
|
readFile: async (filePath) => {
|
|
424
435
|
const resolvedPath = path.resolve(filePath);
|
|
425
|
-
// Containment via path.relative, not a string prefix: a root that
|
|
426
|
-
// already ends in a separator (the filesystem root `/`, a Windows
|
|
427
|
-
// drive root `C:\`) would otherwise be compared against a doubled
|
|
428
|
-
// separator and deny every file beneath it. path.relative also
|
|
429
|
-
// applies the platform's own case rules.
|
|
430
|
-
const withinRoots = (candidate, roots) => roots.some((root) => {
|
|
431
|
-
const relative = path.relative(root, candidate);
|
|
432
|
-
// '' means the candidate IS the root. A relative path that
|
|
433
|
-
// climbs out ('..' or '../x') or stays absolute (a different
|
|
434
|
-
// Windows drive) is outside it. Checking for the '..' segment
|
|
435
|
-
// rather than the '..' prefix keeps a sibling named '..foo'
|
|
436
|
-
// from reading as an escape.
|
|
437
|
-
return (relative === '' ||
|
|
438
|
-
(relative !== '..' &&
|
|
439
|
-
!relative.startsWith(`..${path.sep}`) &&
|
|
440
|
-
!path.isAbsolute(relative)));
|
|
441
|
-
});
|
|
442
436
|
// Lexical pass: rejects the obvious `../../etc/passwd` shape before
|
|
443
437
|
// the sandbox pays for any filesystem call.
|
|
444
438
|
if (!withinRoots(resolvedPath, this.fsReadRoots)) {
|
|
@@ -455,7 +449,7 @@ export class SandboxedToolForge {
|
|
|
455
449
|
// filesystem's own error (ENOENT and friends) rather than masking
|
|
456
450
|
// a missing file as a containment failure.
|
|
457
451
|
const realPath = await realpath(resolvedPath);
|
|
458
|
-
if (!withinRoots(realPath, await this.
|
|
452
|
+
if (!withinRoots(realPath, await this.readRoots.real())) {
|
|
459
453
|
throw new Error(`fs.readFile blocked: path "${resolvedPath}" resolves outside the allowed roots`);
|
|
460
454
|
}
|
|
461
455
|
// Read the RESOLVED path, not the caller's string: re-resolving the
|
|
@@ -473,7 +467,7 @@ export class SandboxedToolForge {
|
|
|
473
467
|
},
|
|
474
468
|
};
|
|
475
469
|
}
|
|
476
|
-
if (
|
|
470
|
+
if (granted.includes('crypto')) {
|
|
477
471
|
extras.crypto = {
|
|
478
472
|
randomUUID: () => randomUUID(),
|
|
479
473
|
createHash: (algorithm) => createHash(algorithm),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"SandboxedToolForge.js","sourceRoot":"","sources":["../../../src/cognition/emergent/SandboxedToolForge.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"SandboxedToolForge.js","sourceRoot":"","sources":["../../../src/cognition/emergent/SandboxedToolForge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AA0CnE,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,aAAa,GAAoC;IACrD,CAAC,aAAa,EAAE,qBAAqB,CAAC;IACtC,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;IAC9C,CAAC,uBAAuB,EAAE,6BAA6B,CAAC;IACxD,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;IAC5C,CAAC,aAAa,EAAE,iCAAiC,CAAC;IAClD,CAAC,eAAe,EAAE,+BAA+B,CAAC;IAClD,CAAC,gBAAgB,EAAE,6BAA6B,CAAC;IACjD,CAAC,mBAAmB,EAAE,mCAAmC,CAAC;IAC1D,CAAC,mBAAmB,EAAE,wBAAwB,CAAC;IAC/C,CAAC,oBAAoB,EAAE,wBAAwB,CAAC;IAChD,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAC1C,CAAC,mBAAmB,EAAE,uBAAuB,CAAC;IAC9C,CAAC,wBAAwB,EAAE,4BAA4B,CAAC;IACxD,CAAC,sBAAsB,EAAE,0BAA0B,CAAC;CACrD,CAAC;AAEF,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,OAAO,kBAAkB;IA0B7B;;;;;OAKG;IACH,YAAY,MAAiC;QAC3C,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,GAAG,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;OAGG;IACH,gBAAgB;QACd,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,oBAAoB,EAAE,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC;YACpD,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAwB;QACnC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,6EAA6E;IAC7E,+BAA+B;IAC/B,6EAA6E;IAE7E;;;;;;OAMG;IACK,mBAAmB,CAAC,OAAe;QACzC,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC;QACxB,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,OAAO,CACL,uEAAuE;gBACvE,sGAAsG;gBACtG,gFAAgF;gBAChF,8HAA8H,CAC/H,CAAC;QACJ,CAAC;QACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,OAAO,CACL,oFAAoF;gBACpF,kHAAkH,CACnH,CAAC;QACJ,CAAC;QACD,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,CACL,mIAAmI,CACpI,CAAC;QACJ,CAAC;QACD,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,OAAO,CACL,+DAA+D;gBAC/D,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,OAAO,oFAAoF,CAAC;QAC9F,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,6EAA6E;IAC7E,uBAAuB;IACvB,6EAA6E;IAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,YAAY,CAAC,IAAY,EAAE,SAAmC;QAC5D,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC;QAE3D,gCAAgC;QAChC,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,UAAU,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,sEAAsE;QACtE,sBAAsB;QACtB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,uEAAuE;YACvE,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,UAAU,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,UAAU,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAClG,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,KAAK,CAAC,OAAO,CAAC,OAAgC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACpD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4FAA4F;gBACnG,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAC1D,eAAe,EAAE,CAAC;aACnB,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,2BAA2B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACpE,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAC1D,eAAe,EAAE,CAAC;aACnB,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,uEAAuE;QACvE,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK;gBACnD,qBAAqB;YACvB,CAAC,CAAC,CAAC,WAA8B,CAAC;YAClC,IAAI,iBAAiB,CAAC,uBAAuB,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC3C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,iCAAiC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC9E,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAC1D,eAAe,EAAE,CAAC;aACnB,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,wBAAwB;QACxB,MAAM,WAAW,GAAG;QAChB,OAAO,CAAC,IAAI;;;;;;;;oCAQgB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;eAClD,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;KAC7C,CAAC;QAEF,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,iCAAiC;QACjC,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC;QACnE,MAAM,YAAY,GAChB,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI;YACzB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEtC,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QAElD,0DAA0D;QAC1D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAChD,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE;SAC7C,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACjD,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QAElE,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,IAAI,MAAM,IAAI,0BAA0B,CAAC;YAC3E,MAAM,YAAY,GAChB,UAAU,CAAC,MAAM,KAAK,SAAS;gBAC7B,CAAC,CAAC,6BAA6B,OAAO,IAAI;gBAC1C,CAAC,CAAC,oBAAoB,SAAS,EAAE,CAAC;YACtC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,YAAY;gBACnB,eAAe;gBACf,eAAe;aAChB,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QACpD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,+CAA+C;gBACtD,eAAe;gBACf,eAAe;aAChB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,MAAe,CAAC;QACpB,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM;YACN,eAAe;YACf,eAAe;SAChB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,6BAA6B;IAC7B,6EAA6E;IAE7E;;;;;;OAMG;IACK,iBAAiB,CAAC,OAAkC;QAC1D,uDAAuD;QACvD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC;YAClD,MAAM,CAAC,KAAK,GAAG,KAAK,EAClB,YAAsC,EACtC,IAA8B,EAC9B,EAAE;gBACF,MAAM,MAAM,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC;gBAClF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACxC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,2BAA2B,CAAC,CAAC;gBAC7E,CAAC;gBACD,OAAO,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAW,CAAC,CAAC;YAC/C,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,EAAE,GAAG;gBACV,QAAQ,EAAE,KAAK,EAAE,QAAgB,EAAE,EAAE;oBACnC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBAE5C,oEAAoE;oBACpE,4CAA4C;oBAC5C,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;wBACjD,MAAM,IAAI,KAAK,CACb,8BAA8B,YAAY,gCAAgC,CAC3E,CAAC;oBACJ,CAAC;oBAED,mEAAmE;oBACnE,kEAAkE;oBAClE,iEAAiE;oBACjE,gEAAgE;oBAChE,8CAA8C;oBAC9C,EAAE;oBACF,kEAAkE;oBAClE,mEAAmE;oBACnE,kEAAkE;oBAClE,2CAA2C;oBAC3C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;oBAC9C,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;wBACxD,MAAM,IAAI,KAAK,CACb,8BAA8B,YAAY,sCAAsC,CACjF,CAAC;oBACJ,CAAC;oBAED,oEAAoE;oBACpE,kEAAkE;oBAClE,gEAAgE;oBAChE,kEAAkE;oBAClE,iEAAiE;oBACjE,+DAA+D;oBAC/D,+DAA+D;oBAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACtC,IAAI,IAAI,CAAC,UAAU,GAAG,OAAS,EAAE,CAAC;wBAChC,MAAM,IAAI,KAAK,CACb,iDAAiD,IAAI,CAAC,UAAU,SAAS,CAC1E,CAAC;oBACJ,CAAC;oBACD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAChC,CAAC;aACF,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,MAAM,GAAG;gBACd,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;gBAC9B,UAAU,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBACxD,UAAU,EAAE,CAAC,SAAiB,EAAE,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC;aAC3E,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
|
|
@@ -2,12 +2,12 @@
|
|
|
2
2
|
* @fileoverview Portable export/import helpers for emergent tools.
|
|
3
3
|
* @module @framers/agentos/emergent/ToolPackage
|
|
4
4
|
*/
|
|
5
|
-
import type { EmergentTool, ToolTier, ToolUsageStats, ComposableToolSpec,
|
|
5
|
+
import type { EmergentTool, ToolTier, ToolUsageStats, ComposableToolSpec, AllowlistName, CreationVerdict, PromotionVerdict } from './types.js';
|
|
6
6
|
import type { JSONSchemaObject } from '../../core/tools/ITool.js';
|
|
7
7
|
export declare const EMERGENT_TOOL_PACKAGE_SCHEMA_VERSION: "agentos.emergent-tool.v1";
|
|
8
8
|
export interface PortableSandboxImplementation {
|
|
9
9
|
mode: 'sandbox';
|
|
10
|
-
allowlist:
|
|
10
|
+
allowlist: AllowlistName[];
|
|
11
11
|
sourcePersisted: boolean;
|
|
12
12
|
redactedAtRest: boolean;
|
|
13
13
|
code?: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ToolPackage.d.ts","sourceRoot":"","sources":["../../../src/cognition/emergent/ToolPackage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,QAAQ,EACR,cAAc,EAEd,kBAAkB,EAClB,
|
|
1
|
+
{"version":3,"file":"ToolPackage.d.ts","sourceRoot":"","sources":["../../../src/cognition/emergent/ToolPackage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,QAAQ,EACR,cAAc,EAEd,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAGlE,eAAO,MAAM,oCAAoC,EAAG,0BAAmC,CAAC;AAExF,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,0BAA0B,GAClC,kBAAkB,GAClB,6BAA6B,CAAC;AAElC,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,OAAO,oCAAoC,CAAC;IAC3D,WAAW,EAAE,eAAe,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE;QACX,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,IAAI,EAAE;QACJ,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,QAAQ,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,YAAY,EAAE,gBAAgB,CAAC;QAC/B,cAAc,EAAE,0BAA0B,CAAC;QAC3C,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,KAAK,CAAC,eAAe,GAAG,gBAAgB,CAAC,CAAC;QACzD,UAAU,EAAE,cAAc,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,+BAA+B;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,yCAAyC;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AA2DD,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE,+BAAoC,GAC5C,2BAA2B,CA6B7B;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,2BAA2B,EACrC,MAAM,GAAE,MAAM,GAAG,MAAe,GAC/B,MAAM,CAKR;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,GACV,2BAA2B,CAiB7B;AAED,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,2BAA2B,EACrC,OAAO,EAAE,yCAAyC,GACjD,YAAY,CAkDd"}
|
|
@@ -0,0 +1,58 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* @fileoverview The host-side broker for code-forged tools under a ceiling.
|
|
3
|
+
* It hands each run the functions the run's grant names, scoped by the
|
|
4
|
+
* ceiling. Before every capability call it checks, in this order: the run is
|
|
5
|
+
* live, the capability is in the grant, the target fits the scope. It then
|
|
6
|
+
* writes the intent record, checks the run is still live, performs the call
|
|
7
|
+
* while tracking it under the run's id, and writes the terminal record. When
|
|
8
|
+
* the run ends, `endCall` waits up to {@link CALL_SETTLE_MS} for what is in
|
|
9
|
+
* flight and returns the run's effects. On `node:vm` these checks are a
|
|
10
|
+
* guardrail for code that acts through these functions; Node's documentation
|
|
11
|
+
* says `node:vm` is not a security mechanism.
|
|
12
|
+
* @module @framers/agentos/emergent/broker/CapabilityBroker
|
|
13
|
+
*/
|
|
14
|
+
import type { ToolEffectRecord } from '../../../core/tools/ITool.js';
|
|
15
|
+
import type { ResolvedCeiling } from '../ceiling.js';
|
|
16
|
+
import { type EffectsStore } from '../EffectsStore.js';
|
|
17
|
+
import type { CallHandle, CapabilityName } from '../types.js';
|
|
18
|
+
/** How long a run's end waits for its aborted capability calls to settle. */
|
|
19
|
+
export declare const CALL_SETTLE_MS = 1000;
|
|
20
|
+
export declare class CapabilityBroker {
|
|
21
|
+
readonly ceiling: ResolvedCeiling;
|
|
22
|
+
private readonly store?;
|
|
23
|
+
private readonly readRoots;
|
|
24
|
+
private readonly runs;
|
|
25
|
+
/**
|
|
26
|
+
* @param ceiling - The resolved ceiling the functions are scoped by.
|
|
27
|
+
* @param store - Where effect records go; absent with `audit.store: 'none'`.
|
|
28
|
+
*/
|
|
29
|
+
constructor(ceiling: ResolvedCeiling, store?: EffectsStore | undefined);
|
|
30
|
+
/**
|
|
31
|
+
* The globals injected into one run's sandbox: a function for each
|
|
32
|
+
* capability that both the grant and the ceiling hold, and nothing else.
|
|
33
|
+
* The owner of the run's handle calls {@link endCall} when the run ends.
|
|
34
|
+
*/
|
|
35
|
+
functionsFor(grant: readonly CapabilityName[], call: CallHandle): Record<string, unknown>;
|
|
36
|
+
/**
|
|
37
|
+
* Ends a run: refuses its capability calls from now on (the owner aborts
|
|
38
|
+
* the run's signal too), waits up to `settleMs` for the calls in flight,
|
|
39
|
+
* writes the crypto count, and returns the run's effects. A call that has
|
|
40
|
+
* not settled is listed `pending`, and its record completes when it settles.
|
|
41
|
+
*/
|
|
42
|
+
endCall(callId: string, settleMs?: number): Promise<ToolEffectRecord[]>;
|
|
43
|
+
private ledgerFor;
|
|
44
|
+
/** The run is live and the capability is in its grant and the ceiling. */
|
|
45
|
+
private admit;
|
|
46
|
+
/**
|
|
47
|
+
* One capability call: the checks (a refusal is recorded as one row), then
|
|
48
|
+
* the recorded call, tracked in flight from its intent write to its
|
|
49
|
+
* terminal write, so ending the run waits for both.
|
|
50
|
+
*/
|
|
51
|
+
private perform;
|
|
52
|
+
/** The intent record, the run checked again, the call, and its terminal record. */
|
|
53
|
+
private carryOut;
|
|
54
|
+
private finish;
|
|
55
|
+
private recordRefusal;
|
|
56
|
+
private intentOf;
|
|
57
|
+
}
|
|
58
|
+
//# sourceMappingURL=CapabilityBroker.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"CapabilityBroker.d.ts","sourceRoot":"","sources":["../../../../src/cognition/emergent/broker/CapabilityBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAoB,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAqC,KAAK,YAAY,EAAuB,MAAM,oBAAoB,CAAC;AAC/G,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAK9D,6EAA6E;AAC7E,eAAO,MAAM,cAAc,OAAO,CAAC;AA2BnC,qBAAa,gBAAgB;IASzB,QAAQ,CAAC,OAAO,EAAE,eAAe;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IATzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IAErD;;;OAGG;gBAEQ,OAAO,EAAE,eAAe,EAChB,KAAK,CAAC,EAAE,YAAY,YAAA;IAKvC;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAwDzF;;;;;OAKG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAuB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IA6C7F,OAAO,CAAC,SAAS;IASjB,0EAA0E;IAC1E,OAAO,CAAC,KAAK;IASb;;;;OAIG;YACW,OAAO;IA0CrB,mFAAmF;YACrE,QAAQ;YAsCR,MAAM;YAiBN,aAAa;IA0B3B,OAAO,CAAC,QAAQ;CASjB"}
|