@intutic/gate 2.4.0 → 2.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +13 -0
- package/dist/chaosGate.d.ts +166 -0
- package/dist/chaosGate.d.ts.map +1 -0
- package/dist/chaosGate.js +372 -0
- package/dist/chaosGate.js.map +1 -0
- package/dist/client.d.ts +26 -15
- package/dist/client.d.ts.map +1 -1
- package/dist/client.js +71 -32
- package/dist/client.js.map +1 -1
- package/dist/errors.d.ts +1 -1
- package/dist/errors.d.ts.map +1 -1
- package/dist/errors.js +3 -0
- package/dist/errors.js.map +1 -1
- package/dist/gate.d.ts +46 -2
- package/dist/gate.d.ts.map +1 -1
- package/dist/gate.js +143 -13
- package/dist/gate.js.map +1 -1
- package/dist/harness.d.ts.map +1 -1
- package/dist/harness.js +17 -4
- package/dist/harness.js.map +1 -1
- package/dist/hold.d.ts.map +1 -1
- package/dist/hold.js +5 -2
- package/dist/hold.js.map +1 -1
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/opaqueRefusal.d.ts +40 -0
- package/dist/opaqueRefusal.d.ts.map +1 -0
- package/dist/opaqueRefusal.js +47 -0
- package/dist/opaqueRefusal.js.map +1 -0
- package/dist/snapshot.d.ts +7 -0
- package/dist/snapshot.d.ts.map +1 -1
- package/dist/snapshot.js +12 -0
- package/dist/snapshot.js.map +1 -1
- package/dist/soprules.d.ts +14 -0
- package/dist/soprules.d.ts.map +1 -1
- package/dist/soprules.js +14 -1
- package/dist/soprules.js.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The OPAQUE intervention mode: an agent is refused without being told which
|
|
3
|
+
* rule refused it.
|
|
4
|
+
*
|
|
5
|
+
* A refusal that names its rule, quotes the rule's text, or says which pattern
|
|
6
|
+
* matched teaches an agent the policy, and an agent that knows the policy can
|
|
7
|
+
* route around it. In an OPAQUE workspace every gate that refuses on workspace
|
|
8
|
+
* policy shows the agent {@link OPAQUE_REFUSAL_MESSAGE} instead, through the
|
|
9
|
+
* same refusal contract: the same exit code, HTTP status and refusal code, so
|
|
10
|
+
* harnesses and clients behave exactly as they would in a TRANSPARENT one.
|
|
11
|
+
* Only the text the agent reads changes. Audit records, trace records,
|
|
12
|
+
* `enforcement_log`, detector findings and the dashboard keep the full reason.
|
|
13
|
+
*
|
|
14
|
+
* Refusals that say nothing about the policy are not changed: a call too large
|
|
15
|
+
* to evaluate, a gate past its deadline, an unreadable payload, a crashed gate,
|
|
16
|
+
* a snapshot that failed its integrity check, and a chaos run's injected fault.
|
|
17
|
+
*
|
|
18
|
+
* `@intutic/gate` carries a byte-identical copy of this module
|
|
19
|
+
* (`packages/gate-js/src/opaqueRefusal.ts`); the Rust proxy (`refusal.rs`)
|
|
20
|
+
* and the Python SDK (`intutic_clawde/gate/opaque.py`) mirror the sentence.
|
|
21
|
+
* `refusal-codes.json` carries it as `opaqueMessage`, and
|
|
22
|
+
* `opaqueRefusalParity.test.ts` holds every copy to it. It carries no quote,
|
|
23
|
+
* dollar sign or backtick, so the hook gates can embed it in generated shell
|
|
24
|
+
* inside single quotes.
|
|
25
|
+
*/
|
|
26
|
+
export declare const OPAQUE_REFUSAL_MESSAGE = "Blocked by workspace policy. Ask a workspace admin if you need this action.";
|
|
27
|
+
/**
|
|
28
|
+
* The policy snapshot's record of an OPAQUE workspace: a data line inside the
|
|
29
|
+
* digest, `@intervention_mode<TAB>OPAQUE`, written only when the mode is
|
|
30
|
+
* OPAQUE, so the snapshot of a TRANSPARENT or SILENT_LOG workspace is
|
|
31
|
+
* unchanged. Two columns, so every rule parser skips it.
|
|
32
|
+
*/
|
|
33
|
+
export declare const INTERVENTION_MODE_RECORD_TAG = "@intervention_mode";
|
|
34
|
+
/** Whether a workspace's resolved intervention mode is OPAQUE. Any case. */
|
|
35
|
+
export declare function isOpaqueInterventionMode(mode: unknown): boolean;
|
|
36
|
+
/** The `.rules` line of an OPAQUE workspace. */
|
|
37
|
+
export declare function encodeInterventionModeRecord(): string;
|
|
38
|
+
/** Whether a `.rules` line is the record of an OPAQUE workspace. */
|
|
39
|
+
export declare function isOpaqueInterventionModeRecord(line: string): boolean;
|
|
40
|
+
//# sourceMappingURL=opaqueRefusal.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"opaqueRefusal.d.ts","sourceRoot":"","sources":["../src/opaqueRefusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,sBAAsB,gFAC4C,CAAA;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,uBAAuB,CAAA;AAEhE,4EAA4E;AAC5E,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAE/D;AAED,gDAAgD;AAChD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpE"}
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The OPAQUE intervention mode: an agent is refused without being told which
|
|
3
|
+
* rule refused it.
|
|
4
|
+
*
|
|
5
|
+
* A refusal that names its rule, quotes the rule's text, or says which pattern
|
|
6
|
+
* matched teaches an agent the policy, and an agent that knows the policy can
|
|
7
|
+
* route around it. In an OPAQUE workspace every gate that refuses on workspace
|
|
8
|
+
* policy shows the agent {@link OPAQUE_REFUSAL_MESSAGE} instead, through the
|
|
9
|
+
* same refusal contract: the same exit code, HTTP status and refusal code, so
|
|
10
|
+
* harnesses and clients behave exactly as they would in a TRANSPARENT one.
|
|
11
|
+
* Only the text the agent reads changes. Audit records, trace records,
|
|
12
|
+
* `enforcement_log`, detector findings and the dashboard keep the full reason.
|
|
13
|
+
*
|
|
14
|
+
* Refusals that say nothing about the policy are not changed: a call too large
|
|
15
|
+
* to evaluate, a gate past its deadline, an unreadable payload, a crashed gate,
|
|
16
|
+
* a snapshot that failed its integrity check, and a chaos run's injected fault.
|
|
17
|
+
*
|
|
18
|
+
* `@intutic/gate` carries a byte-identical copy of this module
|
|
19
|
+
* (`packages/gate-js/src/opaqueRefusal.ts`); the Rust proxy (`refusal.rs`)
|
|
20
|
+
* and the Python SDK (`intutic_clawde/gate/opaque.py`) mirror the sentence.
|
|
21
|
+
* `refusal-codes.json` carries it as `opaqueMessage`, and
|
|
22
|
+
* `opaqueRefusalParity.test.ts` holds every copy to it. It carries no quote,
|
|
23
|
+
* dollar sign or backtick, so the hook gates can embed it in generated shell
|
|
24
|
+
* inside single quotes.
|
|
25
|
+
*/
|
|
26
|
+
export const OPAQUE_REFUSAL_MESSAGE = 'Blocked by workspace policy. Ask a workspace admin if you need this action.';
|
|
27
|
+
/**
|
|
28
|
+
* The policy snapshot's record of an OPAQUE workspace: a data line inside the
|
|
29
|
+
* digest, `@intervention_mode<TAB>OPAQUE`, written only when the mode is
|
|
30
|
+
* OPAQUE, so the snapshot of a TRANSPARENT or SILENT_LOG workspace is
|
|
31
|
+
* unchanged. Two columns, so every rule parser skips it.
|
|
32
|
+
*/
|
|
33
|
+
export const INTERVENTION_MODE_RECORD_TAG = '@intervention_mode';
|
|
34
|
+
/** Whether a workspace's resolved intervention mode is OPAQUE. Any case. */
|
|
35
|
+
export function isOpaqueInterventionMode(mode) {
|
|
36
|
+
return typeof mode === 'string' && mode.trim().toUpperCase() === 'OPAQUE';
|
|
37
|
+
}
|
|
38
|
+
/** The `.rules` line of an OPAQUE workspace. */
|
|
39
|
+
export function encodeInterventionModeRecord() {
|
|
40
|
+
return `${INTERVENTION_MODE_RECORD_TAG}\tOPAQUE`;
|
|
41
|
+
}
|
|
42
|
+
/** Whether a `.rules` line is the record of an OPAQUE workspace. */
|
|
43
|
+
export function isOpaqueInterventionModeRecord(line) {
|
|
44
|
+
const [tag, mode, ...rest] = line.split('\t');
|
|
45
|
+
return tag === INTERVENTION_MODE_RECORD_TAG && rest.length === 0 && isOpaqueInterventionMode(mode);
|
|
46
|
+
}
|
|
47
|
+
//# sourceMappingURL=opaqueRefusal.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"opaqueRefusal.js","sourceRoot":"","sources":["../src/opaqueRefusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,6EAA6E,CAAA;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,oBAAoB,CAAA;AAEhE,4EAA4E;AAC5E,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAA;AAC3E,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,4BAA4B;IAC1C,OAAO,GAAG,4BAA4B,UAAU,CAAA;AAClD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,8BAA8B,CAAC,IAAY;IACzD,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC7C,OAAO,GAAG,KAAK,4BAA4B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAA;AACpG,CAAC"}
|
package/dist/snapshot.d.ts
CHANGED
|
@@ -116,6 +116,13 @@ export declare class Snapshot {
|
|
|
116
116
|
* check, as {@link mcpRegistry} is.
|
|
117
117
|
*/
|
|
118
118
|
mcpAllowlist: McpAllowlistRecord | null;
|
|
119
|
+
/**
|
|
120
|
+
* The workspace is OPAQUE (the `@intervention_mode` record): a refusal on
|
|
121
|
+
* workspace policy tells the agent `OPAQUE_REFUSAL_MESSAGE`, not the rule,
|
|
122
|
+
* and the event keeps the rule. Kept on a snapshot that fails its integrity
|
|
123
|
+
* check, since it only ever hides text and never allows a call.
|
|
124
|
+
*/
|
|
125
|
+
opaque: boolean;
|
|
119
126
|
get healthMessage(): string;
|
|
120
127
|
}
|
|
121
128
|
export interface Decision {
|
package/dist/snapshot.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAMH,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAA8C,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAA;
|
|
1
|
+
{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAMH,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAA8C,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAMhG,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C,kEAAkE;AAClE,eAAO,MAAM,UAAU,EAAG,QAAiB,CAAA;AAC3C,eAAO,MAAM,QAAQ,EAAG,MAAe,CAAA;AACvC,eAAO,MAAM,SAAS,EAAG,OAAgB,CAAA;AACzC;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAG,MAAe,CAAA;AAEvC,MAAM,MAAM,QAAQ,GAAG,OAAO,UAAU,GAAG,OAAO,QAAQ,GAAG,OAAO,SAAS,GAAG,OAAO,QAAQ,CAAA;AAC/F;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,CAAA;AACrF,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAA;AAE3E,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,WAAW,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAA;CAC1B;AAED,qBAAa,QAAQ;IACnB,KAAK,EAAE,IAAI,EAAE,CAAK;IAClB,MAAM,SAAS;IACf,KAAK,EAAE,aAAa,CAAW;IAC/B,WAAW,SAAK;IAChB,WAAW,SAAK;IAChB,OAAO,SAAI;IACX,sCAAsC;IACtC,YAAY,SAAI;IAChB;;;;;OAKG;IACH,SAAS,EAAE,cAAc,GAAG,IAAI,CAAO;IACvC;;;;;;OAMG;IACH,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAO;IAC5C;;;;OAIG;IACH,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAO;IAC9C;;;;;OAKG;IACH,MAAM,UAAQ;IAEd,IAAI,aAAa,IAAI,MAAM,CAa1B;CACF;AAED,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,kGAAkG;IAClG,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAMD,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AAYD,wBAAgB,YAAY,CAAC,WAAW,SAAK,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CA2GtE;AAED,qEAAqE;AACrE,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,QAAQ,EACd,aAAa,UAAQ,GACpB,QAAQ,CAiEV;AAED,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C"}
|
package/dist/snapshot.js
CHANGED
|
@@ -56,6 +56,7 @@ import { homedir } from 'node:os';
|
|
|
56
56
|
import { join } from 'node:path';
|
|
57
57
|
import { decodeMcpAllowlistRecord, decodeMcpRegistryRecord, MCP_ALLOWLIST_RECORD_TAG, MCP_REGISTRY_RECORD_TAG, } from './mcpRegistryRecord.js';
|
|
58
58
|
import { decodeSsoGroupRecord, SSO_GROUP_RECORD_TAG } from './ssoGroups.js';
|
|
59
|
+
import { INTERVENTION_MODE_RECORD_TAG, isOpaqueInterventionModeRecord } from './opaqueRefusal.js';
|
|
59
60
|
import { hasPhrase, phraseText } from './phrases.js';
|
|
60
61
|
import { classify } from './actions.js';
|
|
61
62
|
import { compileSequence, sequenceMatch } from './sequence.js';
|
|
@@ -99,6 +100,13 @@ export class Snapshot {
|
|
|
99
100
|
* check, as {@link mcpRegistry} is.
|
|
100
101
|
*/
|
|
101
102
|
mcpAllowlist = null;
|
|
103
|
+
/**
|
|
104
|
+
* The workspace is OPAQUE (the `@intervention_mode` record): a refusal on
|
|
105
|
+
* workspace policy tells the agent `OPAQUE_REFUSAL_MESSAGE`, not the rule,
|
|
106
|
+
* and the event keeps the rule. Kept on a snapshot that fails its integrity
|
|
107
|
+
* check, since it only ever hides text and never allows a call.
|
|
108
|
+
*/
|
|
109
|
+
opaque = false;
|
|
102
110
|
get healthMessage() {
|
|
103
111
|
switch (this.state) {
|
|
104
112
|
case 'absent':
|
|
@@ -168,6 +176,10 @@ export function loadSnapshot(workspaceId = '', path) {
|
|
|
168
176
|
snap.mcpAllowlist = decodeMcpAllowlistRecord(line);
|
|
169
177
|
continue;
|
|
170
178
|
}
|
|
179
|
+
if (line.startsWith(`${INTERVENTION_MODE_RECORD_TAG}\t`)) {
|
|
180
|
+
snap.opaque = isOpaqueInterventionModeRecord(line);
|
|
181
|
+
continue;
|
|
182
|
+
}
|
|
171
183
|
const f = line.split('\t');
|
|
172
184
|
// Column order: id, severity, flags, subject, reason, source(regex), [argPatternB64].
|
|
173
185
|
// Flags: i = case-insensitive, s = a sequence rule.
|
package/dist/snapshot.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,GAGxB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAuB,MAAM,gBAAgB,CAAA;AAChG,OAAO,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAA;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAE1C,kEAAkE;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAiB,CAAA;AAC3C,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAe,CAAA;AACvC,MAAM,CAAC,MAAM,SAAS,GAAG,OAAgB,CAAA;AACzC;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAe,CAAA;AA4BvC,MAAM,OAAO,QAAQ;IACnB,KAAK,GAAW,EAAE,CAAA;IAClB,MAAM,GAAG,MAAM,CAAA;IACf,KAAK,GAAkB,QAAQ,CAAA;IAC/B,WAAW,GAAG,EAAE,CAAA;IAChB,WAAW,GAAG,EAAE,CAAA;IAChB,OAAO,GAAG,CAAC,CAAA;IACX,sCAAsC;IACtC,YAAY,GAAG,CAAC,CAAA;IAChB;;;;;OAKG;IACH,SAAS,GAA0B,IAAI,CAAA;IACvC;;;;;;OAMG;IACH,WAAW,GAA6B,IAAI,CAAA;IAC5C;;;;OAIG;IACH,YAAY,GAA8B,IAAI,CAAA;
|
|
1
|
+
{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,GAGxB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAuB,MAAM,gBAAgB,CAAA;AAChG,OAAO,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AACjG,OAAO,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAA;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAE1C,kEAAkE;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAiB,CAAA;AAC3C,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAe,CAAA;AACvC,MAAM,CAAC,MAAM,SAAS,GAAG,OAAgB,CAAA;AACzC;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAe,CAAA;AA4BvC,MAAM,OAAO,QAAQ;IACnB,KAAK,GAAW,EAAE,CAAA;IAClB,MAAM,GAAG,MAAM,CAAA;IACf,KAAK,GAAkB,QAAQ,CAAA;IAC/B,WAAW,GAAG,EAAE,CAAA;IAChB,WAAW,GAAG,EAAE,CAAA;IAChB,OAAO,GAAG,CAAC,CAAA;IACX,sCAAsC;IACtC,YAAY,GAAG,CAAC,CAAA;IAChB;;;;;OAKG;IACH,SAAS,GAA0B,IAAI,CAAA;IACvC;;;;;;OAMG;IACH,WAAW,GAA6B,IAAI,CAAA;IAC5C;;;;OAIG;IACH,YAAY,GAA8B,IAAI,CAAA;IAC9C;;;;;OAKG;IACH,MAAM,GAAG,KAAK,CAAA;IAEd,IAAI,aAAa;QACf,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,QAAQ;gBACX,OAAO,gDAAgD,CAAA;YACzD,KAAK,SAAS;gBACZ,OAAO,oIAAoI,CAAA;YAC7I,KAAK,OAAO;gBACV,OAAO,kEAAkE,CAAA;YAC3E,KAAK,OAAO;gBACV,OAAO,sBAAsB,IAAI,CAAC,OAAO,8BAA8B,CAAA;YACzE;gBACE,OAAO,EAAE,CAAA;QACb,CAAC;IACH,CAAC;CACF;AAUD,SAAS,KAAK;IACZ,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACnD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAC9D,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpE,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAAW,GAAG,EAAE,EAAE,IAAa;IAC1D,MAAM,CAAC,GAAG,IAAI,IAAI,YAAY,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAA;IAE3B,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA,CAAC,uBAAuB;IACrC,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAClC,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,oBAAoB,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;YAC3C,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,uBAAuB,IAAI,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;YAChD,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,wBAAwB,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,YAAY,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;YAClD,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,4BAA4B,IAAI,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAA;YAClD,SAAQ;QACV,CAAC;QAED,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,sFAAsF;QACtF,oDAAoD;QACpD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,SAAQ;QACnC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBACd,EAAE,EAAE,CAAC,CAAC,CAAC,CAAE;gBACT,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE;gBACf,OAAO,EAAG,CAAC,CAAC,CAAC,CAAiB,IAAI,KAAK;gBACvC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE;gBACb,OAAO,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;aAC/D,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,YAAY,IAAI,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,IAAI,GAAG,IAAI;SACd,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACtC,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACpF,0EAA0E;IAC1E,yCAAyC;IACzC,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAC/F,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;IACxB,CAAC;IAED,4EAA4E;IAC5E,4CAA4C;IAC5C,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAA;IACtB,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAA,CAAC,+DAA+D;QAC/E,2EAA2E;QAC3E,yDAAyD;QACzD,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QACxE,wEAAwE;QACxE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;IAC1B,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAA;YACrE,IAAI,IAAI,CAAC,OAAO,GAAG,yBAAyB,EAAE,CAAC;gBAC7C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAA,CAAC,8CAA8C;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,QAAQ,CACtB,QAAgB,EAChB,MAAc,EACd,OAAe,EACf,IAAc,EACd,aAAa,GAAG,KAAK;IAErB,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IACtB,IAAI,aAAa,EAAE,CAAC;QAClB,sEAAsE;QACtE,uEAAuE;QACvE,uDAAuD;QACvD,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IACjC,IAAI,KAAK,GAAsB,IAAI,CAAA;IACnC,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,OAAO,GAAkB,IAAI,CAAA;IAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC9B,uEAAuE;YACvE,wEAAwE;YACxE,yDAAyD;YACzD,KAAK,KAAK,UAAU,CAAC,OAAO,CAAC,CAAA;YAC7B,MAAM,CAAC,GAAG,KAAK,CAAA;YACf,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBAAE,SAAQ;QAClF,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,KAAK,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;QAChG,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,KAAK,QAAQ;YACvB,CAAC,CAAC,CAAC,QAAQ,CAAC;YACZ,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ;gBACzB,CAAC,CAAC,CAAC,OAAQ,CAAC;gBACZ,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,MAAM;oBACvB,CAAC,CAAC,CAAC,KAAK,CAAC;oBACT,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;wBAC1B,CAAC,CAAC,CAAC,QAAQ,CAAC;wBACZ,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ;4BACzB,CAAC,CAAC,CAAC,OAAO,CAAC;4BACX,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAEjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAE,SAAQ;YAC1H,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;YACzF,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBAChD,OAAO;oBACL,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,UAAU,IAAI,EAAE;oBAClD,MAAM,EAAE,IAAI,CAAC,EAAE;iBAChB,CAAA;YACH,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;YACrE,CAAC;YACD,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;QACxF,CAAC;IACH,CAAC;IAED,OAAO,KAAK,EAAE,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG,CAAA;AAClD,CAAC"}
|
package/dist/soprules.d.ts
CHANGED
|
@@ -66,6 +66,18 @@ export declare function serialiseToolInput(toolInput: Record<string, unknown> |
|
|
|
66
66
|
* assumed.
|
|
67
67
|
*/
|
|
68
68
|
export declare function parseRules(payload: unknown): SopRule[];
|
|
69
|
+
/**
|
|
70
|
+
* The register as `GET /api/v1/sop/rules` answers it: the rules, and whether
|
|
71
|
+
* the workspace's intervention mode is OPAQUE (`interventionMode`, absent from
|
|
72
|
+
* a control plane that predates it, which reads as not OPAQUE). The gate uses
|
|
73
|
+
* the mode when there is no policy snapshot to read it from.
|
|
74
|
+
*/
|
|
75
|
+
export interface SopRegister {
|
|
76
|
+
rules: SopRule[];
|
|
77
|
+
opaque: boolean;
|
|
78
|
+
}
|
|
79
|
+
/** {@link parseRules}, and the `interventionMode` beside them. */
|
|
80
|
+
export declare function parseRegister(payload: unknown): SopRegister;
|
|
69
81
|
/**
|
|
70
82
|
* Fetch active VALIDATED rules, or `null` if they could not be fetched.
|
|
71
83
|
*
|
|
@@ -75,6 +87,8 @@ export declare function parseRules(payload: unknown): SopRule[];
|
|
|
75
87
|
* about policy.
|
|
76
88
|
*/
|
|
77
89
|
export declare function fetchRules(baseUrl: string, apiKey: string, workspaceId: string, timeoutMs?: number): Promise<SopRule[] | null>;
|
|
90
|
+
/** {@link fetchRules} with the workspace's mode: `null` if the register did not answer. */
|
|
91
|
+
export declare function fetchRegister(baseUrl: string, apiKey: string, workspaceId: string, timeoutMs?: number): Promise<SopRegister | null>;
|
|
78
92
|
/**
|
|
79
93
|
* True when the control plane emitted at least one usable `argPattern`.
|
|
80
94
|
*
|
package/dist/soprules.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"soprules.d.ts","sourceRoot":"","sources":["../src/soprules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;
|
|
1
|
+
{"version":3,"file":"soprules.d.ts","sourceRoot":"","sources":["../src/soprules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,eAAO,MAAM,gBAAgB,OAAQ,CAAA;AAIrC,eAAO,MAAM,YAAY,UAAU,CAAA;AACnC,eAAO,MAAM,WAAW,SAAS,CAAA;AACjC,eAAO,MAAM,eAAe,qBAAqB,CAAA;AAGjD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAY3F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAEhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,EAAE,CA8BtD;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,EAAE,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,CAM3D;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,MAAyB,GACnC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAG3B;AAED,2FAA2F;AAC3F,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,MAAyB,GACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAqB7B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAEtE;AAWD,6DAA6D;AAC7D,wBAAgB,UAAU,CACxB,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACpD,OAAO,GAAG,IAAI,CAMhB"}
|
package/dist/soprules.js
CHANGED
|
@@ -34,6 +34,7 @@
|
|
|
34
34
|
* CLOSED. This tier changes where the policy is *authored*, not whether the
|
|
35
35
|
* run is safe.
|
|
36
36
|
*/
|
|
37
|
+
import { isOpaqueInterventionMode } from './opaqueRefusal.js';
|
|
37
38
|
export const FETCH_TIMEOUT_MS = 3_000;
|
|
38
39
|
// Actions the control plane can return. Anything else is ignored rather than
|
|
39
40
|
// guessed at — an unrecognised action must not silently become "allow".
|
|
@@ -112,6 +113,13 @@ export function parseRules(payload) {
|
|
|
112
113
|
}
|
|
113
114
|
return out;
|
|
114
115
|
}
|
|
116
|
+
/** {@link parseRules}, and the `interventionMode` beside them. */
|
|
117
|
+
export function parseRegister(payload) {
|
|
118
|
+
const mode = payload !== null && typeof payload === 'object' && !Array.isArray(payload)
|
|
119
|
+
? payload.interventionMode
|
|
120
|
+
: undefined;
|
|
121
|
+
return { rules: parseRules(payload), opaque: isOpaqueInterventionMode(mode) };
|
|
122
|
+
}
|
|
115
123
|
/**
|
|
116
124
|
* Fetch active VALIDATED rules, or `null` if they could not be fetched.
|
|
117
125
|
*
|
|
@@ -121,6 +129,11 @@ export function parseRules(payload) {
|
|
|
121
129
|
* about policy.
|
|
122
130
|
*/
|
|
123
131
|
export async function fetchRules(baseUrl, apiKey, workspaceId, timeoutMs = FETCH_TIMEOUT_MS) {
|
|
132
|
+
const register = await fetchRegister(baseUrl, apiKey, workspaceId, timeoutMs);
|
|
133
|
+
return register === null ? null : register.rules;
|
|
134
|
+
}
|
|
135
|
+
/** {@link fetchRules} with the workspace's mode: `null` if the register did not answer. */
|
|
136
|
+
export async function fetchRegister(baseUrl, apiKey, workspaceId, timeoutMs = FETCH_TIMEOUT_MS) {
|
|
124
137
|
const qs = new URLSearchParams({ workspaceId, active: 'true' });
|
|
125
138
|
const controller = new AbortController();
|
|
126
139
|
const timer = setTimeout(() => controller.abort(), timeoutMs);
|
|
@@ -136,7 +149,7 @@ export async function fetchRules(baseUrl, apiKey, workspaceId, timeoutMs = FETCH
|
|
|
136
149
|
if (!res.ok)
|
|
137
150
|
return null;
|
|
138
151
|
const raw = await res.text();
|
|
139
|
-
return
|
|
152
|
+
return parseRegister(raw ? JSON.parse(raw) : {});
|
|
140
153
|
}
|
|
141
154
|
catch {
|
|
142
155
|
return null;
|
package/dist/soprules.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"soprules.js","sourceRoot":"","sources":["../src/soprules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAA;AAErC,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAA;AACnC,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAA;AACjC,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAA;AACjD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAA;AAU3E,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,QAAgB,EAAE,aAAqB;IAChF,IAAI,CAAC;QACH,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAA;QAC9D,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACxD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,4BAA4B;QAC5B,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAqD;IACtF,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,IAAI,IAAe,CAAA;IACnB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,IAAI,GAAG,OAAO,CAAA;IAChB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAkC,CAAA;QAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;QAC1D,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,GAAG,GAAc,EAAE,CAAA;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAQ;QACrD,MAAM,CAAC,GAAG,GAA8B,CAAA;QACxC,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,YAAY,CAAA;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QACnD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW;YAAE,SAAQ;QAC7D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAQ;QACxC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAA;QACzC,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YACpC,WAAW;YACX,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,YAAY,WAAW,EAAE,CAAC;YACrD,UAAU,EAAE,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;SACxD,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,MAAc,EACd,WAAmB,EACnB,YAAoB,gBAAgB;IAEpC,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE;YACzF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,gBAAgB,EAAE,WAAW;aAC9B;YACD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC5B,OAAO,
|
|
1
|
+
{"version":3,"file":"soprules.js","sourceRoot":"","sources":["../src/soprules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAA;AAErC,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAA;AACnC,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAA;AACjC,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAA;AACjD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAA;AAU3E,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,QAAgB,EAAE,aAAqB;IAChF,IAAI,CAAC;QACH,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAA;QAC9D,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACxD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,4BAA4B;QAC5B,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAqD;IACtF,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,IAAI,IAAe,CAAA;IACnB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,IAAI,GAAG,OAAO,CAAA;IAChB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAkC,CAAA;QAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;QAC1D,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,GAAG,GAAc,EAAE,CAAA;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAQ;QACrD,MAAM,CAAC,GAAG,GAA8B,CAAA;QACxC,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,YAAY,CAAA;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QACnD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW;YAAE,SAAQ;QAC7D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAQ;QACxC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAA;QACzC,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YACpC,WAAW;YACX,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,YAAY,WAAW,EAAE,CAAC;YACrD,UAAU,EAAE,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;SACxD,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAaD,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,IAAI,GACR,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACxE,CAAC,CAAE,OAAmC,CAAC,gBAAgB;QACvD,CAAC,CAAC,SAAS,CAAA;IACf,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAA;AAC/E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,MAAc,EACd,WAAmB,EACnB,YAAoB,gBAAgB;IAEpC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;IAC7E,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAA;AAClD,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,MAAc,EACd,WAAmB,EACnB,YAAoB,gBAAgB;IAEpC,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE;YACzF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,gBAAgB,EAAE,WAAW;aAC9B;YACD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC5B,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CACxB,KAAyB,EACzB,QAAgB,EAChB,SAAqD;IAErD,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@intutic/gate",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.5.0",
|
|
4
4
|
"description": "Intutic pre-execution tool gate for JS/TS agent frameworks without a shipped Intutic harness (Mastra, the Vercel AI SDK, LangChain.js, dsh, and hand-rolled agent loops)",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|