@jini-ai/core 0.6.21 → 0.6.23

package/CHANGELOG.md

@@ -1,5 +1,15 @@
+## 0.6.23
+
+- Security hardening.
+
 # @jini-ai/core
 
+## 0.6.22
+
+- `UserFacingError` and `formatUserFacingError`; `decodeToolInputObject` and `unwrapToolInputEnvelope` for delegated tool input.
+- Redaction: whole PEM blocks, merged spans, desktop id and path masking; an unquoted URL secret parameter keeps its enclosing quote.
+- `PlanStaleError` carries `code: "PLAN_STALE"`.
+
 ## 0.6.21
 
 - `createPreparedBatchHandler`: prepares a complete direct batch before any effect, reusing the approval handler's input snapshot, cap, duplicate detection and cancellation lifecycle, with no review card.

package/dist/approval.d.ts

@@ -35,6 +35,17 @@ export interface RememberedApprovalPort {
         confirmer: HumanConfirmer;
     }): Promise<void>;
 }
+/** Host-owned view/version snapshot captured before asking, then carried into the approved
+ * effect. The host validates it at the effect boundary; this port grants no authorization. */
+export interface ApprovalContextPort {
+    capture(required: {
+        ctx: ToolExecutionContext;
+    }): Promise<unknown>;
+    prepare(required: {
+        ctx: ToolExecutionContext;
+        snapshot: unknown;
+    }): ToolExecutionContext;
+}
 export interface ApprovalSteps<TPrepared, TDescription> {
     prepare(required: {
         ctx: ToolExecutionContext;
@@ -153,7 +164,10 @@ export declare function createApprovalProposalStore<TDescription>({ responseTool
 };
 /** Apply a host classification through the same handler owner used by domain plans.
  * A host description's string `rememberKey` opts into reusable grants; descriptions remain opaque.
+ * Optional context is captured only for asking actions and prepared only after approval.
  * @returns The registration with one approval handler; authorization policy is preserved.
+ * @complexity O(input bytes) snapshot plus bounded injected ports; no retained cross-call state.
+ * @overallScore 100
  */
 export declare function applyApprovalPolicy<TDescription>({ registration, classify, asks, describe, askHuman, notConfirmed }: {
     registration: ToolRegistration;
@@ -171,5 +185,6 @@ export declare function applyApprovalPolicy<TDescription>({ registration, classi
     notConfirmed: ApprovalSteps<string, TDescription>['notConfirmed'];
 }, optional?: {
     remembered?: RememberedApprovalPort;
+    context?: ApprovalContextPort;
 }): ToolRegistration;
 //# sourceMappingURL=approval.d.ts.map

package/dist/approval.js

@@ -249,20 +249,34 @@ export function createApprovalProposalStore({ responseTool, messages }, { create
 }
 /** Apply a host classification through the same handler owner used by domain plans.
  * A host description's string `rememberKey` opts into reusable grants; descriptions remain opaque.
+ * Optional context is captured only for asking actions and prepared only after approval.
  * @returns The registration with one approval handler; authorization policy is preserved.
+ * @complexity O(input bytes) snapshot plus bounded injected ports; no retained cross-call state.
+ * @overallScore 100
  */
 export function applyApprovalPolicy({ registration, classify, asks, describe, askHuman, notConfirmed }, optional = {}) {
     return { ...registration, handler: createApprovalHandler({
-            prepare: async ({ ctx }) => classify({ input: ctx.input }),
+            prepare: async ({ ctx }) => {
+                const actionClass = classify({ input: ctx.input });
+                const ask = asks({ class: actionClass });
+                if (!ask || !optional.context)
+                    return { actionClass, ask };
+                return { actionClass, ask, snapshot: await optional.context.capture({ ctx }) };
+            },
             describe: async ({ ctx, prepared }) => {
-                const ask = asks({ class: prepared });
-                const description = await describe({ ctx, class: prepared });
+                const description = await describe({ ctx, class: prepared.actionClass });
                 const candidate = { value: description };
-                return { ask, description, ...(isNonArrayRecord(candidate) && typeof candidate.value.rememberKey === 'string'
+                return { ask: prepared.ask, description, ...(isNonArrayRecord(candidate) && typeof candidate.value.rememberKey === 'string'
                         ? { rememberKey: candidate.value.rememberKey } : {}) };
             },
-            askHuman, notConfirmed,
-            run: ({ ctx }, options) => registration.handler(ctx, options),
+            askHuman,
+            notConfirmed: ({ reason, prepared }) => notConfirmed({ reason, prepared: prepared?.actionClass }),
+            run: ({ ctx, prepared }, options) => {
+                if (!prepared.ask || !optional.context)
+                    return registration.handler(ctx, options);
+                const executionContext = optional.context.prepare({ ctx, snapshot: prepared.snapshot });
+                return registration.handler(executionContext, options);
+            },
         }, optional) };
 }
 //# sourceMappingURL=approval.js.map

package/dist/gated-mutations/gateway.d.ts

@@ -62,6 +62,7 @@ export declare class ForbiddenError extends Error {
     }, optional?: ErrorOptions);
 }
 export declare class PlanStaleError extends Error {
+    readonly code = "PLAN_STALE";
     constructor(required: {
         message: string;
     }, optional?: ErrorOptions);

package/dist/gated-mutations/gateway.js

@@ -14,6 +14,7 @@ export class ForbiddenError extends Error {
     }
 }
 export class PlanStaleError extends Error {
+    code = "PLAN_STALE";
     constructor(required, optional = {}) {
         super(required.message, optional);
     }

package/dist/index.d.ts

@@ -7,6 +7,8 @@ export { createDaemon } from './daemon.js';
 export type { PackDisposalFailure } from './pack-lifecycle.js';
 export { disposePacks, registerPackTools } from './pack-lifecycle.js';
 export * from './redact.js';
+export * from './user-facing-error.js';
+export { onTeardown, runTeardownSteps, type TeardownHost, type TeardownStep } from './teardown.js';
 export * from './api-token-auth.js';
 export * from './origin-validation.js';
 export * from './principal.js';
@@ -30,6 +32,7 @@ export * from "./native-regexp.js";
 export { ForbiddenError as ToolPermissionDeniedError, requireToolPermission, adaptLegacyAuthorize, type LegacyToolAuthorizeFn, type AuthorizationPort as ToolPermissionAuthorizationPort, type RequireToolPermissionRequired, type RequireToolPermissionOptional, } from "./tool-permissions.js";
 export { evaluateFeatureFlag, type FeatureFlagDecision } from './feature-flags.js';
 export { normalizeToolInput, withNormalizationNotes, ToolInputNormalizationError, type NormalizedToolInput, type ToolInputNormalizer } from './tool-input-normalization.js';
+export { decodeToolInputObject, unwrapToolInputEnvelope } from './tool-input-envelope.js';
 export { applyBatchInputs, BATCH_GUIDANCE_MARKER, withoutBatchGuidance, batchOutcomeFor, batchDescriptorFor, batchItemRequiredFields, batchEligibilityFor, defaultBatchableTools, withBatchInput, DEFAULT_MAX_BATCH_ITEMS, type BatchableTool, type BatchEligibility, type BatchOptOut, type BatchResult, type BatchItemResult } from './batch-tool-inputs.js';
 export type { MediaProviderCatalogPolicy, MediaProviderOption, ProviderPreset, ProviderPresetKind } from './provider-catalog.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -5,6 +5,8 @@ export * from './bindings.js';
 export { createDaemon } from './daemon.js';
 export { disposePacks, registerPackTools } from './pack-lifecycle.js';
 export * from './redact.js';
+export * from './user-facing-error.js';
+export { onTeardown, runTeardownSteps } from './teardown.js';
 export * from './api-token-auth.js';
 export * from './origin-validation.js';
 export * from './principal.js';
@@ -25,5 +27,6 @@ export * from "./native-regexp.js";
 export { ForbiddenError as ToolPermissionDeniedError, requireToolPermission, adaptLegacyAuthorize, } from "./tool-permissions.js";
 export { evaluateFeatureFlag } from './feature-flags.js';
 export { normalizeToolInput, withNormalizationNotes, ToolInputNormalizationError } from './tool-input-normalization.js';
+export { decodeToolInputObject, unwrapToolInputEnvelope } from './tool-input-envelope.js';
 export { applyBatchInputs, BATCH_GUIDANCE_MARKER, withoutBatchGuidance, batchOutcomeFor, batchDescriptorFor, batchItemRequiredFields, batchEligibilityFor, defaultBatchableTools, withBatchInput, DEFAULT_MAX_BATCH_ITEMS } from './batch-tool-inputs.js';
 //# sourceMappingURL=index.js.map

package/dist/redact.d.ts

@@ -38,6 +38,21 @@ export interface SecretShapePattern {
 }
 export declare const PEM_PATTERN_NAME = "PEM private key block";
 export declare const SECRET_SHAPE_PATTERNS: readonly SecretShapePattern[];
+/**
+ * Suppress PEM bodies across complete, ordered text lines before other redactors run.
+ * @param _required No ambient state; create one instance per framed output stream.
+ * @param _options Reserved optional policy inputs.
+ * @returns A line redactor and an EOF reset. Call reset after flushing the final line so a
+ * replacement child cannot inherit an unterminated block. Does not frame raw chunks or do I/O.
+ * @complexity O(n) per line; O(h) retained state for the open header's key type of length h.
+ * @example const keys = createPrivateKeyLineRedactor({}, {}); keys.redact({ text: line }, {});
+ */
+export declare function createPrivateKeyLineRedactor(_required: Record<string, never>, _options?: {}): {
+    redact(required: {
+        text: string;
+    }, optional?: Record<string, never>): string;
+    reset(required: Record<string, never>, optional?: Record<string, never>): void;
+};
 export declare const AGENT_FAILURE_SECRET_SHAPE_RE: RegExp;
 /**
  * Exact path SEGMENT names refused at any depth, matched case-insensitively against each segment
@@ -69,6 +84,8 @@ export interface SecretRedactionPattern {
     name: string;
     regex: RegExp;
 }
+/** Every marker redact can generate from its built-in categories; consumers normalize only these. */
+export declare const GENERATED_MARKER_RE: RegExp;
 /** Optional caller-owned secrets and named lexical rules, without ambient credential lookup. */
 export interface SecretRedactionOptions {
     /** Diagnostic text can retain addresses/numbers while using the same credential rules. Default true. */
@@ -88,9 +105,11 @@ export declare const NON_SECRET_TOKEN_RE: RegExp;
 /**
  * Returns `input` with every recognised secret / PII pattern replaced by a
  * `[REDACTED:<kind>]` marker. Under the default policies, idempotent — re-running on already redacted
- * text only matches new tokens. Defaults to conservative; `{ policy: 'aggressive' }`
+ * text only matches new tokens. Exact occurrences wholly within credential labels or generated markers preserve that syntax;
+ * crossing occurrences still mask their complete range; all value rules still see the original context. Defaults to conservative; `{ policy: 'aggressive' }`
  * additionally masks bare 20+ character opaque runs. Exact secrets and extra patterns
- * are honored under either heuristic policy. Exact-only replaces only supplied secrets in one pass,
+ * are honored under either heuristic policy.
+ * Exact-only replaces only supplied secrets in one pass,
  * preserves unmatched characters, and inserts the optional literal marker without reprocessing it.
  *
  * Empty / non-string input passes through unchanged so the caller can use
@@ -117,9 +136,17 @@ export declare function formatErrorForLog(required: {
  * caller can attach an audit summary to the trace metadata ('we stripped 2
  * keys + 1 email before send').
  *
- * Exact secrets run first, longest first: lexical rules or a shorter supplied secret must not
- * split a known credential and leave a suffix behind. Opt-in aggressive opaque rules precede
- * PII rules for the same reason (a numeric token can also contain phone/card candidates).
+ * Every rule matches the ORIGINAL input and contributes value spans; overlapping or adjacent
+ * spans merge, and one left-to-right pass writes one marker per merged span. Sequential
+ * substitution passes leaked in every order tried: each pass saw text an earlier pass had
+ * changed. Exact secrets run first split labels (`a` inside `password=hunter2` left `hunter2`) and
+ * lost context (`note password=` left `hunter2`); run last, a lexical rule that stopped partway
+ * (the label rule at whitespace, vendor/query rules at `.`, `;`, `&`, `!` or quotes) left the rest
+ * of a known secret visible; protecting spans exempted secrets overlapping a marker; and
+ * overlapping secrets left a tail behind. Opt-in aggressive opaque
+ * rules are collected before PII rules so a numeric token keeps the opaque category when tied.
+ * @complexity O(n·(r + e) + s + k) for n input chars, r rules, e exact-secret needles, s needle
+ * chars and k spans.
  */
 export declare function redactSecretsWithCounts({ input }: {
     input: string;