@m1a0rz/agent-identity 0.1.8 → 0.2.0

package/dist/src/hooks/before-tool-call.js

@@ -8,10 +8,20 @@
  */
 import { diagnoseRisk } from "../risk/diagnose-risk.js";
 import { isLowRiskTool } from "../risk/low-risk-tools.js";
-import { getTIPToken } from "../store/tip-store.js";
+import * as skillPathStore from "../store/skill-path-store.js";
 import * as toolApprovalStore from "../store/tool-approval-store.js";
+import { getOrRefreshTIPToken } from "../services/tip-with-refresh.js";
 import { supportsSyncApproval } from "../utils/approval-channel.js";
 import { extractDelegationChainFromJwt } from "../utils/auth.js";
+import { logDebug } from "../utils/logger.js";
+function resolveAuthzFlags(authz) {
+    return {
+        toolCheck: authz?.toolCheck ?? false,
+        skillReadCheck: authz?.skillReadCheck ?? false,
+        requireRiskApproval: authz?.requireRiskApproval ?? false,
+        enableLlmRiskCheck: authz?.enableLlmRiskCheck ?? false,
+    };
+}
 function buildApprovalMessage(toolName, params, approvalId, ttlSeconds, riskReason) {
     const preview = toolName === "exec" || toolName === "process"
         ? String(params.command ?? params.cmd ?? params.script ?? "").slice(0, 80)
@@ -21,29 +31,56 @@ function buildApprovalMessage(toolName, params, approvalId, ttlSeconds, riskReas
         : "";
     return `Tool "${toolName}"${preview ? ` (${preview}...)` : ""} requires your approval.${reasonLine}\nReply "approve" or /identity approve ${approvalId}. Expires in ${ttlSeconds}s.`;
 }
+function isSkillReadPath(pathStr) {
+    if (typeof pathStr !== "string")
+        return false;
+    const p = pathStr.trim().replace(/\\/g, "/");
+    return p.endsWith("SKILL.md") || p.endsWith("/SKILL.md");
+}
 export function createBeforeToolCallHandler(deps) {
-    const { storeDir, identityClient, namespaceName = "default", logger, sendToSession, authz, approvalTtlMs, } = deps;
+    const { storeDir, identityClient, namespaceName = "default", logger, sendToSession, authz, approvalTtlMs, identityService, getOidcConfigForRefresh, configWorkloadName, } = deps;
+    const flags = resolveAuthzFlags(authz);
+    const tipRefreshOptions = identityService && getOidcConfigForRefresh
+        ? {
+            identityService,
+            getOidcConfigForRefresh,
+            configWorkloadName,
+            logger,
+        }
+        : undefined;
     const lowRiskBypass = authz?.lowRiskBypass !== false;
-    const requireRiskApproval = authz?.requireRiskApproval !== false;
     const extraLowRisk = authz?.lowRiskTools;
     return async (event, ctx) => {
         const { toolName, params } = event;
         const sessionKey = ctx.sessionKey;
-        logger?.debug?.(`agent-identity: before_tool_call: toolName=${toolName}`);
+        logDebug(logger, `before_tool_call toolName=${toolName}`);
         if (!sessionKey)
             return;
-        if (lowRiskBypass && isLowRiskTool(toolName, extraLowRisk)) {
-            logger?.debug?.(`agent-identity: low-risk bypass for ${toolName}`);
+        const pathStr = params?.path ?? params?.file_path;
+        const isSkillRead = flags.skillReadCheck &&
+            toolName.toLowerCase() === "read" &&
+            isSkillReadPath(pathStr);
+        const skillName = isSkillRead
+            ? skillPathStore.getSkillNameForPath(sessionKey, String(pathStr ?? ""))
+            : undefined;
+        const shouldRunCheckPermission = (flags.toolCheck && !isSkillRead) || (flags.skillReadCheck && isSkillRead && skillName != null);
+        const shouldBypassLowRisk = lowRiskBypass &&
+            isLowRiskTool(toolName, extraLowRisk) &&
+            !(isSkillRead && skillName);
+        if (shouldBypassLowRisk) {
+            logDebug(logger, `low-risk bypass for ${toolName}`);
             return;
         }
-        const tip = await getTIPToken(storeDir, sessionKey);
+        const tip = await getOrRefreshTIPToken(storeDir, sessionKey, tipRefreshOptions
+            ? { ...tipRefreshOptions, ctxAgentId: ctx.agentId }
+            : undefined);
         if (!tip) {
             return {
                 block: true,
                 blockReason: "AuthZ: session has no valid identity (TIP token required)",
             };
         }
-        if (identityClient) {
+        if (shouldRunCheckPermission && identityClient) {
             const chain = extractDelegationChainFromJwt(tip.token);
             if (!chain) {
                 return {
@@ -53,12 +90,14 @@ export function createBeforeToolCallHandler(deps) {
             }
             const principal = { Type: "user", Id: chain.principalId };
             const action = { Type: "Action", Id: "invoke" };
-            const resource = { Type: "tool", Id: toolName };
-            const originalCallers = chain.actors.map((id) => ({
+            const resource = skillName != null
+                ? { Type: "skill", Id: skillName }
+                : { Type: "tool", Id: toolName };
+            const originalCallers = chain.actors.slice().reverse().map((id) => ({
                 Type: "agent",
                 Id: id,
             }));
-            logger?.debug?.(`agent-identity: before_tool_call: checking permission for ${toolName} (sub: ${tip.sub}), originalCallers: ${originalCallers.map((c) => c.Id).join(", ")}`);
+            logDebug(logger, `before_tool_call checking permission for ${resource.Type}:${resource.Id} (sub: ${tip.sub}), originalCallers: ${originalCallers.map((c) => c.Id).join(", ")}`);
             try {
                 const result = await identityClient.checkPermission({
                     namespaceName,
@@ -70,32 +109,37 @@ export function createBeforeToolCallHandler(deps) {
                 if (!result.allowed) {
                     return {
                         block: true,
-                        blockReason: result.message || `AuthZ: CheckPermission denied for tool ${toolName}`,
+                        blockReason: result.message ||
+                            `AuthZ: CheckPermission denied for ${resource.Type} ${resource.Id}`,
                     };
                 }
             }
             catch (err) {
-                logger?.debug?.(`agent-identity: CheckPermission error: ${String(err)}`);
+                logDebug(logger, `CheckPermission error: ${String(err)}`);
                 return {
                     block: true,
                     blockReason: `AuthZ: Failed to verify permission: ${String(err)}`,
                 };
             }
+            if (skillName != null) {
+                logDebug(logger, `skill read allowed for ${skillName}`);
+                return;
+            }
         }
-        if (!requireRiskApproval) {
-            logger?.debug?.(`agent-identity: AuthZ ok for ${toolName} (sub: ${tip.sub})`);
+        if (!flags.requireRiskApproval) {
+            logDebug(logger, `AuthZ ok for ${toolName} (sub: ${tip.sub})`);
             return;
         }
         const paramsRecord = params && typeof params === "object" ? params : {};
-        const llmConfig = authz?.enableLlmRiskCheck && authz?.llmRiskCheck ? authz.llmRiskCheck : undefined;
+        const llmConfig = flags.enableLlmRiskCheck && authz?.llmRiskCheck ? authz.llmRiskCheck : undefined;
         const { risk, reason: riskReason } = await diagnoseRisk(toolName, paramsRecord, llmConfig, logger);
         if (risk !== "high") {
-            logger?.debug?.(`agent-identity: AuthZ ok for ${toolName} (risk=${risk})`);
+            logDebug(logger, `AuthZ ok for ${toolName} (risk=${risk})`);
             return;
         }
         if (toolApprovalStore.hasRecentApproval(sessionKey, toolName, paramsRecord)) {
             toolApprovalStore.consumeApproval(sessionKey, toolName, paramsRecord);
-            logger?.debug?.(`agent-identity: AuthZ ok for ${toolName} (recent approval)`);
+            logDebug(logger, `AuthZ ok for ${toolName} (recent approval)`);
             return;
         }
         const fullHash = toolApprovalStore.hashToolParams(toolName, paramsRecord);
@@ -112,7 +156,7 @@ export function createBeforeToolCallHandler(deps) {
             await sendToSession(sessionKey, buildApprovalMessage(toolName, paramsRecord, approvalId, ttlSeconds, riskReason));
             const approved = await toolApprovalStore.pollForApproval(approvalId, approvalTtlMs);
             if (approved) {
-                logger?.debug?.(`agent-identity: AuthZ ok for ${toolName} (approved via poll)`);
+                logDebug(logger, `AuthZ ok for ${toolName} (approved via poll)`);
                 return;
             }
             return {

package/dist/src/hooks/llm-input.d.ts

@@ -0,0 +1,19 @@
+/**
+ * llm_input hook: parse <available_skills> from system prompt and store
+ * path -> skill name mapping for skill read permission checks in before_tool_call.
+ * Only runs when authz.skillReadCheck is enabled.
+ */
+export type LlmInputHandlerDeps = {
+    enabled: boolean;
+    logger?: {
+        debug?: (msg: string) => void;
+    };
+};
+export declare function createLlmInputHandler(deps: LlmInputHandlerDeps): (event: {
+    systemPrompt?: string;
+}, ctx: {
+    sessionKey?: string;
+    sessionId?: string;
+    workspaceDir?: string;
+}) => void;
+//# sourceMappingURL=llm-input.d.ts.map

package/dist/src/hooks/llm-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-input.d.ts","sourceRoot":"","sources":["../../../src/hooks/llm-input.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC5C,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,IAI3D,OAAO;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EAChC,KAAK;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KACtE,IAAI,CAcR"}

package/dist/src/hooks/llm-input.js

@@ -0,0 +1,20 @@
+/**
+ * llm_input hook: parse <available_skills> from system prompt and store
+ * path -> skill name mapping for skill read permission checks in before_tool_call.
+ * Only runs when authz.skillReadCheck is enabled.
+ */
+import { parseAvailableSkills } from "../utils/parse-available-skills.js";
+import * as skillPathStore from "../store/skill-path-store.js";
+import { logDebug } from "../utils/logger.js";
+export function createLlmInputHandler(deps) {
+    const { enabled, logger } = deps;
+    return (event, ctx) => {
+        if (!enabled || !ctx.sessionKey)
+            return;
+        const pathToName = parseAvailableSkills(event.systemPrompt);
+        if (pathToName.size === 0)
+            return;
+        skillPathStore.setSkillPathsForSession(ctx.sessionKey, pathToName, ctx.workspaceDir, ctx.sessionId);
+        logDebug(logger, `llm_input parsed ${pathToName.size} skill paths for session`);
+    };
+}

package/dist/src/hooks/sessions-send-propagation.d.ts

@@ -6,10 +6,14 @@
  * Copies session (userToken) to target. Only supports params.sessionKey.
  */
 import type { IdentityService } from "../services/identity-service.js";
+import type { OIDCConfigForRefresh } from "../services/session-refresh.js";
 export type SessionsSendPropagationDeps = {
     storeDir: string;
     identityService: IdentityService;
     configWorkloadName?: string;
+    getOidcConfigForRefresh?: () => Promise<OIDCConfigForRefresh>;
+    /** When false, skip TIP/session propagation to subagents. Default: false. */
+    subagentTipPropagation?: boolean;
     logger: {
         info?: (msg: string) => void;
         debug?: (msg: string) => void;

package/dist/src/hooks/sessions-send-propagation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions-send-propagation.d.ts","sourceRoot":"","sources":["../../../src/hooks/sessions-send-propagation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAKvE,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACzE,CAAC;AAEF,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,2BAA2B,IAIlF,OAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EAC5D,KAAK;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAC/D,OAAO,CAAC,IAAI,CAAC,CA4CjB"}
+{"version":3,"file":"sessions-send-propagation.d.ts","sourceRoot":"","sources":["../../../src/hooks/sessions-send-propagation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAK3E,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,6EAA6E;IAC7E,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACzE,CAAC;AAEF,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,2BAA2B,IAWlF,OAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EAC5D,KAAK;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAC/D,OAAO,CAAC,IAAI,CAAC,CAoCjB"}

package/dist/src/hooks/sessions-send-propagation.js

@@ -5,11 +5,11 @@
  * Uses caller's TIP token as JWT input for delegation (user → main → sub).
  * Copies session (userToken) to target. Only supports params.sessionKey.
  */
-import { getSession, setSession } from "../store/session-store.js";
-import { getTIPToken } from "../store/tip-store.js";
-import { fetchAndStoreTIP } from "../services/tip-acquisition.js";
+import { getOrRefreshTIPToken } from "../services/tip-with-refresh.js";
+import { propagateTIPToTarget } from "../services/tip-propagation.js";
+import { logWarn } from "../utils/logger.js";
 export function createSessionsSendPropagationHandler(deps) {
-    const { storeDir, identityService, configWorkloadName, logger } = deps;
+    const { storeDir, identityService, configWorkloadName, getOidcConfigForRefresh, subagentTipPropagation, logger, } = deps;
     return async (event, ctx) => {
         if (event.toolName !== "sessions_send")
             return;
@@ -21,29 +21,26 @@ export function createSessionsSendPropagationHandler(deps) {
             return;
         }
         try {
-            const callerTIP = await getTIPToken(storeDir, callerSessionKey);
-            if (!callerTIP) {
-                logger.debug?.(`agent-identity: sessions_send skip (caller ${callerSessionKey.slice(0, 24)}... has no TIP)`);
-                return;
-            }
-            await fetchAndStoreTIP({
+            await propagateTIPToTarget({
                 storeDir,
-                sessionKey: targetSessionKey,
+                callerSessionKey,
+                targetSessionKey,
                 identityService,
-                jwtForExchange: callerTIP.token,
-                sub: callerTIP.sub,
-                ctxAgentId: ctx.agentId,
                 configWorkloadName,
-                parentSessionKey: callerSessionKey,
+                subagentTipPropagation,
+                ctxAgentId: ctx.agentId,
+                getCallerTIP: () => getOrRefreshTIPToken(storeDir, callerSessionKey, {
+                    identityService,
+                    getOidcConfigForRefresh,
+                    configWorkloadName,
+                    ctxAgentId: ctx.agentId,
+                    logger,
+                }),
+                logger,
             });
-            logger.info?.(`agent-identity: TIP propagated to ${targetSessionKey.slice(0, 24)}... via sessions_send`);
-            const callerSession = await getSession(storeDir, callerSessionKey);
-            if (callerSession) {
-                await setSession(storeDir, targetSessionKey, callerSession);
-            }
         }
         catch (err) {
-            logger.info?.(`agent-identity: sessions_send propagation failed: ${String(err)}`);
+            logWarn(logger, `sessions_send propagation failed: ${String(err)}`);
         }
     };
 }

package/dist/src/hooks/sessions-spawn-propagation.d.ts

@@ -7,16 +7,20 @@
  * Copies session (userToken) to child.
  */
 import type { IdentityService } from "../services/identity-service.js";
+import type { OIDCConfigForRefresh } from "../services/session-refresh.js";
 export type SessionsSpawnPropagationDeps = {
     storeDir: string;
     identityService: IdentityService;
     configWorkloadName?: string;
+    getOidcConfigForRefresh?: () => Promise<OIDCConfigForRefresh>;
+    /** When false, skip TIP/session propagation to subagents. Default: false. */
+    subagentTipPropagation?: boolean;
     logger: {
         info?: (msg: string) => void;
         debug?: (msg: string) => void;
     };
 };
-export declare function createSessionsSpawnPropagationHandler(deps: SessionsSpawnPropagationDeps): (_event: {
+export declare function createSessionsSpawnPropagationHandler(deps: SessionsSpawnPropagationDeps): (event: {
     childSessionKey: string;
     runId: string;
     agentId: string;

package/dist/src/hooks/sessions-spawn-propagation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions-spawn-propagation.d.ts","sourceRoot":"","sources":["../../../src/hooks/sessions-spawn-propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAKvE,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACzE,CAAC;AAEF,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,4BAA4B,IAIpF,QAAQ;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACnE,KAAK;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,KAC9D,OAAO,CAAC,IAAI,CAAC,CAsCjB"}
+{"version":3,"file":"sessions-spawn-propagation.d.ts","sourceRoot":"","sources":["../../../src/hooks/sessions-spawn-propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAK3E,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,6EAA6E;IAC7E,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACzE,CAAC;AAEF,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,4BAA4B,IAWpF,OAAO;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAClE,KAAK;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,KAC9D,OAAO,CAAC,IAAI,CAAC,CA+BjB"}

package/dist/src/hooks/sessions-spawn-propagation.js

@@ -6,40 +6,38 @@
  * Uses requester's TIP token as JWT input for delegation (user → main → sub).
  * Copies session (userToken) to child.
  */
-import { getSession, setSession } from "../store/session-store.js";
-import { getTIPToken } from "../store/tip-store.js";
-import { fetchAndStoreTIP } from "../services/tip-acquisition.js";
+import { getOrRefreshTIPToken } from "../services/tip-with-refresh.js";
+import { propagateTIPToTarget } from "../services/tip-propagation.js";
+import { logWarn } from "../utils/logger.js";
 export function createSessionsSpawnPropagationHandler(deps) {
-    const { storeDir, identityService, configWorkloadName, logger } = deps;
-    return async (_event, ctx) => {
+    const { storeDir, identityService, configWorkloadName, getOidcConfigForRefresh, subagentTipPropagation, logger, } = deps;
+    return async (event, ctx) => {
         const callerSessionKey = ctx.requesterSessionKey;
-        const targetSessionKey = ctx.childSessionKey ?? _event.childSessionKey;
+        const targetSessionKey = ctx.childSessionKey ?? event.childSessionKey;
         if (!callerSessionKey || !targetSessionKey || callerSessionKey === targetSessionKey) {
             return;
         }
         try {
-            const callerTIP = await getTIPToken(storeDir, callerSessionKey);
-            if (!callerTIP) {
-                logger.debug?.(`agent-identity: sessions_spawn skip (requester ${callerSessionKey.slice(0, 24)}... has no TIP)`);
-                return;
-            }
-            await fetchAndStoreTIP({
+            await propagateTIPToTarget({
                 storeDir,
-                sessionKey: targetSessionKey,
+                callerSessionKey,
+                targetSessionKey,
                 identityService,
-                jwtForExchange: callerTIP.token,
-                sub: callerTIP.sub,
                 configWorkloadName,
-                parentSessionKey: callerSessionKey,
+                subagentTipPropagation,
+                ctxAgentId: event.agentId,
+                getCallerTIP: () => getOrRefreshTIPToken(storeDir, callerSessionKey, {
+                    identityService,
+                    getOidcConfigForRefresh,
+                    configWorkloadName,
+                    ctxAgentId: event.agentId,
+                    logger,
+                }),
+                logger,
             });
-            logger.info?.(`agent-identity: TIP propagated to ${targetSessionKey.slice(0, 24)}... via sessions_spawn`);
-            const callerSession = await getSession(storeDir, callerSessionKey);
-            if (callerSession) {
-                await setSession(storeDir, targetSessionKey, callerSession);
-            }
         }
         catch (err) {
-            logger.info?.(`agent-identity: sessions_spawn propagation failed: ${String(err)}`);
+            logWarn(logger, `sessions_spawn propagation failed: ${String(err)}`);
         }
     };
 }

package/dist/src/hooks/subagent-ended-cleanup.d.ts

@@ -9,6 +9,7 @@ export type SubagentEndedCleanupDeps = {
     logger: {
         info?: (msg: string) => void;
         debug?: (msg: string) => void;
+        warn?: (msg: string) => void;
     };
 };
 export declare function createSubagentEndedCleanupHandler(deps: SubagentEndedCleanupDeps): (event: {

package/dist/src/hooks/subagent-ended-cleanup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subagent-ended-cleanup.d.ts","sourceRoot":"","sources":["../../../src/hooks/subagent-ended-cleanup.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACzE,CAAC;AAEF,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,wBAAwB,IAI5E,OAAO;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,KACtD,OAAO,CAAC,IAAI,CAAC,CAkBjB"}
+{"version":3,"file":"subagent-ended-cleanup.d.ts","sourceRoot":"","sources":["../../../src/hooks/subagent-ended-cleanup.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACvG,CAAC;AAEF,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,wBAAwB,IAI5E,OAAO;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,KACtD,OAAO,CAAC,IAAI,CAAC,CAcjB"}

package/dist/src/hooks/subagent-ended-cleanup.js

@@ -6,6 +6,7 @@
  */
 import { deleteSession } from "../store/session-store.js";
 import { deleteTIPToken } from "../store/tip-store.js";
+import { logDebug, logWarn } from "../utils/logger.js";
 export function createSubagentEndedCleanupHandler(deps) {
     const { storeDir, logger } = deps;
     return async (event) => {
@@ -17,10 +18,10 @@ export function createSubagentEndedCleanupHandler(deps) {
         try {
             await deleteTIPToken(storeDir, targetSessionKey);
             await deleteSession(storeDir, targetSessionKey);
-            logger.debug?.(`agent-identity: cleaned up TIP and session for ${targetSessionKey.slice(0, 24)}... on subagent_ended`);
+            logDebug(logger, `cleaned up TIP and session for ${targetSessionKey.slice(0, 24)}... on subagent_ended`);
         }
         catch (err) {
-            logger.info?.(`agent-identity: subagent_ended cleanup failed for ${targetSessionKey.slice(0, 24)}...: ${String(err)}`);
+            logWarn(logger, `subagent_ended cleanup failed for ${targetSessionKey.slice(0, 24)}...: ${String(err)}`);
         }
     };
 }

package/dist/src/risk/classify-risk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classify-risk.d.ts","sourceRoot":"","sources":["../../../src/risk/classify-risk.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AA+BlE;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,cAAc,CAkBhB;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI;IACjC,eAAe,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,CAQA"}
+{"version":3,"file":"classify-risk.d.ts","sourceRoot":"","sources":["../../../src/risk/classify-risk.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AA+BlE;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,cAAc,CAoBhB;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI;IACjC,eAAe,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,CAQA"}

package/dist/src/risk/classify-risk.js

@@ -38,14 +38,16 @@ export function classifyRiskRules(toolName, params) {
         if (isDangerousCommand(cmd)) {
             return { risk: "high", reason: getDangerousCommandReason(cmd) };
         }
+        return { risk: "low" };
     }
     if (normalized === "write" || normalized === "edit" || normalized === "apply_patch") {
         const path = params.path ?? params.target ?? params.filePath ?? "";
         if (containsSensitivePath(path)) {
             return { risk: "high", reason: "Writes to system or sensitive path" };
         }
+        return { risk: "low" };
     }
-    return { risk: "medium" };
+    return { risk: "low" };
 }
 /**
  * Return built-in risk patterns for display (e.g. identity_list_risk_patterns).

package/dist/src/risk/llm-risk-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"llm-risk-check.d.ts","sourceRoot":"","sources":["../../../src/risk/llm-risk-check.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAkDpD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,QAAQ,GAAG,oBAAoB,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AA0CF,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAyJjE;;GAEG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACvE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAmE/B"}
+{"version":3,"file":"llm-risk-check.d.ts","sourceRoot":"","sources":["../../../src/risk/llm-risk-check.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAmDpD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,QAAQ,GAAG,oBAAoB,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AA0CF,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAyJjE;;GAEG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACvE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAiE/B"}

package/dist/src/risk/llm-risk-check.js

@@ -4,6 +4,7 @@
  * Reference: GuardSpine plugin (ollamaGenerate, runCouncilReview).
  */
 import { hashToolParams } from "../store/tool-approval-store.js";
+import { logDebug, logWarn } from "../utils/logger.js";
 /** Max chars for params JSON; critical fields (command, path) get smarter truncation. */
 const PARAMS_MAX_CHARS = 800;
 const CACHE_TTL_MS_DEFAULT = 300_000; // 5 min
@@ -224,7 +225,7 @@ async function callOpenAiCompletions(endpoint, model, messages, apiKey, timeoutM
 export async function evaluateRiskLlm(toolName, params, config, logger) {
     const { endpoint, api = "ollama", model, apiKey, timeoutMs = 10_000, } = config;
     if (!endpoint?.trim() || !model?.trim()) {
-        logger?.warn?.("agent-identity: llmRiskCheck requires endpoint and model");
+        logWarn(logger, "llmRiskCheck requires endpoint and model");
         return null;
     }
     const paramsRecord = params && typeof params === "object" ? params : {};
@@ -234,7 +235,7 @@ export async function evaluateRiskLlm(toolName, params, config, logger) {
         const cacheKey = hashToolParams(toolName, paramsRecord);
         const cached = riskCache.get(cacheKey);
         if (cached && now < cached.expiresAt) {
-            logger?.debug?.(`agent-identity: LLM risk check cache hit for ${toolName}`);
+            logDebug(logger, `LLM risk check cache hit for ${toolName}`);
             return cached.result;
         }
     }
@@ -264,11 +265,11 @@ export async function evaluateRiskLlm(toolName, params, config, logger) {
                 }
             }
         }
-        logger?.debug?.(`agent-identity: LLM risk check for ${toolName} -> ${result?.risk ?? "parse_fail"}`);
+        logDebug(logger, `LLM risk check for ${toolName} -> ${result?.risk ?? "parse_fail"}`);
         return result;
     }
     catch (err) {
-        logger?.warn?.(`agent-identity: LLM risk check failed: ${String(err)}`);
+        logWarn(logger, `LLM risk check failed: ${String(err)}`);
         return null;
     }
 }

package/dist/src/services/tip-propagation.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Shared TIP propagation logic for sessions_send and sessions_spawn.
+ */
+import type { IdentityService } from "./identity-service.js";
+import type { TIPTokenEntry } from "../store/tip-store.js";
+export type PropagateTIPParams = {
+    storeDir: string;
+    callerSessionKey: string;
+    targetSessionKey: string;
+    identityService: IdentityService;
+    configWorkloadName?: string;
+    subagentTipPropagation?: boolean;
+    ctxAgentId?: string;
+    getCallerTIP: () => Promise<TIPTokenEntry | null>;
+    logger: {
+        info?: (msg: string) => void;
+        debug?: (msg: string) => void;
+    };
+};
+/**
+ * Propagate TIP and session from caller to target.
+ * Uses getCallerTIP() to obtain caller's TIP (supports refresh).
+ */
+export declare function propagateTIPToTarget(params: PropagateTIPParams): Promise<void>;
+//# sourceMappingURL=tip-propagation.d.ts.map

package/dist/src/services/tip-propagation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tip-propagation.d.ts","sourceRoot":"","sources":["../../../src/services/tip-propagation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAM3D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAClD,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACzE,CAAC;AAEF;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CpF"}

package/dist/src/services/tip-propagation.js

@@ -0,0 +1,43 @@
+/**
+ * Shared TIP propagation logic for sessions_send and sessions_spawn.
+ */
+import { getSession, setSession } from "../store/session-store.js";
+import { setTIPToken } from "../store/tip-store.js";
+import { logDebug, logInfo } from "../utils/logger.js";
+import { fetchAndStoreTIP } from "./tip-acquisition.js";
+/**
+ * Propagate TIP and session from caller to target.
+ * Uses getCallerTIP() to obtain caller's TIP (supports refresh).
+ */
+export async function propagateTIPToTarget(params) {
+    const { storeDir, callerSessionKey, targetSessionKey, identityService, configWorkloadName, subagentTipPropagation, ctxAgentId, getCallerTIP, logger, } = params;
+    const callerTIP = await getCallerTIP();
+    if (!callerTIP) {
+        logDebug(logger, `propagation skip (caller ${callerSessionKey.slice(0, 24)}... has no TIP)`);
+        return;
+    }
+    if (subagentTipPropagation === true) {
+        await fetchAndStoreTIP({
+            storeDir,
+            sessionKey: targetSessionKey,
+            identityService,
+            jwtForExchange: callerTIP.token,
+            sub: callerTIP.sub,
+            ctxAgentId,
+            configWorkloadName,
+            parentSessionKey: callerSessionKey,
+        });
+        logInfo(logger, `TIP propagated to ${targetSessionKey.slice(0, 24)}...`);
+    }
+    else {
+        await setTIPToken(storeDir, targetSessionKey, {
+            ...callerTIP,
+            ...(callerSessionKey && { parentSessionKey: callerSessionKey }),
+        });
+        logDebug(logger, `TIP passed through to ${targetSessionKey.slice(0, 24)}...`);
+    }
+    const callerSession = await getSession(storeDir, callerSessionKey);
+    if (callerSession) {
+        await setSession(storeDir, targetSessionKey, callerSession);
+    }
+}

package/dist/src/services/tip-with-refresh.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Get TIP token with optional refresh when expired.
+ * When refresh options are provided and TIP is missing/expired, attempts to
+ * fetch TIP from session userToken (and refresh userToken if expired).
+ */
+import type { IdentityService } from "./identity-service.js";
+import type { OIDCConfigForRefresh } from "./session-refresh.js";
+import { getTIPToken } from "../store/tip-store.js";
+export type GetOrRefreshTIPOptions = {
+    identityService: IdentityService;
+    getOidcConfigForRefresh?: () => Promise<OIDCConfigForRefresh>;
+    configWorkloadName?: string;
+    ctxAgentId?: string;
+    logger?: {
+        debug?: (msg: string) => void;
+        info?: (msg: string) => void;
+    };
+};
+/**
+ * Get TIP token for session. If missing or expired and refresh options provided,
+ * attempts to fetch TIP (refreshing userToken if needed).
+ */
+export declare function getOrRefreshTIPToken(storeDir: string, sessionKey: string, options?: GetOrRefreshTIPOptions): Promise<Awaited<ReturnType<typeof getTIPToken>>>;
+//# sourceMappingURL=tip-with-refresh.d.ts.map

package/dist/src/services/tip-with-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tip-with-refresh.d.ts","sourceRoot":"","sources":["../../../src/services/tip-with-refresh.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMpD,MAAM,MAAM,sBAAsB,GAAG;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC1E,CAAC;AAEF;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CA6DlD"}