@m1a0rz/agent-identity 0.3.1 → 0.3.2

package/dist/src/hooks/before-tool-call.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"before-tool-call.d.ts","sourceRoot":"","sources":["../../../src/hooks/before-tool-call.ts"],"names":[],"mappings":"AAgBA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAYhD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,uGAAuG;IACvG,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IACxE,sEAAsE;IACtE,aAAa,CAAC,EAAE,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,oBAAoB;IACpB,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAwCF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,kBAAkB,IA8BhE,OAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EAC5E,KAAK;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAC/D,OAAO,CAAC;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA2L7D"}
+{"version":3,"file":"before-tool-call.d.ts","sourceRoot":"","sources":["../../../src/hooks/before-tool-call.ts"],"names":[],"mappings":"AAgBA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAiBhD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IACxE,aAAa,CAAC,EAAE,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,KAAK,UAAU,GAAG;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAoCF,iBAAe,kBAAkB,CAC/B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CASjC;AAkCD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,kBAAkB,IAsBhE,OAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACjG,KAAK;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAC/D,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA+F9B;AAwJD,2BAA2B;AAC3B,eAAO,MAAM,SAAS;;CAAyB,CAAC"}

package/dist/src/hooks/before-tool-call.js

@@ -17,57 +17,88 @@ import { diagnoseRisk } from "../risk/diagnose-risk.js";
 import { isLowRiskTool } from "../risk/low-risk-tools.js";
 import * as skillPathStore from "../store/skill-path-store.js";
 import * as toolApprovalStore from "../store/tool-approval-store.js";
+import { loadCredentialEnvBindings } from "../store/credential-env-bindings.js";
+import { getCredential, resolveCredentialValue } from "../store/credential-store.js";
+import { applyEnvSnapshot } from "../store/credential-env-snapshot.js";
 import { getOrRefreshTIPToken } from "../services/tip-with-refresh.js";
 import { supportsSyncApproval } from "../utils/approval-channel.js";
 import { extractDelegationChainFromJwt } from "../utils/auth.js";
-import { logDebug } from "../utils/logger.js";
+import { isSubagentSessionKey, isGroupOrChannelSessionKey } from "../utils/derive-session-key.js";
+import { LOG_PREFIX, logDebug, logWarn } from "../utils/logger.js";
 import { getSender, resolveEffectiveSessionKeyForRun } from "../store/group-sender-store.js";
-import { isGroupOrChannelSessionKey } from "../utils/derive-session-key.js";
+// ─── Exempt tools (bypass session + authz entirely) ──────────────────
+const IDENTITY_EXEMPT_TOOLS = new Set([
+    "identity_login",
+    "identity_logout",
+    "identity_whoami",
+    "identity_status",
+    "identity_config_suggest",
+]);
+/** Tools and reads that are exempt from both session validation and authz. */
+function isSessionExempt(toolName, params, sessionKey) {
+    if (IDENTITY_EXEMPT_TOOLS.has(toolName.trim().toLowerCase()))
+        return true;
+    // Identity plugin's own SKILL.md must always be loadable
+    const pathStr = params?.path ?? params?.file_path;
+    return (toolName.toLowerCase() === "read" &&
+        isSkillReadPath(pathStr) &&
+        skillPathStore.getSkillNameForPath(sessionKey, String(pathStr ?? "")) === "identity");
+}
+function isSkillReadPath(pathStr) {
+    if (typeof pathStr !== "string")
+        return false;
+    const p = pathStr.trim().replace(/\\/g, "/");
+    return p.endsWith("SKILL.md") || p.endsWith("/SKILL.md");
+}
+// ─── Helpers ─────────────────────────────────────────────────────────
+async function resolveCredentials(storeDir, effectiveKey) {
+    const bindings = await loadCredentialEnvBindings(storeDir, effectiveKey);
+    const values = {};
+    for (const [provider, envVar] of Object.entries(bindings)) {
+        const cred = await getCredential(storeDir, effectiveKey, provider);
+        const value = cred ? resolveCredentialValue(cred) : undefined;
+        if (value)
+            values[envVar] = value;
+    }
+    return values;
+}
 function resolveAuthzFlags(authz) {
+    const toolCheck = authz?.toolCheck ?? false;
+    const skillReadCheck = authz?.skillReadCheck ?? false;
+    const requireRiskApproval = authz?.requireRiskApproval ?? false;
+    const enableLlmRiskCheck = authz?.enableLlmRiskCheck ?? false;
     return {
-        toolCheck: authz?.toolCheck ?? false,
-        skillReadCheck: authz?.skillReadCheck ?? false,
-        requireRiskApproval: authz?.requireRiskApproval ?? false,
-        enableLlmRiskCheck: authz?.enableLlmRiskCheck ?? false,
+        toolCheck,
+        skillReadCheck,
+        requireRiskApproval,
+        enableLlmRiskCheck,
+        hasAnyAuthz: toolCheck || skillReadCheck || requireRiskApproval,
     };
 }
 function buildApprovalMessage(toolName, params, approvalId, ttlSeconds, riskReason) {
     const preview = toolName === "exec" || toolName === "process"
         ? String(params.command ?? params.cmd ?? params.script ?? "").slice(0, 80)
         : String(params.path ?? params.target ?? "").slice(0, 80);
-    const reasonLine = riskReason && riskReason.trim()
-        ? `\nRisk: ${riskReason.trim()}`
-        : "";
+    const reasonLine = riskReason && riskReason.trim() ? `\nRisk: ${riskReason.trim()}` : "";
     return `Tool "${toolName}"${preview ? ` (${preview}...)` : ""} requires your approval.${reasonLine}\nReply "approve" or /identity approve ${approvalId}. Expires in ${ttlSeconds}s.`;
 }
-function isSkillReadPath(pathStr) {
-    if (typeof pathStr !== "string")
-        return false;
-    const p = pathStr.trim().replace(/\\/g, "/");
-    return p.endsWith("SKILL.md") || p.endsWith("/SKILL.md");
-}
+// ─── Main handler ────────────────────────────────────────────────────
 export function createBeforeToolCallHandler(deps) {
-    const { storeDir, identityClient, namespaceName = "default", logger, sendToSession, authz, approvalTtlMs, identityService, getOidcConfigForRefresh, configWorkloadName, } = deps;
+    const { storeDir, identityClient, namespaceName = "default", logger, sendToSession, authz, approvalTtlMs = 300_000, identityService, getOidcConfigForRefresh, configWorkloadName, } = deps;
     const flags = resolveAuthzFlags(authz);
-    // Pass identityService when available so we can try fetch with session.userToken when TIP is missing/expired.
-    // getOidcConfigForRefresh is only needed for refresh when userToken itself has expired.
     const tipRefreshOptions = identityService
-        ? {
-            identityService,
-            getOidcConfigForRefresh,
-            configWorkloadName,
-            logger,
-        }
+        ? { identityService, getOidcConfigForRefresh, configWorkloadName, logger }
         : undefined;
     const lowRiskBypass = authz?.lowRiskBypass !== false;
     const extraLowRisk = authz?.lowRiskTools;
     return async (event, ctx) => {
         const { toolName, params } = event;
         const sessionKey = ctx.sessionKey;
-        logDebug(logger, `before_tool_call toolName=${toolName}`);
+        logDebug(logger, `before_tool_call tool=${toolName} session=${sessionKey ?? "?"}`);
         if (!sessionKey)
             return;
         const effectiveKey = resolveEffectiveSessionKeyForRun(sessionKey, event.runId);
+        // Phase 1: group sender context
         if (isGroupOrChannelSessionKey(sessionKey)) {
             const groupSender = getSender(sessionKey);
             if (groupSender) {
@@ -83,127 +114,158 @@ export function createBeforeToolCallHandler(deps) {
                 };
             }
         }
-        const pathStr = params?.path ?? params?.file_path;
-        const isSkillRead = flags.skillReadCheck &&
-            toolName.toLowerCase() === "read" &&
-            isSkillReadPath(pathStr);
-        const skillName = isSkillRead
-            ? skillPathStore.getSkillNameForPath(sessionKey, String(pathStr ?? ""))
-            : undefined;
-        const shouldRunCheckPermission = (flags.toolCheck && !isSkillRead) || (flags.skillReadCheck && isSkillRead && skillName != null);
-        const shouldBypassLowRisk = lowRiskBypass &&
-            isLowRiskTool(toolName, extraLowRisk) &&
-            !(isSkillRead && skillName);
-        if (shouldBypassLowRisk) {
-            logDebug(logger, `low-risk bypass for ${toolName}`);
-            return;
-        }
-        const tip = await getOrRefreshTIPToken(storeDir, effectiveKey, tipRefreshOptions
-            ? { ...tipRefreshOptions, ctxAgentId: ctx.agentId }
-            : undefined);
-        if (!tip) {
-            return {
-                block: true,
-                blockReason: "AuthZ: session has no valid identity (TIP token required)",
-            };
-        }
-        if (shouldRunCheckPermission && identityClient) {
-            const chain = extractDelegationChainFromJwt(tip.token);
-            if (!chain) {
+        const exempt = isSessionExempt(toolName, params, sessionKey);
+        // Phase 2a: mandatory session validation (all non-exempt tools)
+        if (!exempt) {
+            const tip = await getOrRefreshTIPToken(storeDir, effectiveKey, tipRefreshOptions ? { ...tipRefreshOptions, ctxAgentId: ctx.agentId } : undefined);
+            if (!tip) {
+                logDebug(logger, `session: no TIP for tool=${toolName} key=${effectiveKey}`);
                 return {
                     block: true,
-                    blockReason: "AuthZ: failed to parse delegation chain from TIP token",
+                    blockReason: `${LOG_PREFIX} session has no valid identity (TIP token required)`,
                 };
             }
-            const principal = { Type: "user", Id: chain.principalId };
-            const action = { Type: "Action", Id: "invoke" };
-            const resource = skillName != null
-                ? { Type: "skill", Id: skillName }
-                : { Type: "tool", Id: toolName };
-            const originalCallers = chain.actors.slice().reverse().map((id) => ({
-                Type: "agent",
-                Id: id,
-            }));
-            logDebug(logger, `before_tool_call checking permission for ${resource.Type}:${resource.Id} (sub: ${tip.sub}), originalCallers: ${originalCallers.map((c) => c.Id).join(", ")}`);
-            try {
-                const result = await identityClient.checkPermission({
-                    namespaceName,
-                    principal,
-                    action,
-                    resource,
-                    originalCallers,
-                });
-                if (!result.allowed) {
-                    return {
-                        block: true,
-                        blockReason: result.message ||
-                            `AuthZ: CheckPermission denied for ${resource.Type} ${resource.Id}`,
-                    };
-                }
-            }
-            catch (err) {
-                logDebug(logger, `CheckPermission error: ${String(err)}`);
-                return {
-                    block: true,
-                    blockReason: `AuthZ: Failed to verify permission: ${String(err)}`,
-                };
-            }
-            if (skillName != null) {
-                logDebug(logger, `skill read allowed for ${skillName}`);
-                return;
+        }
+        // Phase 2b: permission + risk checks (when authz configured, skip exempt)
+        if (flags.hasAnyAuthz && !exempt) {
+            const authzBlock = await runPermissionAndRiskChecks({
+                toolName,
+                params,
+                sessionKey,
+                effectiveKey,
+                agentId: ctx.agentId,
+                flags,
+                storeDir,
+                identityClient,
+                namespaceName,
+                logger,
+                sendToSession,
+                authz,
+                approvalTtlMs,
+                tipRefreshOptions,
+                lowRiskBypass,
+                extraLowRisk,
+            });
+            if (authzBlock) {
+                logDebug(logger, `authz blocked tool=${toolName}: ${authzBlock.blockReason}`);
+                return authzBlock;
             }
         }
-        if (!flags.requireRiskApproval) {
-            logDebug(logger, `AuthZ ok for ${toolName} (sub: ${tip.sub})`);
+        // Phase 3: credential injection (non-subagent only)
+        if (isSubagentSessionKey(sessionKey))
             return;
+        let credentialValues;
+        try {
+            const creds = await resolveCredentials(storeDir, effectiveKey);
+            if (Object.keys(creds).length > 0) {
+                credentialValues = creds;
+            }
         }
-        const paramsRecord = params && typeof params === "object" ? params : {};
-        const llmConfig = flags.enableLlmRiskCheck && authz?.llmRiskCheck ? authz.llmRiskCheck : undefined;
-        const { risk, reason: riskReason } = await diagnoseRisk(toolName, paramsRecord, llmConfig, logger);
-        if (risk !== "high") {
-            logDebug(logger, `AuthZ ok for ${toolName} (risk=${risk})`);
-            return;
+        catch (err) {
+            logWarn(logger, `credential resolve failed for key=${effectiveKey}: ${String(err)}`);
         }
-        if (toolApprovalStore.hasRecentApproval(effectiveKey, toolName, paramsRecord)) {
-            toolApprovalStore.consumeApproval(effectiveKey, toolName, paramsRecord);
-            logDebug(logger, `AuthZ ok for ${toolName} (recent approval)`);
+        if (!credentialValues)
             return;
+        const envKeys = Object.keys(credentialValues);
+        logDebug(logger, `injecting ${envKeys.length} credential(s) [${envKeys.join(", ")}] ` +
+            `for tool=${toolName} run=${event.runId ?? "?"} key=${effectiveKey}`);
+        await applyEnvSnapshot(credentialValues, event.runId, event.toolCallId);
+        return { params: { _credentialContext: { ...credentialValues } } };
+    };
+}
+async function runPermissionAndRiskChecks(c) {
+    const { toolName, params, sessionKey, effectiveKey, flags, logger } = c;
+    // Determine if this is a SKILL.md read that needs skill-level CheckPermission
+    const pathStr = params?.path ?? params?.file_path;
+    const isSkillRead = flags.skillReadCheck &&
+        toolName.toLowerCase() === "read" &&
+        isSkillReadPath(pathStr);
+    const skillName = isSkillRead
+        ? skillPathStore.getSkillNameForPath(sessionKey, String(pathStr ?? ""))
+        : undefined;
+    const needsCheckPermission = (flags.toolCheck && !isSkillRead) ||
+        (flags.skillReadCheck && isSkillRead && skillName != null);
+    // Low-risk tools skip CheckPermission + risk (not skill reads with a known name)
+    if (c.lowRiskBypass && isLowRiskTool(toolName, c.extraLowRisk) && !(isSkillRead && skillName)) {
+        logDebug(logger, `authz: low-risk bypass for ${toolName}`);
+        return undefined;
+    }
+    // TIP is guaranteed by session check; re-fetch is a cheap in-memory cache hit
+    const tip = await getOrRefreshTIPToken(c.storeDir, effectiveKey, c.tipRefreshOptions ? { ...c.tipRefreshOptions, ctxAgentId: c.agentId } : undefined);
+    // CheckPermission (tool or skill resource)
+    if (needsCheckPermission && c.identityClient && tip) {
+        const chain = extractDelegationChainFromJwt(tip.token);
+        if (!chain) {
+            return { block: true, blockReason: `${LOG_PREFIX} failed to parse delegation chain from TIP token` };
         }
-        const fullHash = toolApprovalStore.hashToolParams(toolName, paramsRecord);
-        const approvalId = toolApprovalStore.shortApprovalId(fullHash + effectiveKey + Date.now());
-        const ttlSeconds = Math.floor(approvalTtlMs / 1000);
-        if (supportsSyncApproval(sessionKey) && sendToSession) {
-            toolApprovalStore.createPending({
-                approvalId,
-                sessionKey: effectiveKey,
-                toolName,
-                params: paramsRecord,
-                ttlMs: approvalTtlMs,
+        const resource = skillName != null
+            ? { Type: "skill", Id: skillName }
+            : { Type: "tool", Id: toolName };
+        const originalCallers = chain.actors.slice().reverse().map((id) => ({
+            Type: "agent",
+            Id: id,
+        }));
+        logDebug(logger, `authz: CheckPermission for ${resource.Type}:${resource.Id} (sub: ${tip.sub})`);
+        try {
+            const result = await c.identityClient.checkPermission({
+                namespaceName: c.namespaceName,
+                principal: { Type: "user", Id: chain.principalId },
+                action: { Type: "Action", Id: "invoke" },
+                resource,
+                originalCallers,
             });
-            await sendToSession(sessionKey, buildApprovalMessage(toolName, paramsRecord, approvalId, ttlSeconds, riskReason));
-            const approved = await toolApprovalStore.pollForApproval(approvalId, approvalTtlMs);
-            if (approved) {
-                logDebug(logger, `AuthZ ok for ${toolName} (approved via poll)`);
-                return;
+            if (!result.allowed) {
+                return {
+                    block: true,
+                    blockReason: result.message || `${LOG_PREFIX} CheckPermission denied for ${resource.Type} ${resource.Id}`,
+                };
             }
-            return {
-                block: true,
-                blockReason: riskReason
-                    ? `AuthZ: High-risk tool requires approval. ${riskReason} Approval timed out or rejected.`
-                    : "AuthZ: High-risk tool requires approval. Approval timed out or rejected.",
-            };
         }
-        toolApprovalStore.createPending({
-            approvalId,
-            sessionKey: effectiveKey,
-            toolName,
-            params: paramsRecord,
-            ttlMs: approvalTtlMs,
-        });
-        const reasonSuffix = riskReason ? ` Reason: ${riskReason}.` : "";
+        catch (err) {
+            return { block: true, blockReason: `${LOG_PREFIX} Failed to verify permission: ${String(err)}` };
+        }
+        if (skillName != null)
+            return undefined;
+    }
+    // Risk approval
+    if (!flags.requireRiskApproval)
+        return undefined;
+    const paramsRecord = params && typeof params === "object" ? params : {};
+    const llmConfig = flags.enableLlmRiskCheck && c.authz?.llmRiskCheck ? c.authz.llmRiskCheck : undefined;
+    const { risk, reason: riskReason } = await diagnoseRisk(toolName, paramsRecord, llmConfig, logger);
+    if (risk !== "high")
+        return undefined;
+    if (toolApprovalStore.hasRecentApproval(effectiveKey, toolName, paramsRecord)) {
+        toolApprovalStore.consumeApproval(effectiveKey, toolName, paramsRecord);
+        return undefined;
+    }
+    const fullHash = toolApprovalStore.hashToolParams(toolName, paramsRecord);
+    const approvalId = toolApprovalStore.shortApprovalId(fullHash + effectiveKey + Date.now());
+    const ttlSeconds = Math.floor(c.approvalTtlMs / 1000);
+    toolApprovalStore.createPending({
+        approvalId,
+        sessionKey: effectiveKey,
+        toolName,
+        params: paramsRecord,
+        ttlMs: c.approvalTtlMs,
+    });
+    if (supportsSyncApproval(sessionKey) && c.sendToSession) {
+        await c.sendToSession(sessionKey, buildApprovalMessage(toolName, paramsRecord, approvalId, ttlSeconds, riskReason));
+        const approved = await toolApprovalStore.pollForApproval(approvalId, c.approvalTtlMs);
+        if (approved)
+            return undefined;
         return {
             block: true,
-            blockReason: `AuthZ: High-risk tool requires approval. Run /identity approve ${approvalId}, then retry.${reasonSuffix}`,
+            blockReason: riskReason
+                ? `${LOG_PREFIX} High-risk tool requires approval. ${riskReason} Approval timed out or rejected.`
+                : `${LOG_PREFIX} High-risk tool requires approval. Approval timed out or rejected.`,
         };
+    }
+    const reasonSuffix = riskReason ? ` Reason: ${riskReason}.` : "";
+    return {
+        block: true,
+        blockReason: `${LOG_PREFIX} High-risk tool requires approval. Run /identity approve ${approvalId}, then retry.${reasonSuffix}`,
     };
 }
+/** Exposed for testing. */
+export const __testing = { resolveCredentials };

package/dist/src/hooks/subagent-ended-cleanup.js

@@ -34,7 +34,7 @@ export function createSubagentEndedCleanupHandler(deps) {
         if (!targetSessionKey)
             return;
         try {
-            await deleteTIPToken(storeDir, targetSessionKey);
+            deleteTIPToken(targetSessionKey);
             await deleteSession(storeDir, targetSessionKey);
             logDebug(logger, `cleaned up TIP and session for ${targetSessionKey.slice(0, 24)}... on subagent_ended`);
         }

package/dist/src/risk/low-risk-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"low-risk-tools.d.ts","sourceRoot":"","sources":["../../../src/risk/low-risk-tools.ts"],"names":[],"mappings":"AAqCA,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAQhF"}
+{"version":3,"file":"low-risk-tools.d.ts","sourceRoot":"","sources":["../../../src/risk/low-risk-tools.ts"],"names":[],"mappings":"AAmCA,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAQhF"}

package/dist/src/risk/low-risk-tools.js

@@ -20,8 +20,6 @@ const LOW_RISK_TOOL_NAMES = new Set([
     "memory_search",
     "memory_get",
     "session_status",
-    "identity_whoami",
-    "identity_status",
     "identity_list_tips",
     "identity_list_credentials",
     "identity_config",

package/dist/src/services/tip-acquisition.d.ts

@@ -4,7 +4,6 @@
  */
 import type { IdentityService } from "./identity-service.js";
 export type FetchAndStoreTIPParams = {
-    storeDir: string;
     sessionKey: string;
     identityService: IdentityService;
     jwtForExchange: string;

package/dist/src/services/tip-acquisition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tip-acquisition.d.ts","sourceRoot":"","sources":["../../../src/services/tip-acquisition.ts"],"names":[],"mappings":"AAgBA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAO7D,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BpF"}
+{"version":3,"file":"tip-acquisition.d.ts","sourceRoot":"","sources":["../../../src/services/tip-acquisition.ts"],"names":[],"mappings":"AAgBA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAO7D,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BpF"}

package/dist/src/services/tip-acquisition.js

@@ -16,7 +16,7 @@
 import { setTIPToken } from "../store/tip-store.js";
 import { resolveAgentId, resolveWorkloadNameForSession, } from "../utils/derive-session-key.js";
 export async function fetchAndStoreTIP(params) {
-    const { storeDir, sessionKey, identityService, jwtForExchange, sub, ctxAgentId, configWorkloadName, targetWorkloadSessionKey, parentSessionKey, } = params;
+    const { sessionKey, identityService, jwtForExchange, sub, ctxAgentId, configWorkloadName, targetWorkloadSessionKey, parentSessionKey, } = params;
     const workloadKey = targetWorkloadSessionKey ?? sessionKey;
     const agentId = resolveAgentId({ agentId: ctxAgentId, sessionKey: workloadKey });
     const workloadName = resolveWorkloadNameForSession({
@@ -35,5 +35,5 @@ export async function fetchAndStoreTIP(params) {
         ...(parentSessionKey && { parentSessionKey }),
         issuedAt: Date.now(),
     };
-    await setTIPToken(storeDir, sessionKey, entry);
+    setTIPToken(sessionKey, entry);
 }

package/dist/src/services/tip-propagation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tip-propagation.d.ts","sourceRoot":"","sources":["../../../src/services/tip-propagation.ts"],"names":[],"mappings":"AAgBA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAM3D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAClD,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACzE,CAAC;AAEF;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CpF"}
+{"version":3,"file":"tip-propagation.d.ts","sourceRoot":"","sources":["../../../src/services/tip-propagation.ts"],"names":[],"mappings":"AAgBA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAM3D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAClD,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACzE,CAAC;AAEF;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CpF"}

package/dist/src/services/tip-propagation.js

@@ -30,7 +30,6 @@ export async function propagateTIPToTarget(params) {
     }
     if (subagentTipPropagation === true) {
         await fetchAndStoreTIP({
-            storeDir,
             sessionKey: targetSessionKey,
             identityService,
             jwtForExchange: callerTIP.token,
@@ -42,7 +41,7 @@ export async function propagateTIPToTarget(params) {
         logInfo(logger, `TIP propagated to ${targetSessionKey.slice(0, 24)}...`);
     }
     else {
-        await setTIPToken(storeDir, targetSessionKey, {
+        setTIPToken(targetSessionKey, {
             ...callerTIP,
             ...(callerSessionKey && { parentSessionKey: callerSessionKey }),
         });

package/dist/src/services/tip-with-refresh.d.ts

@@ -20,5 +20,5 @@ export type GetOrRefreshTIPOptions = {
  * Get TIP token for session. If missing or expired and refresh options provided,
  * attempts to fetch TIP (refreshing userToken if needed).
  */
-export declare function getOrRefreshTIPToken(storeDir: string, sessionKey: string, options?: GetOrRefreshTIPOptions): Promise<Awaited<ReturnType<typeof getTIPToken>>>;
+export declare function getOrRefreshTIPToken(storeDir: string, sessionKey: string, options?: GetOrRefreshTIPOptions): Promise<ReturnType<typeof getTIPToken>>;
 //# sourceMappingURL=tip-with-refresh.d.ts.map

package/dist/src/services/tip-with-refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tip-with-refresh.d.ts","sourceRoot":"","sources":["../../../src/services/tip-with-refresh.ts"],"names":[],"mappings":"AAgBA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMpD,MAAM,MAAM,sBAAsB,GAAG;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC1E,CAAC;AAEF;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAgElD"}
+{"version":3,"file":"tip-with-refresh.d.ts","sourceRoot":"","sources":["../../../src/services/tip-with-refresh.ts"],"names":[],"mappings":"AAgBA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMpD,MAAM,MAAM,sBAAsB,GAAG;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC1E,CAAC;AAEF;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CA8DzC"}

package/dist/src/services/tip-with-refresh.js

@@ -24,7 +24,7 @@ import { fetchAndStoreTIP } from "./tip-acquisition.js";
  * attempts to fetch TIP (refreshing userToken if needed).
  */
 export async function getOrRefreshTIPToken(storeDir, sessionKey, options) {
-    const cached = await getTIPToken(storeDir, sessionKey);
+    const cached = getTIPToken(sessionKey);
     if (cached)
         return cached;
     if (!options) {
@@ -36,7 +36,6 @@ export async function getOrRefreshTIPToken(storeDir, sessionKey, options) {
         return null;
     try {
         await fetchAndStoreTIP({
-            storeDir,
             sessionKey,
             identityService,
             jwtForExchange: session.userToken,
@@ -45,7 +44,7 @@ export async function getOrRefreshTIPToken(storeDir, sessionKey, options) {
             configWorkloadName,
         });
         logInfo(logger, `TIP acquired for ${sessionKey.slice(0, 24)}...`);
-        return getTIPToken(storeDir, sessionKey);
+        return getTIPToken(sessionKey);
     }
     catch (err) {
         const canRefresh = isTokenExpiredError(err) && !!getOidcConfigForRefresh && !!session.refreshToken;
@@ -60,7 +59,6 @@ export async function getOrRefreshTIPToken(storeDir, sessionKey, options) {
             return null;
         try {
             await fetchAndStoreTIP({
-                storeDir,
                 sessionKey,
                 identityService,
                 jwtForExchange: refreshed,
@@ -69,7 +67,7 @@ export async function getOrRefreshTIPToken(storeDir, sessionKey, options) {
                 configWorkloadName,
             });
             logInfo(logger, `TIP acquired after refresh for ${sessionKey.slice(0, 24)}...`);
-            return getTIPToken(storeDir, sessionKey);
+            return getTIPToken(sessionKey);
         }
         catch {
             return null;

package/dist/src/store/credential-env-snapshot.d.ts

@@ -0,0 +1,38 @@
+/**
+ * In-memory env snapshot store for per-tool-call credential injection.
+ *
+ * before_tool_call applies a snapshot (saves baseline, sets env);
+ * after_tool_call restores the snapshot (reverts env to baseline).
+ * Keyed by "runId:toolCallId" so concurrent tool calls stay isolated.
+ *
+ * Each env key has its own promise-chain mutex so concurrent tool calls
+ * writing the SAME key are serialized, while calls using different keys
+ * run fully in parallel.
+ */
+type EnvSnapshot = {
+    /** envVar → previous value (undefined = key was absent) */
+    baseline: Map<string, string | undefined>;
+    /** Release functions for per-key locks (call on restore) */
+    releasers: Array<() => void>;
+    createdAt: number;
+};
+export declare function snapshotKey(runId?: string, toolCallId?: string): string;
+export declare function hasSnapshot(runId?: string, toolCallId?: string): boolean;
+/**
+ * Acquire per-key locks, record baseline, then overwrite process.env.
+ * Keys are sorted before acquisition to prevent deadlocks when two
+ * concurrent calls compete for the same set of keys.
+ */
+export declare function applyEnvSnapshot(credentials: Record<string, string>, runId?: string, toolCallId?: string): Promise<void>;
+/**
+ * Revert process.env to baseline values, then release per-key locks
+ * so the next queued tool call for each key can proceed.
+ */
+export declare function restoreEnvSnapshot(runId?: string, toolCallId?: string): void;
+/** Exposed for testing. */
+export declare const __testing: {
+    snapshots: Map<string, EnvSnapshot>;
+    envKeyChains: Map<string, Promise<void>>;
+};
+export {};
+//# sourceMappingURL=credential-env-snapshot.d.ts.map

package/dist/src/store/credential-env-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-env-snapshot.d.ts","sourceRoot":"","sources":["../../../src/store/credential-env-snapshot.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;;GAUG;AAEH,KAAK,WAAW,GAAG;IACjB,2DAA2D;IAC3D,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1C,4DAA4D;IAC5D,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAyBF,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,KAAK,CAAC,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAc5E;AAoBD,2BAA2B;AAC3B,eAAO,MAAM,SAAS;;;CAA8B,CAAC"}