@mcoda/codali 0.1.107 → 0.1.109

package/dist/runcontext/RunContextResolver.d.ts

@@ -0,0 +1,126 @@
+import type { McpServerDefinition } from "../connectors/mcp/McpClient.js";
+import type { HttpConnectorDefinition } from "../connectors/http/HttpToolDefinition.js";
+/**
+ * The one seam through which Codali learns what a request is allowed to touch.
+ *
+ * Codali is meant to serve many products, and a multi-tenant product like
+ * okacam has a different tool set, different credentials, and different limits
+ * for every tenant. So the tool configuration is never read from a file at run
+ * time — it is *resolved* per request.
+ *
+ * A config file is simply one implementation of this interface, used by the
+ * local CLI and single-tenant deployments. An embedded product implements its
+ * own, or passes a `RunContext` directly on the request; either way the host
+ * supplies the context, and Codali never calls back into the product to fetch
+ * it. That callback would create a circular dependency
+ * (product -> codali -> product) plus the caching, invalidation, and
+ * failure-mode machinery that comes with it, and the authenticated host already
+ * holds this data.
+ */
+export interface RunContextRepo {
+    root?: string;
+    repoId?: string;
+}
+export interface RunContextDocdex {
+    baseUrl?: string;
+    apiKey?: string;
+    repoRoot?: string;
+    repoId?: string;
+    allowedOperations?: string[];
+}
+export interface RunContextTenant {
+    id?: string;
+    slug?: string;
+    realm?: string;
+}
+export interface RunContextLimits {
+    maxRounds?: number;
+    maxToolCalls?: number;
+    maxModelCalls?: number;
+    deadlineMs?: number;
+}
+export interface RunContextAgentRoles {
+    /** Routes, plans, assesses completeness, repairs. Runs on every question. */
+    orchestrator?: string;
+    /** Makes the tool calls. Defaults to the orchestrator when unset. */
+    worker?: string;
+    /** Produces multi-source answers. */
+    synthesizer?: string;
+    /** Generates images and other media. */
+    media?: string;
+}
+export interface RunContext {
+    tenant?: RunContextTenant;
+    repo?: RunContextRepo;
+    docdex?: RunContextDocdex;
+    agentRoles?: RunContextAgentRoles;
+    limits?: RunContextLimits;
+    /**
+     * MCP servers this run may connect to.
+     *
+     * Only ever populated from user/host config or a host-supplied context —
+     * never from repository config. See {@link scrubRepoConfig}.
+     */
+    mcpServers?: McpServerDefinition[];
+    /**
+     * Hand-declared HTTP connectors. Same trust rules as MCP servers: trusted
+     * layers only, never repository config.
+     */
+    httpConnectors?: HttpConnectorDefinition[];
+    /** Tool names permitted for this run. Absent means "registry default". */
+    allowedTools?: string[];
+    deniedTools?: string[];
+    /** Non-fatal problems encountered while resolving, surfaced in the trace. */
+    warnings?: string[];
+}
+export interface RunContextResolveInput {
+    workspaceRoot: string;
+    tenant?: RunContextTenant;
+    /** Context supplied directly by an embedding host, taking precedence. */
+    provided?: RunContext;
+}
+export interface RunContextResolver {
+    readonly id: string;
+    resolve(input: RunContextResolveInput): Promise<RunContext>;
+}
+export interface RepoConfigScrubResult {
+    value: Record<string, unknown>;
+    rejectedKeys: string[];
+}
+/**
+ * Strips forbidden keys from a repository config, recording what was dropped.
+ * Rejection is loud rather than silent: the keys land in run warnings so a
+ * repository that tries to widen its own permissions is visible.
+ */
+export declare const scrubRepoConfig: (config: Record<string, unknown>, pathPrefix?: string) => RepoConfigScrubResult;
+/**
+ * Merges a narrower context over a broader one. Allow-lists intersect and
+ * deny-lists union, so a later layer can only ever restrict what an earlier one
+ * permitted — never widen it.
+ */
+export declare const mergeRunContexts: (base: RunContext, override: RunContext) => RunContext;
+export interface LocalConfigResolverOptions {
+    /** Overridden in tests; defaults to `~/.codali`. */
+    userConfigDir?: string;
+}
+/**
+ * Resolves run context from trusted user config, then applies the repository's
+ * narrowing config on top. Used by the CLI and any single-tenant deployment.
+ */
+export declare class LocalConfigRunContextResolver implements RunContextResolver {
+    private readonly options;
+    readonly id = "local_config";
+    constructor(options?: LocalConfigResolverOptions);
+    resolve(input: RunContextResolveInput): Promise<RunContext>;
+}
+/**
+ * Uses context handed over by an embedding host. This is the okacam path: the
+ * product resolves the tenant's tools and credentials from its own database and
+ * passes them on the request.
+ */
+export declare class ProvidedRunContextResolver implements RunContextResolver {
+    readonly id = "provided";
+    resolve(input: RunContextResolveInput): Promise<RunContext>;
+}
+export declare const resolveRunContext: (input: RunContextResolveInput, resolver?: RunContextResolver) => Promise<RunContext>;
+//# sourceMappingURL=RunContextResolver.d.ts.map

package/dist/runcontext/RunContextResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RunContextResolver.d.ts","sourceRoot":"","sources":["../../src/runcontext/RunContextResolver.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAGxF;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACnC;;;OAGG;IACH,cAAc,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAC3C,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,UAAU,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7D;AA2CD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,mBAAe,KACd,qBAoBF,CAAC;AA6OF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,UAAU,EAAE,UAAU,UAAU,KAAG,UAiCzE,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,oDAAoD;IACpD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,YAAW,kBAAkB;IAG1D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,QAAQ,CAAC,EAAE,kBAAkB;gBAEA,OAAO,GAAE,0BAA+B;IAE/D,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC;CA8BlE;AAED;;;;GAIG;AACH,qBAAa,0BAA2B,YAAW,kBAAkB;IACnE,QAAQ,CAAC,EAAE,cAAc;IAEnB,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC;CAYlE;AAED,eAAO,MAAM,iBAAiB,GAC5B,OAAO,sBAAsB,EAC7B,WAAW,kBAAkB,KAC5B,OAAO,CAAC,UAAU,CAKpB,CAAC"}

package/dist/runcontext/RunContextResolver.js

@@ -0,0 +1,389 @@
+import { homedir } from "node:os";
+import path from "node:path";
+import { readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { resolveCredential } from "./CredentialFile.js";
+/**
+ * Keys a repository-level config file is forbidden to set.
+ *
+ * A checked-out repository is untrusted input. If `.codali/config.toml` could
+ * define an MCP server command, a base URL, or a credential reference, then
+ * cloning a repository and running `codali ask` inside it would be enough to
+ * execute an arbitrary binary or redirect traffic to an attacker's endpoint.
+ *
+ * The boundary is therefore: user/host config may define what runs and where
+ * it connects; repository config may only *narrow* what is already permitted,
+ * identify the repository, and set harmless presentation defaults.
+ */
+const REPO_FORBIDDEN_KEYS = new Set([
+    "command",
+    "args",
+    "env",
+    "url",
+    "base_url",
+    "baseurl",
+    "api_key",
+    "apikey",
+    "token",
+    "secret",
+    "credential",
+    "credentials",
+    "password",
+    "headers",
+    // Every reader below accepts both snake_case and camelCase, so both spellings
+    // must be forbidden. Listing only one is a hole, not a style preference.
+    "mcp_servers",
+    "mcpservers",
+    "api_connectors",
+    "apiconnectors",
+    "http_connectors",
+    "httpconnectors",
+    "agents",
+    "agent_roles",
+    "agentroles",
+    "docdex",
+]);
+/**
+ * Strips forbidden keys from a repository config, recording what was dropped.
+ * Rejection is loud rather than silent: the keys land in run warnings so a
+ * repository that tries to widen its own permissions is visible.
+ */
+export const scrubRepoConfig = (config, pathPrefix = "") => {
+    const value = {};
+    const rejectedKeys = [];
+    for (const [key, entry] of Object.entries(config)) {
+        const qualified = pathPrefix ? `${pathPrefix}.${key}` : key;
+        if (REPO_FORBIDDEN_KEYS.has(key.toLowerCase())) {
+            rejectedKeys.push(qualified);
+            continue;
+        }
+        if (entry && typeof entry === "object" && !Array.isArray(entry)) {
+            const nested = scrubRepoConfig(entry, qualified);
+            value[key] = nested.value;
+            rejectedKeys.push(...nested.rejectedKeys);
+            continue;
+        }
+        value[key] = entry;
+    }
+    return { value, rejectedKeys };
+};
+const readJsonFile = async (filePath) => {
+    if (!existsSync(filePath))
+        return undefined;
+    try {
+        const raw = await readFile(filePath, "utf8");
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const asStringArray = (value) => Array.isArray(value)
+    ? value.filter((entry) => typeof entry === "string")
+    : undefined;
+const asString = (value) => typeof value === "string" && value.trim() ? value.trim() : undefined;
+const asNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
+const readAgentRoles = (value) => {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const record = value;
+    const roles = {
+        orchestrator: asString(record.orchestrator),
+        worker: asString(record.worker),
+        synthesizer: asString(record.synthesizer),
+        media: asString(record.media),
+    };
+    return Object.values(roles).some(Boolean) ? roles : undefined;
+};
+const readLimits = (value) => {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const record = value;
+    const limits = {
+        maxRounds: asNumber(record.maxRounds ?? record.max_rounds),
+        maxToolCalls: asNumber(record.maxToolCalls ?? record.max_tool_calls),
+        maxModelCalls: asNumber(record.maxModelCalls ?? record.max_model_calls),
+        deadlineMs: asNumber(record.deadlineMs ?? record.deadline_ms),
+    };
+    return Object.values(limits).some((entry) => entry !== undefined) ? limits : undefined;
+};
+/**
+ * Reads MCP server definitions from a *trusted* config layer. Never called on
+ * repository config: `scrubRepoConfig` removes the keys first.
+ */
+const readMcpServers = (value) => {
+    if (!Array.isArray(value))
+        return undefined;
+    const servers = [];
+    for (const entry of value) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const record = entry;
+        const name = asString(record.name);
+        if (!name)
+            continue;
+        const transport = asString(record.transport) ?? (record.command ? "stdio" : "http");
+        const common = {
+            name,
+            enabled: typeof record.enabled === "boolean" ? record.enabled : undefined,
+            readOnly: record.readOnly === true || record.read_only === true,
+            timeoutMs: asNumber(record.timeoutMs ?? record.timeout_ms),
+            allowTools: asStringArray(record.allowTools ?? record.allow_tools),
+            denyTools: asStringArray(record.denyTools ?? record.deny_tools),
+        };
+        if (transport === "stdio") {
+            const command = asString(record.command);
+            if (!command)
+                continue;
+            servers.push({
+                ...common,
+                transport: "stdio",
+                command,
+                args: asStringArray(record.args),
+                cwd: asString(record.cwd),
+                env: resolveEnvRefs(record.env),
+            });
+            continue;
+        }
+        const url = asString(record.url);
+        if (!url)
+            continue;
+        servers.push({
+            ...common,
+            transport: "http",
+            url,
+            headers: resolveEnvRefs(record.headers),
+        });
+    }
+    return servers.length > 0 ? servers : undefined;
+};
+/**
+ * Reads HTTP connector declarations from a *trusted* config layer. Credentials
+ * are resolved through the same `env:` indirection as MCP servers, so a config
+ * file never has to hold a literal secret.
+ */
+const readHttpConnectors = (value) => {
+    if (!Array.isArray(value))
+        return undefined;
+    const connectors = [];
+    for (const entry of value) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const record = entry;
+        const name = asString(record.name);
+        // Base URLs resolve `env:` references too. A site hostname is not secret,
+        // but keeping every connector detail in one credentials file beats
+        // splitting it across two places for no reason.
+        const baseUrl = resolveEnvRef(record.baseUrl ?? record.base_url);
+        if (!name || !baseUrl || !Array.isArray(record.tools))
+            continue;
+        const tools = record.tools
+            .filter((tool) => Boolean(tool && typeof tool === "object"))
+            .map((tool) => ({
+            id: asString(tool.id) ?? "",
+            description: asString(tool.description) ?? "",
+            method: (asString(tool.method) ?? "GET").toUpperCase(),
+            urlTemplate: asString(tool.urlTemplate ?? tool.url_template) ?? "",
+            inputSchema: tool.inputSchema,
+            responseSelector: asString(tool.responseSelector ?? tool.response_selector),
+            maxResponseChars: asNumber(tool.maxResponseChars ?? tool.max_response_chars),
+        }))
+            .filter((tool) => tool.id && tool.urlTemplate);
+        if (tools.length === 0)
+            continue;
+        const authRecord = record.auth && typeof record.auth === "object"
+            ? record.auth
+            : undefined;
+        connectors.push({
+            name,
+            baseUrl,
+            enabled: typeof record.enabled === "boolean" ? record.enabled : undefined,
+            timeoutMs: asNumber(record.timeoutMs ?? record.timeout_ms),
+            headers: resolveEnvRefs(record.headers),
+            tools,
+            auth: authRecord
+                ? {
+                    type: (asString(authRecord.type) ?? "none"),
+                    token: resolveEnvRef(authRecord.token),
+                    username: resolveEnvRef(authRecord.username),
+                    password: resolveEnvRef(authRecord.password),
+                    headerName: asString(authRecord.headerName ?? authRecord.header_name),
+                    tokenUrl: resolveEnvRef(authRecord.tokenUrl ?? authRecord.token_url),
+                    clientId: resolveEnvRef(authRecord.clientId ?? authRecord.client_id),
+                    refreshToken: resolveEnvRef(authRecord.refreshToken ?? authRecord.refresh_token),
+                    scope: asString(authRecord.scope),
+                }
+                : undefined,
+        });
+    }
+    return connectors.length > 0 ? connectors : undefined;
+};
+/**
+ * Substitutes `env:NAME` references, including when embedded in a larger
+ * string. Header values are the common case — `"Bearer env:GITHUB_TOKEN"` is
+ * what anyone would write, and requiring the reference to sit at the start of
+ * the value would silently transmit the literal text as a credential.
+ *
+ * An unresolvable reference yields `undefined` for the whole value rather than
+ * a half-substituted string: sending `Bearer env:GITHUB_TOKEN` to an API is
+ * worse than sending nothing, because the failure looks like a bad token
+ * instead of a missing one.
+ */
+const ENV_REF_PATTERN = /env:([A-Za-z_][A-Za-z0-9_]*)/g;
+const substituteEnvRefs = (value) => {
+    if (!value.includes("env:"))
+        return value;
+    let missing = false;
+    const output = value.replace(ENV_REF_PATTERN, (_match, name) => {
+        const resolved = resolveCredential(name);
+        if (resolved === undefined) {
+            missing = true;
+            return "";
+        }
+        return resolved;
+    });
+    return missing ? undefined : output;
+};
+const resolveEnvRef = (value) => {
+    if (typeof value !== "string")
+        return undefined;
+    return substituteEnvRefs(value);
+};
+/**
+ * Resolves `env:NAME` references so a config file never has to contain a
+ * literal secret. Local-CLI convenience only: an embedded multi-tenant host
+ * supplies credentials directly and must not be able to name host env vars.
+ */
+const resolveEnvRefs = (value) => {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const output = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (typeof entry !== "string")
+            continue;
+        // Resolved from the process environment first, then ~/.codali/.creds.
+        const resolved = substituteEnvRefs(entry);
+        if (resolved !== undefined)
+            output[key] = resolved;
+    }
+    return Object.keys(output).length > 0 ? output : undefined;
+};
+const contextFromConfig = (config) => ({
+    agentRoles: readAgentRoles(config.agents ?? config.agent_roles),
+    mcpServers: readMcpServers(config.mcpServers ?? config.mcp_servers),
+    httpConnectors: readHttpConnectors(config.httpConnectors ?? config.http_connectors),
+    limits: readLimits(config.limits),
+    allowedTools: asStringArray(config.allowedTools ?? config.allowed_tools),
+    deniedTools: asStringArray(config.deniedTools ?? config.denied_tools),
+    docdex: (() => {
+        const raw = config.docdex;
+        if (!raw || typeof raw !== "object")
+            return undefined;
+        const record = raw;
+        return {
+            baseUrl: asString(record.baseUrl ?? record.base_url),
+            apiKey: asString(record.apiKey ?? record.api_key),
+            repoRoot: asString(record.repoRoot ?? record.repo_root),
+            repoId: asString(record.repoId ?? record.repo_id),
+            allowedOperations: asStringArray(record.allowedOperations ?? record.allowed_operations),
+        };
+    })(),
+});
+/**
+ * Merges a narrower context over a broader one. Allow-lists intersect and
+ * deny-lists union, so a later layer can only ever restrict what an earlier one
+ * permitted — never widen it.
+ */
+export const mergeRunContexts = (base, override) => {
+    const allowedTools = base.allowedTools && override.allowedTools
+        ? base.allowedTools.filter((tool) => override.allowedTools?.includes(tool))
+        : (override.allowedTools ?? base.allowedTools);
+    const deniedTools = [
+        ...new Set([...(base.deniedTools ?? []), ...(override.deniedTools ?? [])]),
+    ];
+    const minDefined = (a, b) => {
+        if (a === undefined)
+            return b;
+        if (b === undefined)
+            return a;
+        return Math.min(a, b);
+    };
+    return {
+        tenant: override.tenant ?? base.tenant,
+        repo: { ...base.repo, ...override.repo },
+        // Servers come from a trusted layer only; a narrower layer cannot add one.
+        mcpServers: override.mcpServers ?? base.mcpServers,
+        httpConnectors: override.httpConnectors ?? base.httpConnectors,
+        docdex: { ...base.docdex, ...override.docdex },
+        agentRoles: { ...base.agentRoles, ...override.agentRoles },
+        limits: {
+            maxRounds: minDefined(base.limits?.maxRounds, override.limits?.maxRounds),
+            maxToolCalls: minDefined(base.limits?.maxToolCalls, override.limits?.maxToolCalls),
+            maxModelCalls: minDefined(base.limits?.maxModelCalls, override.limits?.maxModelCalls),
+            deadlineMs: minDefined(base.limits?.deadlineMs, override.limits?.deadlineMs),
+        },
+        allowedTools,
+        deniedTools: deniedTools.length > 0 ? deniedTools : undefined,
+        warnings: [...(base.warnings ?? []), ...(override.warnings ?? [])],
+    };
+};
+/**
+ * Resolves run context from trusted user config, then applies the repository's
+ * narrowing config on top. Used by the CLI and any single-tenant deployment.
+ */
+export class LocalConfigRunContextResolver {
+    constructor(options = {}) {
+        this.options = options;
+        this.id = "local_config";
+    }
+    async resolve(input) {
+        const warnings = [];
+        const userDir = this.options.userConfigDir ?? path.join(homedir(), ".codali");
+        const userConfig = await readJsonFile(path.join(userDir, "config.json"));
+        const base = userConfig ? contextFromConfig(userConfig) : {};
+        const repoConfigRaw = await readJsonFile(path.join(input.workspaceRoot, ".codali", "config.json"));
+        let repoContext = {};
+        if (repoConfigRaw) {
+            const scrubbed = scrubRepoConfig(repoConfigRaw);
+            if (scrubbed.rejectedKeys.length > 0) {
+                warnings.push(`repo_config_keys_rejected:${scrubbed.rejectedKeys.join(",")}`);
+            }
+            repoContext = contextFromConfig(scrubbed.value);
+        }
+        const merged = mergeRunContexts(base, repoContext);
+        return {
+            ...merged,
+            tenant: input.tenant ?? merged.tenant,
+            repo: { root: input.workspaceRoot, ...merged.repo },
+            warnings: [...(merged.warnings ?? []), ...warnings],
+        };
+    }
+}
+/**
+ * Uses context handed over by an embedding host. This is the okacam path: the
+ * product resolves the tenant's tools and credentials from its own database and
+ * passes them on the request.
+ */
+export class ProvidedRunContextResolver {
+    constructor() {
+        this.id = "provided";
+    }
+    async resolve(input) {
+        if (!input.provided) {
+            throw new Error("ProvidedRunContextResolver requires a RunContext on the request.");
+        }
+        return {
+            ...input.provided,
+            repo: { root: input.workspaceRoot, ...input.provided.repo },
+            tenant: input.tenant ?? input.provided.tenant,
+        };
+    }
+}
+export const resolveRunContext = async (input, resolver) => {
+    const active = resolver ??
+        (input.provided ? new ProvidedRunContextResolver() : new LocalConfigRunContextResolver());
+    return active.resolve(input);
+};

package/dist/storage/CodaliDatasetPrivacyEngine.d.ts

@@ -1,6 +1,6 @@
 import { type CodaliStorageObjectPrivacyFlags, type CodaliStorageObjectRef, type CodaliStorageObjectRetentionClass, type CodaliStoragePrivacyClassification, type CodaliStoragePrivacyMetadata } from "./CodaliStorageContracts.js";
 export type CodaliDatasetPrivacyPurpose = "training" | "export" | "eval" | "replay" | "durable_persistence";
-export type CodaliDatasetSecretFindingKind = "sensitive_key" | "bearer_token" | "openai_api_key" | "cloud_access_key" | "github_token" | "jwt" | "private_key" | "env_secret_assignment";
+export type CodaliDatasetSecretFindingKind = "sensitive_key" | "bearer_token" | "openai_api_key" | "cloud_access_key" | "github_token" | "jwt" | "private_key" | "env_secret_assignment" | "connector_api_key";
 export type CodaliDatasetEligibilityBlockerCode = "secrets_detected" | "privacy_training_not_allowed" | "privacy_export_not_allowed" | "object_training_not_allowed" | "object_export_not_allowed" | "object_eval_not_allowed" | "object_replay_not_allowed" | "retention_do_not_store" | "redaction_required" | "policy_override_requires_admin_audit" | "policy_override_not_requested" | "policy_override_hard_blocked";
 export interface CodaliDatasetSecretFinding {
     kind: CodaliDatasetSecretFindingKind;

package/dist/storage/CodaliDatasetPrivacyEngine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CodaliDatasetPrivacyEngine.d.ts","sourceRoot":"","sources":["../../src/storage/CodaliDatasetPrivacyEngine.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,+BAA+B,EACpC,KAAK,sBAAsB,EAC3B,KAAK,iCAAiC,EACtC,KAAK,kCAAkC,EACvC,KAAK,4BAA4B,EAClC,MAAM,6BAA6B,CAAC;AAErC,MAAM,MAAM,2BAA2B,GACnC,UAAU,GACV,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,qBAAqB,CAAC;AAE1B,MAAM,MAAM,8BAA8B,GACtC,eAAe,GACf,cAAc,GACd,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,KAAK,GACL,aAAa,GACb,uBAAuB,CAAC;AAE5B,MAAM,MAAM,mCAAmC,GAC3C,kBAAkB,GAClB,8BAA8B,GAC9B,4BAA4B,GAC5B,6BAA6B,GAC7B,2BAA2B,GAC3B,yBAAyB,GACzB,2BAA2B,GAC3B,wBAAwB,GACxB,oBAAoB,GACpB,sCAAsC,GACtC,+BAA+B,GAC/B,8BAA8B,CAAC;AAEnC,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,8BAA8B,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kCAAkC,CAAC,QAAQ,GAAG,OAAO;IACpE,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,0BAA0B,EAAE,CAAC;IACvC,eAAe,EAAE,QAAQ,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iCAAiC;IAChD,MAAM,EAAE,wBAAwB,CAAC;IACjC,WAAW,EAAE,IAAI,CAAC,4BAA4B,EAAE,UAAU,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC7B,cAAc,CAAC,EAAE,kCAAkC,CAAC;IACpD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,UAAU,CAAC,EAAE,8BAA8B,CAAC;IAC5C,cAAc,CAAC,EAAE,iCAAiC,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,4BAA4B,CAAC;IACtC,YAAY,EAAE,+BAA+B,CAAC;IAC9C,iBAAiB,EAAE,8BAA8B,CAAC;IAClD,gBAAgB,EAAE;QAChB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9B,CAAC;IACF,cAAc,EAAE,0BAA0B,EAAE,CAAC;IAC7C,WAAW,EAAE;QACX,eAAe,EAAE,OAAO,CAAC;QACzB,WAAW,EAAE,OAAO,CAAC;QACrB,aAAa,EAAE,OAAO,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC;QACvB,yBAAyB,EAAE,OAAO,CAAC;QACnC,QAAQ,EAAE,+BAA+B,EAAE,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,mCAAmC,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,2BAA2B,CAAC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,+BAA+B,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,6BAA6B,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,2BAA2B,CAAC;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,2BAA2B,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,mCAAmC,EAAE,CAAC;CACzD;AAED,MAAM,WAAW,6BAA6B,CAAC,QAAQ;IACrD,OAAO,EAAE,OAAO,CAAC,2BAA2B,EAAE,qBAAqB,CAAC,CAAC;IACrE,SAAS,EAAE,sBAAsB,CAAC;IAClC,OAAO,EAAE,4BAA4B,CAAC;IACtC,cAAc,CAAC,EAAE,2BAA2B,CAAC;IAC7C,WAAW,EAAE,CAAC,SAAS,EAAE,sBAAsB,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CAClF;AAED,MAAM,MAAM,8BAA8B,CAAC,QAAQ,IAC/C;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,gCAAgC,CAAC;IAC3C,OAAO,EAAE,QAAQ,CAAC;CACnB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,QAAQ,EAAE,gCAAgC,CAAC;CAC5C,CAAC;AAEN,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;gBAExC,QAAQ,EAAE,gCAAgC;CASvD;AA4ID,eAAO,MAAM,mCAAmC,GAAI,QAAQ,GAAG,OAAO,EACpE,SAAS,QAAQ,KAChB,kCAAkC,CAAC,QAAQ,CAQ7C,CAAC;AAEF,eAAO,MAAM,2BAA2B,GACtC,QAAQ,wBAAwB,EAChC,OAAO,MAAM,8BAA8B,EAC3C,OAAO,MAAM,KACZ,MAoBF,CAAC;AAEF,eAAO,MAAM,4BAA4B,GACvC,QAAQ,wBAAwB,EAChC,aAAa,IAAI,CAAC,4BAA4B,EAAE,UAAU,CAAC,KAC1D,8BA4BF,CAAC;AAEF,eAAO,MAAM,uCAAuC,GAClD,gBAAgB,iCAAiC,KAChD,gCAeF,CAAC;AAEF,eAAO,MAAM,sCAAsC,GACjD,SAAS,OAAO,CAAC,2BAA2B,EAAE,qBAAqB,CAAC,EACpE,WAAW,sBAAsB,EACjC,SAAS,4BAA4B,KACpC,gCAiGF,CAAC;AAgBF,eAAO,MAAM,gCAAgC,GAC3C,UAAU,gCAAgC,EAC1C,WAAW,2BAA2B,KACrC,gCAkEF,CAAC;AAEF,eAAO,MAAM,2CAA2C,GACtD,SAAS,OAAO,CAAC,2BAA2B,EAAE,qBAAqB,CAAC,EACpE,WAAW,sBAAsB,EACjC,SAAS,4BAA4B,KACpC,IAOF,CAAC;AAEF,eAAO,MAAM,4CAA4C,GACvD,gBAAgB,iCAAiC,KAChD,IAGF,CAAC;AAEF,eAAO,MAAM,8BAA8B,GAAU,QAAQ,EAC3D,OAAO,6BAA6B,CAAC,QAAQ,CAAC,KAC7C,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAiBlD,CAAC;AAEF,eAAO,MAAM,oCAAoC,GAC/C,OAAO,iCAAiC,KACvC,4BAiKF,CAAC"}
+{"version":3,"file":"CodaliDatasetPrivacyEngine.d.ts","sourceRoot":"","sources":["../../src/storage/CodaliDatasetPrivacyEngine.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,+BAA+B,EACpC,KAAK,sBAAsB,EAC3B,KAAK,iCAAiC,EACtC,KAAK,kCAAkC,EACvC,KAAK,4BAA4B,EAClC,MAAM,6BAA6B,CAAC;AAErC,MAAM,MAAM,2BAA2B,GACnC,UAAU,GACV,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,qBAAqB,CAAC;AAE1B,MAAM,MAAM,8BAA8B,GACtC,eAAe,GACf,cAAc,GACd,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,KAAK,GACL,aAAa,GACb,uBAAuB,GACvB,mBAAmB,CAAC;AAExB,MAAM,MAAM,mCAAmC,GAC3C,kBAAkB,GAClB,8BAA8B,GAC9B,4BAA4B,GAC5B,6BAA6B,GAC7B,2BAA2B,GAC3B,yBAAyB,GACzB,2BAA2B,GAC3B,wBAAwB,GACxB,oBAAoB,GACpB,sCAAsC,GACtC,+BAA+B,GAC/B,8BAA8B,CAAC;AAEnC,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,8BAA8B,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kCAAkC,CAAC,QAAQ,GAAG,OAAO;IACpE,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,0BAA0B,EAAE,CAAC;IACvC,eAAe,EAAE,QAAQ,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iCAAiC;IAChD,MAAM,EAAE,wBAAwB,CAAC;IACjC,WAAW,EAAE,IAAI,CAAC,4BAA4B,EAAE,UAAU,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC7B,cAAc,CAAC,EAAE,kCAAkC,CAAC;IACpD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,UAAU,CAAC,EAAE,8BAA8B,CAAC;IAC5C,cAAc,CAAC,EAAE,iCAAiC,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,4BAA4B,CAAC;IACtC,YAAY,EAAE,+BAA+B,CAAC;IAC9C,iBAAiB,EAAE,8BAA8B,CAAC;IAClD,gBAAgB,EAAE;QAChB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9B,CAAC;IACF,cAAc,EAAE,0BAA0B,EAAE,CAAC;IAC7C,WAAW,EAAE;QACX,eAAe,EAAE,OAAO,CAAC;QACzB,WAAW,EAAE,OAAO,CAAC;QACrB,aAAa,EAAE,OAAO,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC;QACvB,yBAAyB,EAAE,OAAO,CAAC;QACnC,QAAQ,EAAE,+BAA+B,EAAE,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,mCAAmC,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,2BAA2B,CAAC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,+BAA+B,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,6BAA6B,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,2BAA2B,CAAC;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,2BAA2B,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,mCAAmC,EAAE,CAAC;CACzD;AAED,MAAM,WAAW,6BAA6B,CAAC,QAAQ;IACrD,OAAO,EAAE,OAAO,CAAC,2BAA2B,EAAE,qBAAqB,CAAC,CAAC;IACrE,SAAS,EAAE,sBAAsB,CAAC;IAClC,OAAO,EAAE,4BAA4B,CAAC;IACtC,cAAc,CAAC,EAAE,2BAA2B,CAAC;IAC7C,WAAW,EAAE,CAAC,SAAS,EAAE,sBAAsB,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CAClF;AAED,MAAM,MAAM,8BAA8B,CAAC,QAAQ,IAC/C;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,gCAAgC,CAAC;IAC3C,OAAO,EAAE,QAAQ,CAAC;CACnB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,QAAQ,EAAE,gCAAgC,CAAC;CAC5C,CAAC;AAEN,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;gBAExC,QAAQ,EAAE,gCAAgC;CASvD;AAwJD,eAAO,MAAM,mCAAmC,GAAI,QAAQ,GAAG,OAAO,EACpE,SAAS,QAAQ,KAChB,kCAAkC,CAAC,QAAQ,CAQ7C,CAAC;AAEF,eAAO,MAAM,2BAA2B,GACtC,QAAQ,wBAAwB,EAChC,OAAO,MAAM,8BAA8B,EAC3C,OAAO,MAAM,KACZ,MAoBF,CAAC;AAEF,eAAO,MAAM,4BAA4B,GACvC,QAAQ,wBAAwB,EAChC,aAAa,IAAI,CAAC,4BAA4B,EAAE,UAAU,CAAC,KAC1D,8BA4BF,CAAC;AAEF,eAAO,MAAM,uCAAuC,GAClD,gBAAgB,iCAAiC,KAChD,gCAeF,CAAC;AAEF,eAAO,MAAM,sCAAsC,GACjD,SAAS,OAAO,CAAC,2BAA2B,EAAE,qBAAqB,CAAC,EACpE,WAAW,sBAAsB,EACjC,SAAS,4BAA4B,KACpC,gCAiGF,CAAC;AAgBF,eAAO,MAAM,gCAAgC,GAC3C,UAAU,gCAAgC,EAC1C,WAAW,2BAA2B,KACrC,gCAkEF,CAAC;AAEF,eAAO,MAAM,2CAA2C,GACtD,SAAS,OAAO,CAAC,2BAA2B,EAAE,qBAAqB,CAAC,EACpE,WAAW,sBAAsB,EACjC,SAAS,4BAA4B,KACpC,IAOF,CAAC;AAEF,eAAO,MAAM,4CAA4C,GACvD,gBAAgB,iCAAiC,KAChD,IAGF,CAAC;AAEF,eAAO,MAAM,8BAA8B,GAAU,QAAQ,EAC3D,OAAO,6BAA6B,CAAC,QAAQ,CAAC,KAC7C,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAiBlD,CAAC;AAEF,eAAO,MAAM,oCAAoC,GAC/C,OAAO,iCAAiC,KACvC,4BAiKF,CAAC"}

package/dist/storage/CodaliDatasetPrivacyEngine.js

@@ -30,6 +30,18 @@ const SECRET_VALUE_PATTERNS = [
         kind: "env_secret_assignment",
         pattern: /\b(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PRIVATE[_-]?KEY)=["']?[^"'\s]{8,}["']?/gi,
     },
+    // Connector credentials. Added alongside the first MCP connector, because
+    // that is the point at which third-party secrets first flow through a run.
+    // The `sk-` rule above does not match underscore-delimited keys such as
+    // mswarm's `sk_prod_mswarm_...`, so those need their own rule.
+    {
+        kind: "connector_api_key",
+        pattern: /\bsk_[A-Za-z0-9]+_[A-Za-z0-9_]{8,}\b/g,
+    },
+    { kind: "connector_api_key", pattern: /\bglpat-[A-Za-z0-9_-]{16,}\b/g },
+    { kind: "connector_api_key", pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g },
+    { kind: "connector_api_key", pattern: /\bAIza[0-9A-Za-z_-]{30,}\b/g },
+    { kind: "connector_api_key", pattern: /\bnpm_[A-Za-z0-9]{30,}\b/g },
 ];
 const PERSONAL_KEY_PATTERNS = [
     /(^|[_-])(email|phone|ssn|person|user[_-]?id|requester)([_-]|$)/i,

package/dist/tools/ToolRegistry.d.ts

@@ -1,9 +1,22 @@
-import { type ToolContext, type ToolDefinition, type ToolExecutionResult } from "./ToolTypes.js";
+import { type ToolCapability, type ToolContext, type ToolDefinition, type ToolDescriptor, type ToolExecutionResult } from "./ToolTypes.js";
+/**
+ * Projects a registered tool into its model-facing descriptor. Kept as a free
+ * function so connector adapters can reuse the same defaulting rules.
+ */
+export declare const toolDescriptorFor: (tool: ToolDefinition) => ToolDescriptor;
 export declare class ToolRegistry {
     private tools;
     register(tool: ToolDefinition): void;
     list(): ToolDefinition[];
     describe(): Array<Pick<ToolDefinition, "name" | "description" | "inputSchema">>;
+    /**
+     * Model-facing view of the registry, optionally narrowed to a set of tool
+     * names. This is derived on every call rather than cached so the planner can
+     * never see a schema the executor would not honour.
+     */
+    catalog(names?: readonly string[]): ToolDescriptor[];
+    /** Capability -> tools, for the first stage of two-level tool exposure. */
+    capabilities(names?: readonly string[]): Map<ToolCapability, ToolDescriptor[]>;
     execute(name: string, args: unknown, context: ToolContext): Promise<ToolExecutionResult>;
 }
 //# sourceMappingURL=ToolRegistry.d.ts.map

package/dist/tools/ToolRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ToolRegistry.d.ts","sourceRoot":"","sources":["../../src/tools/ToolRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,cAAc,EAGnB,KAAK,mBAAmB,EAGzB,MAAM,gBAAgB,CAAC;AA4QxB,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAqC;IAElD,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAOpC,IAAI,IAAI,cAAc,EAAE;IAIxB,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IAQzE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAkC/F"}
+{"version":3,"file":"ToolRegistry.d.ts","sourceRoot":"","sources":["../../src/tools/ToolRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,cAAc,EAGnB,KAAK,mBAAmB,EAGzB,MAAM,gBAAgB,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,cAAc,KAAG,cAOvD,CAAC;AA4QH,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAqC;IAElD,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAOpC,IAAI,IAAI,cAAc,EAAE;IAIxB,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IAQ/E;;;;OAIG;IACH,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,EAAE;IAOpD,2EAA2E;IAC3E,YAAY,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,CAAC;IAaxE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAkC/F"}

package/dist/tools/ToolRegistry.js

@@ -1,4 +1,16 @@
-import { ToolExecutionError, toolErrorCategoryForCode, } from "./ToolTypes.js";
+import { ToolExecutionError, toolCapabilityForName, toolErrorCategoryForCode, } from "./ToolTypes.js";
+/**
+ * Projects a registered tool into its model-facing descriptor. Kept as a free
+ * function so connector adapters can reuse the same defaulting rules.
+ */
+export const toolDescriptorFor = (tool) => ({
+    name: tool.name,
+    description: tool.description,
+    inputSchema: tool.inputSchema,
+    outputSchema: tool.outputSchema,
+    readOnly: tool.readOnly ?? false,
+    capability: tool.capability ?? toolCapabilityForName(tool.name),
+});
 const isObject = (value) => {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 };
@@ -262,6 +274,31 @@ export class ToolRegistry {
             inputSchema: tool.inputSchema,
         }));
     }
+    /**
+     * Model-facing view of the registry, optionally narrowed to a set of tool
+     * names. This is derived on every call rather than cached so the planner can
+     * never see a schema the executor would not honour.
+     */
+    catalog(names) {
+        const filter = names ? new Set(names) : undefined;
+        return this.list()
+            .filter((tool) => !filter || filter.has(tool.name))
+            .map((tool) => toolDescriptorFor(tool));
+    }
+    /** Capability -> tools, for the first stage of two-level tool exposure. */
+    capabilities(names) {
+        const grouped = new Map();
+        for (const descriptor of this.catalog(names)) {
+            const bucket = grouped.get(descriptor.capability);
+            if (bucket) {
+                bucket.push(descriptor);
+            }
+            else {
+                grouped.set(descriptor.capability, [descriptor]);
+            }
+        }
+        return grouped;
+    }
     async execute(name, args, context) {
         const tool = this.tools.get(name);
         if (!tool) {