@nodetool-ai/agents 0.7.0-rc.22 → 0.8.1

package/dist/sandbox-module-fixtures.js

@@ -0,0 +1,214 @@
+/** A digest is opaque to the loader; these fixtures never vary it. */
+const DIGEST = "a".repeat(64);
+/** Build a JS module resolution entry from its files; the first is the entry. */
+export function fixtureModule(specifier, packName, files) {
+    const entry = files[0];
+    if (entry === undefined) {
+        throw new Error(`sandbox fixture ${specifier} has no entry file`);
+    }
+    return {
+        specifier,
+        packName,
+        contentDigest: DIGEST,
+        moduleId: entry.id,
+        kind: "js",
+        source: entry.source,
+        graph: files.map((file) => ({
+            id: file.id,
+            kind: "js",
+            source: file.source,
+            dependencies: [],
+            internal: file.internal ?? false
+        }))
+    };
+}
+/** Wrap modules as the resolution a run hands the sandbox. */
+export function fixtureResolution(modules) {
+    return { modules: [...modules], statuses: [] };
+}
+/** The `@acme/geo` entry, whose only export needs an internal sibling to work. */
+export const GEO_MODULE = fixtureModule("@acme/geo", "@acme/nodetool-geo", [
+    {
+        id: "sandbox/geo.js",
+        source: `import { round } from "./internal/round.js";
+export const haversine = (a, b) => round(Math.abs(a - b) * 111);`
+    },
+    {
+        id: "sandbox/internal/round.js",
+        source: "export const round = (n) => Math.round(n * 100) / 100;",
+        internal: true
+    }
+]);
+/** A second entry of the same pack, for the two-modules-one-pack case. */
+export const GEO_EXTRA_MODULE = fixtureModule("@acme/geo/extra", "@acme/nodetool-geo", [{ id: "sandbox/extra.js", source: "export const label = () => 'extra';" }]);
+/** An unrelated pack whose internal file must stay unreachable. */
+export const OTHER_MODULE = fixtureModule("@other/pack", "@other/nodetool-pack", [
+    { id: "sandbox/main.js", source: "export const hi = () => 'other';" },
+    {
+        id: "sandbox/internal/secret.js",
+        source: "export const secret = () => 'secret';",
+        internal: true
+    }
+]);
+/** A module that reaches for a timer at its own top level. */
+export const TIMER_MODULE = fixtureModule("@acme/timer", "@acme/nodetool-timer", [
+    {
+        id: "sandbox/timer.js",
+        source: `setTimeout(() => {}, 0);
+export const value = 1;`
+    }
+]);
+/** A module that reaches for `eval` while it evaluates. */
+export const EVIL_MODULE = fixtureModule("@acme/evil", "@acme/nodetool-evil", [
+    { id: "sandbox/evil.js", source: 'export const value = eval("1 + 1");' }
+]);
+const GEO_ONLY = [GEO_MODULE];
+const GEO_AND_OTHER = [GEO_MODULE, OTHER_MODULE];
+export const SANDBOX_MODULE_FIXTURES = [
+    {
+        name: "declared-import",
+        description: "a named export of a declared module is importable and callable",
+        modules: GEO_ONLY,
+        code: 'import { haversine } from "@acme/geo";\nreturn haversine(1, 3);',
+        result: 222
+    },
+    {
+        name: "two-modules-one-pack",
+        description: "two entries of one pack both resolve",
+        modules: [GEO_MODULE, GEO_EXTRA_MODULE],
+        code: `import { haversine } from "@acme/geo";
+import { label } from "@acme/geo/extra";
+return label() + ":" + haversine(0, 1);`,
+        result: "extra:111"
+    },
+    {
+        name: "internal-helper",
+        description: "a module's relative import of its own internal sibling resolves — the " +
+            "answer is only right because ./internal/round.js ran",
+        modules: GEO_ONLY,
+        code: 'import { haversine } from "@acme/geo";\nreturn haversine(0, 0.001);',
+        result: 0.11
+    },
+    {
+        name: "deny-node-builtin",
+        description: "a `node:*` specifier is denied by name",
+        modules: GEO_AND_OTHER,
+        code: 'import "node:buffer";\nreturn 1;',
+        errorContains: ["node:buffer", "not a sandbox package this run serves"]
+    },
+    {
+        name: "deny-compat-module",
+        description: "a bare compat module the QuickJS wrapper itself warmed is still denied",
+        modules: GEO_AND_OTHER,
+        code: 'import "buffer";\nreturn 1;',
+        errorContains: ["buffer", "not a sandbox package this run serves"]
+    },
+    {
+        name: "deny-absolute-path",
+        description: "an absolute path is not a specifier the loader serves",
+        modules: GEO_AND_OTHER,
+        code: 'import "/etc/passwd";\nreturn 1;',
+        errorContains: ["/etc/passwd", "not a sandbox package this run serves"]
+    },
+    {
+        name: "deny-relative-escape",
+        description: "user code cannot climb out with `../`",
+        modules: GEO_AND_OTHER,
+        code: 'import "../secrets.js";\nreturn 1;',
+        errorContains: ["../secrets.js", "not a sandbox package this run serves"]
+    },
+    {
+        name: "deny-encoded-traversal",
+        description: "percent-encoding the traversal does not decode into one",
+        modules: GEO_AND_OTHER,
+        code: 'import "%2e%2e/secrets.js";\nreturn 1;',
+        errorContains: ["%2e%2e/secrets.js", "not a sandbox package this run serves"]
+    },
+    {
+        name: "deny-undeclared-specifier",
+        description: "a specifier the node did not declare is refused",
+        modules: GEO_AND_OTHER,
+        code: 'import "@acme/other";\nreturn 1;',
+        errorContains: ["@acme/other", "not a sandbox package this run serves"]
+    },
+    {
+        name: "deny-other-pack-internal",
+        description: "another pack's internal file is not addressable",
+        modules: GEO_AND_OTHER,
+        code: 'import "@other/nodetool-pack/sandbox/internal/secret.js";\nreturn 1;',
+        errorContains: ["sandbox/internal/secret.js", "not a sandbox package this run serves"]
+    },
+    {
+        name: "deny-own-internal-from-user-code",
+        description: "a declared module's internal file is for that module, not for user code",
+        modules: GEO_ONLY,
+        code: 'import "sandbox/internal/round.js";\nreturn 1;',
+        errorContains: ["sandbox/internal/round.js"]
+    },
+    {
+        name: "deny-dynamic-import-of-declared",
+        description: "dynamic import() is denied even for a declared specifier a static " +
+            "import already put in the module cache",
+        modules: GEO_ONLY,
+        code: `import { haversine } from "@acme/geo";
+try {
+  await import("@acme/geo");
+  return "LOADED";
+} catch (e) {
+  return e.message;
+}`,
+        catchesError: true,
+        errorContains: ["dynamic import()", "@acme/geo"]
+    },
+    {
+        name: "deny-computed-dynamic-import",
+        description: "a specifier assembled at run time is denied like any other",
+        modules: GEO_ONLY,
+        code: `try {
+  await import("node:" + "buffer");
+  return "LOADED";
+} catch (e) {
+  return e.message;
+}`,
+        catchesError: true,
+        errorContains: ["dynamic import()", "node:buffer"]
+    },
+    {
+        name: "deny-variable-dynamic-import",
+        description: "a specifier held in a variable is denied like any other",
+        modules: GEO_ONLY,
+        code: `const target = ["f", "s"].join("");
+try {
+  await import(target);
+  return "LOADED";
+} catch (e) {
+  return e.message;
+}`,
+        catchesError: true,
+        errorContains: ["dynamic import()", "fs"]
+    },
+    {
+        name: "harden-module-top-level-timer",
+        description: "a module cannot use a timer at its own top level — dependencies " +
+            "evaluate before the entry, so the entry's own deletions come too late",
+        modules: [TIMER_MODULE],
+        code: 'import { value } from "@acme/timer";\nreturn value;',
+        errorContains: ["setTimeout"]
+    },
+    {
+        name: "harden-module-eval",
+        description: "a module cannot re-enter dynamic code generation with eval",
+        modules: [EVIL_MODULE],
+        code: 'import { value } from "@acme/evil";\nreturn value;',
+        errorContains: ["eval"]
+    }
+];
+/** One fixture by name, for a suite that drives a subset. */
+export function sandboxModuleFixture(name) {
+    const fixture = SANDBOX_MODULE_FIXTURES.find((entry) => entry.name === name);
+    if (fixture === undefined) {
+        throw new Error(`unknown sandbox module fixture: ${name}`);
+    }
+    return fixture;
+}
+//# sourceMappingURL=sandbox-module-fixtures.js.map

package/dist/sandbox-module-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-module-fixtures.js","sourceRoot":"","sources":["../src/sandbox-module-fixtures.ts"],"names":[],"mappings":"AAyBA,sEAAsE;AACtE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAS9B,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,QAAgB,EAChB,KAAoC;IAEpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,oBAAoB,CAAC,CAAC;IACpE,CAAC;IACD,OAAO;QACL,SAAS;QACT,QAAQ;QACR,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,KAAK,CAAC,EAAE;QAClB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAa;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;SACjC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAC/B,OAAyC;IAEzC,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACjD,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,oBAAoB,EAAE;IACzE;QACE,EAAE,EAAE,gBAAgB;QACpB,MAAM,EAAE;iEACqD;KAC9D;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,MAAM,EAAE,wDAAwD;QAChE,QAAQ,EAAE,IAAI;KACf;CACF,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAC3C,iBAAiB,EACjB,oBAAoB,EACpB,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC,CAC5E,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC,aAAa,EAAE,sBAAsB,EAAE;IAC/E,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,kCAAkC,EAAE;IACrE;QACE,EAAE,EAAE,4BAA4B;QAChC,MAAM,EAAE,uCAAuC;QAC/C,QAAQ,EAAE,IAAI;KACf;CACF,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC,aAAa,EAAE,sBAAsB,EAAE;IAC/E;QACE,EAAE,EAAE,kBAAkB;QACtB,MAAM,EAAE;wBACY;KACrB;CACF,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,EAAE,qBAAqB,EAAE;IAC5E,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,qCAAqC,EAAE;CACzE,CAAC,CAAC;AAuBH,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,CAAC;AAC9B,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,uBAAuB,GAAoC;IACtE;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,gEAAgE;QAC7E,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,iEAAiE;QACvE,MAAM,EAAE,GAAG;KACZ;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC;QACvC,IAAI,EAAE;;wCAE8B;QACpC,MAAM,EAAE,WAAW;KACpB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,wEAAwE;YACxE,sDAAsD;QACxD,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,qEAAqE;QAC3E,MAAM,EAAE,IAAI;KACb;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,kCAAkC;QACxC,aAAa,EAAE,CAAC,aAAa,EAAE,uCAAuC,CAAC;KACxE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,wEAAwE;QAC1E,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,6BAA6B;QACnC,aAAa,EAAE,CAAC,QAAQ,EAAE,uCAAuC,CAAC;KACnE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,kCAAkC;QACxC,aAAa,EAAE,CAAC,aAAa,EAAE,uCAAuC,CAAC;KACxE;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,uCAAuC;QACpD,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,oCAAoC;QAC1C,aAAa,EAAE,CAAC,eAAe,EAAE,uCAAuC,CAAC;KAC1E;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,wCAAwC;QAC9C,aAAa,EAAE,CAAC,mBAAmB,EAAE,uCAAuC,CAAC;KAC9E;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,iDAAiD;QAC9D,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,kCAAkC;QACxC,aAAa,EAAE,CAAC,aAAa,EAAE,uCAAuC,CAAC;KACxE;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,iDAAiD;QAC9D,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,sEAAsE;QAC5E,aAAa,EAAE,CAAC,4BAA4B,EAAE,uCAAuC,CAAC;KACvF;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,yEAAyE;QAC3E,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,gDAAgD;QACtD,aAAa,EAAE,CAAC,2BAA2B,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,oEAAoE;YACpE,wCAAwC;QAC1C,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE;;;;;;EAMR;QACE,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,CAAC,kBAAkB,EAAE,WAAW,CAAC;KACjD;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE;;;;;EAKR;QACE,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,CAAC,kBAAkB,EAAE,aAAa,CAAC;KACnD;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE;;;;;;EAMR;QACE,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,CAAC,kBAAkB,EAAE,IAAI,CAAC;KAC1C;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,kEAAkE;YAClE,uEAAuE;QACzE,OAAO,EAAE,CAAC,YAAY,CAAC;QACvB,IAAI,EAAE,qDAAqD;QAC3D,aAAa,EAAE,CAAC,YAAY,CAAC;KAC9B;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,IAAI,EAAE,oDAAoD;QAC1D,aAAa,EAAE,CAAC,MAAM,CAAC;KACxB;CACF,CAAC;AAEF,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/sandbox-toolbelt.d.ts

@@ -0,0 +1,13 @@
+import { type ProcessingContext } from "@nodetool-ai/runtime";
+import type { Tool } from "./tools/base-tool.js";
+import { getAllMcpTools } from "./tools/mcp-tools.js";
+export declare const NODETOOL_PRELUDE: string;
+export declare function assembleSandboxToolbelt(options?: Parameters<typeof getAllMcpTools>[0]): Tool[];
+/**
+ * Add the current user's configured provider catalogs to a script toolbelt.
+ * Provider instances stay owned by the processing context, so credentials,
+ * custom endpoints, tracing, and cancellation follow the script run.
+ */
+export declare function assembleJsScriptToolbelt(context: ProcessingContext): Promise<Tool[]>;
+export declare function sandboxToolBridgeGlobals(context: ProcessingContext, tools?: Tool[]): Record<string, unknown>;
+//# sourceMappingURL=sandbox-toolbelt.d.ts.map

package/dist/sandbox-toolbelt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-toolbelt.d.ts","sourceRoot":"","sources":["../src/sandbox-toolbelt.ts"],"names":[],"mappings":"AAsBA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAMjD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAItD,eAAO,MAAM,gBAAgB,QAAmD,CAAC;AAEjF,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAM,GACjD,IAAI,EAAE,CAWR;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,IAAI,EAAE,CAAC,CAcjB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,iBAAiB,EAC1B,KAAK,GAAE,IAAI,EAA8B,GACxC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB"}

package/dist/sandbox-toolbelt.js

@@ -0,0 +1,64 @@
+/**
+ * The toolbelt a Code node and a JS script share.
+ *
+ * Same assembly as an agent loop's server half: `getBuiltinTools()` plus the
+ * Apify and SerpAPI capabilities, plus the in-process MCP tools that only need
+ * the process node registry. The example catalog and DSL exporter live above
+ * this package, so those tools stay dark and `nodetool.capabilities()` reports
+ * the difference. JS scripts use `assembleJsScriptToolbelt` to add the current
+ * user's configured provider catalogs for model discovery.
+ *
+ * Apify and SerpAPI are here because a body can already reach both by import
+ * (`@nodetool-ai/sandbox-nodetool/apify`), which the Code node mounts ungated.
+ * Leaving them off the belt meant the two paths disagreed: a chat that ran
+ * `tools.run_apify_actor` and then wrote the same call into a Code node got
+ * `TypeError: not a function` at run time, with nothing naming the tool. They
+ * carry no run source, so each call runs over the invoking context's own
+ * ungated run — the same door the import path opens, not a wider one.
+ *
+ * Chat CodeAct can also carry client `ui_*` tools. Those need a browser, so
+ * they are not on this belt.
+ */
+import { NodeRegistry } from "@nodetool-ai/node-sdk";
+import { listRegisteredProviderIds } from "@nodetool-ai/runtime";
+import { getBuiltinTools } from "./tools/builtin-tools.js";
+import { getApifyTools, getSerpApiTools } from "./tools/external-capability-tools.js";
+import { getAllMcpTools } from "./tools/mcp-tools.js";
+import { buildToolBridge, TOOLS_PRELUDE } from "./codeact/tool-api.js";
+import { NODETOOL_API_PRELUDE_FULL } from "./codeact/nodetool-api.js";
+export const NODETOOL_PRELUDE = `${TOOLS_PRELUDE}\n${NODETOOL_API_PRELUDE_FULL}`;
+export function assembleSandboxToolbelt(options = {}) {
+    const byName = new Map();
+    for (const tool of [
+        ...getBuiltinTools(),
+        ...getApifyTools(),
+        ...getSerpApiTools(),
+        ...getAllMcpTools({ registry: NodeRegistry.global, ...options })
+    ]) {
+        byName.set(tool.name, tool);
+    }
+    return [...byName.values()];
+}
+/**
+ * Add the current user's configured provider catalogs to a script toolbelt.
+ * Provider instances stay owned by the processing context, so credentials,
+ * custom endpoints, tracing, and cancellation follow the script run.
+ */
+export async function assembleJsScriptToolbelt(context) {
+    const providers = {};
+    await Promise.all(listRegisteredProviderIds().map(async (providerId) => {
+        try {
+            if (await context.isProviderConfigured(providerId)) {
+                providers[providerId] = await context.getProvider(providerId);
+            }
+        }
+        catch {
+            // A broken provider must not prevent scripts from using another one.
+        }
+    }));
+    return assembleSandboxToolbelt({ providers });
+}
+export function sandboxToolBridgeGlobals(context, tools = assembleSandboxToolbelt()) {
+    return buildToolBridge({ tools, context }).globals;
+}
+//# sourceMappingURL=sandbox-toolbelt.js.map

package/dist/sandbox-toolbelt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-toolbelt.js","sourceRoot":"","sources":["../src/sandbox-toolbelt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,yBAAyB,EAG1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACL,aAAa,EACb,eAAe,EAChB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,aAAa,KAAK,yBAAyB,EAAE,CAAC;AAEjF,MAAM,UAAU,uBAAuB,CACrC,OAAO,GAAyC,EAAE;IAElD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgB,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI;QACjB,GAAG,eAAe,EAAE;QACpB,GAAG,aAAa,EAAE;QAClB,GAAG,eAAe,EAAE;QACpB,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;KACjE,EAAE,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAA0B;IAE1B,MAAM,SAAS,GAAiC,EAAE,CAAC;IACnD,MAAM,OAAO,CAAC,GAAG,CACf,yBAAyB,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;QACnD,IAAI,CAAC;YACH,IAAI,MAAM,OAAO,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnD,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAA0B,EAC1B,KAAK,GAAW,uBAAuB,EAAE;IAEzC,OAAO,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC;AACrD,CAAC"}

package/dist/security-monitor.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Autonomous security monitor — an opt-in LLM judge that vets a single pending
+ * write/execute/external tool call before it runs, from inside the existing
+ * permission gate ({@link file://./tools/tool-permissions.ts}).
+ *
+ * The monitor reuses the gate's read/write/execute/external classification:
+ * read-class tools are never consulted (enforced by the gate). For every other
+ * class the monitor is handed { action name, category, args, recent transcript }
+ * and returns a strict verdict: { block, reason, severity, tier }. The judge
+ * enforces a two-tier model — HARD blocks (never cleared by user intent) and
+ * SOFT blocks (clearable by precise, explicit user intent in the transcript).
+ * The clearing logic lives entirely in the judge prompt; this class trusts the
+ * returned `block` flag.
+ *
+ * Fail-CLOSED for what the monitor exists to vet: when the judge errors or
+ * returns unparseable output, a `write`, `execute` or `external` action gets
+ * a SOFT block naming the failure, so a judge outage withholds the action
+ * rather than waving it through. A `read` action is allowed on the same
+ * failure — the gate never consults the monitor for one, so reaching here
+ * with `read` is a caller's choice, and a read has nothing to withhold.
+ *
+ * This module performs a single non-streaming provider call per review via
+ * `provider.generateMessageTraced`. It is fully opt-in and constructed only
+ * when an agent enables it — when no monitor is wired into the gate, the gate
+ * behaves byte-for-byte as before.
+ */
+import type { BaseProvider } from "@nodetool-ai/runtime";
+import type { PermissionCategory } from "./tools/tool-permissions.js";
+/** How severe the judged concern is. */
+export type SecuritySeverity = "low" | "medium" | "high" | "critical";
+/**
+ * Block tier. `hard` = a security boundary; never cleared by user intent.
+ * `soft` = destructive/irreversible but clearable by precise user intent.
+ * `none` = allowed.
+ */
+export type SecurityTier = "hard" | "soft" | "none";
+/** The single pending action handed to the judge. */
+export interface PendingAction {
+    /** Tool name about to run. */
+    name: string;
+    /** Permission category of the tool. */
+    category: PermissionCategory;
+    /** Tool arguments (with the reserved `_message` field already stripped). */
+    args: Record<string, unknown>;
+    /** Recent transcript text, used to evaluate user-intent clearing of SOFT blocks. */
+    transcript?: string;
+}
+/** The judge's structured verdict for one pending action. */
+export interface SecurityVerdict {
+    block: boolean;
+    reason: string;
+    severity: SecuritySeverity;
+    tier: SecurityTier;
+}
+export interface SecurityMonitorOptions {
+    provider: BaseProvider;
+    model: string;
+    /** Max characters of transcript forwarded to the judge. Default 8000. */
+    maxTranscriptChars?: number;
+    /** Max characters of serialized args forwarded to the judge. Default 4000. */
+    maxArgChars?: number;
+    /** Optional thread/conversation id passed to the provider call. */
+    threadId?: string;
+}
+export declare function parseVerdict(text: string): SecurityVerdict | null;
+/**
+ * The LLM judge. One {@link review} call per actionable tool invocation.
+ */
+export declare class SecurityMonitor {
+    private readonly provider;
+    private readonly model;
+    private readonly maxTranscriptChars;
+    private readonly maxArgChars;
+    private readonly threadId?;
+    constructor(opts: SecurityMonitorOptions);
+    /**
+     * Judge a single pending action. Returns a {@link SecurityVerdict}. On any
+     * provider error or unparseable output, returns {@link unjudgedVerdict}: a
+     * block for an actionable category, allow for `read` (see module header).
+     */
+    review(action: PendingAction): Promise<SecurityVerdict>;
+}
+/**
+ * Bridge a {@link SecurityMonitor} into the permission gate. Returns a plain
+ * consult callback (the gate stays free of any provider/LLM dependency) that
+ * forwards a pending action to {@link SecurityMonitor.review}.
+ */
+export declare function createSecurityMonitorConsult(monitor: SecurityMonitor): (action: PendingAction) => Promise<SecurityVerdict>;
+//# sourceMappingURL=security-monitor.d.ts.map

package/dist/security-monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-monitor.d.ts","sourceRoot":"","sources":["../src/security-monitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EACV,YAAY,EAEb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AActE,wCAAwC;AACxC,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEtE;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEpD,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,YAAY,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA8JD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAwCjE;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IAEnC,YAAY,IAAI,EAAE,sBAAsB,EAOvC;IAED;;;;OAIG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAwD5D;CACF;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,eAAe,GACvB,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,eAAe,CAAC,CAErD"}