@oracle-agent/oracle 0.35.43 → 0.35.44

package/dist/cli/commands/extension-policy.mjs

@@ -1,3 +1,3 @@
-import v from"node:fs";import y from"node:path";import{homedir as R}from"node:os";var l=Object.freeze(["oracle_cli","memory_add","memory_remove","memory_search","skill_load","skill_create","skill_list","cron_add","cron_list","cron_remove","meta_analyze","web_fetch","web_search","file_read","file_write","mcp_list","mcp_call","todo_list","todo_set","session_search","research_delegate","rlm","deep_research","clarify","code_eval","learn_skill","approval_preview","workspace_artifact","research_artifact","portfolio_analyze","tax_lots","position_health","governance_prepare","safety_intelligence","portfolio_risk","trade_lifecycle","signal_score","vault_status","signer_status","signer_execute","signer_disarm","receipt_report","watch_create","watch_list","portfolio_snapshot","vision_analyze","browser_exec","xurl","knowledge_search","x402_prepare"]),c="deny",L=256*1024,T=128,u=Object.freeze({version:1,source:"default",defaultDecision:c,allow:l,deny:Object.freeze([])});function s(e){let t=new Set;if(!Array.isArray(e))return t;for(let o of e){if(typeof o!="string")continue;let r=o.trim();r.length===0||r.length>T||t.add(r)}return t}function P(e){return{allow:!1,reason:e}}function O(e){return{allow:!0,reason:e}}var _="extension-prepare-only",p=Object.freeze(["oracle_cli","memory_search","skill_load","skill_list","web_fetch","web_search","todo_list","todo_set","session_search","research_delegate","rlm","deep_research","clarify","code_eval","approval_preview","research_artifact","portfolio_analyze","tax_lots","position_health","governance_prepare","safety_intelligence","portfolio_risk","trade_lifecycle","signal_score","vault_status","signer_status","receipt_report","watch_list","portfolio_snapshot","vision_analyze","knowledge_search"]),d=new Set(p);function h(e=process.env){return e?.ORACLE_EXECUTION_MODE===_}function w(e,t=process.env){if(!h(t))return O("allowed: normal Oracle execution mode");let o=typeof e?.name=="string"?e.name.trim():"";return!o||!d.has(o)?P(`denied: tool "${o||"unknown"}" is outside extension prepare-only mode`):O(`allowed: tool "${o}" is inside extension prepare-only mode`)}function j(e,t=process.env){if(!h(t))return e;let o=[...s(e?.allow)].filter(n=>d.has(n)),r=new Set([...s(e?.deny),...l.filter(n=>!d.has(n))]);return Object.freeze({version:1,source:`${String(e?.source||"default")}:extension-prepare-only`,defaultDecision:c,allow:Object.freeze(o),deny:Object.freeze([...r])})}var z="ORACLE_TOOL_SURFACE",a=Object.freeze({PUBLIC_APP:"public-app",RESEARCH_X_TELEGRAM:"research-x-telegram",OWNER_DESK:"owner-desk"}),N=Object.freeze(Object.values(a));function m(e){let t=e.filter(o=>!l.includes(o));if(t.length)throw new Error(`tool surface allowlist names unknown shipped tools: ${t.join(", ")}`);return Object.freeze([...e])}var E=m(["oracle_cli","memory_search","skill_load","skill_list","web_fetch","web_search","todo_list","todo_set","session_search","research_delegate","rlm","deep_research","clarify","code_eval","approval_preview","research_artifact","portfolio_analyze","tax_lots","position_health","governance_prepare","safety_intelligence","portfolio_risk","trade_lifecycle","signal_score","receipt_report","watch_list","portfolio_snapshot","vision_analyze","knowledge_search","x402_prepare"]),S=m([...E,"file_read","meta_analyze","cron_list","mcp_list","xurl"]),g=Object.freeze([...l]),Y=Object.freeze({[a.PUBLIC_APP]:E,[a.RESEARCH_X_TELEGRAM]:S,[a.OWNER_DESK]:g}),C=Object.freeze({[a.PUBLIC_APP]:new Set(E),[a.RESEARCH_X_TELEGRAM]:new Set(S),[a.OWNER_DESK]:new Set(g)});function k(e=process.env){let t=e?.[z];return typeof t!="string"?"":t.trim()}function D(e){let t=typeof e=="string"?e.trim():"";return t?C[t]||new Set:null}function $(e,t=process.env){let o=k(t);if(!o)return e;let r=D(o),n=N.includes(o)?o:"unknown",A=[...s(e?.allow)].filter(f=>r.has(f)),b=new Set([...s(e?.deny),...l.filter(f=>!r.has(f))]);return Object.freeze({version:1,source:`${String(e?.source||"default")}:surface-${n}`,defaultDecision:c,allow:Object.freeze(A),deny:Object.freeze([...b])})}function i(e,t=process.env){return $(j(e,t),t)}function I(e=process.env){let t=e&&e.ORACLE_CONFIG_DIR||y.join(R(),".config","oracle");return y.join(t,"tool-policy.json")}function x(e=process.env){try{let t=I(e),o=v.readFileSync(t,"utf8");if(typeof o!="string"||o.length>L)return i(u,e);let r=JSON.parse(o);if(!r||typeof r!="object"||Array.isArray(r))return i(u,e);let n=Array.isArray(r.allow)?s(r.allow):s(l);return i(Object.freeze({version:1,source:t,defaultDecision:c,allow:Object.freeze([...n]),deny:Object.freeze([...s(r.deny)])}),e)}catch{return i(u,e)}}function M(e=process.env){let t={...e,ORACLE_EXECUTION_MODE:_},o=x(t);return{ok:w({name:"signer_execute",args:{}},t).allow===!1&&!o.allow.includes("signer_execute"),version:1,mode:_,signerExecute:!1,tools:p}}var B={name:"extension-policy",summary:"attest the extension prepare-only tool boundary",group:"system",usage:"oracle extension-policy --json",async run(e){if(e.argv.length!==1||e.argv[0]!=="--json")return process.stderr.write(`oracle extension-policy requires --json
+import v from"node:fs";import y from"node:path";import{homedir as R}from"node:os";var i=Object.freeze(["oracle_cli","memory_add","memory_remove","memory_search","skill_load","skill_create","skill_list","cron_add","cron_list","cron_remove","meta_analyze","web_fetch","web_search","file_read","file_write","mcp_list","mcp_call","evidence_read","todo_list","todo_set","session_search","research_delegate","rlm","deep_research","clarify","code_eval","learn_skill","approval_preview","workspace_artifact","research_artifact","portfolio_analyze","tax_lots","position_health","governance_prepare","safety_intelligence","portfolio_risk","trade_lifecycle","signal_score","vault_status","signer_status","signer_execute","signer_disarm","receipt_report","watch_create","watch_list","portfolio_snapshot","vision_analyze","browser_exec","xurl","knowledge_search","x402_prepare"]),c="deny",L=256*1024,T=128,u=Object.freeze({version:1,source:"default",defaultDecision:c,allow:i,deny:Object.freeze([])});function s(e){let t=new Set;if(!Array.isArray(e))return t;for(let o of e){if(typeof o!="string")continue;let r=o.trim();r.length===0||r.length>T||t.add(r)}return t}function P(e){return{allow:!1,reason:e}}function O(e){return{allow:!0,reason:e}}var _="extension-prepare-only",p=Object.freeze(["oracle_cli","memory_search","skill_load","skill_list","web_fetch","web_search","evidence_read","todo_list","todo_set","session_search","research_delegate","rlm","deep_research","clarify","code_eval","approval_preview","research_artifact","portfolio_analyze","tax_lots","position_health","governance_prepare","safety_intelligence","portfolio_risk","trade_lifecycle","signal_score","vault_status","signer_status","receipt_report","watch_list","portfolio_snapshot","vision_analyze","knowledge_search"]),d=new Set(p);function h(e=process.env){return e?.ORACLE_EXECUTION_MODE===_}function w(e,t=process.env){if(!h(t))return O("allowed: normal Oracle execution mode");let o=typeof e?.name=="string"?e.name.trim():"";return!o||!d.has(o)?P(`denied: tool "${o||"unknown"}" is outside extension prepare-only mode`):O(`allowed: tool "${o}" is inside extension prepare-only mode`)}function j(e,t=process.env){if(!h(t))return e;let o=[...s(e?.allow)].filter(n=>d.has(n)),r=new Set([...s(e?.deny),...i.filter(n=>!d.has(n))]);return Object.freeze({version:1,source:`${String(e?.source||"default")}:extension-prepare-only`,defaultDecision:c,allow:Object.freeze(o),deny:Object.freeze([...r])})}var z="ORACLE_TOOL_SURFACE",a=Object.freeze({PUBLIC_APP:"public-app",RESEARCH_X_TELEGRAM:"research-x-telegram",OWNER_DESK:"owner-desk"}),N=Object.freeze(Object.values(a));function m(e){let t=e.filter(o=>!i.includes(o));if(t.length)throw new Error(`tool surface allowlist names unknown shipped tools: ${t.join(", ")}`);return Object.freeze([...e])}var E=m(["oracle_cli","memory_search","skill_load","skill_list","web_fetch","web_search","evidence_read","todo_list","todo_set","session_search","research_delegate","rlm","deep_research","clarify","code_eval","approval_preview","research_artifact","portfolio_analyze","tax_lots","position_health","governance_prepare","safety_intelligence","portfolio_risk","trade_lifecycle","signal_score","receipt_report","watch_list","portfolio_snapshot","vision_analyze","knowledge_search","x402_prepare"]),S=m([...E,"file_read","meta_analyze","cron_list","mcp_list","xurl"]),g=Object.freeze([...i]),Y=Object.freeze({[a.PUBLIC_APP]:E,[a.RESEARCH_X_TELEGRAM]:S,[a.OWNER_DESK]:g}),C=Object.freeze({[a.PUBLIC_APP]:new Set(E),[a.RESEARCH_X_TELEGRAM]:new Set(S),[a.OWNER_DESK]:new Set(g)});function k(e=process.env){let t=e?.[z];return typeof t!="string"?"":t.trim()}function D(e){let t=typeof e=="string"?e.trim():"";return t?C[t]||new Set:null}function $(e,t=process.env){let o=k(t);if(!o)return e;let r=D(o),n=N.includes(o)?o:"unknown",A=[...s(e?.allow)].filter(f=>r.has(f)),b=new Set([...s(e?.deny),...i.filter(f=>!r.has(f))]);return Object.freeze({version:1,source:`${String(e?.source||"default")}:surface-${n}`,defaultDecision:c,allow:Object.freeze(A),deny:Object.freeze([...b])})}function l(e,t=process.env){return $(j(e,t),t)}function I(e=process.env){let t=e&&e.ORACLE_CONFIG_DIR||y.join(R(),".config","oracle");return y.join(t,"tool-policy.json")}function x(e=process.env){try{let t=I(e),o=v.readFileSync(t,"utf8");if(typeof o!="string"||o.length>L)return l(u,e);let r=JSON.parse(o);if(!r||typeof r!="object"||Array.isArray(r))return l(u,e);let n=Array.isArray(r.allow)?s(r.allow):s(i);return l(Object.freeze({version:1,source:t,defaultDecision:c,allow:Object.freeze([...n]),deny:Object.freeze([...s(r.deny)])}),e)}catch{return l(u,e)}}function M(e=process.env){let t={...e,ORACLE_EXECUTION_MODE:_},o=x(t);return{ok:w({name:"signer_execute",args:{}},t).allow===!1&&!o.allow.includes("signer_execute"),version:1,mode:_,signerExecute:!1,tools:p}}var B={name:"extension-policy",summary:"attest the extension prepare-only tool boundary",group:"system",usage:"oracle extension-policy --json",async run(e){if(e.argv.length!==1||e.argv[0]!=="--json")return process.stderr.write(`oracle extension-policy requires --json
 `),1;let t=M();return process.stdout.write(`${JSON.stringify(t)}
 `),t.ok?0:1}};export{B as default,M as extensionPolicyAttestation};