@orangecheck/agent-anthropic 1.1.2 → 1.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/index.js +6 -1
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +7 -2
- package/dist/index.mjs.map +1 -1
- package/package.json +3 -3
- package/src/default-scope.test.ts +52 -0
- package/src/index.ts +9 -3
package/README.md
CHANGED
|
@@ -68,7 +68,7 @@ The stamp's `content.hash` is a SHA-256 of the RFC-8785-canonicalized JSON:
|
|
|
68
68
|
|
|
69
69
|
This shape is minimal by design — a verifier reconstructs it from the three fields without knowing anything Anthropic-SDK-specific.
|
|
70
70
|
|
|
71
|
-
The action's `scope_exercised` defaults to `anthropic:tool(name
|
|
71
|
+
The action's `scope_exercised` defaults to `anthropic:tool(name="<tool>")` (the name quoted, so it is read as written), which is the tightest scope that exactly identifies the call. Callers who want a narrower scope can pass `scopeExercised` explicitly; `stampToolUse` pre-flights sub-scope containment against the delegation.
|
|
72
72
|
|
|
73
73
|
## API
|
|
74
74
|
|
package/dist/index.js
CHANGED
|
@@ -29,7 +29,12 @@ function toolUseId(agentAddress, signedAt, delegationId, scopeExercised, t) {
|
|
|
29
29
|
});
|
|
30
30
|
}
|
|
31
31
|
async function stampToolUse(input) {
|
|
32
|
-
const scopeExercised = input.scopeExercised ??
|
|
32
|
+
const scopeExercised = input.scopeExercised ?? agentCore.canonicalizeScope({
|
|
33
|
+
product: "anthropic",
|
|
34
|
+
verb: "tool",
|
|
35
|
+
// A quoted value, read as written: a tool called "*" is that tool.
|
|
36
|
+
constraints: [{ key: "name", op: "=", value: input.toolUse.name, quoted: true }]
|
|
37
|
+
});
|
|
33
38
|
agentCore.assertScopeGranted(input.delegation, scopeExercised, "stampToolUse");
|
|
34
39
|
const bytes = canonicalizeToolUse(input.toolUse);
|
|
35
40
|
return agentSigner.signAsAgent({
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/index.ts"],"names":["canonicalize","hexEncode","sha256","computeActionId","assertScopeGranted","signAsAgent"],"mappings":";;;;;;;
|
|
1
|
+
{"version":3,"sources":["../src/index.ts"],"names":["canonicalize","hexEncode","sha256","computeActionId","canonicalizeScope","assertScopeGranted","signAsAgent"],"mappings":";;;;;;;AAgDO,SAAS,oBAAoB,CAAA,EAAiC;AACjE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,MAAM,CAAA,CAAE;AAAA,GACZ;AACA,EAAA,MAAM,GAAA,GAAMA,uBAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,YAAY,CAAA,EAA6B;AACrD,EAAA,OAAO,YAAYC,mBAAA,CAAUC,aAAA,CAAO,mBAAA,CAAoB,CAAC,CAAC,CAAC,CAAA;AAC/D;AAEO,SAAS,SAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,CAAA,EACM;AACN,EAAA,OAAOC,yBAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,YAAY,CAAC,CAAA;AAAA,IAC3B,cAAA,EAAgB,mBAAA,CAAoB,CAAC,CAAA,CAAE,UAAA;AAAA,IACvC,YAAA,EAAc,kDAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAmBA,eAAsB,aAAa,KAAA,EAAmD;AAClF,EAAA,MAAM,cAAA,GACF,KAAA,CAAM,cAAA,IAAkBC,2BAAA,CAAkB;AAAA,IACtC,OAAA,EAAS,WAAA;AAAA,IACT,IAAA,EAAM,MAAA;AAAA;AAAA,IAEN,WAAA,EAAa,CAAC,EAAE,GAAA,EAAK,MAAA,EAAQ,EAAA,EAAI,GAAA,EAAK,KAAA,EAAO,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAM,MAAA,EAAQ,MAAM;AAAA,GAClF,CAAA;AAEL,EAAAC,4BAAA,CAAmB,KAAA,CAAM,UAAA,EAAY,cAAA,EAAgB,cAAc,CAAA;AAEnE,EAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,KAAA,CAAM,OAAO,CAAA;AAC/C,EAAA,OAAOC,uBAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA,CAAY,MAAM,OAAO,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAW;AAAA,IACtE,IAAA,EAAM,kDAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAsBA,eAAsB,gBAClB,KAAA,EACiC;AACjC,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,KAAK,CAAA;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,IAAA,CAAK,MAAM,OAAO,CAAA;AAC7C,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC5B","file":"index.js","sourcesContent":["// @orangecheck/agent-anthropic — wrap Anthropic Tool Use invocations in\n// OC Agent action envelopes.\n//\n// Anthropic's Messages API surfaces tool calls as `tool_use` content\n// blocks: { type: 'tool_use', id, name, input }. This module canonicalizes\n// each tool_use, hashes it, and produces an agent-action envelope binding\n// the BIP-322-authenticated agent to the (tool_name, input) tuple — at a\n// scope of `anthropic:tool(name=\"<tool>\")`.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n assertScopeGranted,\n canonicalize,\n canonicalizeScope,\n computeActionId,\n hexEncode,\n type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n signAsAgent,\n type ActionEnvelope,\n type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Canonicalization of an Anthropic tool_use\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface AnthropicToolUse {\n /** The `id` Anthropic assigns to this tool_use block (passed back as tool_use_id on result). */\n id: string;\n /** The tool name registered in your `tools` array on messages.create. */\n name: string;\n /** The model's structured input for this tool — JSON-serializable. */\n input: Record<string, unknown>;\n}\n\n/**\n * Produce the canonical bytes for an Anthropic tool_use. The bytes are what\n * the agent-action envelope's `content.hash` is a SHA-256 of.\n *\n * Shape (RFC 8785 canonical JSON, then trailing LF):\n * {\n * \"id\": <tool_use_id>,\n * \"input\": <canonical JSON of input>,\n * \"name\": <tool name>\n * }\n */\nexport function canonicalizeToolUse(t: AnthropicToolUse): Uint8Array {\n const canon = {\n id: t.id,\n input: t.input,\n name: t.name,\n };\n const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n return new TextEncoder().encode(str + '\\n');\n}\n\nexport function toolUseHash(t: AnthropicToolUse): string {\n return 'sha256:' + hexEncode(sha256(canonicalizeToolUse(t)));\n}\n\nexport function toolUseId(\n agentAddress: string,\n signedAt: string,\n delegationId: string,\n scopeExercised: string,\n t: AnthropicToolUse\n): string {\n return computeActionId({\n address: agentAddress,\n content_hash: toolUseHash(t),\n content_length: canonicalizeToolUse(t).byteLength,\n content_mime: 'application/vnd.oc-agent.anthropic-tool-use+json',\n signed_at: signedAt,\n delegation_id: delegationId,\n scope_exercised: scopeExercised,\n });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamped tool_use\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface StampToolUseInput {\n agent: SignerRef;\n delegation: DelegationEnvelope;\n toolUse: AnthropicToolUse;\n /** Defaults to `anthropic:tool(name=\"<tool>\")` — the tightest admissible sub-scope. */\n scopeExercised?: string;\n signedAt?: Date;\n}\n\n/**\n * Stamp an Anthropic tool_use without executing it. Useful for pre-\n * authorization flows or batch stamping.\n */\nexport async function stampToolUse(input: StampToolUseInput): Promise<ActionEnvelope> {\n const scopeExercised =\n input.scopeExercised ?? canonicalizeScope({\n product: 'anthropic',\n verb: 'tool',\n // A quoted value, read as written: a tool called \"*\" is that tool.\n constraints: [{ key: 'name', op: '=', value: input.toolUse.name, quoted: true }],\n });\n\n assertScopeGranted(input.delegation, scopeExercised, 'stampToolUse');\n\n const bytes = canonicalizeToolUse(input.toolUse);\n return signAsAgent({\n agent: input.agent,\n delegation: input.delegation as never,\n content: { hash: toolUseHash(input.toolUse), length: bytes.byteLength },\n mime: 'application/vnd.oc-agent.anthropic-tool-use+json',\n scopeExercised,\n signedAt: input.signedAt,\n });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// invokeWithStamp — call the tool AND produce the stamp around it\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface InvokeWithStampInput<T> extends StampToolUseInput {\n /** Your handler that actually runs the tool. Returns whatever the tool returns. */\n call: (toolUse: AnthropicToolUse) => Promise<T>;\n}\n\nexport interface InvokeWithStampResult<T> {\n result: T;\n action: ActionEnvelope;\n}\n\n/**\n * Stamp the tool_use first, then execute the handler. The stamped envelope\n * is returned alongside the result so the caller can ship them together —\n * e.g. as a side-channel to an audit log, or as the `_oc_agent` metadata on\n * the tool_result content block back to Claude.\n */\nexport async function invokeWithStamp<T>(\n input: InvokeWithStampInput<T>\n): Promise<InvokeWithStampResult<T>> {\n const action = await stampToolUse(input);\n const result = await input.call(input.toolUse);\n return { result, action };\n}\n"]}
|
package/dist/index.mjs
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { sha256 } from '@noble/hashes/sha256';
|
|
2
|
-
import { canonicalize, hexEncode, computeActionId, assertScopeGranted } from '@orangecheck/agent-core';
|
|
2
|
+
import { canonicalize, hexEncode, computeActionId, canonicalizeScope, assertScopeGranted } from '@orangecheck/agent-core';
|
|
3
3
|
import { signAsAgent } from '@orangecheck/agent-signer';
|
|
4
4
|
|
|
5
5
|
// src/index.ts
|
|
@@ -27,7 +27,12 @@ function toolUseId(agentAddress, signedAt, delegationId, scopeExercised, t) {
|
|
|
27
27
|
});
|
|
28
28
|
}
|
|
29
29
|
async function stampToolUse(input) {
|
|
30
|
-
const scopeExercised = input.scopeExercised ??
|
|
30
|
+
const scopeExercised = input.scopeExercised ?? canonicalizeScope({
|
|
31
|
+
product: "anthropic",
|
|
32
|
+
verb: "tool",
|
|
33
|
+
// A quoted value, read as written: a tool called "*" is that tool.
|
|
34
|
+
constraints: [{ key: "name", op: "=", value: input.toolUse.name, quoted: true }]
|
|
35
|
+
});
|
|
31
36
|
assertScopeGranted(input.delegation, scopeExercised, "stampToolUse");
|
|
32
37
|
const bytes = canonicalizeToolUse(input.toolUse);
|
|
33
38
|
return signAsAgent({
|
package/dist/index.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;
|
|
1
|
+
{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;AAgDO,SAAS,oBAAoB,CAAA,EAAiC;AACjE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,MAAM,CAAA,CAAE;AAAA,GACZ;AACA,EAAA,MAAM,GAAA,GAAM,aAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,YAAY,CAAA,EAA6B;AACrD,EAAA,OAAO,YAAY,SAAA,CAAU,MAAA,CAAO,mBAAA,CAAoB,CAAC,CAAC,CAAC,CAAA;AAC/D;AAEO,SAAS,SAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,CAAA,EACM;AACN,EAAA,OAAO,eAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,YAAY,CAAC,CAAA;AAAA,IAC3B,cAAA,EAAgB,mBAAA,CAAoB,CAAC,CAAA,CAAE,UAAA;AAAA,IACvC,YAAA,EAAc,kDAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAmBA,eAAsB,aAAa,KAAA,EAAmD;AAClF,EAAA,MAAM,cAAA,GACF,KAAA,CAAM,cAAA,IAAkB,iBAAA,CAAkB;AAAA,IACtC,OAAA,EAAS,WAAA;AAAA,IACT,IAAA,EAAM,MAAA;AAAA;AAAA,IAEN,WAAA,EAAa,CAAC,EAAE,GAAA,EAAK,MAAA,EAAQ,EAAA,EAAI,GAAA,EAAK,KAAA,EAAO,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAM,MAAA,EAAQ,MAAM;AAAA,GAClF,CAAA;AAEL,EAAA,kBAAA,CAAmB,KAAA,CAAM,UAAA,EAAY,cAAA,EAAgB,cAAc,CAAA;AAEnE,EAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,KAAA,CAAM,OAAO,CAAA;AAC/C,EAAA,OAAO,WAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA,CAAY,MAAM,OAAO,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAW;AAAA,IACtE,IAAA,EAAM,kDAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAsBA,eAAsB,gBAClB,KAAA,EACiC;AACjC,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,KAAK,CAAA;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,IAAA,CAAK,MAAM,OAAO,CAAA;AAC7C,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC5B","file":"index.mjs","sourcesContent":["// @orangecheck/agent-anthropic — wrap Anthropic Tool Use invocations in\n// OC Agent action envelopes.\n//\n// Anthropic's Messages API surfaces tool calls as `tool_use` content\n// blocks: { type: 'tool_use', id, name, input }. This module canonicalizes\n// each tool_use, hashes it, and produces an agent-action envelope binding\n// the BIP-322-authenticated agent to the (tool_name, input) tuple — at a\n// scope of `anthropic:tool(name=\"<tool>\")`.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n assertScopeGranted,\n canonicalize,\n canonicalizeScope,\n computeActionId,\n hexEncode,\n type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n signAsAgent,\n type ActionEnvelope,\n type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Canonicalization of an Anthropic tool_use\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface AnthropicToolUse {\n /** The `id` Anthropic assigns to this tool_use block (passed back as tool_use_id on result). */\n id: string;\n /** The tool name registered in your `tools` array on messages.create. */\n name: string;\n /** The model's structured input for this tool — JSON-serializable. */\n input: Record<string, unknown>;\n}\n\n/**\n * Produce the canonical bytes for an Anthropic tool_use. The bytes are what\n * the agent-action envelope's `content.hash` is a SHA-256 of.\n *\n * Shape (RFC 8785 canonical JSON, then trailing LF):\n * {\n * \"id\": <tool_use_id>,\n * \"input\": <canonical JSON of input>,\n * \"name\": <tool name>\n * }\n */\nexport function canonicalizeToolUse(t: AnthropicToolUse): Uint8Array {\n const canon = {\n id: t.id,\n input: t.input,\n name: t.name,\n };\n const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n return new TextEncoder().encode(str + '\\n');\n}\n\nexport function toolUseHash(t: AnthropicToolUse): string {\n return 'sha256:' + hexEncode(sha256(canonicalizeToolUse(t)));\n}\n\nexport function toolUseId(\n agentAddress: string,\n signedAt: string,\n delegationId: string,\n scopeExercised: string,\n t: AnthropicToolUse\n): string {\n return computeActionId({\n address: agentAddress,\n content_hash: toolUseHash(t),\n content_length: canonicalizeToolUse(t).byteLength,\n content_mime: 'application/vnd.oc-agent.anthropic-tool-use+json',\n signed_at: signedAt,\n delegation_id: delegationId,\n scope_exercised: scopeExercised,\n });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamped tool_use\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface StampToolUseInput {\n agent: SignerRef;\n delegation: DelegationEnvelope;\n toolUse: AnthropicToolUse;\n /** Defaults to `anthropic:tool(name=\"<tool>\")` — the tightest admissible sub-scope. */\n scopeExercised?: string;\n signedAt?: Date;\n}\n\n/**\n * Stamp an Anthropic tool_use without executing it. Useful for pre-\n * authorization flows or batch stamping.\n */\nexport async function stampToolUse(input: StampToolUseInput): Promise<ActionEnvelope> {\n const scopeExercised =\n input.scopeExercised ?? canonicalizeScope({\n product: 'anthropic',\n verb: 'tool',\n // A quoted value, read as written: a tool called \"*\" is that tool.\n constraints: [{ key: 'name', op: '=', value: input.toolUse.name, quoted: true }],\n });\n\n assertScopeGranted(input.delegation, scopeExercised, 'stampToolUse');\n\n const bytes = canonicalizeToolUse(input.toolUse);\n return signAsAgent({\n agent: input.agent,\n delegation: input.delegation as never,\n content: { hash: toolUseHash(input.toolUse), length: bytes.byteLength },\n mime: 'application/vnd.oc-agent.anthropic-tool-use+json',\n scopeExercised,\n signedAt: input.signedAt,\n });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// invokeWithStamp — call the tool AND produce the stamp around it\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface InvokeWithStampInput<T> extends StampToolUseInput {\n /** Your handler that actually runs the tool. Returns whatever the tool returns. */\n call: (toolUse: AnthropicToolUse) => Promise<T>;\n}\n\nexport interface InvokeWithStampResult<T> {\n result: T;\n action: ActionEnvelope;\n}\n\n/**\n * Stamp the tool_use first, then execute the handler. The stamped envelope\n * is returned alongside the result so the caller can ship them together —\n * e.g. as a side-channel to an audit log, or as the `_oc_agent` metadata on\n * the tool_result content block back to Claude.\n */\nexport async function invokeWithStamp<T>(\n input: InvokeWithStampInput<T>\n): Promise<InvokeWithStampResult<T>> {\n const action = await stampToolUse(input);\n const result = await input.call(input.toolUse);\n return { result, action };\n}\n"]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@orangecheck/agent-anthropic",
|
|
3
|
-
"version": "1.1.
|
|
3
|
+
"version": "1.1.4",
|
|
4
4
|
"description": "Wrap Anthropic Tool Use (Claude tool_use blocks) with OC Agent scope enforcement and emit a signed agent-action envelope per tool execution.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"bitcoin",
|
|
@@ -51,8 +51,8 @@
|
|
|
51
51
|
},
|
|
52
52
|
"dependencies": {
|
|
53
53
|
"@noble/hashes": "^1.5.0",
|
|
54
|
-
"@orangecheck/agent-core": "^2.
|
|
55
|
-
"@orangecheck/agent-signer": "^0.5.
|
|
54
|
+
"@orangecheck/agent-core": "^2.10.0",
|
|
55
|
+
"@orangecheck/agent-signer": "^0.5.2"
|
|
56
56
|
},
|
|
57
57
|
"devDependencies": {
|
|
58
58
|
"@types/node": "^22.10.2",
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
// The default exercised scope names the tool as a quoted value, so the name is
|
|
2
|
+
// read as written: a tool called "*" is that tool, not every tool.
|
|
3
|
+
import { describe, expect, it } from 'vitest';
|
|
4
|
+
|
|
5
|
+
import { parseScope, verifyAction } from '@orangecheck/agent-core';
|
|
6
|
+
import { createDelegation } from '@orangecheck/agent-signer';
|
|
7
|
+
|
|
8
|
+
import { stampToolUse } from './index.js';
|
|
9
|
+
|
|
10
|
+
const PRINCIPAL = 'bc1qprincipal000000000000000000000000000000';
|
|
11
|
+
const AGENT = 'bc1qagent0000000000000000000000000000000000';
|
|
12
|
+
const fakeSign = (address: string) => async (msg: string) =>
|
|
13
|
+
Buffer.from(`sig:${address}:${msg}`, 'utf8').toString('base64');
|
|
14
|
+
const fakeVerify = async (msg: string, sig: string, address: string) =>
|
|
15
|
+
sig === Buffer.from(`sig:${address}:${msg}`, 'utf8').toString('base64');
|
|
16
|
+
|
|
17
|
+
const stamp = async (scope: string, name: string) => {
|
|
18
|
+
const delegation = await createDelegation({
|
|
19
|
+
principal: { address: PRINCIPAL, signMessage: fakeSign(PRINCIPAL) },
|
|
20
|
+
agentAddress: AGENT,
|
|
21
|
+
scopes: [scope],
|
|
22
|
+
ttlMs: 60 * 60 * 1000,
|
|
23
|
+
});
|
|
24
|
+
const action = await stampToolUse({
|
|
25
|
+
agent: { address: AGENT, signMessage: fakeSign(AGENT) },
|
|
26
|
+
delegation,
|
|
27
|
+
toolUse: { id: 't1', name, input: {} },
|
|
28
|
+
});
|
|
29
|
+
const r = await verifyAction({ action, delegation, verifyBip322: fakeVerify, skipRevocationCheck: true });
|
|
30
|
+
return { action, ok: r.ok };
|
|
31
|
+
};
|
|
32
|
+
|
|
33
|
+
describe('the default exercised scope', () => {
|
|
34
|
+
it('quotes the name', async () => {
|
|
35
|
+
const { action, ok } = await stamp('anthropic:tool(name=search)', 'search');
|
|
36
|
+
expect(action.scope_exercised).toBe('anthropic:tool(name="search")');
|
|
37
|
+
expect(ok).toBe(true);
|
|
38
|
+
});
|
|
39
|
+
|
|
40
|
+
it('stamps a tool called "*" as that tool, not every tool', async () => {
|
|
41
|
+
const { action, ok } = await stamp('anthropic:tool(name="*")', '*');
|
|
42
|
+
expect(action.scope_exercised).toBe('anthropic:tool(name="*")');
|
|
43
|
+
expect(ok).toBe(true);
|
|
44
|
+
});
|
|
45
|
+
|
|
46
|
+
it('keeps scope punctuation in a name as part of the name', async () => {
|
|
47
|
+
const { action, ok } = await stamp('anthropic:tool(name="a,b")', 'a,b');
|
|
48
|
+
const c = parseScope(action.scope_exercised).constraints[0];
|
|
49
|
+
expect(c).toEqual({ key: 'name', op: '=', value: 'a,b', quoted: true });
|
|
50
|
+
expect(ok).toBe(true);
|
|
51
|
+
});
|
|
52
|
+
});
|
package/src/index.ts
CHANGED
|
@@ -5,12 +5,13 @@
|
|
|
5
5
|
// blocks: { type: 'tool_use', id, name, input }. This module canonicalizes
|
|
6
6
|
// each tool_use, hashes it, and produces an agent-action envelope binding
|
|
7
7
|
// the BIP-322-authenticated agent to the (tool_name, input) tuple — at a
|
|
8
|
-
// scope of `anthropic:tool(name
|
|
8
|
+
// scope of `anthropic:tool(name="<tool>")`.
|
|
9
9
|
|
|
10
10
|
import { sha256 } from '@noble/hashes/sha256';
|
|
11
11
|
import {
|
|
12
12
|
assertScopeGranted,
|
|
13
13
|
canonicalize,
|
|
14
|
+
canonicalizeScope,
|
|
14
15
|
computeActionId,
|
|
15
16
|
hexEncode,
|
|
16
17
|
type DelegationEnvelope,
|
|
@@ -85,7 +86,7 @@ export interface StampToolUseInput {
|
|
|
85
86
|
agent: SignerRef;
|
|
86
87
|
delegation: DelegationEnvelope;
|
|
87
88
|
toolUse: AnthropicToolUse;
|
|
88
|
-
/** Defaults to `anthropic:tool(name
|
|
89
|
+
/** Defaults to `anthropic:tool(name="<tool>")` — the tightest admissible sub-scope. */
|
|
89
90
|
scopeExercised?: string;
|
|
90
91
|
signedAt?: Date;
|
|
91
92
|
}
|
|
@@ -96,7 +97,12 @@ export interface StampToolUseInput {
|
|
|
96
97
|
*/
|
|
97
98
|
export async function stampToolUse(input: StampToolUseInput): Promise<ActionEnvelope> {
|
|
98
99
|
const scopeExercised =
|
|
99
|
-
input.scopeExercised ??
|
|
100
|
+
input.scopeExercised ?? canonicalizeScope({
|
|
101
|
+
product: 'anthropic',
|
|
102
|
+
verb: 'tool',
|
|
103
|
+
// A quoted value, read as written: a tool called "*" is that tool.
|
|
104
|
+
constraints: [{ key: 'name', op: '=', value: input.toolUse.name, quoted: true }],
|
|
105
|
+
});
|
|
100
106
|
|
|
101
107
|
assertScopeGranted(input.delegation, scopeExercised, 'stampToolUse');
|
|
102
108
|
|