@pentoshi/clai 3.5.1 → 3.7.2

package/dist/safety/engagement-policy.js

@@ -0,0 +1,198 @@
+import { normalizeScopeTarget, targetInScope } from "../store/scope.js";
+const methodAllowed = (method, scope) => {
+    if (!scope.allowedMethods?.length)
+        return true;
+    return scope.allowedMethods.some((allowed) => allowed.toUpperCase() === method.toUpperCase());
+};
+const pathAllowed = (path, scope) => {
+    if (!scope.allowedPaths?.length)
+        return true;
+    const normalized = path.startsWith("/") ? path : `/${path}`;
+    return scope.allowedPaths.some((allowed) => {
+        const prefix = allowed.startsWith("/") ? allowed : `/${allowed}`;
+        return normalized === prefix || normalized.startsWith(prefix.endsWith("/") ? prefix : `${prefix}/`);
+    });
+};
+export function evaluateEngagementAction(scope, action, now = Date.now()) {
+    const target = normalizeScopeTarget(action.target);
+    const deny = (reason) => ({
+        allowed: false,
+        reason,
+        normalizedTarget: target,
+        capability: action.capability,
+        phase: action.phase,
+    });
+    if (!scope || !isScopeActiveAt(scope, now))
+        return deny("engagement scope is missing, empty, or outside its time window");
+    if (!targetInScope(target, scope))
+        return deny(`target is excluded or not authorized: ${target}`);
+    if (scope.allowedPhases?.length && !scope.allowedPhases.includes(action.phase)) {
+        return deny(`phase is not authorized: ${action.phase}`);
+    }
+    if (action.port !== undefined && scope.allowedPorts?.length && !scope.allowedPorts.includes(action.port)) {
+        return deny(`port is not authorized: ${action.port}`);
+    }
+    if (!methodAllowed(action.method ?? "GET", scope))
+        return deny(`HTTP method is not authorized: ${action.method}`);
+    if (!pathAllowed(action.path ?? "/", scope))
+        return deny(`path is not authorized: ${action.path}`);
+    for (const redirect of action.redirectChain ?? []) {
+        if (!targetInScope(redirect, scope))
+            return deny(`redirect destination is excluded or out of scope: ${normalizeScopeTarget(redirect)}`);
+    }
+    for (const address of action.resolvedAddresses ?? []) {
+        if (!targetInScope(address, scope))
+            return deny(`DNS resolution escaped authorized assets: ${address}`);
+    }
+    return {
+        allowed: true,
+        reason: "authorized by engagement scope",
+        normalizedTarget: target,
+        capability: action.capability,
+        phase: action.phase,
+    };
+}
+function isScopeActiveAt(scope, now) {
+    if (!scope.authorizedTargets?.length)
+        return false;
+    if (!scope.expiresAt)
+        return true;
+    const expires = Date.parse(scope.expiresAt);
+    return Number.isNaN(expires) || now <= expires;
+}
+/** In-memory token bucket/concurrency enforcement; inject clock for deterministic tests. */
+export class EngagementPolicyEngine {
+    now;
+    tokens = 0;
+    lastRefill = 0;
+    active = 0;
+    scopeIdentity = "";
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    acquire(scope, action) {
+        const decision = evaluateEngagementAction(scope, action, this.now());
+        if (!decision.allowed || !scope)
+            return { decision, release: () => undefined };
+        const identity = JSON.stringify([scope.name, scope.updatedAt, scope.authorizedTargets, scope.maxRate, scope.maxConcurrency]);
+        const rate = Math.max(0, scope.maxRate ?? Number.POSITIVE_INFINITY);
+        const concurrency = Math.max(1, Math.floor(scope.maxConcurrency ?? Number.MAX_SAFE_INTEGER));
+        const now = this.now();
+        if (identity !== this.scopeIdentity) {
+            this.scopeIdentity = identity;
+            this.tokens = Number.isFinite(rate) ? rate : Number.MAX_SAFE_INTEGER;
+            this.lastRefill = now;
+            this.active = 0;
+        }
+        if (this.active >= concurrency) {
+            return { decision: { ...decision, allowed: false, reason: "engagement concurrency limit reached" }, release: () => undefined };
+        }
+        if (Number.isFinite(rate)) {
+            const elapsedSeconds = Math.max(0, now - this.lastRefill) / 1_000;
+            this.tokens = Math.min(rate, this.tokens + elapsedSeconds * rate);
+            this.lastRefill = now;
+            if (this.tokens < 1) {
+                return { decision: { ...decision, allowed: false, reason: "engagement rate limit reached" }, release: () => undefined };
+            }
+            this.tokens -= 1;
+        }
+        this.active += 1;
+        let released = false;
+        return {
+            decision,
+            release: () => {
+                if (released)
+                    return;
+                released = true;
+                this.active = Math.max(0, this.active - 1);
+            },
+        };
+    }
+}
+export function actionFromUrl(input) {
+    const parsed = new URL(input.url);
+    return {
+        target: parsed.hostname,
+        url: input.url,
+        port: parsed.port ? Number(parsed.port) : parsed.protocol === "https:" ? 443 : 80,
+        path: parsed.pathname || "/",
+        method: input.method ?? "GET",
+        phase: input.phase ?? "enumeration",
+        capability: input.capability ?? (/^(?:GET|HEAD|OPTIONS)$/i.test(input.method ?? "GET") ? "passive" : "active-enumeration"),
+        redirectChain: input.redirectChain,
+        resolvedAddresses: input.resolvedAddresses,
+    };
+}
+export function engagementActionForToolCall(call) {
+    if (call.name === "pentest.webDiscover") {
+        const url = String(call.args.baseUrl ?? "");
+        return url ? actionFromUrl({ url, phase: "enumeration", capability: "active-enumeration" }) : undefined;
+    }
+    if (call.name === "pentest.apiEnumerate") {
+        const url = String(call.args.specUrl ?? "");
+        return url ? actionFromUrl({ url, phase: "enumeration", capability: "active-enumeration" }) : undefined;
+    }
+    if (call.name === "pentest.authCompare") {
+        const url = String(call.args.url ?? "");
+        return url ? actionFromUrl({ url, phase: "authentication", capability: "authentication" }) : undefined;
+    }
+    if (call.name === "pentest.scanStatus") {
+        const target = String(call.args.target ?? "");
+        return target ? { target, path: "/", method: "GET", phase: "recon", capability: "passive" } : undefined;
+    }
+    if (call.name === "http.fetch") {
+        const url = typeof call.args.url === "string" ? call.args.url : "";
+        if (!url)
+            return undefined;
+        return actionFromUrl({
+            url,
+            method: typeof call.args.method === "string" ? call.args.method : "GET",
+            phase: /^(?:GET|HEAD|OPTIONS)$/i.test(String(call.args.method ?? "GET")) ? "enumeration" : "exploitation",
+        });
+    }
+    if (call.name === "net.scan" || call.name === "pentest.recon") {
+        const target = String(call.args.target ?? call.args.host ?? "");
+        if (!target)
+            return undefined;
+        const port = typeof call.args.port === "number" ? call.args.port : undefined;
+        return { target, port, path: "/", method: "GET", phase: "recon", capability: "active-enumeration" };
+    }
+    if (call.name !== "shell.exec" && call.name !== "shell.start")
+        return undefined;
+    const command = String(call.args.command ?? "");
+    const url = command.match(/https?:\/\/[^\s'"<>]+/i)?.[0];
+    const hostCandidates = [...command.matchAll(/(?:^|\s)((?:[a-z0-9-]+\.)+[a-z]{2,}|(?:\d{1,3}\.){3}\d{1,3})(?=\s|$)/gi)]
+        .map((match) => match[1])
+        .filter((candidate) => Boolean(candidate));
+    const host = url ? new URL(url).hostname : hostCandidates.at(-1);
+    if (!host)
+        return undefined;
+    const destructive = /\b(?:rm\s+-rf|mkfs|dd\s+if=|shutdown|reboot|drop\s+(?:database|table)|delete\s+from)\b/i.test(command);
+    const persistence = /\b(?:crontab|launchctl|systemctl\s+enable|schtasks|authorized_keys|startup|persistence)\b/i.test(command);
+    const exploitation = /\b(?:sqlmap|hydra|metasploit|msfconsole|exploit|payload|reverse.shell|csrf|xss|union\s+select)\b/i.test(command);
+    const authentication = /\b(?:login|auth|password|credential|jwt|session|hydra)\b/i.test(command);
+    const phase = destructive || persistence
+        ? "post-exploitation"
+        : exploitation
+            ? "exploitation"
+            : authentication
+                ? "authentication"
+                : "enumeration";
+    const capability = destructive
+        ? "destructive"
+        : persistence
+            ? "persistence"
+            : exploitation
+                ? "exploitation"
+                : authentication
+                    ? "authentication"
+                    : "active-enumeration";
+    return {
+        target: host,
+        ...(url ? { url, port: Number(new URL(url).port || (new URL(url).protocol === "https:" ? 443 : 80)), path: new URL(url).pathname } : {}),
+        method: /\bcurl\b[^\n]*\s-X\s+([A-Z]+)/i.exec(command)?.[1] ?? "GET",
+        phase,
+        capability,
+    };
+}
+//# sourceMappingURL=engagement-policy.js.map

package/dist/safety/engagement-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engagement-policy.js","sourceRoot":"","sources":["../../src/safety/engagement-policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAqCxE,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,KAAsB,EAAW,EAAE;IACxE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AAChG,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAsB,EAAW,EAAE;IACpE,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5D,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QACjE,OAAO,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,UAAU,wBAAwB,CACtC,KAAkC,EAClC,MAAwB,EACxB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAkB,EAAE,CAAC,CAAC;QAChD,OAAO,EAAE,KAAK;QACd,MAAM;QACN,gBAAgB,EAAE,MAAM;QACxB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAC1H,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;IAClG,IAAI,KAAK,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC,4BAA4B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACzG,OAAO,IAAI,CAAC,2BAA2B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,kCAAkC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAClH,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,2BAA2B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAEnG,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,qDAAqD,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1I,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QACrD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,6CAA6C,OAAO,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,gCAAgC;QACxC,gBAAgB,EAAE,MAAM;QACxB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB,EAAE,GAAW;IAC1D,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC;AACjD,CAAC;AAOD,4FAA4F;AAC5F,MAAM,OAAO,sBAAsB;IAMJ;IALrB,MAAM,GAAG,CAAC,CAAC;IACX,UAAU,GAAG,CAAC,CAAC;IACf,MAAM,GAAG,CAAC,CAAC;IACX,aAAa,GAAG,EAAE,CAAC;IAE3B,YAA6B,MAAoB,IAAI,CAAC,GAAG;QAA5B,QAAG,GAAH,GAAG,CAAyB;IAAG,CAAC;IAE7D,OAAO,CAAC,KAAkC,EAAE,MAAwB;QAClE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QAC7H,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,QAAQ,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;YAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC;YACrE,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;YACtB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;YAC/B,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;QACjI,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;YAClE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,cAAc,GAAG,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;YACtB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;YAC1H,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,GAAG,EAAE;gBACZ,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC7C,CAAC;SACF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,KAO7B;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,QAAQ;QACvB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACjF,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,GAAG;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK;QAC7B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,aAAa;QACnC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAC1H,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAc;IACxD,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,aAAa,CAAC;YACnB,GAAG;YACH,MAAM,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;YACvE,KAAK,EAAE,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc;SAC1G,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IAChF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,wEAAwE,CAAC,CAAC;SACnH,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,WAAW,GAAG,yFAAyF,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5H,MAAM,WAAW,GAAG,4FAA4F,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/H,MAAM,YAAY,GAAG,mGAAmG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvI,MAAM,cAAc,GAAG,2DAA2D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjG,MAAM,KAAK,GAAoB,WAAW,IAAI,WAAW;QACvD,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,YAAY;YACZ,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,cAAc;gBACd,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,aAAa,CAAC;IACtB,MAAM,UAAU,GAAqB,WAAW;QAC9C,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,YAAY;gBACZ,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,cAAc;oBACd,CAAC,CAAC,gBAAgB;oBAClB,CAAC,CAAC,oBAAoB,CAAC;IAC/B,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxI,MAAM,EAAE,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK;QACpE,KAAK;QACL,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/store/config.d.ts

@@ -33,6 +33,13 @@ export interface ClaiConfig {
     disableKeychain: boolean;
     /** Permissions mode for auto-confirming tool calls ("default" or "allow-all"). */
     permissions?: "default" | "allow-all";
+    /**
+     * Tool calling protocol:
+     * - auto (default): native when dialect supports it, text fallback otherwise
+     * - native: prefer native; still text-fallback on tools-unsupported
+     * - text: force legacy fenced tool protocol
+     */
+    toolCalling?: "auto" | "native" | "text";
 }
 /**
  * Best-effort classification for the built-in providers. Some "free-cloud"

package/dist/store/config.js

@@ -47,6 +47,7 @@ const defaults = {
     activeSearchProvider: "duckduckgo",
     disableKeychain: false,
     permissions: "default",
+    toolCalling: "auto",
 };
 const store = (() => {
     try {

package/dist/store/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/store/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAsC3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAyC;IACpE,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,YAAY;IACpB,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,YAAY;IACzB,MAAM,EAAE,YAAY;IACpB,YAAY,EAAE,YAAY;IAC1B,MAAM,EAAE,YAAY;IACpB,YAAY,EAAE,YAAY;CAC3B,CAAC;AAEF,MAAM,QAAQ,GAAe;IAC3B,eAAe,EAAE,QAAQ;IACzB,YAAY,EAAE,aAAa,CAAC,MAAM;IAClC,WAAW,EAAE,KAAK;IAClB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,KAAK;IACxB,YAAY,EAAE,CAAC,OAAO,EAAE,CAAC;IACzB,UAAU,EAAE,wBAAwB;IACpC,SAAS,EAAE,KAAK;IAChB,eAAe,EAAE,CAAC;IAClB,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,QAAQ,EAAE,KAAK;IACf,gBAAgB,EAAE,KAAK;IACvB,OAAO,EAAE,KAAK;IACd,YAAY,EAAE,KAAK;IACnB,WAAW,EAAE,KAAK;IAClB,oEAAoE;IACpE,kEAAkE;IAClE,qBAAqB,EAAE,CAAC;IACxB,YAAY,EAAE,KAAK;IACnB,oBAAoB,EAAE,YAAY;IAClC,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,SAAS;CACvB,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE;IAClB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,IAAI,CAAa;YAC7B,WAAW,EAAE,MAAM;YACnB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,MAAM,UAAU,SAAS;IACvB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;IAC5B,MAAM,cAAc,GAAwC,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAE1E,EAAE,CAAC;QACF,cAAc,CAAC,QAAQ,CAAC,GAAG,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IACD,OAAO;QACL,GAAG,OAAO;QACV,YAAY,EAAE,qBAAqB,CACjC,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,YAAY,CACrB;QACD,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAA0B;IACrD,MAAM,IAAI,GAAG,EAAE,GAAG,SAAS,EAAE,EAAE,GAAG,KAAK,EAAuB,CAAC;IAC/D,IAAI,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAoB;IACrD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,YAAY,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAU;IACvC,OAAO,YAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAAoB,EACpB,KAAa;IAEb,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC;IAC5E,OAAO,YAAY,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAoB;IACnD,MAAM,UAAU,GAAG,SAAS,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,UAAU;QACf,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC7C,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAmC;IAC7D,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrC,MAAM,IAAI,GAAwB;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;KACvC,CAAC;IACF,OAAO,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,SAAS,EAAE,CAAC,oBAAoB,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAoB;IAC1D,OAAO,YAAY,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/store/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AA6C3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAyC;IACpE,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,YAAY;IACpB,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,YAAY;IACzB,MAAM,EAAE,YAAY;IACpB,YAAY,EAAE,YAAY;IAC1B,MAAM,EAAE,YAAY;IACpB,YAAY,EAAE,YAAY;CAC3B,CAAC;AAEF,MAAM,QAAQ,GAAe;IAC3B,eAAe,EAAE,QAAQ;IACzB,YAAY,EAAE,aAAa,CAAC,MAAM;IAClC,WAAW,EAAE,KAAK;IAClB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,KAAK;IACxB,YAAY,EAAE,CAAC,OAAO,EAAE,CAAC;IACzB,UAAU,EAAE,wBAAwB;IACpC,SAAS,EAAE,KAAK;IAChB,eAAe,EAAE,CAAC;IAClB,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,QAAQ,EAAE,KAAK;IACf,gBAAgB,EAAE,KAAK;IACvB,OAAO,EAAE,KAAK;IACd,YAAY,EAAE,KAAK;IACnB,WAAW,EAAE,KAAK;IAClB,oEAAoE;IACpE,kEAAkE;IAClE,qBAAqB,EAAE,CAAC;IACxB,YAAY,EAAE,KAAK;IACnB,oBAAoB,EAAE,YAAY;IAClC,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,SAAS;IACtB,WAAW,EAAE,MAAM;CACpB,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE;IAClB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,IAAI,CAAa;YAC7B,WAAW,EAAE,MAAM;YACnB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,MAAM,UAAU,SAAS;IACvB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;IAC5B,MAAM,cAAc,GAAwC,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAE1E,EAAE,CAAC;QACF,cAAc,CAAC,QAAQ,CAAC,GAAG,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IACD,OAAO;QACL,GAAG,OAAO;QACV,YAAY,EAAE,qBAAqB,CACjC,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,YAAY,CACrB;QACD,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAA0B;IACrD,MAAM,IAAI,GAAG,EAAE,GAAG,SAAS,EAAE,EAAE,GAAG,KAAK,EAAuB,CAAC;IAC/D,IAAI,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAoB;IACrD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,YAAY,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAU;IACvC,OAAO,YAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAAoB,EACpB,KAAa;IAEb,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC;IAC5E,OAAO,YAAY,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAoB;IACnD,MAAM,UAAU,GAAG,SAAS,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,UAAU;QACf,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC7C,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAmC;IAC7D,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrC,MAAM,IAAI,GAAwB;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;KACvC,CAAC;IACF,OAAO,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,SAAS,EAAE,CAAC,oBAAoB,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAoB;IAC1D,OAAO,YAAY,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/store/engagement.d.ts

@@ -0,0 +1,115 @@
+import type { EngagementScope } from "./scope.js";
+export type FindingState = "suspected" | "reproduced" | "verified" | "reported" | "remediated" | "retested" | "rejected" | "inconclusive";
+export type CoverageState = "applicable" | "covered" | "inconclusive" | "excluded";
+export interface EngagementFinding {
+    id: string;
+    title: string;
+    targetId: string;
+    state: FindingState;
+    reproduction?: string | undefined;
+    impact?: string | undefined;
+    remediation?: string | undefined;
+    evidenceIds: string[];
+    severity?: string | undefined;
+    updatedAt: string;
+}
+export interface EngagementEvidence {
+    id: string;
+    targetId: string;
+    testCaseId?: string | undefined;
+    artifactPath?: string | undefined;
+    artifactHash?: string | undefined;
+    observation: string;
+    observedAt: string;
+}
+export interface EngagementCheckpoint {
+    id: string;
+    actionId: string;
+    jobId: string;
+    status: string;
+    artifactPath: string;
+    offset: number;
+    observation: string;
+    recordedAt: string;
+}
+export interface EngagementActionRecord {
+    id: string;
+    targetId: string;
+    testCaseId: string;
+    tool: string;
+    phase: string;
+    capability: string;
+    authorized: boolean;
+    authorizationReason: string;
+    status: "blocked" | "running" | "passed" | "failed" | "inconclusive";
+    evidenceId?: string | undefined;
+    recordedAt: string;
+}
+export interface EngagementGraph {
+    schemaVersion: 1;
+    id: string;
+    name: string;
+    scope: EngagementScope;
+    assets: Array<{
+        id: string;
+        value: string;
+        addresses: string[];
+        services: string[];
+        endpoints: string[];
+    }>;
+    principals: Array<{
+        id: string;
+        label: string;
+        roles: string[];
+    }>;
+    testCases: Array<{
+        id: string;
+        targetId: string;
+        phase: string;
+        capability: string;
+        status: "planned" | "running" | "passed" | "failed" | "inconclusive";
+    }>;
+    actions: EngagementActionRecord[];
+    checkpoints: EngagementCheckpoint[];
+    evidence: EngagementEvidence[];
+    findings: EngagementFinding[];
+    coverage: Array<{
+        dimension: string;
+        state: CoverageState;
+        rationale: string;
+    }>;
+    residualRisk: string[];
+    createdAt: string;
+    updatedAt: string;
+}
+/** Stable across process restarts and conversation compaction for the same authorization. */
+export declare function engagementIdForScope(scope: EngagementScope): string;
+export declare function createEngagement(scope: EngagementScope): EngagementGraph;
+export declare function saveEngagement(graph: EngagementGraph): Promise<void>;
+export declare function loadEngagement(id: string): Promise<EngagementGraph | undefined>;
+export declare function openEngagement(scope: EngagementScope): Promise<EngagementGraph>;
+export declare function beginEngagementAction(graph: EngagementGraph, input: {
+    tool: string;
+    target: string;
+    phase: string;
+    capability: string;
+    authorized: boolean;
+    reason: string;
+}): EngagementActionRecord;
+export declare function recordEngagementCheckpoint(graph: EngagementGraph, input: Omit<EngagementCheckpoint, "id" | "recordedAt">): EngagementCheckpoint;
+export declare function reconcileEngagementJob(graph: EngagementGraph, input: {
+    jobId: string;
+    status: string;
+    artifactPath: string;
+    offset: number;
+    observation: string;
+}): EngagementCheckpoint | undefined;
+export declare function finishEngagementAction(graph: EngagementGraph, actionId: string, result: {
+    ok: boolean;
+    observation: string;
+    artifactPath?: string | undefined;
+    scannerLead?: boolean | undefined;
+}): EngagementEvidence;
+export declare function transitionFinding(graph: EngagementGraph, findingId: string, state: FindingState, patch?: Partial<Pick<EngagementFinding, "reproduction" | "impact" | "remediation" | "severity" | "evidenceIds">>): EngagementFinding;
+export declare function createFinding(graph: EngagementGraph, input: Pick<EngagementFinding, "title" | "targetId"> & Partial<Pick<EngagementFinding, "severity" | "evidenceIds">>): EngagementFinding;
+export declare function renderEngagementReport(graph: EngagementGraph): string;

package/dist/store/engagement.js

@@ -0,0 +1,278 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { getDataDir } from "./paths.js";
+const pathFor = (id) => join(getDataDir(), "engagements", `${encodeURIComponent(id)}.json`);
+const engagementSaveQueues = new Map();
+function mergeById(existing, incoming, choose = (_current, next) => next) {
+    const merged = new Map(existing.map((entry) => [entry.id, entry]));
+    for (const entry of incoming) {
+        const current = merged.get(entry.id);
+        merged.set(entry.id, current ? choose(current, entry) : entry);
+    }
+    return [...merged.values()];
+}
+const terminalProgress = (status) => status === "running" || status === "planned" ? 0 : 1;
+/** Preserve sibling parallel action updates while merging whole-graph snapshots. */
+function mergeEngagementGraphs(existing, incoming) {
+    if (!existing || existing.id !== incoming.id)
+        return incoming;
+    return {
+        ...existing,
+        ...incoming,
+        assets: mergeById(existing.assets, incoming.assets, (current, next) => ({
+            ...current,
+            ...next,
+            addresses: [...new Set([...current.addresses, ...next.addresses])],
+            services: [...new Set([...current.services, ...next.services])],
+            endpoints: [...new Set([...current.endpoints, ...next.endpoints])],
+        })),
+        principals: mergeById(existing.principals, incoming.principals, (current, next) => ({
+            ...current,
+            ...next,
+            roles: [...new Set([...current.roles, ...next.roles])],
+        })),
+        testCases: mergeById(existing.testCases, incoming.testCases, (current, next) => terminalProgress(next.status) >= terminalProgress(current.status) ? next : current),
+        actions: mergeById(existing.actions, incoming.actions, (current, next) => terminalProgress(next.status) >= terminalProgress(current.status) ? next : current),
+        checkpoints: mergeById(existing.checkpoints, incoming.checkpoints),
+        evidence: mergeById(existing.evidence, incoming.evidence),
+        findings: mergeById(existing.findings, incoming.findings, (current, next) => next.updatedAt >= current.updatedAt ? next : current),
+        coverage: [
+            ...new Map([...existing.coverage, ...incoming.coverage].map((entry) => [entry.dimension, entry])).values(),
+        ],
+        residualRisk: [...new Set([...existing.residualRisk, ...incoming.residualRisk])],
+        createdAt: existing.createdAt <= incoming.createdAt ? existing.createdAt : incoming.createdAt,
+    };
+}
+const normalizedScopeIdentity = (scope) => JSON.stringify({
+    name: scope.name ?? "",
+    authorizedTargets: [...scope.authorizedTargets].sort(),
+    excludedTargets: [...(scope.excludedTargets ?? [])].sort(),
+    createdAt: scope.createdAt ?? "",
+});
+/** Stable across process restarts and conversation compaction for the same authorization. */
+export function engagementIdForScope(scope) {
+    return createHash("sha256").update(normalizedScopeIdentity(scope)).digest("hex").slice(0, 32);
+}
+export function createEngagement(scope) {
+    const now = new Date().toISOString();
+    return {
+        schemaVersion: 1,
+        id: engagementIdForScope(scope),
+        name: scope.name ?? "authorized engagement",
+        scope,
+        assets: scope.authorizedTargets.map((value) => ({ id: randomUUID(), value, addresses: [], services: [], endpoints: [] })),
+        principals: [],
+        testCases: [],
+        actions: [],
+        checkpoints: [],
+        evidence: [],
+        findings: [],
+        coverage: [],
+        residualRisk: [],
+        createdAt: now,
+        updatedAt: now,
+    };
+}
+export function saveEngagement(graph) {
+    const previous = engagementSaveQueues.get(graph.id) ?? Promise.resolve();
+    const queued = previous.catch(() => undefined).then(async () => {
+        const dir = join(getDataDir(), "engagements");
+        const path = pathFor(graph.id);
+        const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+        await mkdir(dir, { recursive: true });
+        try {
+            let existing;
+            try {
+                const parsed = JSON.parse(await readFile(path, "utf8"));
+                if (parsed.schemaVersion === 1)
+                    existing = parsed;
+            }
+            catch {
+                // First save or corrupt prior state: the incoming valid graph replaces it.
+            }
+            const merged = mergeEngagementGraphs(existing, graph);
+            merged.updatedAt = new Date().toISOString();
+            await writeFile(temp, `${JSON.stringify(merged, null, 2)}\n`, { mode: 0o600 });
+            await rename(temp, path);
+        }
+        finally {
+            await unlink(temp).catch(() => undefined);
+        }
+    });
+    engagementSaveQueues.set(graph.id, queued);
+    void queued.finally(() => {
+        if (engagementSaveQueues.get(graph.id) === queued) {
+            engagementSaveQueues.delete(graph.id);
+        }
+    }).catch(() => undefined);
+    return queued;
+}
+export async function loadEngagement(id) {
+    try {
+        const parsed = JSON.parse(await readFile(pathFor(id), "utf8"));
+        if (parsed.schemaVersion !== 1)
+            return undefined;
+        parsed.actions ??= [];
+        parsed.checkpoints ??= [];
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function openEngagement(scope) {
+    const id = engagementIdForScope(scope);
+    const existing = await loadEngagement(id);
+    if (existing) {
+        existing.scope = scope;
+        return existing;
+    }
+    const created = createEngagement(scope);
+    await saveEngagement(created);
+    return created;
+}
+function assetFor(graph, target) {
+    const existing = graph.assets.find((asset) => asset.value === target);
+    if (existing)
+        return existing;
+    const asset = { id: randomUUID(), value: target, addresses: [], services: [], endpoints: [] };
+    graph.assets.push(asset);
+    return asset;
+}
+export function beginEngagementAction(graph, input) {
+    const target = assetFor(graph, input.target);
+    const testCase = {
+        id: randomUUID(),
+        targetId: target.id,
+        phase: input.phase,
+        capability: input.capability,
+        status: (input.authorized ? "running" : "failed"),
+    };
+    graph.testCases.push(testCase);
+    const action = {
+        id: randomUUID(),
+        targetId: target.id,
+        testCaseId: testCase.id,
+        tool: input.tool,
+        phase: input.phase,
+        capability: input.capability,
+        authorized: input.authorized,
+        authorizationReason: input.reason,
+        status: input.authorized ? "running" : "blocked",
+        recordedAt: new Date().toISOString(),
+    };
+    graph.actions.push(action);
+    return action;
+}
+export function recordEngagementCheckpoint(graph, input) {
+    const action = graph.actions.find((entry) => entry.id === input.actionId);
+    if (!action)
+        throw new Error(`Unknown engagement action: ${input.actionId}`);
+    const checkpoint = {
+        id: randomUUID(),
+        ...input,
+        recordedAt: new Date().toISOString(),
+    };
+    graph.checkpoints.push(checkpoint);
+    action.status = ["exited", "failed", "killed", "lost"].includes(input.status)
+        ? input.status === "exited" ? "inconclusive" : "failed"
+        : "running";
+    return checkpoint;
+}
+export function reconcileEngagementJob(graph, input) {
+    const prior = [...graph.checkpoints].reverse().find((entry) => entry.jobId === input.jobId);
+    if (!prior)
+        return undefined;
+    const checkpoint = recordEngagementCheckpoint(graph, {
+        actionId: prior.actionId,
+        ...input,
+    });
+    if (["exited", "failed", "killed", "lost"].includes(input.status)) {
+        const action = graph.actions.find((entry) => entry.id === prior.actionId);
+        const testCase = action ? graph.testCases.find((entry) => entry.id === action.testCaseId) : undefined;
+        const terminalStatus = input.status === "exited" ? "inconclusive" : "failed";
+        if (action)
+            action.status = terminalStatus;
+        if (testCase)
+            testCase.status = terminalStatus;
+    }
+    return checkpoint;
+}
+export function finishEngagementAction(graph, actionId, result) {
+    const action = graph.actions.find((entry) => entry.id === actionId);
+    if (!action)
+        throw new Error(`Unknown engagement action: ${actionId}`);
+    const evidence = {
+        id: randomUUID(),
+        targetId: action.targetId,
+        testCaseId: action.testCaseId,
+        ...(result.artifactPath ? { artifactPath: result.artifactPath } : {}),
+        observation: result.observation,
+        observedAt: new Date().toISOString(),
+    };
+    graph.evidence.push(evidence);
+    action.evidenceId = evidence.id;
+    action.status = result.scannerLead ? "inconclusive" : result.ok ? "passed" : "failed";
+    const testCase = graph.testCases.find((entry) => entry.id === action.testCaseId);
+    if (testCase)
+        testCase.status = action.status;
+    return evidence;
+}
+const validTransitions = {
+    suspected: ["reproduced", "rejected", "inconclusive"],
+    reproduced: ["verified", "rejected", "inconclusive"],
+    verified: ["reported", "rejected"],
+    reported: ["remediated"],
+    remediated: ["retested"],
+    retested: [],
+    rejected: [],
+    inconclusive: ["suspected", "rejected"],
+};
+export function transitionFinding(graph, findingId, state, patch = {}) {
+    const finding = graph.findings.find((entry) => entry.id === findingId);
+    if (!finding)
+        throw new Error(`Unknown finding: ${findingId}`);
+    if (finding.state !== state && !validTransitions[finding.state].includes(state)) {
+        throw new Error(`Invalid finding transition: ${finding.state} -> ${state}`);
+    }
+    Object.assign(finding, patch);
+    if (state === "verified") {
+        if (!finding.reproduction?.trim() || !finding.impact?.trim() || finding.evidenceIds.length === 0) {
+            throw new Error("Verified findings require reproduction, impact, and linked evidence");
+        }
+        const linked = new Set(graph.evidence.map((entry) => entry.id));
+        if (finding.evidenceIds.some((id) => !linked.has(id)))
+            throw new Error("Verified finding references unknown evidence");
+    }
+    finding.state = state;
+    finding.updatedAt = new Date().toISOString();
+    return finding;
+}
+export function createFinding(graph, input) {
+    const finding = {
+        id: randomUUID(),
+        title: input.title,
+        targetId: input.targetId,
+        state: "suspected",
+        evidenceIds: input.evidenceIds ?? [],
+        ...(input.severity ? { severity: input.severity } : {}),
+        updatedAt: new Date().toISOString(),
+    };
+    graph.findings.push(finding);
+    return finding;
+}
+export function renderEngagementReport(graph) {
+    const verified = graph.findings.filter((finding) => ["verified", "reported", "remediated", "retested"].includes(finding.state));
+    const leads = graph.findings.filter((finding) => ["suspected", "reproduced", "inconclusive"].includes(finding.state));
+    const exclusions = graph.scope.excludedTargets ?? [];
+    const section = (title, lines) => `${title}\n${lines.length ? lines.map((line) => `- ${line}`).join("\n") : "- None"}`;
+    return [
+        section("Verified findings", verified.map((finding) => `${finding.title} (${finding.state})`)),
+        section("Inconclusive leads", leads.map((finding) => `${finding.title} (${finding.state})`)),
+        section("Coverage", graph.coverage.map((item) => `${item.dimension}: ${item.state} — ${item.rationale}`)),
+        section("Exclusions", exclusions),
+        section("Residual risk", graph.residualRisk),
+    ].join("\n\n");
+}
+//# sourceMappingURL=engagement.js.map