@provos/ironcurtain 0.6.0 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +21 -2
- package/dist/cli-help.d.ts +63 -0
- package/dist/cli-help.js +102 -0
- package/dist/cli-help.js.map +1 -0
- package/dist/cli.js +73 -56
- package/dist/cli.js.map +1 -1
- package/dist/config/config-command.js +136 -2
- package/dist/config/config-command.js.map +1 -1
- package/dist/config/generated/tool-annotations.json +487 -338
- package/dist/config/index.d.ts +21 -1
- package/dist/config/index.js +12 -4
- package/dist/config/index.js.map +1 -1
- package/dist/config/mcp-servers.json +2 -8
- package/dist/config/paths.d.ts +30 -0
- package/dist/config/paths.js +58 -0
- package/dist/config/paths.js.map +1 -1
- package/dist/config/tool-description-hints.json +15 -0
- package/dist/config/types.d.ts +7 -0
- package/dist/config/user-config.d.ts +21 -0
- package/dist/config/user-config.js +8 -0
- package/dist/config/user-config.js.map +1 -1
- package/dist/cron/compile-task-policy.d.ts +17 -0
- package/dist/cron/compile-task-policy.js +39 -0
- package/dist/cron/compile-task-policy.js.map +1 -0
- package/dist/cron/cron-scheduler.d.ts +65 -0
- package/dist/cron/cron-scheduler.js +184 -0
- package/dist/cron/cron-scheduler.js.map +1 -0
- package/dist/cron/file-lock.d.ts +41 -0
- package/dist/cron/file-lock.js +156 -0
- package/dist/cron/file-lock.js.map +1 -0
- package/dist/cron/format-utils.d.ts +18 -0
- package/dist/cron/format-utils.js +145 -0
- package/dist/cron/format-utils.js.map +1 -0
- package/dist/cron/git-sync.d.ts +22 -0
- package/dist/cron/git-sync.js +121 -0
- package/dist/cron/git-sync.js.map +1 -0
- package/dist/cron/headless-transport.d.ts +27 -0
- package/dist/cron/headless-transport.js +43 -0
- package/dist/cron/headless-transport.js.map +1 -0
- package/dist/cron/job-commands.d.ts +39 -0
- package/dist/cron/job-commands.js +522 -0
- package/dist/cron/job-commands.js.map +1 -0
- package/dist/cron/job-store.d.ts +35 -0
- package/dist/cron/job-store.js +111 -0
- package/dist/cron/job-store.js.map +1 -0
- package/dist/cron/types.d.ts +127 -0
- package/dist/cron/types.js +25 -0
- package/dist/cron/types.js.map +1 -0
- package/dist/daemon/control-socket.d.ts +127 -0
- package/dist/daemon/control-socket.js +261 -0
- package/dist/daemon/control-socket.js.map +1 -0
- package/dist/daemon/daemon-command.d.ts +13 -0
- package/dist/daemon/daemon-command.js +230 -0
- package/dist/daemon/daemon-command.js.map +1 -0
- package/dist/daemon/ironcurtain-daemon.d.ts +90 -0
- package/dist/daemon/ironcurtain-daemon.js +548 -0
- package/dist/daemon/ironcurtain-daemon.js.map +1 -0
- package/dist/docker/adapters/claude-code.js +7 -47
- package/dist/docker/adapters/claude-code.js.map +1 -1
- package/dist/docker/adapters/goose.d.ts +58 -0
- package/dist/docker/adapters/goose.js +250 -0
- package/dist/docker/adapters/goose.js.map +1 -0
- package/dist/docker/adapters/shared-scripts.d.ts +29 -0
- package/dist/docker/adapters/shared-scripts.js +80 -0
- package/dist/docker/adapters/shared-scripts.js.map +1 -0
- package/dist/docker/agent-adapter.d.ts +12 -0
- package/dist/docker/agent-adapter.js.map +1 -1
- package/dist/docker/agent-registry.d.ts +6 -1
- package/dist/docker/agent-registry.js +10 -1
- package/dist/docker/agent-registry.js.map +1 -1
- package/dist/docker/docker-agent-session.d.ts +2 -25
- package/dist/docker/docker-agent-session.js +7 -106
- package/dist/docker/docker-agent-session.js.map +1 -1
- package/dist/docker/docker-infrastructure.d.ts +8 -0
- package/dist/docker/docker-infrastructure.js +12 -11
- package/dist/docker/docker-infrastructure.js.map +1 -1
- package/dist/docker/pty-session.js +7 -4
- package/dist/docker/pty-session.js.map +1 -1
- package/dist/escalation/escalation-watcher.d.ts +2 -0
- package/dist/escalation/escalation-watcher.js +3 -0
- package/dist/escalation/escalation-watcher.js.map +1 -1
- package/dist/escalation/session-registry.js +1 -14
- package/dist/escalation/session-registry.js.map +1 -1
- package/dist/index.js +30 -1
- package/dist/index.js.map +1 -1
- package/dist/mux/mux-app.js +11 -6
- package/dist/mux/mux-app.js.map +1 -1
- package/dist/mux/mux-command.js +20 -9
- package/dist/mux/mux-command.js.map +1 -1
- package/dist/mux/mux-input-handler.d.ts +5 -0
- package/dist/mux/mux-input-handler.js +64 -9
- package/dist/mux/mux-input-handler.js.map +1 -1
- package/dist/mux/mux-renderer.d.ts +20 -0
- package/dist/mux/mux-renderer.js +127 -35
- package/dist/mux/mux-renderer.js.map +1 -1
- package/dist/mux/mux-splash.js +2 -1
- package/dist/mux/mux-splash.js.map +1 -1
- package/dist/mux/paste-interceptor.d.ts +22 -0
- package/dist/mux/paste-interceptor.js +143 -0
- package/dist/mux/paste-interceptor.js.map +1 -0
- package/dist/mux/pty-bridge.js +1 -1
- package/dist/mux/pty-bridge.js.map +1 -1
- package/dist/mux/types.d.ts +8 -1
- package/dist/mux/types.js +17 -5
- package/dist/mux/types.js.map +1 -1
- package/dist/pipeline/annotate.js +2 -1
- package/dist/pipeline/annotate.js.map +1 -1
- package/dist/pipeline/compile.d.ts +4 -34
- package/dist/pipeline/compile.js +29 -568
- package/dist/pipeline/compile.js.map +1 -1
- package/dist/pipeline/constitution-compiler.js +1 -1
- package/dist/pipeline/mcp-connections.d.ts +16 -0
- package/dist/pipeline/mcp-connections.js +61 -0
- package/dist/pipeline/mcp-connections.js.map +1 -0
- package/dist/pipeline/pipeline-runner.d.ts +86 -0
- package/dist/pipeline/pipeline-runner.js +554 -0
- package/dist/pipeline/pipeline-runner.js.map +1 -0
- package/dist/pipeline/pipeline-shared.d.ts +29 -2
- package/dist/pipeline/pipeline-shared.js +68 -12
- package/dist/pipeline/pipeline-shared.js.map +1 -1
- package/dist/pipeline/refresh-lists.js +38 -12
- package/dist/pipeline/refresh-lists.js.map +1 -1
- package/dist/pipeline/scenario-generator.js +2 -1
- package/dist/pipeline/scenario-generator.js.map +1 -1
- package/dist/pipeline/tool-annotator.d.ts +3 -3
- package/dist/pipeline/tool-annotator.js +96 -4
- package/dist/pipeline/tool-annotator.js.map +1 -1
- package/dist/pipeline/types.d.ts +52 -0
- package/dist/sandbox/index.js +36 -1
- package/dist/sandbox/index.js.map +1 -1
- package/dist/session/agent-session.d.ts +3 -0
- package/dist/session/agent-session.js +10 -1
- package/dist/session/agent-session.js.map +1 -1
- package/dist/session/index.js +54 -5
- package/dist/session/index.js.map +1 -1
- package/dist/session/preflight.js +26 -6
- package/dist/session/preflight.js.map +1 -1
- package/dist/session/prompts.d.ts +14 -0
- package/dist/session/prompts.js +39 -2
- package/dist/session/prompts.js.map +1 -1
- package/dist/session/session-manager.d.ts +105 -0
- package/dist/session/session-manager.js +134 -0
- package/dist/session/session-manager.js.map +1 -0
- package/dist/session/types.d.ts +27 -0
- package/dist/session/workspace-validation.d.ts +2 -0
- package/dist/session/workspace-validation.js +6 -5
- package/dist/session/workspace-validation.js.map +1 -1
- package/dist/signal/bot-command.d.ts +2 -0
- package/dist/signal/bot-command.js +8 -0
- package/dist/signal/bot-command.js.map +1 -1
- package/dist/signal/format.d.ts +27 -0
- package/dist/signal/format.js +59 -0
- package/dist/signal/format.js.map +1 -1
- package/dist/signal/signal-bot-daemon.d.ts +27 -25
- package/dist/signal/signal-bot-daemon.js +145 -130
- package/dist/signal/signal-bot-daemon.js.map +1 -1
- package/dist/signal/signal-container.js +63 -19
- package/dist/signal/signal-container.js.map +1 -1
- package/dist/signal/signal-transport.js +3 -8
- package/dist/signal/signal-transport.js.map +1 -1
- package/dist/trusted-process/domain-utils.d.ts +38 -4
- package/dist/trusted-process/domain-utils.js +118 -11
- package/dist/trusted-process/domain-utils.js.map +1 -1
- package/dist/trusted-process/index.js +6 -2
- package/dist/trusted-process/index.js.map +1 -1
- package/dist/trusted-process/mcp-client-manager.js +11 -5
- package/dist/trusted-process/mcp-client-manager.js.map +1 -1
- package/dist/trusted-process/mcp-proxy-server.d.ts +2 -0
- package/dist/trusted-process/mcp-proxy-server.js +59 -16
- package/dist/trusted-process/mcp-proxy-server.js.map +1 -1
- package/dist/trusted-process/permissive-output-validator.d.ts +23 -0
- package/dist/trusted-process/permissive-output-validator.js +10 -0
- package/dist/trusted-process/permissive-output-validator.js.map +1 -0
- package/dist/trusted-process/policy-engine.d.ts +27 -4
- package/dist/trusted-process/policy-engine.js +152 -57
- package/dist/trusted-process/policy-engine.js.map +1 -1
- package/dist/trusted-process/tool-description-hints.d.ts +19 -0
- package/dist/trusted-process/tool-description-hints.js +53 -0
- package/dist/trusted-process/tool-description-hints.js.map +1 -0
- package/dist/types/argument-roles.d.ts +33 -1
- package/dist/types/argument-roles.js +129 -1
- package/dist/types/argument-roles.js.map +1 -1
- package/docker/Dockerfile.goose +34 -0
- package/docker/entrypoint-goose.sh +30 -0
- package/package.json +1 -1
- package/src/config/generated/tool-annotations.json +487 -338
- package/src/config/mcp-servers.json +2 -8
|
@@ -7,14 +7,13 @@
|
|
|
7
7
|
*/
|
|
8
8
|
import type { LanguageModel } from 'ai';
|
|
9
9
|
import { type Ora } from 'ora';
|
|
10
|
-
export { loadConstitutionText } from '../config/paths.js';
|
|
11
10
|
import type { MCPServerConfig } from '../config/types.js';
|
|
11
|
+
import type { CompiledRule, DiscardedScenario, TestScenario, ToolAnnotationsFile } from './types.js';
|
|
12
12
|
import { type LlmLogContext } from './llm-logger.js';
|
|
13
13
|
import { type PromptCacheStrategy } from '../session/prompt-cache.js';
|
|
14
14
|
export interface PipelineConfig {
|
|
15
15
|
constitutionPath: string;
|
|
16
16
|
constitutionText: string;
|
|
17
|
-
constitutionHash: string;
|
|
18
17
|
mcpServers: Record<string, MCPServerConfig>;
|
|
19
18
|
generatedDir: string;
|
|
20
19
|
packageGeneratedDir: string;
|
|
@@ -24,6 +23,16 @@ export interface PipelineConfig {
|
|
|
24
23
|
export declare function loadPipelineConfig(): PipelineConfig;
|
|
25
24
|
export declare function computeHash(...inputs: string[]): string;
|
|
26
25
|
export declare function loadExistingArtifact<T>(generatedDir: string, filename: string, fallbackDir?: string): T | undefined;
|
|
26
|
+
/**
|
|
27
|
+
* Loads tool-annotations.json, resolving any conditional role specs to their
|
|
28
|
+
* default roles so the pipeline always sees the flat ToolAnnotationsFile shape.
|
|
29
|
+
*
|
|
30
|
+
* This is the single entry point for the compilation pipeline. Only the
|
|
31
|
+
* annotator (which writes the file) and the policy engine (which resolves
|
|
32
|
+
* conditionals at evaluation time against actual call args) need to know
|
|
33
|
+
* about StoredToolAnnotationsFile.
|
|
34
|
+
*/
|
|
35
|
+
export declare function loadToolAnnotationsFile(dir: string, fallbackDir?: string): ToolAnnotationsFile | undefined;
|
|
27
36
|
export declare function showCached(text: string): void;
|
|
28
37
|
export declare function withSpinner<T>(text: string, fn: (spinner: Ora) => Promise<T>, successFn?: (result: T, elapsed: number) => string): Promise<{
|
|
29
38
|
result: T;
|
|
@@ -31,6 +40,24 @@ export declare function withSpinner<T>(text: string, fn: (spinner: Ora) => Promi
|
|
|
31
40
|
}>;
|
|
32
41
|
/** Writes a JSON artifact to the generated directory with consistent formatting. */
|
|
33
42
|
export declare function writeArtifact(generatedDir: string, filename: string, data: unknown): void;
|
|
43
|
+
/**
|
|
44
|
+
* Resolves all `paths.within` values in compiled rules to their real
|
|
45
|
+
* filesystem paths, following symlinks. This ensures that symlinked
|
|
46
|
+
* directories (e.g., ~/Downloads -> /mnt/c/.../Downloads on WSL) are
|
|
47
|
+
* resolved to their canonical form so that runtime path comparisons
|
|
48
|
+
* match correctly.
|
|
49
|
+
*
|
|
50
|
+
* Falls back to path.resolve() if the path does not exist on disk.
|
|
51
|
+
*/
|
|
52
|
+
export declare function resolveRulePaths(rules: CompiledRule[]): CompiledRule[];
|
|
53
|
+
/**
|
|
54
|
+
* Merges replacement scenarios from the regeneration session into the
|
|
55
|
+
* scenario list. Removes corrected and discarded scenarios, then adds
|
|
56
|
+
* unique replacements that don't duplicate any remaining scenario.
|
|
57
|
+
*/
|
|
58
|
+
export declare function mergeReplacements(scenarios: TestScenario[], replacements: TestScenario[], corrections: ReadonlyArray<{
|
|
59
|
+
scenarioDescription: string;
|
|
60
|
+
}>, discardedScenarios: ReadonlyArray<DiscardedScenario>): TestScenario[];
|
|
34
61
|
export interface PipelineLlm {
|
|
35
62
|
model: LanguageModel;
|
|
36
63
|
logContext: LlmLogContext;
|
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
* content-hash caching, and spinner helpers.
|
|
7
7
|
*/
|
|
8
8
|
import { createHash } from 'node:crypto';
|
|
9
|
-
import {
|
|
9
|
+
import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
|
|
10
10
|
import { resolve, dirname } from 'node:path';
|
|
11
11
|
import { fileURLToPath } from 'node:url';
|
|
12
12
|
import { wrapLanguageModel } from 'ai';
|
|
@@ -15,9 +15,8 @@ import ora from 'ora';
|
|
|
15
15
|
import { computeProtectedPaths, resolveMcpServerPaths } from '../config/index.js';
|
|
16
16
|
import { createLanguageModel } from '../config/model-provider.js';
|
|
17
17
|
import { getIronCurtainHome, getUserGeneratedDir, loadConstitutionText } from '../config/paths.js';
|
|
18
|
-
// Re-export so existing pipeline callers (loadPipelineConfig) don't need updating.
|
|
19
|
-
export { loadConstitutionText } from '../config/paths.js';
|
|
20
18
|
import { loadUserConfig } from '../config/user-config.js';
|
|
19
|
+
import { resolveRealPath, resolveStoredAnnotationsFile } from '../types/argument-roles.js';
|
|
21
20
|
import { createLlmLoggingMiddleware } from './llm-logger.js';
|
|
22
21
|
import { createCacheStrategy } from '../session/prompt-cache.js';
|
|
23
22
|
const __dirname = dirname(fileURLToPath(import.meta.url));
|
|
@@ -25,7 +24,6 @@ export function loadPipelineConfig() {
|
|
|
25
24
|
const configDir = resolve(__dirname, '..', 'config');
|
|
26
25
|
const constitutionPath = resolve(configDir, 'constitution.md');
|
|
27
26
|
const constitutionText = loadConstitutionText(constitutionPath);
|
|
28
|
-
const constitutionHash = createHash('sha256').update(constitutionText).digest('hex');
|
|
29
27
|
const mcpServersPath = resolve(configDir, 'mcp-servers.json');
|
|
30
28
|
const mcpServers = JSON.parse(readFileSync(mcpServersPath, 'utf-8'));
|
|
31
29
|
resolveMcpServerPaths(mcpServers);
|
|
@@ -54,7 +52,6 @@ export function loadPipelineConfig() {
|
|
|
54
52
|
return {
|
|
55
53
|
constitutionPath,
|
|
56
54
|
constitutionText,
|
|
57
|
-
constitutionHash,
|
|
58
55
|
mcpServers,
|
|
59
56
|
generatedDir,
|
|
60
57
|
packageGeneratedDir,
|
|
@@ -79,17 +76,30 @@ export function loadExistingArtifact(generatedDir, filename, fallbackDir) {
|
|
|
79
76
|
candidates.push(resolve(fallbackDir, filename));
|
|
80
77
|
}
|
|
81
78
|
for (const path of candidates) {
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
// Corrupt file -- try next candidate
|
|
88
|
-
}
|
|
79
|
+
try {
|
|
80
|
+
return JSON.parse(readFileSync(path, 'utf-8'));
|
|
81
|
+
}
|
|
82
|
+
catch {
|
|
83
|
+
// File missing or corrupt -- try next candidate
|
|
89
84
|
}
|
|
90
85
|
}
|
|
91
86
|
return undefined;
|
|
92
87
|
}
|
|
88
|
+
/**
|
|
89
|
+
* Loads tool-annotations.json, resolving any conditional role specs to their
|
|
90
|
+
* default roles so the pipeline always sees the flat ToolAnnotationsFile shape.
|
|
91
|
+
*
|
|
92
|
+
* This is the single entry point for the compilation pipeline. Only the
|
|
93
|
+
* annotator (which writes the file) and the policy engine (which resolves
|
|
94
|
+
* conditionals at evaluation time against actual call args) need to know
|
|
95
|
+
* about StoredToolAnnotationsFile.
|
|
96
|
+
*/
|
|
97
|
+
export function loadToolAnnotationsFile(dir, fallbackDir) {
|
|
98
|
+
const stored = loadExistingArtifact(dir, 'tool-annotations.json', fallbackDir);
|
|
99
|
+
if (!stored)
|
|
100
|
+
return undefined;
|
|
101
|
+
return resolveStoredAnnotationsFile(stored);
|
|
102
|
+
}
|
|
93
103
|
// ---------------------------------------------------------------------------
|
|
94
104
|
// Spinner Helpers
|
|
95
105
|
// ---------------------------------------------------------------------------
|
|
@@ -126,6 +136,52 @@ export function writeArtifact(generatedDir, filename, data) {
|
|
|
126
136
|
mkdirSync(generatedDir, { recursive: true });
|
|
127
137
|
writeFileSync(resolve(generatedDir, filename), JSON.stringify(data, null, 2) + '\n');
|
|
128
138
|
}
|
|
139
|
+
// ---------------------------------------------------------------------------
|
|
140
|
+
// Rule Path Resolution
|
|
141
|
+
// ---------------------------------------------------------------------------
|
|
142
|
+
/**
|
|
143
|
+
* Resolves all `paths.within` values in compiled rules to their real
|
|
144
|
+
* filesystem paths, following symlinks. This ensures that symlinked
|
|
145
|
+
* directories (e.g., ~/Downloads -> /mnt/c/.../Downloads on WSL) are
|
|
146
|
+
* resolved to their canonical form so that runtime path comparisons
|
|
147
|
+
* match correctly.
|
|
148
|
+
*
|
|
149
|
+
* Falls back to path.resolve() if the path does not exist on disk.
|
|
150
|
+
*/
|
|
151
|
+
export function resolveRulePaths(rules) {
|
|
152
|
+
return rules.map((rule) => {
|
|
153
|
+
if (!rule.if.paths?.within)
|
|
154
|
+
return rule;
|
|
155
|
+
const resolved = resolveRealPath(rule.if.paths.within);
|
|
156
|
+
if (resolved === rule.if.paths.within)
|
|
157
|
+
return rule;
|
|
158
|
+
return {
|
|
159
|
+
...rule,
|
|
160
|
+
if: {
|
|
161
|
+
...rule.if,
|
|
162
|
+
paths: { ...rule.if.paths, within: resolved },
|
|
163
|
+
},
|
|
164
|
+
};
|
|
165
|
+
});
|
|
166
|
+
}
|
|
167
|
+
// ---------------------------------------------------------------------------
|
|
168
|
+
// Scenario Merge
|
|
169
|
+
// ---------------------------------------------------------------------------
|
|
170
|
+
/**
|
|
171
|
+
* Merges replacement scenarios from the regeneration session into the
|
|
172
|
+
* scenario list. Removes corrected and discarded scenarios, then adds
|
|
173
|
+
* unique replacements that don't duplicate any remaining scenario.
|
|
174
|
+
*/
|
|
175
|
+
export function mergeReplacements(scenarios, replacements, corrections, discardedScenarios) {
|
|
176
|
+
const removedDescriptions = new Set([
|
|
177
|
+
...corrections.map((c) => c.scenarioDescription),
|
|
178
|
+
...discardedScenarios.filter((d) => d.scenario.source !== 'handwritten').map((d) => d.scenario.description),
|
|
179
|
+
]);
|
|
180
|
+
const kept = scenarios.filter((s) => !removedDescriptions.has(s.description));
|
|
181
|
+
const keptDescriptions = new Set(kept.map((s) => s.description));
|
|
182
|
+
const uniqueReplacements = replacements.filter((r) => !keptDescriptions.has(r.description));
|
|
183
|
+
return [...kept, ...uniqueReplacements];
|
|
184
|
+
}
|
|
129
185
|
/**
|
|
130
186
|
* Creates a language model wrapped with pipeline logging middleware.
|
|
131
187
|
* Both annotate.ts and compile.ts use this to set up their LLM instance.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pipeline-shared.js","sourceRoot":"","sources":["../../src/pipeline/pipeline-shared.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"pipeline-shared.js","sourceRoot":"","sources":["../../src/pipeline/pipeline-shared.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AACvC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAiB,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAInG,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAQ1D,OAAO,EAAE,eAAe,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAsB,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAA4B,MAAM,4BAA4B,CAAC;AAE3F,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAgB1D,MAAM,UAAU,kBAAkB;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAoC,CAAC;IACxG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAElC,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAE5E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1C,uGAAuG;IACvG,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,0BAA0B,CAAC;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,eAAe,CAAC;IAEnE,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,gBAAgB;QAChB,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,gBAAgB;QAChB,gBAAgB;QAChB,UAAU;QACV,YAAY;QACZ,mBAAmB;QACnB,gBAAgB;QAChB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,UAAU,WAAW,CAAC,GAAG,MAAgB;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,2IAA2I;AAC3I,MAAM,UAAU,oBAAoB,CAAI,YAAoB,EAAE,QAAgB,EAAE,WAAoB;IAClG,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrD,IAAI,WAAW,EAAE,CAAC;QAChB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAM,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAE,WAAoB;IACvE,MAAM,MAAM,GAAG,oBAAoB,CAA4B,GAAG,EAAE,uBAAuB,EAAE,WAAW,CAAC,CAAC;IAC1G,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,4BAA4B,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACnF,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,EAAgC,EAChC,SAAkD;IAElD,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACnF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,GAAG,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC;IACtC,CAAC,EAAE,IAAI,CAAC,CAAC;IACT,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;QACjC,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;QAC5C,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAChG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,QAAgB,EAAE,IAAa;IACjF,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC;QAExC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEnD,OAAO;YACL,GAAG,IAAI;YACP,EAAE,EAAE;gBACF,GAAG,IAAI,CAAC,EAAE;gBACV,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;aAC9C;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAyB,EACzB,YAA4B,EAC5B,WAA2D,EAC3D,kBAAoD;IAEpD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;QAClC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAChD,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC5G,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACjE,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAE5F,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,kBAAkB,CAAC,CAAC;AAC1C,CAAC;AAaD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,YAAoB,EAAE,eAAuB;IACnF,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAChF,MAAM,UAAU,GAAkB,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,0BAA0B,CAAC,OAAO,EAAE,UAAU,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACpE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACvD,CAAC"}
|
|
@@ -10,22 +10,46 @@
|
|
|
10
10
|
*/
|
|
11
11
|
import { resolve } from 'node:path';
|
|
12
12
|
import { fileURLToPath } from 'node:url';
|
|
13
|
+
import { parseArgs } from 'node:util';
|
|
13
14
|
import chalk from 'chalk';
|
|
15
|
+
import { checkHelp } from '../cli-help.js';
|
|
14
16
|
import { resolveAllLists } from './list-resolver.js';
|
|
15
|
-
import { connectMcpServersForLists, disconnectMcpServers } from './
|
|
17
|
+
import { connectMcpServersForLists, disconnectMcpServers } from './mcp-connections.js';
|
|
16
18
|
import { createPipelineLlm, loadExistingArtifact, loadPipelineConfig, writeArtifact, withSpinner, } from './pipeline-shared.js';
|
|
19
|
+
// ---------------------------------------------------------------------------
|
|
20
|
+
// Help + Argument Parsing
|
|
21
|
+
// ---------------------------------------------------------------------------
|
|
22
|
+
const refreshListsSpec = {
|
|
23
|
+
name: 'ironcurtain refresh-lists',
|
|
24
|
+
description: 'Re-resolve dynamic lists without full recompilation',
|
|
25
|
+
usage: ['ironcurtain refresh-lists [options]'],
|
|
26
|
+
options: [
|
|
27
|
+
{ flag: 'list', description: 'Refresh only the named list', placeholder: '<name>' },
|
|
28
|
+
{ flag: 'with-mcp', description: 'Connect to MCP servers for data-backed lists' },
|
|
29
|
+
],
|
|
30
|
+
examples: [
|
|
31
|
+
'ironcurtain refresh-lists # Refresh all knowledge-based lists',
|
|
32
|
+
'ironcurtain refresh-lists --list major-news # Refresh a single list',
|
|
33
|
+
'ironcurtain refresh-lists --with-mcp # Include MCP-backed lists',
|
|
34
|
+
],
|
|
35
|
+
};
|
|
17
36
|
function parseRefreshArgs(args) {
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
}
|
|
28
|
-
|
|
37
|
+
const { values } = parseArgs({
|
|
38
|
+
args,
|
|
39
|
+
options: {
|
|
40
|
+
help: { type: 'boolean', short: 'h' },
|
|
41
|
+
list: { type: 'string' },
|
|
42
|
+
'with-mcp': { type: 'boolean' },
|
|
43
|
+
},
|
|
44
|
+
allowPositionals: true,
|
|
45
|
+
strict: false,
|
|
46
|
+
});
|
|
47
|
+
if (checkHelp(values, refreshListsSpec))
|
|
48
|
+
return null;
|
|
49
|
+
return {
|
|
50
|
+
listName: values.list,
|
|
51
|
+
withMcp: values['with-mcp'] ?? false,
|
|
52
|
+
};
|
|
29
53
|
}
|
|
30
54
|
// ---------------------------------------------------------------------------
|
|
31
55
|
// List Filtering
|
|
@@ -60,6 +84,8 @@ function selectListsToRefresh(definitions, options) {
|
|
|
60
84
|
// ---------------------------------------------------------------------------
|
|
61
85
|
export async function main(args = []) {
|
|
62
86
|
const options = parseRefreshArgs(args);
|
|
87
|
+
if (!options)
|
|
88
|
+
return;
|
|
63
89
|
const config = loadPipelineConfig();
|
|
64
90
|
// Load compiled policy to get list definitions
|
|
65
91
|
const compiledPolicy = loadExistingArtifact(config.generatedDir, 'compiled-policy.json', config.packageGeneratedDir);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"refresh-lists.js","sourceRoot":"","sources":["../../src/pipeline/refresh-lists.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAA4B,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"refresh-lists.js","sourceRoot":"","sources":["../../src/pipeline/refresh-lists.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAoB,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAA4B,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAG9B,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,MAAM,gBAAgB,GAAgB;IACpC,IAAI,EAAE,2BAA2B;IACjC,WAAW,EAAE,qDAAqD;IAClE,KAAK,EAAE,CAAC,qCAAqC,CAAC;IAC9C,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,6BAA6B,EAAE,WAAW,EAAE,QAAQ,EAAE;QACnF,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,8CAA8C,EAAE;KAClF;IACD,QAAQ,EAAE;QACR,oFAAoF;QACpF,wEAAwE;QACxE,2EAA2E;KAC5E;CACF,CAAC;AASF,SAAS,gBAAgB,CAAC,IAAc;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC3B,IAAI;QACJ,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACrC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAChC;QACD,gBAAgB,EAAE,IAAI;QACtB,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,MAA4B,EAAE,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3E,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,IAA0B;QAC3C,OAAO,EAAG,MAAM,CAAC,UAAU,CAAyB,IAAI,KAAK;KAC9D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,WAA6B,EAAE,OAA4B;IACvF,IAAI,QAAQ,GAAG,WAAW,CAAC;IAE3B,wDAAwD;IACxD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,QAAQ,iCAAiC,CAAC,CAAC,CAAC;YAC5F,OAAO,CAAC,KAAK,CAAC,oBAAoB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;YAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,IAAI,6CAA6C,CAAC,CAAC;QAC1G,CAAC;QACD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAiB,EAAE;IAC5C,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,+CAA+C;IAC/C,MAAM,cAAc,GAAG,oBAAoB,CACzC,MAAM,CAAC,YAAY,EACnB,sBAAsB,EACtB,MAAM,CAAC,mBAAmB,CAC3B,CAAC;IACF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC,CAAC;QAChH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,cAAc,GAAG,cAAc,CAAC,eAAe,IAAI,EAAE,CAAC;IAC5D,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,kEAAkE,CAAC,CAAC,CAAC;QAChG,OAAO;IACT,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAE9F,gFAAgF;IAChF,MAAM,aAAa,GAAG,oBAAoB,CACxC,MAAM,CAAC,YAAY,EACnB,oBAAoB,EACpB,MAAM,CAAC,mBAAmB,CAC3B,CAAC;IAEF,mCAAmC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACpF,IAAI,cAA4D,CAAC;IACjE,IAAI,QAAQ,EAAE,CAAC;QACb,cAAc,GAAG,MAAM,yBAAyB,CAAC,oBAAoB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,0BAA0B,CAAC;QAC5C,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,WAAW,CAClD,QAAQ,EACR,KAAK,EAAE,OAAO,EAAE,EAAE,CAChB,eAAe,CACb,oBAAoB,EACpB,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,EAC9B,aAAa,EACb,CAAC,GAAG,EAAE,EAAE;YACN,OAAO,CAAC,IAAI,GAAG,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC;QACxC,CAAC,EACD,IAAI,CACL,EACH,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;YAC/C,OAAO,GAAG,QAAQ,KAAK,KAAK,uBAAuB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,CAAC,CACF,CAAC;QAEF,4EAA4E;QAC5E,MAAM,WAAW,GAAqB;YACpC,WAAW,EAAE,cAAc,CAAC,WAAW;YACvC,KAAK,EAAE;gBACL,GAAG,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC/B,GAAG,cAAc,CAAC,KAAK;aACxB;SACF,CAAC;QACF,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAEtE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACjD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -95,7 +95,7 @@ Generate diverse test scenarios covering:
|
|
|
95
95
|
4. **Edge cases**: path traversal attacks, boundary conditions
|
|
96
96
|
5. **Side-effect-free tools**: tools with no path arguments (should be allowed)
|
|
97
97
|
6. **Move operations**: all moves involve a delete-path role on the source argument
|
|
98
|
-
7. **Domain-based operations**: if any tools have URL roles (fetch-url, git-remote-url), generate scenarios for allowed domains, disallowed domains, and named remote resolution
|
|
98
|
+
7. **Domain-based operations**: if any tools have URL roles (fetch-url, git-remote-url), generate scenarios for allowed domains, disallowed domains, and named remote resolution. For git-remote-url args, always supply an explicit URL (https:// or git@ form) — never omit them (see IMPORTANT below)
|
|
99
99
|
|
|
100
100
|
The policy uses a default-deny model. Compiled rules only express "allow" or "escalate":
|
|
101
101
|
- "allow" -- explicitly permitted by a compiled rule
|
|
@@ -121,6 +121,7 @@ IMPORTANT:
|
|
|
121
121
|
- Use concrete paths based on the sandbox directory "${sandboxDirectory}".
|
|
122
122
|
- For paths outside all permitted areas, use paths like "/etc/passwd", "/var/log/syslog", etc.
|
|
123
123
|
- Generate at least 10 scenarios with good coverage across all three decision types (allow, deny, escalate).
|
|
124
|
+
- **Always include explicit URL values for git-remote-url arguments** (e.g., "https://github.com/org/repo.git" or "git@github.com:org/repo.git"). Never omit them. The policy engine resolves the default git remote from the filesystem at runtime, but that resolution does not run during policy verification — an absent git-remote-url arg means zero URL args are extracted, so domain-constrained compiled rules cannot match and will appear to fail incorrectly.
|
|
124
125
|
|
|
125
126
|
Be concise in descriptions and reasoning -- one sentence each.`;
|
|
126
127
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scenario-generator.js","sourceRoot":"","sources":["../../src/pipeline/scenario-generator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAGnC,SAAS,4BAA4B,CAAC,WAAkC,EAAE,SAAgC;IACxG,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;YAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC7C,CAAC;QACF,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;KACnC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAA+B;IACvE,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE7E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,uBAAuB,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,OAAO,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC;IACzF,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;EAIP,OAAO;;;CAGR,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,gBAAwB,EACxB,WAA6B,EAC7B,gBAAwB,EACxB,oBAA+B,EAC/B,YAA+B;IAE/B,MAAM,kBAAkB,GAAG,WAAW;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aACxD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,iBAAiB,CAAC,CAAC,WAAW,WAAW,QAAQ,IAAI,MAAM,GAAG,CAAC;IACrH,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;EAIP,gBAAgB;;;;EAIhB,kBAAkB;;;;uBAIG,gBAAgB;EAErC,oBAAoB,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC,CAAC;;;;;EAKJ,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CACrD;QACG,CAAC,CAAC,EACN;EACE,yBAAyB,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uDAiCc,gBAAgB
|
|
1
|
+
{"version":3,"file":"scenario-generator.js","sourceRoot":"","sources":["../../src/pipeline/scenario-generator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAGnC,SAAS,4BAA4B,CAAC,WAAkC,EAAE,SAAgC;IACxG,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;YAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC7C,CAAC;QACF,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;KACnC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAA+B;IACvE,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE7E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,uBAAuB,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,OAAO,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC;IACzF,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;EAIP,OAAO;;;CAGR,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,gBAAwB,EACxB,WAA6B,EAC7B,gBAAwB,EACxB,oBAA+B,EAC/B,YAA+B;IAE/B,MAAM,kBAAkB,GAAG,WAAW;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aACxD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,iBAAiB,CAAC,CAAC,WAAW,WAAW,QAAQ,IAAI,MAAM,GAAG,CAAC;IACrH,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;EAIP,gBAAgB;;;;EAIhB,kBAAkB;;;;uBAIG,gBAAgB;EAErC,oBAAoB,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC,CAAC;;;;;EAKJ,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CACrD;QACG,CAAC,CAAC,EACN;EACE,yBAAyB,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uDAiCc,gBAAgB;;;;;+DAKR,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,CAAe,EAAE,CAAe;IAClD,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,OAAO,KAAK,KAAK,KAAK,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,gBAAwB,EACxB,WAA6B,EAC7B,oBAAoC,EACpC,gBAAwB,EACxB,GAAkB,EAClB,oBAA+B,EAC/B,UAAsC,EACtC,MAAoC,EACpC,YAA+B;IAE/B,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAA0B,CAAC;IAChG,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAA0B,CAAC;IAC5F,MAAM,MAAM,GAAG,4BAA4B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAEpE,MAAM,eAAe,GACnB,MAAM;QACN,0BAA0B,CAAC,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC;IAElH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAChD,KAAK,EAAE,GAAG;QACV,MAAM;QACN,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,2DAA2D;QACnE,UAAU;KACX,CAAC,CAAC;IAEH,4DAA4D;IAC5D,MAAM,SAAS,GAAmB,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC;QACJ,MAAM,EAAE,WAAoB;KAC7B,CAAC,CAAC,CAAC;IAEJ,iEAAiE;IACjE,8BAA8B;IAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5F,oCAAoC;IACpC,OAAO,CAAC,GAAG,oBAAoB,EAAE,GAAG,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG,2DAA2D,CAAC;AAEzF;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA0B;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,mBAAmB,0BAA0B,CAAC,CAAC,iBAAiB,KAAK,CAAC,CAAC,kBAAkB,GAAG,CAC5G,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,4BAA4B;YAC1B,uGAAuG;YACvG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CACnB,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,MAAM,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,MAAM,EAAE,CAC7E,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,mDAAmD;YACjD,6GAA6G;YAC7G,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CACnB,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CACvC,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CACpH,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,wCAAwC;YACtC,mFAAmF;YACnF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CACnB,CAAC;IACJ,CAAC;IAED,OAAO,CACL,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QACrB,iFAAiF;QACjF,2DAA2D;QAC3D,mFAAmF,CACpF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,CAA8B;IAC1C,KAAK,CAAgB;IACrB,MAAM,CAAkD;IACxD,oBAAoB,CAAiB;IACrC,OAAO,GAA2D,EAAE,CAAC;IACrE,UAAU,CAAS;IAC5B,KAAK,GAAG,CAAC,CAAC;IAElB,YAAY,OAKX;QACC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QAEzD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAA0B,CAAC;QACxG,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAA0B,CAAC;QACpG,IAAI,CAAC,MAAM,GAAG,4BAA4B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAsC;QACnD,MAAM,WAAW,GAAG,oBAAoB,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAE1D,UAAU,EAAE,CAAC,yBAAyB,CAAC,CAAC;QAExC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,eAAe,EAAE,kBAAkB;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QAEb,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAmB,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC;YACJ,MAAM,EAAE,WAAoB;SAC7B,CAAC,CAAC,CAAC;QAEJ,4CAA4C;QAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO,CAAC,GAAG,IAAI,CAAC,oBAAoB,EAAE,GAAG,MAAM,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CAAC,QAA0B,EAAE,UAAsC;QACjF,sEAAsE;QACtE,MAAM,eAAe,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QAE9D,UAAU,EAAE,CAAC,gCAAgC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;QAEnE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,eAAe,EAAE,kBAAkB;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QAEb,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,GAAG,CAAC;YACJ,MAAM,EAAE,WAAoB;SAC7B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,oDAAoD;IACpD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF"}
|
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
* reach runtime.
|
|
8
8
|
*/
|
|
9
9
|
import type { LanguageModel } from 'ai';
|
|
10
|
-
import type {
|
|
10
|
+
import type { StoredToolAnnotation } from './types.js';
|
|
11
11
|
export interface MCPToolSchema {
|
|
12
12
|
name: string;
|
|
13
13
|
description?: string;
|
|
@@ -16,9 +16,9 @@ export interface MCPToolSchema {
|
|
|
16
16
|
/** Builds role description lines dynamically from the registry for the LLM prompt. */
|
|
17
17
|
export declare function buildRoleDescriptions(serverName?: string): string;
|
|
18
18
|
export declare function buildAnnotationPrompt(serverName: string, tools: MCPToolSchema[]): string;
|
|
19
|
-
export declare function annotateTools(serverName: string, tools: MCPToolSchema[], llm: LanguageModel, onProgress?: (message: string) => void): Promise<
|
|
19
|
+
export declare function annotateTools(serverName: string, tools: MCPToolSchema[], llm: LanguageModel, onProgress?: (message: string) => void): Promise<StoredToolAnnotation[]>;
|
|
20
20
|
export interface HeuristicValidationResult {
|
|
21
21
|
valid: boolean;
|
|
22
22
|
warnings: string[];
|
|
23
23
|
}
|
|
24
|
-
export declare function validateAnnotationsHeuristic(tools: MCPToolSchema[], annotations:
|
|
24
|
+
export declare function validateAnnotationsHeuristic(tools: MCPToolSchema[], annotations: StoredToolAnnotation[]): HeuristicValidationResult;
|
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
* reach runtime.
|
|
8
8
|
*/
|
|
9
9
|
import { z } from 'zod';
|
|
10
|
-
import { ARGUMENT_ROLE_REGISTRY, getRoleDefinition, getRolesForServer, } from '../types/argument-roles.js';
|
|
10
|
+
import { ARGUMENT_ROLE_REGISTRY, extractDefaultRoles, getRoleDefinition, getRolesForServer, isConditionalRoles, } from '../types/argument-roles.js';
|
|
11
11
|
import { generateObjectWithRepair } from './generate-with-repair.js';
|
|
12
12
|
function buildAnnotationsResponseSchema(serverName, tools) {
|
|
13
13
|
const toolNames = tools.map((t) => t.name);
|
|
@@ -17,6 +17,34 @@ function buildAnnotationsResponseSchema(serverName, tools) {
|
|
|
17
17
|
// LLMs sometimes return a bare string instead of a single-element array.
|
|
18
18
|
// Accept both formats and normalize to an array.
|
|
19
19
|
const rolesArraySchema = z.union([z.array(argumentRoleSchema), argumentRoleSchema.transform((r) => [r])]);
|
|
20
|
+
// Conditional role schemas: a condition on a sibling argument's value
|
|
21
|
+
const scalarSchema = z.union([z.string(), z.number(), z.boolean()]);
|
|
22
|
+
const conditionSchema = z
|
|
23
|
+
.object({
|
|
24
|
+
arg: z.string(),
|
|
25
|
+
equals: scalarSchema.optional(),
|
|
26
|
+
in: z.array(scalarSchema).optional(),
|
|
27
|
+
is: z.enum(['present', 'absent', 'truthy', 'falsy']).optional(),
|
|
28
|
+
})
|
|
29
|
+
.refine((c) => {
|
|
30
|
+
const count = [c.equals !== undefined, c.in !== undefined, c.is !== undefined].filter(Boolean).length;
|
|
31
|
+
return count === 1;
|
|
32
|
+
}, { message: 'Exactly one of equals, in, or is must be set' });
|
|
33
|
+
const conditionalEntrySchema = z.object({
|
|
34
|
+
condition: conditionSchema,
|
|
35
|
+
roles: rolesArraySchema,
|
|
36
|
+
});
|
|
37
|
+
const conditionalRolesSchema = z
|
|
38
|
+
.object({
|
|
39
|
+
default: rolesArraySchema,
|
|
40
|
+
when: z.array(conditionalEntrySchema),
|
|
41
|
+
})
|
|
42
|
+
.refine((spec) => {
|
|
43
|
+
const defaultSet = new Set(spec.default);
|
|
44
|
+
return spec.when.every((entry) => entry.roles.every((role) => defaultSet.has(role)));
|
|
45
|
+
}, { message: 'Conditional roles must be a subset of the default roles' });
|
|
46
|
+
// An argument's roles: either a static array or a conditional block
|
|
47
|
+
const argumentRoleSpecSchema = z.union([rolesArraySchema, conditionalRolesSchema]);
|
|
20
48
|
// Map tool name → expected argument names from input schemas
|
|
21
49
|
const toolArgNames = new Map();
|
|
22
50
|
for (const t of tools) {
|
|
@@ -27,7 +55,7 @@ function buildAnnotationsResponseSchema(serverName, tools) {
|
|
|
27
55
|
toolName: z.enum(toolNames),
|
|
28
56
|
comment: z.string(),
|
|
29
57
|
sideEffects: z.boolean(),
|
|
30
|
-
args: z.record(z.string(),
|
|
58
|
+
args: z.record(z.string(), argumentRoleSpecSchema),
|
|
31
59
|
});
|
|
32
60
|
return z.object({
|
|
33
61
|
annotations: z.array(toolAnnotationSchema).superRefine((annotations, ctx) => {
|
|
@@ -42,6 +70,23 @@ function buildAnnotationsResponseSchema(serverName, tools) {
|
|
|
42
70
|
message: `Tool "${a.toolName}" is missing role annotations for arguments: ${missingArgs.join(', ')}. Each argument must have a role array (e.g. ["read-path"] or ["none"]).`,
|
|
43
71
|
});
|
|
44
72
|
}
|
|
73
|
+
// Cross-argument validation: conditional role conditions must reference
|
|
74
|
+
// sibling argument names that exist in the same tool's annotation
|
|
75
|
+
for (const [argName, spec] of Object.entries(a.args)) {
|
|
76
|
+
if (isConditionalRoles(spec)) {
|
|
77
|
+
for (const entry of spec.when) {
|
|
78
|
+
const condArg = entry.condition.arg;
|
|
79
|
+
if (!(condArg in a.args)) {
|
|
80
|
+
ctx.addIssue({
|
|
81
|
+
code: 'custom',
|
|
82
|
+
path: [i, 'args', argName],
|
|
83
|
+
message: `Conditional role on "${argName}" references unknown argument "${condArg}". ` +
|
|
84
|
+
`The condition argument must be another argument in the same tool's input schema.`,
|
|
85
|
+
});
|
|
86
|
+
}
|
|
87
|
+
}
|
|
88
|
+
}
|
|
89
|
+
}
|
|
45
90
|
}
|
|
46
91
|
}),
|
|
47
92
|
});
|
|
@@ -99,6 +144,53 @@ Here is a complete example annotation for a move_file tool that shows multi-role
|
|
|
99
144
|
}
|
|
100
145
|
}
|
|
101
146
|
|
|
147
|
+
## Conditional Roles
|
|
148
|
+
|
|
149
|
+
When a tool has a mode/operation argument that changes its behavior, use
|
|
150
|
+
conditional role assignment instead of assigning the union of all possible
|
|
151
|
+
roles. This produces more precise policy evaluation.
|
|
152
|
+
|
|
153
|
+
Use conditional roles when:
|
|
154
|
+
- A tool has an operation/mode/type argument that selects between read,
|
|
155
|
+
write, and delete behavior
|
|
156
|
+
- A boolean flag (like dryRun or force) changes whether the tool modifies
|
|
157
|
+
state
|
|
158
|
+
|
|
159
|
+
Format for conditional roles:
|
|
160
|
+
{
|
|
161
|
+
"default": ["read-path", "write-history", "delete-history"],
|
|
162
|
+
"when": [
|
|
163
|
+
{ "condition": { "arg": "operation", "equals": "list" }, "roles": ["read-path"] },
|
|
164
|
+
{ "condition": { "arg": "operation", "in": ["create", "rename"] }, "roles": ["read-path", "write-history"] },
|
|
165
|
+
{ "condition": { "arg": "operation", "equals": "delete" }, "roles": ["read-path", "delete-history"] }
|
|
166
|
+
]
|
|
167
|
+
}
|
|
168
|
+
|
|
169
|
+
Rules for conditional roles:
|
|
170
|
+
- The "default" MUST be the MOST RESTRICTIVE role set (the union of all
|
|
171
|
+
possible roles). This is the fallback when no condition matches.
|
|
172
|
+
- Each "when" entry narrows the roles for a specific mode/flag value.
|
|
173
|
+
- The "arg" in a condition must reference another argument in the same
|
|
174
|
+
tool's input schema.
|
|
175
|
+
- Use "equals" for single-value matching, "in" for multiple values with
|
|
176
|
+
the same roles, and "is" for presence/truthiness checks.
|
|
177
|
+
- Only use conditional roles when the mode argument genuinely changes the
|
|
178
|
+
security profile. Do not add conditions for arguments that do not affect
|
|
179
|
+
which resources are accessed.
|
|
180
|
+
- Most arguments will still use static role arrays. Only use conditional
|
|
181
|
+
roles where the tool is clearly multi-mode.
|
|
182
|
+
|
|
183
|
+
Example: A tool with dryRun flag:
|
|
184
|
+
{
|
|
185
|
+
"path": {
|
|
186
|
+
"default": ["read-path", "write-path"],
|
|
187
|
+
"when": [
|
|
188
|
+
{ "condition": { "arg": "dryRun", "equals": true }, "roles": ["read-path"] }
|
|
189
|
+
]
|
|
190
|
+
},
|
|
191
|
+
"dryRun": ["none"]
|
|
192
|
+
}
|
|
193
|
+
|
|
102
194
|
Here are the tools to annotate:
|
|
103
195
|
|
|
104
196
|
${toolDescriptions}
|
|
@@ -178,7 +270,7 @@ export function validateAnnotationsHeuristic(tools, annotations) {
|
|
|
178
270
|
const argType = argSchema['type'];
|
|
179
271
|
if (argType === 'boolean' || argType === 'number' || argType === 'integer')
|
|
180
272
|
continue;
|
|
181
|
-
const roles = annotation.args[argName];
|
|
273
|
+
const roles = argName in annotation.args ? extractDefaultRoles(annotation.args[argName]) : undefined;
|
|
182
274
|
const hasPathRole = roles && roles.some((r) => getRoleDefinition(r).isResourceIdentifier);
|
|
183
275
|
if (!hasPathRole) {
|
|
184
276
|
warnings.push(`Tool "${tool.name}" argument "${argName}" looks like a path but has no path role in annotation`);
|
|
@@ -186,7 +278,7 @@ export function validateAnnotationsHeuristic(tools, annotations) {
|
|
|
186
278
|
}
|
|
187
279
|
// Check for path-like default values or examples
|
|
188
280
|
if (hasPathLikeValues(tool.inputSchema)) {
|
|
189
|
-
const hasAnyPathRole = Object.values(annotation.args).some((
|
|
281
|
+
const hasAnyPathRole = Object.values(annotation.args).some((spec) => extractDefaultRoles(spec).some((r) => getRoleDefinition(r).isResourceIdentifier));
|
|
190
282
|
if (!hasAnyPathRole) {
|
|
191
283
|
warnings.push(`Tool "${tool.name}" schema has path-like defaults/examples but no path roles in annotation`);
|
|
192
284
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tool-annotator.js","sourceRoot":"","sources":["../../src/pipeline/tool-annotator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,
|
|
1
|
+
{"version":3,"file":"tool-annotator.js","sourceRoot":"","sources":["../../src/pipeline/tool-annotator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAUrE,SAAS,8BAA8B,CAAC,UAAkB,EAAE,KAAsB;IAChF,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAA0B,CAAC;IAEpE,sEAAsE;IACtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAsC,CAAC;IAC5G,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE9C,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1G,sEAAsE;IACtE,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,eAAe,GAAG,CAAC;SACtB,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;QAC/B,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;QACpC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KAChE,CAAC;SACD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACtG,OAAO,KAAK,KAAK,CAAC,CAAC;IACrB,CAAC,EACD,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAC5D,CAAC;IAEJ,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,CAAC;SAC7B,MAAM,CAAC;QACN,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;KACtC,CAAC;SACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC,EACD,EAAE,OAAO,EAAE,yDAAyD,EAAE,CACvE,CAAC;IAEJ,oEAAoE;IACpE,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAEnF,6DAA6D;IAC7D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC7E,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;QACxB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC;KACnD,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE;YAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBACzB,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxD,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;wBACjB,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,gDAAgD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,0EAA0E;qBAC7K,CAAC,CAAC;gBACL,CAAC;gBAED,wEAAwE;gBACxE,kEAAkE;gBAClE,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;4BAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;4BACpC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gCACzB,GAAG,CAAC,QAAQ,CAAC;oCACX,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC;oCAC1B,OAAO,EACL,wBAAwB,OAAO,kCAAkC,OAAO,KAAK;wCAC7E,kFAAkF;iCACrF,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,UAAmB;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,CAAC,CAAC;IACnG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,KAAsB;IAC9E,MAAM,gBAAgB,GAAG,KAAK;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,OAAO;YACL,SAAS,CAAC,CAAC,IAAI,EAAE;YACjB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;YACpD,iBAAiB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;SAC1D;aACE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC;SACD,IAAI,CAAC,aAAa,CAAC,CAAC;IAEvB,OAAO,oFAAoF,UAAU;;;;;;;;;;EAUrG,qBAAqB,CAAC,UAAU,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuEjC,gBAAgB;;6BAEW,KAAK,CAAC,MAAM,+CAA+C,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,KAAsB,EACtB,GAAkB,EAClB,UAAsC;IAEtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAExD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAChD,KAAK,EAAE,GAAG;QACV,MAAM;QACN,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,WAAW,GAA2B,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,GAAG,CAAC;QACJ,UAAU;KACX,CAAC,CAAC,CAAC;IAEJ,yDAAyD;IACzD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,0EAA0E;AAC1E,oCAAoC;AACpC,0EAA0E;AAE1E,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAE3F,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA+B;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAwD,CAAC;IAC/F,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC1B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACzE,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,MAAM,UAAU,4BAA4B,CAC1C,KAAsB,EACtB,WAAmC;IAEnC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAgC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE,CAA4C,CAAC;QAErG,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBAAE,SAAS;YAE9C,gFAAgF;YAChF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YAErF,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrG,MAAM,WAAW,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAE1F,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,eAAe,OAAO,wDAAwD,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAClE,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CACjF,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,0EAA0E,CAAC,CAAC;YAC9G,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC5B,QAAQ;KACT,CAAC;AACJ,CAAC"}
|
package/dist/pipeline/types.d.ts
CHANGED
|
@@ -25,6 +25,58 @@ export interface ToolAnnotationsFile {
|
|
|
25
25
|
tools: ToolAnnotation[];
|
|
26
26
|
}>;
|
|
27
27
|
}
|
|
28
|
+
/**
|
|
29
|
+
* A condition on a sibling argument that determines which roles apply.
|
|
30
|
+
* Exactly one of equals/in/is must be set.
|
|
31
|
+
*/
|
|
32
|
+
export interface RoleCondition {
|
|
33
|
+
readonly arg: string;
|
|
34
|
+
readonly equals?: string | number | boolean;
|
|
35
|
+
readonly in?: ReadonlyArray<string | number | boolean>;
|
|
36
|
+
readonly is?: 'present' | 'absent' | 'truthy' | 'falsy';
|
|
37
|
+
}
|
|
38
|
+
/**
|
|
39
|
+
* A conditional role assignment: when the condition matches,
|
|
40
|
+
* these roles apply instead of the default.
|
|
41
|
+
*/
|
|
42
|
+
export interface ConditionalRoleEntry {
|
|
43
|
+
readonly condition: RoleCondition;
|
|
44
|
+
readonly roles: ArgumentRole[];
|
|
45
|
+
}
|
|
46
|
+
/**
|
|
47
|
+
* Roles for an argument that depend on the values of sibling arguments.
|
|
48
|
+
* The `default` roles apply when no `when` clause matches.
|
|
49
|
+
*
|
|
50
|
+
* Invariant: each `when` entry's `roles` must be a subset of `default`.
|
|
51
|
+
* This ensures conditional resolution can only narrow, never expand.
|
|
52
|
+
*/
|
|
53
|
+
export interface ConditionalRoles {
|
|
54
|
+
readonly default: ArgumentRole[];
|
|
55
|
+
readonly when: ConditionalRoleEntry[];
|
|
56
|
+
}
|
|
57
|
+
/**
|
|
58
|
+
* An argument's roles in the stored (on-disk) format: either a static
|
|
59
|
+
* array (backward compatible) or a conditional block with default + when.
|
|
60
|
+
*/
|
|
61
|
+
export type ArgumentRoleSpec = ArgumentRole[] | ConditionalRoles;
|
|
62
|
+
/**
|
|
63
|
+
* A tool annotation as stored in tool-annotations.json.
|
|
64
|
+
* Args may contain conditional role specs that need resolution
|
|
65
|
+
* against actual tool call arguments before use.
|
|
66
|
+
*/
|
|
67
|
+
export interface StoredToolAnnotation extends Omit<ToolAnnotation, 'args'> {
|
|
68
|
+
args: Record<string, ArgumentRoleSpec>;
|
|
69
|
+
}
|
|
70
|
+
/**
|
|
71
|
+
* The tool-annotations.json file format.
|
|
72
|
+
* Uses StoredToolAnnotation because the file may contain conditional specs.
|
|
73
|
+
*/
|
|
74
|
+
export interface StoredToolAnnotationsFile extends Omit<ToolAnnotationsFile, 'servers'> {
|
|
75
|
+
servers: Record<string, {
|
|
76
|
+
inputHash: string;
|
|
77
|
+
tools: StoredToolAnnotation[];
|
|
78
|
+
}>;
|
|
79
|
+
}
|
|
28
80
|
export interface PathCondition {
|
|
29
81
|
roles: ArgumentRole[];
|
|
30
82
|
within: string;
|