@provos/ironcurtain 0.7.2 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +29 -100
- package/dist/config/first-start.js +4 -1
- package/dist/config/first-start.js.map +1 -1
- package/dist/config/mcp-servers.json +8 -2
- package/dist/config/paths.d.ts +5 -0
- package/dist/config/paths.js +8 -0
- package/dist/config/paths.js.map +1 -1
- package/dist/config/user-config.d.ts +27 -0
- package/dist/config/user-config.js +28 -0
- package/dist/config/user-config.js.map +1 -1
- package/dist/cron/constitution-generator.d.ts +2 -1
- package/dist/cron/constitution-generator.js +35 -36
- package/dist/cron/constitution-generator.js.map +1 -1
- package/dist/daemon/ironcurtain-daemon.js +1 -0
- package/dist/daemon/ironcurtain-daemon.js.map +1 -1
- package/dist/docker/adapters/claude-code.js +32 -5
- package/dist/docker/adapters/claude-code.js.map +1 -1
- package/dist/docker/agent-adapter.d.ts +40 -0
- package/dist/docker/claude-md-seed.d.ts +27 -0
- package/dist/docker/claude-md-seed.js +42 -0
- package/dist/docker/claude-md-seed.js.map +1 -0
- package/dist/docker/docker-agent-session.js +2 -0
- package/dist/docker/docker-agent-session.js.map +1 -1
- package/dist/docker/docker-infrastructure.d.ts +15 -1
- package/dist/docker/docker-infrastructure.js +72 -1
- package/dist/docker/docker-infrastructure.js.map +1 -1
- package/dist/docker/mitm-proxy.d.ts +15 -0
- package/dist/docker/mitm-proxy.js +75 -7
- package/dist/docker/mitm-proxy.js.map +1 -1
- package/dist/docker/package-types.d.ts +127 -0
- package/dist/docker/package-types.js +8 -0
- package/dist/docker/package-types.js.map +1 -0
- package/dist/docker/package-validator.d.ts +41 -0
- package/dist/docker/package-validator.js +90 -0
- package/dist/docker/package-validator.js.map +1 -0
- package/dist/docker/pty-session.d.ts +15 -0
- package/dist/docker/pty-session.js +205 -44
- package/dist/docker/pty-session.js.map +1 -1
- package/dist/docker/pty-types.d.ts +24 -0
- package/dist/docker/pty-types.js +2 -0
- package/dist/docker/pty-types.js.map +1 -1
- package/dist/docker/registry-proxy.d.ts +142 -0
- package/dist/docker/registry-proxy.js +856 -0
- package/dist/docker/registry-proxy.js.map +1 -0
- package/dist/index.js +10 -2
- package/dist/index.js.map +1 -1
- package/dist/memory/memory-annotations.d.ts +47 -0
- package/dist/memory/memory-annotations.js +87 -0
- package/dist/memory/memory-annotations.js.map +1 -0
- package/dist/memory/memory-prompt.d.ts +12 -0
- package/dist/memory/memory-prompt.js +20 -0
- package/dist/memory/memory-prompt.js.map +1 -0
- package/dist/memory/resolve-memory-path.d.ts +20 -0
- package/dist/memory/resolve-memory-path.js +30 -0
- package/dist/memory/resolve-memory-path.js.map +1 -0
- package/dist/mux/mux-app.js +78 -10
- package/dist/mux/mux-app.js.map +1 -1
- package/dist/mux/mux-input-handler.d.ts +28 -2
- package/dist/mux/mux-input-handler.js +164 -7
- package/dist/mux/mux-input-handler.js.map +1 -1
- package/dist/mux/mux-renderer.d.ts +3 -1
- package/dist/mux/mux-renderer.js +181 -7
- package/dist/mux/mux-renderer.js.map +1 -1
- package/dist/mux/persona-scanner.d.ts +19 -0
- package/dist/mux/persona-scanner.js +53 -0
- package/dist/mux/persona-scanner.js.map +1 -0
- package/dist/mux/pty-bridge.d.ts +4 -0
- package/dist/mux/pty-bridge.js +6 -0
- package/dist/mux/pty-bridge.js.map +1 -1
- package/dist/mux/session-scanner.d.ts +18 -0
- package/dist/mux/session-scanner.js +65 -0
- package/dist/mux/session-scanner.js.map +1 -0
- package/dist/mux/types.d.ts +13 -1
- package/dist/mux/types.js +5 -1
- package/dist/mux/types.js.map +1 -1
- package/dist/persona/persona-command.js +130 -88
- package/dist/persona/persona-command.js.map +1 -1
- package/dist/persona/persona-prompt.d.ts +7 -7
- package/dist/persona/persona-prompt.js +14 -29
- package/dist/persona/persona-prompt.js.map +1 -1
- package/dist/persona/resolve.js +5 -2
- package/dist/persona/resolve.js.map +1 -1
- package/dist/sandbox/index.d.ts +26 -10
- package/dist/sandbox/index.js +131 -40
- package/dist/sandbox/index.js.map +1 -1
- package/dist/session/agent-session.d.ts +2 -1
- package/dist/session/agent-session.js +4 -1
- package/dist/session/agent-session.js.map +1 -1
- package/dist/session/index.d.ts +25 -1
- package/dist/session/index.js +57 -8
- package/dist/session/index.js.map +1 -1
- package/dist/session/prompts.js +8 -8
- package/dist/session/types.d.ts +5 -0
- package/dist/session/workspace-validation.js +37 -6
- package/dist/session/workspace-validation.js.map +1 -1
- package/dist/trusted-process/index.js +23 -29
- package/dist/trusted-process/index.js.map +1 -1
- package/dist/trusted-process/mcp-proxy-server.d.ts +9 -0
- package/dist/trusted-process/mcp-proxy-server.js +91 -37
- package/dist/trusted-process/mcp-proxy-server.js.map +1 -1
- package/dist/trusted-process/policy-engine.d.ts +4 -1
- package/dist/trusted-process/policy-engine.js +15 -1
- package/dist/trusted-process/policy-engine.js.map +1 -1
- package/docker/Dockerfile.base +22 -0
- package/docker/Dockerfile.base.arm64 +44 -4
- package/docker/entrypoint-claude-code.sh +9 -1
- package/package.json +7 -2
- package/src/config/mcp-servers.json +8 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,8BAA8B,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAA0B,EAAE;IAC9D,+EAA+E;IAC/E,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,IAAI,GAAgB,gBAAgB,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEvE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAAuB;IAClD,IAAI,CAAC,OAAO,CAAC,eAAe;QAAE,OAAO,OAAO,CAAC;IAC7C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9B,OAAO;QACL,GAAG,OAAO;QACV,qEAAqE;QACrE,0EAA0E;QAC1E,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1G,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CAAC,OAAuB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IAEpC,uEAAuE;IACvE,8CAA8C;IAC9C,MAAM,kBAAkB,GAAG,OAAO,CAAC,eAAe,IAAI,SAAS,CAAC;IAEhE,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,YAAY,CACpB,0BAA0B,OAAO,CAAC,eAAe,KAAK,GAAG,kCAAkC,UAAU,EAAE,EACvG,qBAAqB,CACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEzF,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,gBAAgB,GAAmB,aAAa,CAAC,wBAAwB;QAC7E,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,wBAAwB,EAAE,aAAa,CAAC,wBAAwB,EAAE;QAClF,CAAC,CAAC,OAAO,CAAC;IAEZ,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAEjH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2BAA2B;QAC3B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,eAAe;YAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1F,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAChC,OAAqD,EACrD,OAAuB;IAEvB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,MAAM,kBAAkB,GAAG,OAAO,CAAC,eAAe,IAAI,SAAS,CAAC;IAEhE,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEzF,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;IAC3F,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;IAEjF,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAC7C,aAAa,CAAC,MAAM,EACpB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAClC,aAAa,CAAC,UAAU,EACxB,aAAa,CAAC,UAAU,EACxB,aAAa,CAAC,aAAa,EAC3B,aAAa,CAAC,YAAY,EAC1B,SAAS,CACV,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC;QACrC,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,SAAS;QACT,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,YAAY,EAAE,aAAa,CAAC,YAAY;QACxC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,sBAAsB,EAAE;YACtB,YAAY,EAAE,aAAa,CAAC,wBAAwB;gBAClD,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,OAAO,aAAa,CAAC,wBAAwB,EAAE;gBACtE,CAAC,CAAC,KAAK,CAAC,YAAY;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB;KACF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,eAAe;YAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACjG,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAaD;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,CAAC,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAEvF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,YAAY,CACpB,+CAA+C;YAC7C,aAAa,cAAc,IAAI;YAC/B,YAAY,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACtC,qBAAqB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CACzB,MAAyB,EACzB,kBAA0B,EAC1B,SAAoB,EACpB,OAGI,EAAE;IAEN,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,wBAAwB,EAAE,GAAG,IAAI,CAAC;IAClE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IACrD,IAAI,eAA8C,CAAC;IAEnD,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;QACD,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAC/B,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QAE3C,sEAAsE;QACtE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;QACzC,CAAC;QAED,uEAAuE;QACvE,6EAA6E;QAC7E,sEAAsE;QACtE,MAAM,mBAAmB,GAAG,oCAAoC,CAC9D,QAAQ,CAAC,OAAO,EAChB,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CACpC,CAAC;QACF,wBAAwB,GAAG,wBAAwB;YACjD,CAAC,CAAC,GAAG,mBAAmB,OAAO,wBAAwB,EAAE;YACzD,CAAC,CAAC,mBAAmB,CAAC;QAExB,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,yBAAyB,SAAS,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,aAAa,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAEhE,oEAAoE;IACpE,mEAAmE;IACnE,0DAA0D;IAC1D,iEAAiE;IACjE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,MAAM,cAAc,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,qBAAqB,GAAG,+BAA+B,CAAC,kBAAkB,CAAC,CAAC;IAElF,gEAAgE;IAChE,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9C,MAAM,CAAC,IAAI,CAAC,WAAW,SAAS,UAAU,CAAC,CAAC;IAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,CAAC,mBAAmB,aAAa,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC,cAAc,YAAY,EAAE,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC;IACtC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,yBAAyB,eAAe,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,iEAAiE;IACjE,wEAAwE;IACxE,MAAM,aAAa,GAAG;QACpB,GAAG,MAAM;QACT,gBAAgB,EAAE,UAAU;QAC5B,YAAY;QACZ,aAAa;QACb,cAAc;QACd,UAAU;QACV,qBAAqB;QACrB,gEAAgE;QAChE,wEAAwE;QACxE,sDAAsD;QACtD,GAAG,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,YAAY,EAAE,SAAS;gBACvB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,YAAY;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAA6B;QACrF,4EAA4E;QAC5E,GAAG,CAAC,kBAAkB;YACpB,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;YAC7G,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,kDAAkD;IAClD,IAAI,eAAe,EAAE,CAAC;QACpB,aAAa,CAAC,UAAU,GAAG,oBAAoB,CAAC,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC7F,CAAC;IAED,sEAAsE;IACtE,8BAA8B,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAE1D,yDAAyD;IACzD,sDAAsD;IACtD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,mBAAmB,CAAC,kBAAkB,EAAE;YACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,wEAAwE;YACxE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,UAAU;QACV,UAAU;QACV,aAAa;QACb,YAAY;QACZ,wBAAwB;KACzB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAA0D,EAC1D,UAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAmC,CAAC;IACnF,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,uDAAuD;IACvD,0EAA0E;IAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;IAC3C,CAAC;AACH,CAAC;AAgBD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,8BAA8B,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAA0B,EAAE;IAC9D,+EAA+E;IAC/E,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,IAAI,GAAgB,gBAAgB,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEvE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAAuB;IAClD,IAAI,CAAC,OAAO,CAAC,eAAe;QAAE,OAAO,OAAO,CAAC;IAC7C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9B,OAAO;QACL,GAAG,OAAO;QACV,qEAAqE;QACrE,0EAA0E;QAC1E,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1G,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CAAC,OAAuB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IAEpC,uEAAuE;IACvE,8CAA8C;IAC9C,MAAM,kBAAkB,GAAG,OAAO,CAAC,eAAe,IAAI,SAAS,CAAC;IAEhE,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,YAAY,CACpB,0BAA0B,OAAO,CAAC,eAAe,KAAK,GAAG,kCAAkC,UAAU,EAAE,EACvG,qBAAqB,CACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEzF,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,gBAAgB,GAAmB,aAAa,CAAC,wBAAwB;QAC7E,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,wBAAwB,EAAE,aAAa,CAAC,wBAAwB,EAAE;QAClF,CAAC,CAAC,OAAO,CAAC;IAEZ,MAAM,OAAO,GAAG,IAAI,YAAY,CAC9B,aAAa,CAAC,MAAM,EACpB,SAAS,EACT,aAAa,CAAC,aAAa,EAC3B,aAAa,CAAC,UAAU,EACxB,gBAAgB,CACjB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2BAA2B;QAC3B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,eAAe;YAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1F,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAChC,OAAqD,EACrD,OAAuB;IAEvB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,MAAM,kBAAkB,GAAG,OAAO,CAAC,eAAe,IAAI,SAAS,CAAC;IAEhE,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEzF,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;IAC3F,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;IACjF,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAE5E,MAAM,eAAe,GAAG,mBAAmB,CAAC;QAC1C,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;KAChD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAC7C,aAAa,CAAC,MAAM,EACpB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAClC,aAAa,CAAC,UAAU,EACxB,aAAa,CAAC,UAAU,EACxB,aAAa,CAAC,aAAa,EAC3B,aAAa,CAAC,YAAY,EAC1B,SAAS,CACV,CAAC;IAEF,wEAAwE;IACxE,oEAAoE;IACpE,4EAA4E;IAC5E,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QACtE,IAAI,eAAe,EAAE,CAAC;YACpB,aAAa,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,UAAU,CAAC,YAAY,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC;QACrC,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,SAAS;QACT,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,YAAY,EAAE,aAAa,CAAC,YAAY;QACxC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,sBAAsB,EAAE;YACtB,YAAY,EAAE,aAAa,CAAC,wBAAwB;gBAClD,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,OAAO,aAAa,CAAC,wBAAwB,EAAE;gBACtE,CAAC,CAAC,KAAK,CAAC,YAAY;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB;KACF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,eAAe;YAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACjG,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAaD;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,CAAC,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAEvF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,YAAY,CACpB,+CAA+C;YAC7C,aAAa,cAAc,IAAI;YAC/B,YAAY,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACtC,qBAAqB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAyB,EACzB,kBAA0B,EAC1B,SAAoB,EACpB,OASI,EAAE;IAEN,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,wBAAwB,EAAE,GAAG,IAAI,CAAC;IAClE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IACrD,IAAI,eAA8C,CAAC;IAEnD,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;QACD,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAC/B,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QAE3C,sEAAsE;QACtE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;QACzC,CAAC;QAED,sFAAsF;QACtF,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;QACvD,MAAM,mBAAmB,GAAG,oCAAoC,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClG,wBAAwB,GAAG,wBAAwB;YACjD,CAAC,CAAC,GAAG,mBAAmB,OAAO,wBAAwB,EAAE;YACzD,CAAC,CAAC,mBAAmB,CAAC;QAExB,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,yBAAyB,SAAS,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,aAAa,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAEhE,oEAAoE;IACpE,mEAAmE;IACnE,0DAA0D;IAC1D,iEAAiE;IACjE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,MAAM,cAAc,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,qBAAqB,GAAG,+BAA+B,CAAC,kBAAkB,CAAC,CAAC;IAElF,gEAAgE;IAChE,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9C,MAAM,CAAC,IAAI,CAAC,WAAW,SAAS,UAAU,CAAC,CAAC;IAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,CAAC,mBAAmB,aAAa,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC,cAAc,YAAY,EAAE,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC;IACtC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,yBAAyB,eAAe,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,iEAAiE;IACjE,wEAAwE;IACxE,MAAM,aAAa,GAAG;QACpB,GAAG,MAAM;QACT,gBAAgB,EAAE,UAAU;QAC5B,YAAY;QACZ,aAAa;QACb,cAAc;QACd,UAAU;QACV,qBAAqB;QACrB,gEAAgE;QAChE,wEAAwE;QACxE,sDAAsD;QACtD,GAAG,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,YAAY,EAAE,SAAS;gBACvB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,YAAY;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAA6B;QACrF,4EAA4E;QAC5E,GAAG,CAAC,kBAAkB;YACpB,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;YAC7G,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,kDAAkD;IAClD,IAAI,eAAe,EAAE,CAAC;QACpB,aAAa,CAAC,UAAU,GAAG,oBAAoB,CAAC,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC7F,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;IAC9C,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,GAAG,uBAAuB,CAAC;YACrE,MAAM;YACN,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAW;YACjD,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,eAAe;SACnD,CAAC,CAAC;QAEH,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,oBAAoB,CAAC,uBAAuB,EAAE,CAAC,CAAC;YACrE,wBAAwB,GAAG,wBAAwB;gBACjD,CAAC,CAAC,GAAG,YAAY,OAAO,wBAAwB,EAAE;gBAClD,CAAC,CAAC,YAAY,CAAC;QACnB,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,8BAA8B,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAE1D,yDAAyD;IACzD,sDAAsD;IACtD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,mBAAmB,CAAC,kBAAkB,EAAE;YACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,wEAAwE;YACxE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,UAAU;QACV,UAAU;QACV,aAAa;QACb,YAAY;QACZ,wBAAwB;KACzB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAA0D,EAC1D,UAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAmC,CAAC;IACnF,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,uDAAuD;IACvD,0EAA0E;IAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;IAC3C,CAAC;AACH,CAAC;AAgBD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC"}
|
package/dist/session/prompts.js
CHANGED
|
@@ -18,7 +18,7 @@ ${sandboxInfo}
|
|
|
18
18
|
|
|
19
19
|
- Tools are synchronous — do NOT use \`await\`.
|
|
20
20
|
- Use \`return\` to send a value back to the conversation.
|
|
21
|
-
- Example: \`const result =
|
|
21
|
+
- Example: \`const result = filesystem.list_directory({ path: "/tmp" });\`
|
|
22
22
|
|
|
23
23
|
## Efficient code execution
|
|
24
24
|
|
|
@@ -35,11 +35,11 @@ BAD — 81 separate execute_code calls:
|
|
|
35
35
|
...
|
|
36
36
|
|
|
37
37
|
GOOD — one execute_code call with a loop:
|
|
38
|
-
const dir =
|
|
38
|
+
const dir = filesystem.list_directory({ path: "/data" });
|
|
39
39
|
let count = 0;
|
|
40
40
|
for (const entry of dir.entries) {
|
|
41
41
|
if (entry.name.endsWith('.txt')) {
|
|
42
|
-
|
|
42
|
+
filesystem.move_file({ source: \`/data/\${entry.name}\`, destination: \`/archive/\${entry.name}\` });
|
|
43
43
|
count++;
|
|
44
44
|
}
|
|
45
45
|
}
|
|
@@ -52,7 +52,7 @@ Large tool results are automatically truncated. To avoid losing information:
|
|
|
52
52
|
- Before reading files, use list_directory to survey what exists. Assess which files are relevant to the task.
|
|
53
53
|
- Do NOT read all files in a directory at once. Read a few at a time, summarize findings, then continue if needed.
|
|
54
54
|
- For large files, use the head and tail parameters on read_text_file to read specific portions.
|
|
55
|
-
Example:
|
|
55
|
+
Example: filesystem.read_text_file({ path: "large.log", tail: 50 })
|
|
56
56
|
- If a result contains [... truncated N bytes ...], use targeted reads to access the specific portion you need.
|
|
57
57
|
- When you need information from multiple files, read them in a single execute_code call using a loop, not in separate calls.
|
|
58
58
|
|
|
@@ -63,8 +63,8 @@ ${serverLines}
|
|
|
63
63
|
### Tool discovery
|
|
64
64
|
|
|
65
65
|
Call \`help.help('serverName')\` to list the tools in a server with their required parameters.
|
|
66
|
-
Call \`__getToolInterface('
|
|
67
|
-
Use the exact callable name from the catalog (e.g., \`
|
|
66
|
+
Call \`__getToolInterface('filesystem.read_text_file')\` to inspect a tool's full TypeScript interface.
|
|
67
|
+
Use the exact callable name from the catalog (e.g., \`filesystem.read_text_file\`, \`git.push\`).
|
|
68
68
|
|
|
69
69
|
Example workflow:
|
|
70
70
|
\`\`\`typescript
|
|
@@ -73,11 +73,11 @@ const info = help.help('filesystem');
|
|
|
73
73
|
return info;
|
|
74
74
|
|
|
75
75
|
// 2. Inspect a tool's interface
|
|
76
|
-
const iface = __getToolInterface('
|
|
76
|
+
const iface = __getToolInterface('filesystem.read_text_file');
|
|
77
77
|
return iface;
|
|
78
78
|
|
|
79
79
|
// 3. Then use them
|
|
80
|
-
const content =
|
|
80
|
+
const content = filesystem.read_text_file({ path: '/data/config.json' });
|
|
81
81
|
return content;
|
|
82
82
|
\`\`\`
|
|
83
83
|
`;
|
package/dist/session/types.d.ts
CHANGED
|
@@ -239,6 +239,11 @@ export interface SessionOptions {
|
|
|
239
239
|
* persona takes precedence with a warning.
|
|
240
240
|
*/
|
|
241
241
|
persona?: string;
|
|
242
|
+
/**
|
|
243
|
+
* Cron job ID. When set (and no persona), the memory server uses
|
|
244
|
+
* a job-specific database at ~/.ironcurtain/jobs/{jobId}/memory.db.
|
|
245
|
+
*/
|
|
246
|
+
jobId?: string;
|
|
242
247
|
}
|
|
243
248
|
/**
|
|
244
249
|
* The core session contract. A session is a stateful conversation
|
|
@@ -10,7 +10,8 @@ import { statSync } from 'node:fs';
|
|
|
10
10
|
import { homedir } from 'node:os';
|
|
11
11
|
import { resolve } from 'node:path';
|
|
12
12
|
import { expandTilde, resolveRealPath } from '../types/argument-roles.js';
|
|
13
|
-
import { getIronCurtainHome } from '../config/paths.js';
|
|
13
|
+
import { getIronCurtainHome, getSessionsDir } from '../config/paths.js';
|
|
14
|
+
import { getPersonasDir } from '../persona/resolve.js';
|
|
14
15
|
/** Returns true when `child` is equal to or nested inside `parent`. */
|
|
15
16
|
export function isEqualOrInside(child, parent) {
|
|
16
17
|
if (child === parent)
|
|
@@ -18,6 +19,27 @@ export function isEqualOrInside(child, parent) {
|
|
|
18
19
|
const prefix = parent === '/' ? '/' : parent + '/';
|
|
19
20
|
return child.startsWith(prefix);
|
|
20
21
|
}
|
|
22
|
+
/**
|
|
23
|
+
* Checks whether a canonical path inside ~/.ironcurtain/ is one of the
|
|
24
|
+
* managed workspace directories that should be allowed as a workspace:
|
|
25
|
+
* - personas/{name}/workspace[/...]
|
|
26
|
+
* - sessions/{id}/sandbox[/...]
|
|
27
|
+
*/
|
|
28
|
+
function isAllowedIronCurtainSubpath(canonical) {
|
|
29
|
+
const personasBase = resolveRealPath(getPersonasDir());
|
|
30
|
+
if (isEqualOrInside(canonical, personasBase)) {
|
|
31
|
+
const relative = canonical.slice(personasBase.length + 1);
|
|
32
|
+
if (/^[^/]+\/workspace(\/.*)?$/.test(relative))
|
|
33
|
+
return true;
|
|
34
|
+
}
|
|
35
|
+
const sessionsBase = resolveRealPath(getSessionsDir());
|
|
36
|
+
if (isEqualOrInside(canonical, sessionsBase)) {
|
|
37
|
+
const relative = canonical.slice(sessionsBase.length + 1);
|
|
38
|
+
if (/^[^/]+\/sandbox(\/.*)?$/.test(relative))
|
|
39
|
+
return true;
|
|
40
|
+
}
|
|
41
|
+
return false;
|
|
42
|
+
}
|
|
21
43
|
/**
|
|
22
44
|
* Validates and canonicalizes a workspace path.
|
|
23
45
|
*
|
|
@@ -46,8 +68,13 @@ export function validateWorkspacePath(rawPath, protectedPaths) {
|
|
|
46
68
|
if (canonical === resolveRealPath(homedir())) {
|
|
47
69
|
throw new Error('Cannot use home directory as workspace');
|
|
48
70
|
}
|
|
71
|
+
// IronCurtain manages two kinds of internal workspace directories:
|
|
72
|
+
// - Persona workspaces: ~/.ironcurtain/personas/{name}/workspace[/...]
|
|
73
|
+
// - Session sandboxes: ~/.ironcurtain/sessions/{id}/sandbox[/...]
|
|
74
|
+
// These are always allowed. All other paths under ~/.ironcurtain/ are rejected.
|
|
49
75
|
const ironCurtainHome = resolveRealPath(getIronCurtainHome());
|
|
50
|
-
|
|
76
|
+
const isAllowedInternalPath = isEqualOrInside(canonical, ironCurtainHome) && isAllowedIronCurtainSubpath(canonical);
|
|
77
|
+
if (isEqualOrInside(canonical, ironCurtainHome) && !isAllowedInternalPath) {
|
|
51
78
|
throw new Error(`Workspace path is inside the IronCurtain home directory: ${canonical}`);
|
|
52
79
|
}
|
|
53
80
|
// Check that workspace is not inside a protected path.
|
|
@@ -55,10 +82,14 @@ export function validateWorkspacePath(rawPath, protectedPaths) {
|
|
|
55
82
|
// NOT checked here — the PolicyEngine already protects those paths at
|
|
56
83
|
// runtime regardless of the allowedDirectory, so a workspace that happens
|
|
57
84
|
// to contain e.g. src/config/generated/ is perfectly safe.
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
85
|
+
// Allowed internal paths are exempt — they live under ~/.ironcurtain/ by
|
|
86
|
+
// design, and the PolicyEngine protects config/policy files at runtime.
|
|
87
|
+
if (!isAllowedInternalPath) {
|
|
88
|
+
for (const pp of protectedPaths) {
|
|
89
|
+
const protectedCanonical = resolveRealPath(pp);
|
|
90
|
+
if (isEqualOrInside(canonical, protectedCanonical)) {
|
|
91
|
+
throw new Error(`Workspace path overlaps with protected path: ${protectedCanonical}`);
|
|
92
|
+
}
|
|
62
93
|
}
|
|
63
94
|
}
|
|
64
95
|
return canonical;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"workspace-validation.js","sourceRoot":"","sources":["../../src/session/workspace-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"workspace-validation.js","sourceRoot":"","sources":["../../src/session/workspace-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,MAAc;IAC3D,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;IACnD,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,SAAiB;IACpD,MAAM,YAAY,GAAG,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;IACvD,IAAI,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1D,IAAI,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9D,CAAC;IACD,MAAM,YAAY,GAAG,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;IACvD,IAAI,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1D,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,cAAwB;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAE5C,gCAAgC;IAChC,IAAI,IAAiC,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,SAAS,KAAK,eAAe,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,mEAAmE;IACnE,uEAAuE;IACvE,mEAAmE;IACnE,gFAAgF;IAChF,MAAM,eAAe,GAAG,eAAe,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC9D,MAAM,qBAAqB,GAAG,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAEpH,IAAI,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,4DAA4D,SAAS,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,uDAAuD;IACvD,2EAA2E;IAC3E,sEAAsE;IACtE,0EAA0E;IAC1E,2DAA2D;IAC3D,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,MAAM,kBAAkB,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;YAE/C,IAAI,eAAe,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,gDAAgD,kBAAkB,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
|
@@ -10,7 +10,9 @@ import { prepareToolArgs } from './path-utils.js';
|
|
|
10
10
|
import { extractPolicyRoots, toMcpRoots, directoryForPath } from './policy-roots.js';
|
|
11
11
|
import * as logger from '../logger.js';
|
|
12
12
|
import { extractMcpErrorMessage } from './mcp-error-utils.js';
|
|
13
|
+
import { extractTextFromContent, buildAuditEntry } from './mcp-proxy-server.js';
|
|
13
14
|
import { updateServerContext, formatServerContext } from './server-context.js';
|
|
15
|
+
import { buildTrustedServerSet } from '../memory/memory-annotations.js';
|
|
14
16
|
/**
|
|
15
17
|
* Detects Docker-style `-e VAR_NAME` args (no `=`) where the env var is unset.
|
|
16
18
|
*/
|
|
@@ -47,7 +49,8 @@ export class TrustedProcess {
|
|
|
47
49
|
});
|
|
48
50
|
checkConstitutionFreshness(compiledPolicy, config.constitutionPath);
|
|
49
51
|
const serverDomainAllowlists = extractServerDomainAllowlists(config.mcpServers);
|
|
50
|
-
|
|
52
|
+
const trustedServers = buildTrustedServerSet(config.mcpServers);
|
|
53
|
+
this.policyEngine = new PolicyEngine(compiledPolicy, toolAnnotations, config.protectedPaths, config.allowedDirectory, serverDomainAllowlists, dynamicLists, trustedServers);
|
|
51
54
|
const policyRoots = extractPolicyRoots(compiledPolicy, config.allowedDirectory);
|
|
52
55
|
this.mcpRoots = toMcpRoots(policyRoots);
|
|
53
56
|
this.mcpManager = new MCPClientManager();
|
|
@@ -114,9 +117,16 @@ export class TrustedProcess {
|
|
|
114
117
|
*/
|
|
115
118
|
async handleToolCall(request) {
|
|
116
119
|
const startTime = Date.now();
|
|
117
|
-
// Annotation-driven normalization: split into transport vs policy args
|
|
120
|
+
// Annotation-driven normalization: split into transport vs policy args.
|
|
121
|
+
// Trusted servers skip annotation lookup and prepareToolArgs — use raw args directly.
|
|
118
122
|
const annotation = this.policyEngine.getAnnotation(request.serverName, request.toolName, request.arguments);
|
|
119
|
-
|
|
123
|
+
let argsForTransport;
|
|
124
|
+
let argsForPolicy;
|
|
125
|
+
if (!annotation && this.policyEngine.isTrustedServer(request.serverName)) {
|
|
126
|
+
argsForTransport = request.arguments;
|
|
127
|
+
argsForPolicy = request.arguments;
|
|
128
|
+
}
|
|
129
|
+
else if (!annotation) {
|
|
120
130
|
const reason = `Missing annotation for tool: ${request.serverName}__${request.toolName}. Re-run 'ironcurtain annotate-tools' to update.`;
|
|
121
131
|
return {
|
|
122
132
|
requestId: request.requestId,
|
|
@@ -126,7 +136,9 @@ export class TrustedProcess {
|
|
|
126
136
|
durationMs: Date.now() - startTime,
|
|
127
137
|
};
|
|
128
138
|
}
|
|
129
|
-
|
|
139
|
+
else {
|
|
140
|
+
({ argsForTransport, argsForPolicy } = prepareToolArgs(request.arguments, annotation, this.config.allowedDirectory));
|
|
141
|
+
}
|
|
130
142
|
const policyRequest = { ...request, arguments: argsForPolicy };
|
|
131
143
|
const transportRequest = { ...request, arguments: argsForTransport };
|
|
132
144
|
// Step 1: Evaluate request against the policy rule chain
|
|
@@ -175,7 +187,7 @@ export class TrustedProcess {
|
|
|
175
187
|
}
|
|
176
188
|
// Expand roots to include target directories so the filesystem
|
|
177
189
|
// server accepts the forwarded call (for both auto and human approval).
|
|
178
|
-
if (escalationResult === 'approved') {
|
|
190
|
+
if (escalationResult === 'approved' && annotation) {
|
|
179
191
|
const pathValues = extractAnnotatedPaths(transportRequest.arguments, annotation, getPathRoles());
|
|
180
192
|
for (const p of pathValues) {
|
|
181
193
|
const dir = directoryForPath(p);
|
|
@@ -192,13 +204,7 @@ export class TrustedProcess {
|
|
|
192
204
|
resultContent = mcpResult;
|
|
193
205
|
if (mcpResult.isError) {
|
|
194
206
|
resultStatus = 'error';
|
|
195
|
-
|
|
196
|
-
if (Array.isArray(content)) {
|
|
197
|
-
resultError = content
|
|
198
|
-
.filter((c) => c.type === 'text' && typeof c.text === 'string')
|
|
199
|
-
.map((c) => c.text)
|
|
200
|
-
.join('\n');
|
|
201
|
-
}
|
|
207
|
+
resultError = extractTextFromContent(mcpResult.content);
|
|
202
208
|
}
|
|
203
209
|
else {
|
|
204
210
|
resultStatus = 'success';
|
|
@@ -217,23 +223,11 @@ export class TrustedProcess {
|
|
|
217
223
|
}
|
|
218
224
|
const durationMs = Date.now() - startTime;
|
|
219
225
|
// Step 4: Append-only audit log (records argsForTransport -- what was sent to MCP server)
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
|
|
224
|
-
|
|
225
|
-
arguments: transportRequest.arguments,
|
|
226
|
-
policyDecision,
|
|
227
|
-
escalationResult,
|
|
228
|
-
result: {
|
|
229
|
-
status: resultStatus,
|
|
230
|
-
content: resultStatus === 'success' ? resultContent : undefined,
|
|
231
|
-
error: resultError,
|
|
232
|
-
},
|
|
233
|
-
durationMs,
|
|
234
|
-
autoApproved: autoApproved || undefined,
|
|
235
|
-
};
|
|
236
|
-
this.auditLog.log(auditEntry);
|
|
226
|
+
this.auditLog.log(buildAuditEntry(transportRequest, transportRequest.arguments, policyDecision, {
|
|
227
|
+
status: resultStatus,
|
|
228
|
+
content: resultStatus === 'success' ? resultContent : undefined,
|
|
229
|
+
error: resultError,
|
|
230
|
+
}, durationMs, { escalationResult, autoApproved: autoApproved || undefined }));
|
|
237
231
|
// Step 5: Return result to caller
|
|
238
232
|
return {
|
|
239
233
|
requestId: transportRequest.requestId,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trusted-process/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trusted-process/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAgB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAyB,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAExE;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAAc;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YACD,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD,MAAM,OAAO,cAAc;IAYf;IAXF,YAAY,CAAe;IAC3B,UAAU,CAAmB;IAC7B,QAAQ,CAAY;IACpB,QAAQ,CAAW;IACnB,UAAU,CAAoB;IAC9B,YAAY,CAAsB;IAClC,gBAAgB,GAA2B,IAAI,CAAC;IAChD,eAAe,GAAkB,IAAI,CAAC;IACtC,gBAAgB,GAAqB,IAAI,GAAG,EAAE,CAAC;IAEvD,YACU,MAAyB,EACjC,OAA+B;QADvB,WAAM,GAAN,MAAM,CAAmB;QAGjC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC;YAC5E,SAAS,EAAE,MAAM,CAAC,YAAY;YAC9B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,YAAY;YACpE,WAAW,EAAE,sBAAsB,EAAE;SACtC,CAAC,CAAC;QACH,0BAA0B,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEpE,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChF,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,cAAc,EACd,eAAe,EACf,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,gBAAgB,EACvB,sBAAsB,EACtB,YAAY,EACZ,cAAc,CACf,CAAC;QAEF,MAAM,WAAW,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAExC,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE;YAChD,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,OAAe;QAChC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,+EAA+E;YAC/E,MAAM,WAAW,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,wBAAwB,IAAI,sCAAsC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,oCAAoC,IAAI,MAAM,GAAG,aAAa,CAAC,CAAC;gBAC5E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC1G,CAAC;QAED,uCAAuC;QACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;QAC7D,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvG,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,0CAA0C;gBAC1C,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAwB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,wEAAwE;QACxE,sFAAsF;QACtF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5G,IAAI,gBAAyC,CAAC;QAC9C,IAAI,aAAsC,CAAC;QAE3C,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC;YACrC,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,CAAC;aAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,gCAAgC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,kDAAkD,CAAC;YACzI,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;gBACjC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE;gBACtE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,eAAe,CACpD,OAAO,CAAC,SAAS,EACjB,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC7B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC/D,MAAM,gBAAgB,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAErE,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAmB;YACrC,MAAM,EAAE,UAAU,CAAC,QAAQ;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;QAEF,IAAI,gBAAmD,CAAC;QACxD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,aAAsB,CAAC;QAC3B,IAAI,YAA4C,CAAC;QACjD,IAAI,WAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,kEAAkE;YAClE,IAAI,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACvC,8CAA8C;gBAC9C,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;oBAClD,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC;wBACE,WAAW,EAAE,IAAI,CAAC,eAAe;wBACjC,QAAQ,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE;wBACrD,gBAAgB,EAAE,UAAU,CAAC,MAAM;qBACpC,EACD,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBAEF,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;wBACtC,YAAY,GAAG,IAAI,CAAC;wBACpB,gBAAgB,GAAG,UAAU,CAAC;wBAC9B,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;wBAChC,cAAc,CAAC,MAAM,GAAG,kBAAkB,UAAU,CAAC,SAAS,EAAE,CAAC;oBACnE,CAAC;gBACH,CAAC;gBAED,wDAAwD;gBACxD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;oBAClG,gBAAgB,GAAG,IAAI,CAAC,YAAY;wBAClC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC;wBACjF,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;oBAEzF,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;wBACpC,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;wBAChC,cAAc,CAAC,MAAM,GAAG,qCAAqC,CAAC;oBAChE,CAAC;yBAAM,CAAC;wBACN,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC;wBAC/B,cAAc,CAAC,MAAM,GAAG,mCAAmC,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAED,+DAA+D;gBAC/D,wEAAwE;gBACxE,IAAI,gBAAgB,KAAK,UAAU,IAAI,UAAU,EAAE,CAAC;oBAClD,MAAM,UAAU,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;oBACjG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;wBAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;wBAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE;4BACzD,GAAG,EAAE,UAAU,GAAG,EAAE;4BACpB,IAAI,EAAE,qBAAqB;yBAC5B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAC/C,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAA6C,CAAC;gBAC/C,aAAa,GAAG,SAAS,CAAC;gBAE1B,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,YAAY,GAAG,OAAO,CAAC;oBACvB,WAAW,GAAG,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC1D,CAAC;qBAAM,CAAC;oBACN,YAAY,GAAG,SAAS,CAAC;oBACzB,mBAAmB,CACjB,IAAI,CAAC,gBAAgB,EACrB,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;gBAChE,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,OAAO,CAAC;YACvB,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC1C,aAAa,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,0FAA0F;QAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,CACf,eAAe,CACb,gBAAgB,EAChB,gBAAgB,CAAC,SAAS,EAC1B,cAAc,EACd;YACE,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC/D,KAAK,EAAE,WAAW;SACnB,EACD,UAAU,EACV,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,IAAI,SAAS,EAAE,CAC9D,CACF,CAAC;QAEF,kCAAkC;QAClC,OAAO;YACL,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,cAAc;YACd,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF"}
|
|
@@ -49,6 +49,15 @@ export interface ClientState {
|
|
|
49
49
|
roots: McpRoot[];
|
|
50
50
|
rootsRefreshed?: () => void;
|
|
51
51
|
}
|
|
52
|
+
/**
|
|
53
|
+
* Delay before retrying a tool call that returned "access denied" immediately
|
|
54
|
+
* after roots expansion. The filesystem server needs time to async-validate
|
|
55
|
+
* (fs.realpath, fs.stat) the new roots after receiving the rootsListChanged
|
|
56
|
+
* notification. Exported for test access.
|
|
57
|
+
*/
|
|
58
|
+
export declare const ROOTS_RACE_RETRY_DELAY_MS = 200;
|
|
59
|
+
/** Extracts concatenated text from MCP content blocks. */
|
|
60
|
+
export declare function extractTextFromContent(content: unknown): string | undefined;
|
|
52
61
|
/**
|
|
53
62
|
* Returns true when a user context is safe to act on for auto-approval.
|
|
54
63
|
*
|
|
@@ -57,21 +57,28 @@ import { extractMcpErrorMessage } from './mcp-error-utils.js';
|
|
|
57
57
|
import { updateServerContext, formatServerContext } from './server-context.js';
|
|
58
58
|
import { permissiveJsonSchemaValidator } from './permissive-output-validator.js';
|
|
59
59
|
import { VERSION } from '../version.js';
|
|
60
|
+
import { buildTrustedServerSet } from '../memory/memory-annotations.js';
|
|
60
61
|
import { loadToolDescriptionHints, applyToolDescriptionHints } from './tool-description-hints.js';
|
|
61
62
|
/**
|
|
62
63
|
* Adds a root to a client's root list and waits for the server to
|
|
63
64
|
* fetch the updated list. No-op if the root URI is already present.
|
|
64
65
|
* Times out after ROOTS_REFRESH_TIMEOUT_MS if the server never requests
|
|
65
66
|
* the updated list (e.g. servers that don't implement Roots protocol).
|
|
67
|
+
*
|
|
68
|
+
* Returns `'added'` when the server acknowledged the update (called
|
|
69
|
+
* `roots/list`), `'timeout'` when the server didn't respond in time,
|
|
70
|
+
* or `false` when the root was already present.
|
|
66
71
|
*/
|
|
67
72
|
async function addRootToClient(state, root) {
|
|
68
73
|
if (state.roots.some((r) => r.uri === root.uri))
|
|
69
|
-
return;
|
|
74
|
+
return false;
|
|
70
75
|
state.roots.push(root);
|
|
71
76
|
let timer;
|
|
77
|
+
let outcome = 'timeout';
|
|
72
78
|
const refreshed = new Promise((resolve) => {
|
|
73
79
|
state.rootsRefreshed = () => {
|
|
74
80
|
clearTimeout(timer);
|
|
81
|
+
outcome = 'added';
|
|
75
82
|
resolve();
|
|
76
83
|
};
|
|
77
84
|
});
|
|
@@ -84,6 +91,28 @@ async function addRootToClient(state, root) {
|
|
|
84
91
|
});
|
|
85
92
|
await state.client.sendRootsListChanged();
|
|
86
93
|
await Promise.race([refreshed, timeout]);
|
|
94
|
+
return outcome;
|
|
95
|
+
}
|
|
96
|
+
/**
|
|
97
|
+
* Delay before retrying a tool call that returned "access denied" immediately
|
|
98
|
+
* after roots expansion. The filesystem server needs time to async-validate
|
|
99
|
+
* (fs.realpath, fs.stat) the new roots after receiving the rootsListChanged
|
|
100
|
+
* notification. Exported for test access.
|
|
101
|
+
*/
|
|
102
|
+
export const ROOTS_RACE_RETRY_DELAY_MS = 200;
|
|
103
|
+
/**
|
|
104
|
+
* Checks whether an MCP tool call result looks like a roots-race "access denied"
|
|
105
|
+
* error -- the filesystem server rejected the call because it hasn't finished
|
|
106
|
+
* processing the updated roots yet.
|
|
107
|
+
*/
|
|
108
|
+
function isRootsRaceError(result) {
|
|
109
|
+
if (!('isError' in result) || !result.isError)
|
|
110
|
+
return false;
|
|
111
|
+
const text = extractTextFromContent(result.content);
|
|
112
|
+
if (!text)
|
|
113
|
+
return false;
|
|
114
|
+
const lower = text.toLowerCase();
|
|
115
|
+
return lower.includes('access denied') || lower.includes('outside allowed directories');
|
|
87
116
|
}
|
|
88
117
|
/** Appends a timestamped line to the session log file. */
|
|
89
118
|
function logToSessionFile(sessionLogPath, message) {
|
|
@@ -114,7 +143,7 @@ function getMissingEnvVars(args) {
|
|
|
114
143
|
return missing;
|
|
115
144
|
}
|
|
116
145
|
/** Extracts concatenated text from MCP content blocks. */
|
|
117
|
-
function extractTextFromContent(content) {
|
|
146
|
+
export function extractTextFromContent(content) {
|
|
118
147
|
if (!Array.isArray(content))
|
|
119
148
|
return undefined;
|
|
120
149
|
const texts = content
|
|
@@ -418,9 +447,11 @@ export async function handleCallTool(toolName, rawArgs, deps) {
|
|
|
418
447
|
isError: true,
|
|
419
448
|
};
|
|
420
449
|
}
|
|
421
|
-
// Annotation-driven normalization: split into transport vs policy args
|
|
450
|
+
// Annotation-driven normalization: split into transport vs policy args.
|
|
451
|
+
// Trusted servers skip annotation lookup and prepareToolArgs — use raw args directly.
|
|
422
452
|
const annotation = deps.policyEngine.getAnnotation(toolInfo.serverName, toolInfo.name, rawArgs);
|
|
423
|
-
|
|
453
|
+
const isTrusted = !annotation && deps.policyEngine.isTrustedServer(toolInfo.serverName);
|
|
454
|
+
if (!annotation && !isTrusted) {
|
|
424
455
|
return {
|
|
425
456
|
content: [
|
|
426
457
|
{
|
|
@@ -431,34 +462,45 @@ export async function handleCallTool(toolName, rawArgs, deps) {
|
|
|
431
462
|
isError: true,
|
|
432
463
|
};
|
|
433
464
|
}
|
|
434
|
-
|
|
435
|
-
|
|
436
|
-
|
|
437
|
-
|
|
438
|
-
|
|
439
|
-
|
|
440
|
-
|
|
441
|
-
|
|
442
|
-
|
|
443
|
-
|
|
444
|
-
|
|
445
|
-
|
|
446
|
-
|
|
447
|
-
|
|
448
|
-
|
|
449
|
-
|
|
450
|
-
|
|
451
|
-
|
|
452
|
-
|
|
453
|
-
|
|
454
|
-
|
|
455
|
-
|
|
456
|
-
|
|
457
|
-
|
|
465
|
+
let argsForTransport;
|
|
466
|
+
let argsForPolicy;
|
|
467
|
+
if (isTrusted) {
|
|
468
|
+
// Trusted server with no annotation: use raw args for both transport and policy
|
|
469
|
+
argsForTransport = rawArgs;
|
|
470
|
+
argsForPolicy = rawArgs;
|
|
471
|
+
}
|
|
472
|
+
else {
|
|
473
|
+
// annotation is guaranteed non-null here: we returned early if both are falsy
|
|
474
|
+
const resolvedAnnotation = annotation;
|
|
475
|
+
// Enrich git tool args with the locally tracked working directory when
|
|
476
|
+
// the agent omits the `path` argument. The git MCP server tracks its own
|
|
477
|
+
// CWD (set via git_set_working_dir) and uses it implicitly, but the
|
|
478
|
+
// policy engine needs the explicit path to resolve sandbox containment
|
|
479
|
+
// and the default remote URL for domain-based policy rules.
|
|
480
|
+
// The serverContextMap mirrors the git server's working directory from
|
|
481
|
+
// successful git_set_working_dir / git_clone calls, avoiding an RPC.
|
|
482
|
+
let effectiveRawArgs = rawArgs;
|
|
483
|
+
const hasEffectivePath = 'path' in rawArgs && typeof rawArgs.path === 'string' && rawArgs.path.trim() !== '';
|
|
484
|
+
if (toolInfo.serverName === 'git' && 'path' in resolvedAnnotation.args && !hasEffectivePath) {
|
|
485
|
+
const gitWorkDir = deps.serverContextMap.get('git')?.workingDirectory;
|
|
486
|
+
if (!gitWorkDir) {
|
|
487
|
+
const errorMsg = 'Git server has no working directory set. Call git_set_working_dir first.';
|
|
488
|
+
deps.auditLog.log(buildAuditEntry({
|
|
489
|
+
requestId: uuidv4(),
|
|
490
|
+
serverName: toolInfo.serverName,
|
|
491
|
+
toolName: toolInfo.name,
|
|
492
|
+
arguments: rawArgs,
|
|
493
|
+
timestamp: new Date().toISOString(),
|
|
494
|
+
}, rawArgs, { status: 'deny', rule: 'git-path-enrichment-failed', reason: errorMsg }, { status: 'denied', error: errorMsg }, 0, {}));
|
|
495
|
+
return {
|
|
496
|
+
content: [{ type: 'text', text: `Error: ${errorMsg}` }],
|
|
497
|
+
isError: true,
|
|
498
|
+
};
|
|
499
|
+
}
|
|
500
|
+
effectiveRawArgs = { ...rawArgs, path: gitWorkDir };
|
|
458
501
|
}
|
|
459
|
-
|
|
502
|
+
({ argsForTransport, argsForPolicy } = prepareToolArgs(effectiveRawArgs, resolvedAnnotation, deps.allowedDirectory, CONTAINER_WORKSPACE_DIR));
|
|
460
503
|
}
|
|
461
|
-
const { argsForTransport, argsForPolicy } = prepareToolArgs(effectiveRawArgs, annotation, deps.allowedDirectory, CONTAINER_WORKSPACE_DIR);
|
|
462
504
|
const request = {
|
|
463
505
|
requestId: uuidv4(),
|
|
464
506
|
serverName: toolInfo.serverName,
|
|
@@ -474,6 +516,7 @@ export async function handleCallTool(toolName, rawArgs, deps) {
|
|
|
474
516
|
};
|
|
475
517
|
let escalationResult;
|
|
476
518
|
let autoApproved = false;
|
|
519
|
+
let rootsExpanded = false;
|
|
477
520
|
const serverSandboxConfig = deps.resolvedSandboxConfigs.get(toolInfo.serverName);
|
|
478
521
|
const serverIsSandboxed = serverSandboxConfig?.sandboxed === true;
|
|
479
522
|
function logAudit(result, durationMs, overrideEscalation) {
|
|
@@ -541,13 +584,15 @@ export async function handleCallTool(toolName, rawArgs, deps) {
|
|
|
541
584
|
}
|
|
542
585
|
// Expand roots for approved path arguments only (skip URLs, opaques)
|
|
543
586
|
const state = deps.clientStates.get(toolInfo.serverName);
|
|
544
|
-
if (state) {
|
|
587
|
+
if (state && annotation) {
|
|
545
588
|
const pathValues = extractAnnotatedPaths(argsForTransport, annotation, getPathRoles());
|
|
546
589
|
for (const p of pathValues) {
|
|
547
|
-
await addRootToClient(state, {
|
|
590
|
+
const result = await addRootToClient(state, {
|
|
548
591
|
uri: `file://${directoryForPath(p)}`,
|
|
549
592
|
name: 'escalation-approved',
|
|
550
593
|
});
|
|
594
|
+
if (result === 'added')
|
|
595
|
+
rootsExpanded = true;
|
|
551
596
|
}
|
|
552
597
|
}
|
|
553
598
|
}
|
|
@@ -580,10 +625,18 @@ export async function handleCallTool(toolName, rawArgs, deps) {
|
|
|
580
625
|
// CompatibilityCallToolResultSchema accepts the legacy `toolResult` response format
|
|
581
626
|
// (protocol version 2024-10-07). Output schema validation is intentionally
|
|
582
627
|
// bypassed by the permissiveJsonSchemaValidator injected at Client construction time.
|
|
583
|
-
const
|
|
584
|
-
|
|
585
|
-
|
|
586
|
-
|
|
628
|
+
const callToolArgs = { name: toolInfo.name, arguments: argsForTransport };
|
|
629
|
+
const callToolOpts = { timeout: getEscalationTimeoutMs() };
|
|
630
|
+
let result = await client.callTool(callToolArgs, CompatibilityCallToolResultSchema, callToolOpts);
|
|
631
|
+
// Race condition mitigation: after roots expansion the filesystem server
|
|
632
|
+
// has been notified but may not have finished async-validating the new
|
|
633
|
+
// roots (fs.realpath, fs.stat). Retry once after a short delay.
|
|
634
|
+
if (rootsExpanded && isRootsRaceError(result)) {
|
|
635
|
+
const initialError = extractTextFromContent(result.content) ?? 'access denied (roots race)';
|
|
636
|
+
logAudit({ status: 'error', error: `Roots race detected, retrying: ${initialError}` }, Date.now() - startTime);
|
|
637
|
+
await new Promise((r) => setTimeout(r, ROOTS_RACE_RETRY_DELAY_MS));
|
|
638
|
+
result = await client.callTool(callToolArgs, CompatibilityCallToolResultSchema, callToolOpts);
|
|
639
|
+
}
|
|
587
640
|
// Reverse-rewrite host sandbox paths to container workspace paths in results
|
|
588
641
|
const rewrittenContent = deps.allowedDirectory
|
|
589
642
|
? rewriteResultContent(result.content, deps.allowedDirectory, CONTAINER_WORKSPACE_DIR)
|
|
@@ -640,7 +693,8 @@ async function main() {
|
|
|
640
693
|
fallbackDir: getPackageGeneratedDir(),
|
|
641
694
|
});
|
|
642
695
|
const serverDomainAllowlists = extractServerDomainAllowlists(serversConfig);
|
|
643
|
-
const
|
|
696
|
+
const trustedServers = buildTrustedServerSet(serversConfig);
|
|
697
|
+
const policyEngine = new PolicyEngine(compiledPolicy, toolAnnotations, protectedPaths, allowedDirectory, serverDomainAllowlists, dynamicLists, trustedServers);
|
|
644
698
|
const auditLog = new AuditLog(auditLogPath, { redact: auditRedaction });
|
|
645
699
|
const circuitBreaker = new CallCircuitBreaker();
|
|
646
700
|
const autoApproveModel = await createAutoApproveModel(sessionLogPath);
|