@sema-agent/connectors 0.5.0 → 0.7.0

package/dist/release-archive.js

@@ -1,6 +1,16 @@
-import { gunzipSync } from 'node:zlib';
+import { chmodSync, closeSync, createReadStream, fchmodSync, fstatSync, mkdirSync, openSync, readSync, symlinkSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { createInflateRaw, gunzipSync, inflateRawSync } from 'node:zlib';
+import { writeAll, writeAllStream } from './write-all.js';
 const BLOCK = 512;
-const UNPACKED_LIMIT = 512 * 1024 * 1024;
+export const UNPACKED_LIMIT = 1024 * 1024 * 1024;
+const LINK_LIMIT = 4096;
+const FILE_MODE = 0o644;
+const EXEC_MODE = 0o755;
+const DIR_MODE = 0o755;
+export const formatOf = (file) => (/\.(?:tar\.gz|tgz)$/.test(file) ? 'tar.gz' : /\.zip$/.test(file) ? 'zip' : null);
 function text(h, at, length) {
     const raw = h.subarray(at, at + length);
     const end = raw.indexOf(0);
@@ -25,6 +35,8 @@ function pax(body) {
         const value = record.slice(eq + 1);
         if (key === 'path')
             out.path = value;
+        if (key === 'linkpath')
+            out.link = value;
         if (key === 'size') {
             if (!/^[0-9]+$/.test(value))
                 return null;
@@ -34,7 +46,7 @@ function pax(body) {
     }
     return out;
 }
-export function entryOf(archive, wanted) {
+function tarEntries(archive) {
     const refuse = (problem) => ({ ok: false, problem });
     let tar;
     try {
@@ -43,7 +55,7 @@ export function entryOf(archive, wanted) {
     catch {
         return refuse('is not a gzip stream within the size limit');
     }
-    const found = [];
+    const entries = [];
     let next = {};
     for (let at = 0;;) {
         if (at === tar.length)
@@ -59,7 +71,7 @@ export function entryOf(archive, wanted) {
         if (octal(h, 148, 8) !== sum)
             return refuse('has a damaged header');
         const type = h[156] === 0 ? '0' : String.fromCharCode(h[156] ?? 0);
-        const meta = type === 'x' || type === 'g' || type === 'L';
+        const meta = type === 'x' || type === 'g' || type === 'L' || type === 'K';
         const own = octal(h, 124, 12);
         const size = meta ? own : (next.size ?? own);
         if (size === null)
@@ -80,17 +92,457 @@ export function entryOf(archive, wanted) {
             next = { ...next, path: body.toString('utf8').replace(/\0+$/, '') };
             continue;
         }
+        if (type === 'K') {
+            next = { ...next, link: body.toString('utf8').replace(/\0+$/, '') };
+            continue;
+        }
         if (type === 'g')
             continue;
         const prefix = text(h, 257, 6).startsWith('ustar') ? text(h, 345, 155) : '';
         const name = next.path ?? (prefix === '' ? text(h, 0, 100) : `${prefix}/${text(h, 0, 100)}`);
+        const link = next.link ?? text(h, 157, 100);
         next = {};
-        if ((type === '0' || type === '7') && name.replace(/^\.\//, '') === wanted)
-            found.push(Buffer.from(body));
+        entries.push({ name, type: type === '7' ? '0' : type, mode: octal(h, 100, 8) ?? 0, body, link });
     }
+    return { ok: true, entries };
+}
+export function entryOf(archive, wanted) {
+    const read = tarEntries(archive);
+    if (!read.ok)
+        return read;
+    const found = read.entries.filter((e) => e.type === '0' && e.name.replace(/^\.\//, '') === wanted);
     if (found.length === 0)
-        return refuse(`holds no ${wanted}`);
+        return { ok: false, problem: `holds no ${wanted}` };
     if (found.length > 1)
-        return refuse(`holds ${wanted} more than once`);
-    return { ok: true, bytes: found[0] };
+        return { ok: false, problem: `holds ${wanted} more than once` };
+    return { ok: true, bytes: Buffer.from(found[0].body) };
+}
+const EOCD = 0x06054b50;
+const CENTRAL = 0x02014b50;
+const LOCAL = 0x04034b50;
+const ZIP64_LOCATOR = 0x07064b50;
+const UNIX = 3;
+const S_IFMT = 0o170000;
+function readAt(fd, position, length) {
+    const b = Buffer.alloc(length);
+    let got = 0;
+    while (got < length) {
+        const n = readSync(fd, b, got, length - got, position + got);
+        if (n === 0)
+            break;
+        got += n;
+    }
+    return got === length ? b : b.subarray(0, got);
+}
+function zipEntries(fd) {
+    const refuse = (problem) => ({ ok: false, problem });
+    const size = fstatSync(fd).size;
+    if (size < 22)
+        return refuse('is not a zip archive');
+    const tailStart = Math.max(0, size - 22 - 65535);
+    const tail = readAt(fd, tailStart, size - tailStart);
+    const ends = [];
+    for (let i = tail.length - 22; i >= 0; i--)
+        if (tail.readUInt32LE(i) === EOCD && i + 22 + tail.readUInt16LE(i + 20) === tail.length)
+            ends.push(i);
+    if (ends.length !== 1)
+        return refuse(ends.length === 0 ? 'is not a zip archive' : 'has more than one end record');
+    const e = ends[0];
+    const eocdAt = tailStart + e;
+    if (tail.readUInt16LE(e + 4) !== 0 || tail.readUInt16LE(e + 6) !== 0)
+        return refuse('is a split archive');
+    const count = tail.readUInt16LE(e + 10);
+    const cdSize = tail.readUInt32LE(e + 12);
+    const cdAt = tail.readUInt32LE(e + 16);
+    if (tail.readUInt16LE(e + 8) !== count || count === 0xffff || cdSize === 0xffffffff || cdAt === 0xffffffff)
+        return refuse('is a ZIP64 archive, which is not taken');
+    if (eocdAt >= 20 && readAt(fd, eocdAt - 20, 4).readUInt32LE(0) === ZIP64_LOCATOR)
+        return refuse('is a ZIP64 archive, which is not taken');
+    if (cdAt + cdSize !== eocdAt)
+        return refuse('has a central directory that does not end where its end record starts');
+    const cd = readAt(fd, cdAt, cdSize);
+    const entries = [];
+    const utf8 = new TextDecoder('utf-8', { fatal: true });
+    let total = 0;
+    let at = 0;
+    for (let i = 0; i < count; i++) {
+        if (at + 46 > cd.length || cd.readUInt32LE(at) !== CENTRAL)
+            return refuse('has a damaged central directory');
+        const host = cd.readUInt8(at + 5);
+        const flags = cd.readUInt16LE(at + 8);
+        const method = cd.readUInt16LE(at + 10);
+        const crc = cd.readUInt32LE(at + 16);
+        const compressed = cd.readUInt32LE(at + 20);
+        const unpacked = cd.readUInt32LE(at + 24);
+        const nameLength = cd.readUInt16LE(at + 28);
+        const extraLength = cd.readUInt16LE(at + 30);
+        const commentLength = cd.readUInt16LE(at + 32);
+        const disk = cd.readUInt16LE(at + 34);
+        const external = cd.readUInt32LE(at + 38);
+        const localAt = cd.readUInt32LE(at + 42);
+        const raw = cd.subarray(at + 46, at + 46 + nameLength);
+        at += 46 + nameLength + extraLength + commentLength;
+        if (at > cd.length)
+            return refuse('has a damaged central directory');
+        if (compressed === 0xffffffff || unpacked === 0xffffffff || localAt === 0xffffffff || disk !== 0)
+            return refuse('is a ZIP64 archive, which is not taken');
+        if ((flags & 0x0001) !== 0 || (flags & 0x0040) !== 0 || (flags & 0x2000) !== 0)
+            return refuse('holds an encrypted entry');
+        if (method !== 0 && method !== 8)
+            return refuse('holds an entry compressed with a method other than stored or deflate');
+        if (method === 0 && compressed !== unpacked)
+            return refuse('holds a stored entry whose sizes disagree');
+        if ((flags & 0x0800) === 0 && raw.some((b) => b >= 0x80))
+            return refuse('holds a name that is not flagged as UTF-8');
+        let name;
+        try {
+            name = utf8.decode(raw);
+        }
+        catch {
+            return refuse('holds a name that is not UTF-8');
+        }
+        const unixMode = host === UNIX ? external >>> 16 : 0;
+        const type = unixMode & S_IFMT;
+        const slash = name.endsWith('/');
+        let kind;
+        if (type === 0o120000)
+            kind = 'link';
+        else if (type === 0o040000 || (type === 0 && slash))
+            kind = 'directory';
+        else if (type === 0o100000 || type === 0)
+            kind = 'file';
+        else
+            return refuse('holds an entry of a kind that is not taken (a device, a pipe or a socket)');
+        if ((kind === 'directory') !== slash)
+            return refuse('holds an entry whose kind and name disagree');
+        if (kind === 'link' && unpacked > LINK_LIMIT)
+            return refuse('holds a symbolic link with a target that is too long');
+        total += unpacked;
+        if (total > UNPACKED_LIMIT)
+            return refuse(`unpacks to more than ${UNPACKED_LIMIT} bytes`);
+        const local = readAt(fd, localAt, 30);
+        if (local.length !== 30 || local.readUInt32LE(0) !== LOCAL)
+            return refuse('has a damaged local header');
+        const localName = readAt(fd, localAt + 30, local.readUInt16LE(26));
+        if (!localName.equals(raw) || local.readUInt16LE(8) !== method || (local.readUInt16LE(6) & 0x0001) !== 0)
+            return refuse('has a local header that disagrees with its central directory');
+        const data = localAt + 30 + local.readUInt16LE(26) + local.readUInt16LE(28);
+        entries.push({ name, kind, mode: unixMode & 0o7777, method, crc, compressed, size: unpacked, local: localAt, data });
+    }
+    if (at !== cd.length)
+        return refuse('has a damaged central directory');
+    const byPlace = [...entries].sort((a, b) => a.local - b.local);
+    for (let i = 0; i < byPlace.length; i++) {
+        const x = byPlace[i];
+        const limit = i + 1 < byPlace.length ? byPlace[i + 1].local : cdAt;
+        if (x.local === limit || x.data + x.compressed > limit)
+            return refuse('holds entries whose data overlap');
+    }
+    return { ok: true, entries };
+}
+const CRC_TABLE = (() => {
+    const t = new Int32Array(256);
+    for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        t[n] = c;
+    }
+    return t;
+})();
+function crc32(crc, bytes) {
+    let c = ~crc;
+    for (let i = 0; i < bytes.length; i++)
+        c = CRC_TABLE[(c ^ bytes[i]) & 0xff] ^ (c >>> 8);
+    return ~c >>> 0;
+}
+function zipBytes(fd, e) {
+    const packed = readAt(fd, e.data, e.compressed);
+    if (packed.length !== e.compressed)
+        return null;
+    let bytes;
+    try {
+        bytes = e.method === 8 ? inflateRawSync(packed, { maxOutputLength: Math.max(e.size, 1) }) : packed;
+    }
+    catch {
+        return null;
+    }
+    return bytes.length === e.size && crc32(0, bytes) === e.crc ? bytes : null;
+}
+function withFile(path, fn) {
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+    }
+    catch {
+        return null;
+    }
+    try {
+        return { value: fn(fd) };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+const wholeFile = (path) => withFile(path, (fd) => readAt(fd, 0, fstatSync(fd).size))?.value ?? null;
+export function archiveEntry(path, format, wanted) {
+    if (format === 'tar.gz') {
+        const bytes = wholeFile(path);
+        return bytes === null ? { ok: false, problem: 'cannot be read' } : entryOf(bytes, wanted);
+    }
+    const r = withFile(path, (fd) => {
+        const read = zipEntries(fd);
+        if (!read.ok)
+            return read;
+        const found = read.entries.filter((e) => e.kind === 'file' && e.name === wanted);
+        if (found.length === 0)
+            return { ok: false, problem: `holds no ${wanted}` };
+        if (found.length > 1)
+            return { ok: false, problem: `holds ${wanted} more than once` };
+        const bytes = zipBytes(fd, found[0]);
+        return bytes === null ? { ok: false, problem: `holds a damaged ${wanted}` } : { ok: true, bytes };
+    });
+    return r?.value ?? { ok: false, problem: 'cannot be read' };
+}
+const SEGMENT_BAD = /[\x00-\x1f\x7f\\]/;
+const segmentProblem = (s) => s === '' || s === '.' || SEGMENT_BAD.test(s);
+function below(name, top) {
+    const bare = name.replace(/^\.\//, '');
+    if (bare.startsWith('/'))
+        return { problem: 'holds an entry with an absolute path' };
+    if (bare === top || bare === `${top}/`)
+        return { segments: [] };
+    if (!bare.startsWith(`${top}/`))
+        return { problem: `holds an entry outside ${top}/` };
+    const rest = bare.slice(top.length + 1).replace(/\/$/, '');
+    const segments = rest.split('/');
+    if (segments.some((s) => s === '..'))
+        return { problem: 'holds an entry whose path climbs out of its directory (..)' };
+    if (segments.some(segmentProblem))
+        return { problem: 'holds an entry whose path has an empty or "." segment, a backslash or a control character' };
+    return { segments };
+}
+const linkTargetTaken = (target) => target !== '' && !target.startsWith('/') && target.split('/').every((s) => s !== '..' && !segmentProblem(s));
+function plannedProblem(planned) {
+    const kinds = new Map();
+    for (const p of planned) {
+        const key = p.segments.join('/');
+        if (kinds.has(key))
+            return 'holds a name more than once';
+        kinds.set(key, p.kind);
+    }
+    for (const p of planned) {
+        for (let i = 1; i < p.segments.length; i++) {
+            const parent = kinds.get(p.segments.slice(0, i).join('/'));
+            if (parent !== undefined && parent !== 'directory')
+                return `holds an entry below a ${parent === 'link' ? 'symbolic link' : 'file'} of the archive`;
+        }
+    }
+    return null;
+}
+async function writePlanned(planned, dest) {
+    const pathOf = (p) => join(dest, ...p.segments);
+    const directory = (path) => {
+        mkdirSync(path, { recursive: true, mode: DIR_MODE });
+        chmodSync(path, DIR_MODE);
+    };
+    for (const p of planned)
+        if (p.kind === 'directory')
+            directory(pathOf(p));
+    for (const p of planned) {
+        if (p.kind !== 'file')
+            continue;
+        mkdirSync(dirname(pathOf(p)), { recursive: true, mode: DIR_MODE });
+        const problem = await p.write(pathOf(p));
+        if (problem !== null)
+            return problem;
+    }
+    for (const p of planned) {
+        if (p.kind !== 'link')
+            continue;
+        mkdirSync(dirname(pathOf(p)), { recursive: true, mode: DIR_MODE });
+        symlinkSync(p.link, pathOf(p));
+    }
+    return null;
+}
+const modeOf = (mode) => ((mode & 0o111) !== 0 ? EXEC_MODE : FILE_MODE);
+function writeBytes(target, bytes, mode) {
+    const fd = openSync(target, 'wx', mode);
+    try {
+        fchmodSync(fd, mode);
+        writeAll(fd, bytes);
+    }
+    finally {
+        closeSync(fd);
+    }
+    return null;
+}
+function planTar(archive, top) {
+    const read = tarEntries(archive);
+    if (!read.ok)
+        return { problem: read.problem };
+    const planned = [];
+    for (const e of read.entries) {
+        const where = below(e.name, top);
+        if ('problem' in where)
+            return where;
+        if (where.segments.length === 0)
+            continue;
+        if (e.type === '0') {
+            const mode = modeOf(e.mode);
+            planned.push({ segments: where.segments, kind: 'file', mode, size: e.body.length, write: (target) => writeBytes(target, e.body, mode) });
+        }
+        else if (e.type === '5')
+            planned.push({ segments: where.segments, kind: 'directory', mode: DIR_MODE, size: 0, write: () => null });
+        else if (e.type === '2') {
+            if (!linkTargetTaken(e.link))
+                return { problem: 'holds a symbolic link whose target is not a relative path below its own directory' };
+            planned.push({ segments: where.segments, kind: 'link', mode: 0, size: 0, link: e.link, write: () => null });
+        }
+        else if (e.type === '1')
+            return { problem: 'holds a hard link, which is not taken' };
+        else
+            return { problem: 'holds an entry of a kind that is not taken (a device, a pipe or a socket)' };
+    }
+    return { planned };
+}
+class Checked extends Transform {
+    limit;
+    size = 0;
+    crc = 0;
+    constructor(limit) {
+        super();
+        this.limit = limit;
+    }
+    _transform(chunk, _encoding, done) {
+        this.size += chunk.length;
+        if (this.size > this.limit)
+            return done(new Error('the entry is larger than the archive says'));
+        this.crc = crc32(this.crc, chunk);
+        done(null, chunk);
+    }
+}
+function planZip(fd, path, top) {
+    const read = zipEntries(fd);
+    if (!read.ok)
+        return { problem: read.problem };
+    const planned = [];
+    for (const e of read.entries) {
+        const where = below(e.name, top);
+        if ('problem' in where)
+            return where;
+        if (where.segments.length === 0)
+            continue;
+        if (e.kind === 'directory')
+            planned.push({ segments: where.segments, kind: 'directory', mode: DIR_MODE, size: 0, write: () => null });
+        else if (e.kind === 'link') {
+            const target = zipBytes(fd, e);
+            if (target === null)
+                return { problem: 'holds a damaged symbolic link' };
+            const link = target.toString('utf8');
+            if (!linkTargetTaken(link))
+                return { problem: 'holds a symbolic link whose target is not a relative path below its own directory' };
+            planned.push({ segments: where.segments, kind: 'link', mode: 0, size: 0, link, write: () => null });
+        }
+        else {
+            const mode = modeOf(e.mode);
+            planned.push({
+                segments: where.segments,
+                kind: 'file',
+                mode,
+                size: e.size,
+                write: async (target) => {
+                    if (e.compressed === 0)
+                        return e.size === 0 && e.crc === 0 ? writeBytes(target, Buffer.alloc(0), mode) : 'holds a damaged entry';
+                    const checked = new Checked(e.size);
+                    const source = createReadStream(path, { start: e.data, end: e.data + e.compressed - 1 });
+                    let fd = null;
+                    try {
+                        fd = openSync(target, 'wx', mode);
+                        fchmodSync(fd, mode);
+                        if (e.method === 8)
+                            await pipeline(source, createInflateRaw(), checked, writeAllStream(fd));
+                        else
+                            await pipeline(source, checked, writeAllStream(fd));
+                    }
+                    catch {
+                        source.destroy();
+                        return 'holds a damaged entry';
+                    }
+                    finally {
+                        if (fd !== null)
+                            closeSync(fd);
+                    }
+                    return checked.size === e.size && checked.crc === e.crc ? null : 'holds an entry whose size or CRC-32 does not match the archive';
+                },
+            });
+        }
+    }
+    return { planned };
+}
+export async function unpackTree(path, format, top, dest) {
+    if (format === 'tar.gz') {
+        const bytes = wholeFile(path);
+        if (bytes === null)
+            return 'cannot be read';
+        const plan = planTar(bytes, top);
+        if ('problem' in plan)
+            return plan.problem;
+        return plannedProblem(plan.planned) ?? (await writePlanned(plan.planned, dest));
+    }
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+    }
+    catch {
+        return 'cannot be read';
+    }
+    try {
+        const plan = planZip(fd, path, top);
+        if ('problem' in plan)
+            return plan.problem;
+        return plannedProblem(plan.planned) ?? (await writePlanned(plan.planned, dest));
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function treeProblem(path, format, top) {
+    if (format === 'tar.gz') {
+        const bytes = wholeFile(path);
+        if (bytes === null)
+            return 'cannot be read';
+        const plan = planTar(bytes, top);
+        return 'problem' in plan ? plan.problem : plannedProblem(plan.planned);
+    }
+    const r = withFile(path, (fd) => {
+        const plan = planZip(fd, path, top);
+        return 'problem' in plan ? plan.problem : plannedProblem(plan.planned);
+    });
+    return r === null ? 'cannot be read' : r.value;
+}
+export function treeListing(path, format, top) {
+    const listed = (plan) => {
+        if ('problem' in plan)
+            return { ok: false, problem: plan.problem };
+        const problem = plannedProblem(plan.planned);
+        if (problem !== null)
+            return { ok: false, problem };
+        const paths = new Map();
+        for (const p of plan.planned) {
+            for (let i = 1; i < p.segments.length; i++) {
+                const parent = p.segments.slice(0, i).join('/');
+                if (!paths.has(parent))
+                    paths.set(parent, { kind: 'directory', mode: DIR_MODE, size: 0 });
+            }
+            paths.set(p.segments.join('/'), { kind: p.kind, mode: p.kind === 'link' ? 0 : p.mode, size: p.size, ...(p.link !== undefined ? { link: p.link } : {}) });
+        }
+        return { ok: true, paths };
+    };
+    if (format === 'tar.gz') {
+        const bytes = wholeFile(path);
+        return bytes === null ? { ok: false, problem: 'cannot be read' } : listed(planTar(bytes, top));
+    }
+    const r = withFile(path, (fd) => listed(planZip(fd, path, top)));
+    return r === null ? { ok: false, problem: 'cannot be read' } : r.value;
 }

package/dist/secrets.d.ts

@@ -34,6 +34,7 @@ export interface LaunchSecrets {
     readonly handles: readonly SecretHandle[];
     readonly files: ReadonlyMap<string, string>;
     readonly values: readonly string[];
+    readonly policy: readonly string[] | null;
     remove(): void;
 }
 export type LaunchCopy = ({
@@ -44,6 +45,14 @@ export type LaunchCopy = ({
 };
 export declare const NO_HANDLES: LaunchSecrets;
 export declare function copyForLaunch(configDir: string, connector: string): LaunchCopy;
+export declare const POLICY_FILE = "tools.json";
+export type PolicyReading = {
+    readonly ok: true;
+    readonly policy: readonly string[] | null;
+} | {
+    readonly ok: false;
+    readonly problem: string;
+};
 export declare function openFileSecrets(options: {
     readonly configDir: string;
     readonly connector: string;

package/dist/secrets.js

@@ -1,5 +1,5 @@
 import { randomBytes } from 'node:crypto';
-import { closeSync, constants, fchmodSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, renameSync, rmSync } from 'node:fs';
+import { closeSync, constants, fchmodSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, renameSync, rmSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join } from 'node:path';
 import { CONNECTOR_NAME } from './connector-name.js';
 import { hasRepeatedKey } from './json-text.js';
@@ -56,7 +56,7 @@ function locked(dir, connector, fn) {
         release();
     }
 }
-export const NO_HANDLES = { handles: [], files: new Map(), values: [], remove: () => undefined };
+export const NO_HANDLES = { handles: [], files: new Map(), values: [], policy: null, remove: () => undefined };
 export function copyForLaunch(configDir, connector) {
     const dir = handleDirectory(configDir, connector);
     try {
@@ -74,11 +74,15 @@ export function copyForLaunch(configDir, connector) {
     return r.ok ? r.value : r;
 }
 function copyHandles(configDir, dir, connector) {
+    const policyReading = readToolPolicy(dir, connector);
+    if (!policyReading.ok)
+        return policyReading;
+    const { policy } = policyReading;
     const listing = listHandles(dir, connector);
     if (!listing.ok)
         return listing;
     if (listing.handles.length === 0)
-        return { ok: true, ...NO_HANDLES };
+        return { ok: true, ...NO_HANDLES, policy };
     const copies = mkdtempSync(join(dir, '.launch-'));
     const remove = () => rmSync(copies, { recursive: true, force: true });
     try {
@@ -98,7 +102,7 @@ function copyHandles(configDir, dir, connector) {
             if (isSecret(handle))
                 values.push(bytes.toString('utf8'));
         }
-        return { ok: true, handles: listing.handles, files, values, remove };
+        return { ok: true, handles: listing.handles, files, values, policy, remove };
     }
     catch (e) {
         remove();
@@ -142,6 +146,64 @@ function entryProblem(path, kind, label) {
         return `${label} has permissions wider than ${kind === 'directory' ? '0700' : '0600'}`;
     return null;
 }
+export const POLICY_FILE = 'tools.json';
+const ALLOW_NAME = /^[^\s\x00-\x1F\x7F]+$/;
+function validAllowList(v) {
+    if (!Array.isArray(v))
+        return false;
+    const seen = new Set();
+    for (const name of v) {
+        if (typeof name !== 'string' || name === '*' || !ALLOW_NAME.test(name) || seen.has(name))
+            return false;
+        seen.add(name);
+    }
+    return true;
+}
+function readToolPolicy(dir, connector) {
+    const relative = `connectors/${connector}/${POLICY_FILE}`;
+    const refuse = (problem) => ({ ok: false, problem: `connector ${connector}: ${problem}` });
+    const malformed = () => refuse(`${relative} does not hold a JSON object whose only key is "allow", a list of non-empty tool names with no whitespace, no control character and no repeat`);
+    let fd;
+    try {
+        fd = openSync(join(dir, POLICY_FILE), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === 'ENOENT')
+            return { ok: true, policy: null };
+        if (code === 'ELOOP')
+            return refuse(`${relative} is a symbolic link`);
+        return refuse(`${relative} cannot be read`);
+    }
+    try {
+        if (!fstatSync(fd).isFile())
+            return refuse(`${relative} is not a regular file`);
+        let text;
+        try {
+            text = readFileSync(fd, 'utf8');
+        }
+        catch {
+            return refuse(`${relative} cannot be read`);
+        }
+        let value;
+        try {
+            value = JSON.parse(text);
+        }
+        catch {
+            return malformed();
+        }
+        if (value === null || typeof value !== 'object' || Array.isArray(value) || hasRepeatedKey(text))
+            return malformed();
+        const keys = Object.keys(value);
+        if (keys.length !== 1 || keys[0] !== 'allow')
+            return malformed();
+        const allow = value.allow;
+        return validAllowList(allow) ? { ok: true, policy: allow } : malformed();
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 function listHandles(dir, connector) {
     const refuse = (problem) => ({ ok: false, problem: `connector ${connector}: ${problem}` });
     try {

package/dist/write-all.d.ts

@@ -1,2 +1,4 @@
+import { Writable } from 'node:stream';
 export declare function writeAll(fd: number, data: string | Uint8Array): void;
+export declare function writeAllStream(fd: number): Writable;
 export declare function writeFailure(e: unknown): string;