@stratusagent/plugins 0.11.8 → 0.11.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/loader.d.ts +7 -1
- package/dist/loader.d.ts.map +1 -1
- package/dist/loader.js +1 -0
- package/dist/loader.js.map +1 -1
- package/dist/protected.d.ts +33 -0
- package/dist/protected.d.ts.map +1 -0
- package/dist/protected.js +152 -0
- package/dist/protected.js.map +1 -0
- package/package.json +3 -3
package/dist/index.d.ts
CHANGED
|
@@ -16,4 +16,5 @@ export { ManifestBoundToolRegistry, riskFloorFor, type PluginToolRecord, } from
|
|
|
16
16
|
export { isFirstPartyPackage, loadOptionalModule, loadPlugins, pluginConfigWithHostDefaults, preflightPlugin, installedPackageVersion, readPluginManifest, type CreatePlugin, type LoadedPlugin, type LoadPluginsOptions, type LoadPluginsResult, type OptionalModuleHost, type PluginLoadFailure, type PluginSkillRecord, } from './loader.ts';
|
|
17
17
|
export { createFileLedger, createProcessLocalLedger, isLedgerPath, LEDGER_FILENAME, ledgerContentTrust, ledgerGuard, ledgerTrustOfContent, nameIdentifiesHandle, type FileIdentity, type LedgerGuard, type TaintedWriteLedger, } from './provenance.ts';
|
|
18
18
|
export { workspaceResolver, workspacePreparer, allAgentWorkspaces } from './workspace.ts';
|
|
19
|
+
export { protectedPathGuard, type ProtectedPathGuard } from './protected.ts';
|
|
19
20
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -16,4 +16,5 @@ export { ManifestBoundToolRegistry, riskFloorFor, } from "./registry.js";
|
|
|
16
16
|
export { isFirstPartyPackage, loadOptionalModule, loadPlugins, pluginConfigWithHostDefaults, preflightPlugin, installedPackageVersion, readPluginManifest, } from "./loader.js";
|
|
17
17
|
export { createFileLedger, createProcessLocalLedger, isLedgerPath, LEDGER_FILENAME, ledgerContentTrust, ledgerGuard, ledgerTrustOfContent, nameIdentifiesHandle, } from "./provenance.js";
|
|
18
18
|
export { workspaceResolver, workspacePreparer, allAgentWorkspaces } from "./workspace.js";
|
|
19
|
+
export { protectedPathGuard } from "./protected.js";
|
|
19
20
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,GAQpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAK3B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,yBAAyB,EACzB,YAAY,GAEb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,kBAAkB,GAQnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,oBAAoB,GAIrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,GAQpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAK3B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,yBAAyB,EACzB,YAAY,GAEb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,kBAAkB,GAQnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,oBAAoB,GAIrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAA2B,MAAM,gBAAgB,CAAC"}
|
package/dist/loader.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type { AgentWorkspaces, CredentialResolver, EventBus, JsonObject, Plugin, PluginStateDirectory, SkillRegistry, ToolRegistry } from '@stratusagent/core';
|
|
1
|
+
import type { AgentWorkspaces, CredentialResolver, EventBus, JsonObject, Plugin, PluginStateDirectory, ProtectedPaths, SkillRegistry, ToolRegistry } from '@stratusagent/core';
|
|
2
2
|
import { type PluginManifest } from './manifest.ts';
|
|
3
3
|
import { type PluginToolRecord } from './registry.ts';
|
|
4
4
|
import { type ChannelSecretSource, type ContributionTargets, type PluginContributionRecords } from './contributions.ts';
|
|
@@ -185,6 +185,12 @@ export interface LoadPluginsOptions {
|
|
|
185
185
|
* plugin is never handed another's directory.
|
|
186
186
|
*/
|
|
187
187
|
stateDirectories?: (packageName: string) => PluginStateDirectory;
|
|
188
|
+
/**
|
|
189
|
+
* What no plugin may hand an agent, handed to every plugin's `setup` as
|
|
190
|
+
* `PluginContext.protectedPaths`. The same answer for every plugin: what
|
|
191
|
+
* the host keeps from agents does not depend on which plugin asks.
|
|
192
|
+
*/
|
|
193
|
+
protectedPaths?: ProtectedPaths;
|
|
188
194
|
/** Overrides the trusted set. See `isFirstPartyPackage`. */
|
|
189
195
|
trusted?: (packageName: string) => boolean;
|
|
190
196
|
/** Handed to every plugin's `setup` as `PluginContext.log` / `.warn`. */
|
package/dist/loader.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,UAAU,EACV,MAAM,EACN,oBAAoB,
|
|
1
|
+
{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,UAAU,EACV,MAAM,EACN,oBAAoB,EACpB,cAAc,EAEd,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,GAAU,CAAC,GAAG,OAAO,EAClD,WAAW,MAAM,EACjB,MAAM,kBAAkB,KACvB,OAAO,CAAC,CAAC,GAAG,SAAS,CASvB,CAAC;AAEF,+DAA+D;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AA8B5E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,GAClC,WAAW,MAAM,EACjB,MAAM,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,KACxC,OAAO,CAAC,MAAM,GAAG,SAAS,CAc5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,EACjB,MAAM,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,KACxC,OAAO,CAAC;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAGzD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,aAAa,MAAM,KAAG,OACmB,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,aAAa,EAAE,yBAAyB,CAAC;IACzC;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC;IAC/C,IAAI,EAAE,kBAAkB,CAAC;IACzB,4EAA4E;IAC5E,KAAK,EAAE,YAAY,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,GAAG,EAAE,QAAQ,CAAC;IACd;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,CAAC,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACvC,SAAS,CAAC,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjE;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,yEAAyE;IACzE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAmBD;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,GACvC,OAAO,UAAU,EACjB,UAAU,cAAc,KACvB,UAWF,CAAC;AAmEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,eAAe,GAC1B,UAAU,cAAc,EACxB,WAAW,MAAM,EACjB,OAAO,UAAU,KAChB,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,WAAW,GAAU,SAAS,kBAAkB,KAAG,OAAO,CAAC,iBAAiB,CA4IxF,CAAC"}
|
package/dist/loader.js
CHANGED
|
@@ -319,6 +319,7 @@ export const loadPlugins = async (options) => {
|
|
|
319
319
|
: {}),
|
|
320
320
|
...(options.workspaces !== undefined ? { workspaces: options.workspaces } : {}),
|
|
321
321
|
...(options.stateDirectories !== undefined ? { stateDirectory: options.stateDirectories(manifest.packageName) } : {}),
|
|
322
|
+
...(options.protectedPaths !== undefined ? { protectedPaths: options.protectedPaths } : {}),
|
|
322
323
|
...(options.log !== undefined ? { log: options.log } : {}),
|
|
323
324
|
...(options.warn !== undefined ? { warn: options.warn } : {}),
|
|
324
325
|
});
|
package/dist/loader.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"loader.js","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;
|
|
1
|
+
{"version":3,"file":"loader.js","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAczC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAyB,MAAM,eAAe,CAAC;AACjF,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAI3B,MAAM,oBAAoB,CAAC;AAkB5B;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,SAAiB,EACjB,IAAwB,EACA,EAAE;IAC1B,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,yEAAyE;IACzE,yBAAyB;IACzB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAM,CAAC;AAC7C,CAAC,CAAC;AAKF;;;;GAIG;AACH,MAAM,cAAc,GAAG,KAAK,EAC1B,WAAmB,EACnB,SAAiB,EACqC,EAAE;IACxD,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;IACzD,uEAAuE;IACvE,qEAAqE;IACrE,qCAAqC;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;YACzE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,EAAE,SAAS,EAAE,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM;YACR,CAAC;YACD,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,SAAS,GAAG,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAC1C,SAAiB,EACjB,IAAyC,EACZ,EAAE;IAC/B,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,OAAO,GAAI,WAAqC,CAAC,OAAO,CAAC;QAC/D,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,SAAiB,EACjB,IAAyC,EACiB,EAAE;IAC5D,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5F,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;AAC9E,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAW,EAAE,CAClE,WAAW,KAAK,eAAe,IAAI,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAqI9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,KAAiB,EACjB,QAAwB,EACZ,EAAE;IACd,uEAAuE;IACvE,kEAAkE;IAClE,0CAA0C;IAC1C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACpG,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,mEAAmE;IACnE,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AASF;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,KAAK,EAC/B,QAAwB,EACxB,gBAAwB,EACM,EAAE;IAChC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAClE,uEAAuE;QACvE,qEAAqE;QACrE,gBAAgB;QAChB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,WAAW,WAAW,CAAC,EAAE,yCAAyC,WAAW,CAAC,IAAI,EAAE,CACnH,CAAC;QACJ,CAAC;QACD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,WAAW,WAAW,CAAC,EAAE,yBAAyB,WAAW,CAAC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9J,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,WAAW,WAAW,CAAC,EAAE,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7I,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,WAAW,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,KAAK,EAAE,eAAe,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3F,MAAM,EAAE;gBACN,EAAE,EAAE,SAAS;gBACb,MAAM,EAAE,WAAW,CAAC,EAAE;gBACtB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE;gBACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,OAAO,EAAE,QAAQ,CAAC,WAAW;gBAC7B,IAAI,EAAE,QAAQ;aACf;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,QAAwB,EACxB,SAAiB,EACjB,KAAiB,EACF,EAAE;IACjB,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,oBAAoB,CAAC,QAAQ,EAAE,4BAA4B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9E,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAA2B,EAA8B,EAAE;IAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAC;IACvD,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,kBAAkB,GAAG,wBAAwB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAClF,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChD,qEAAqE;YACrE,uEAAuE;YACvE,mEAAmE;YACnE,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC7D,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,aAAa,GAAG,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAE9D,gEAAgE;YAChE,+DAA+D;YAC/D,0CAA0C;YAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE1F,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAoC,CAAC;YACzF,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;gBAC9C,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,0EAA0E,CACzG,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBAClD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,+DAA+D,CAC9F,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC;YAElB,MAAM,IAAI,GAAG,IAAI,yBAAyB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;YACnH,MAAM,aAAa,GAAG,IAAI,0BAA0B,CAAC;gBACnD,QAAQ;gBACR,OAAO;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5F,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,IAAI;gBACX,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,kEAAkE;gBAClE,gEAAgE;gBAChE,8DAA8D;gBAC9D,kBAAkB;gBAClB,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;oBACnC,CAAC,CAAC,EAAE,WAAW,EAAE,qCAAqC,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE;oBACvF,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrH,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YAEH,mEAAmE;YACnE,8DAA8D;YAC9D,8DAA8D;YAC9D,4DAA4D;YAC5D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,YAAY,EAAE,CAAC;oBACrC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;wBACjC,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,KAAK,CAAC,EAAE,2DAA2D,CAC3F,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,oEAAoE;YACpE,oEAAoE;YACpE,aAAa,CAAC,eAAe,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAwB,EAAE,CAAC;YACvC,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;gBACrD,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAChC,gEAAgE;gBAChE,gEAAgE;gBAChE,gEAAgE;gBAChE,6DAA6D;gBAC7D,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;YAED,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,QAAQ,CAAC,WAAW;gBAC7B,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW;gBACpG,QAAQ;gBACR,OAAO,EAAE,SAAS;gBAClB,KAAK;gBACL,MAAM;gBACN,aAAa,EAAE,WAAW;gBAC1B,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,kEAAkE;YAClE,kDAAkD;YAClD,IAAI,CAAC;gBACH,MAAM,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC,CAAC"}
|
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
import type { ProtectedPaths } from '@stratusagent/core';
|
|
2
|
+
import type { FileIdentity } from './provenance.ts';
|
|
3
|
+
/**
|
|
4
|
+
* Which protected path, if any, `absolutePath` is or lies under. Answers
|
|
5
|
+
* with the host's own spelling of what matched, so a refusal can name it.
|
|
6
|
+
*
|
|
7
|
+
* `identity` is the inode the caller is about to act on, when it has one;
|
|
8
|
+
* without it the guard looks the path up itself.
|
|
9
|
+
*/
|
|
10
|
+
export type ProtectedPathGuard = (absolutePath: string, identity?: FileIdentity) => Promise<string | undefined>;
|
|
11
|
+
/**
|
|
12
|
+
* Build the guard for one call from what the host protects right now.
|
|
13
|
+
*
|
|
14
|
+
* Each path counts under two spellings, the host's and the canonical one,
|
|
15
|
+
* because the path being judged arrives canonical from the root resolver,
|
|
16
|
+
* and `~/.stratus` behind a link would otherwise compare as somewhere else.
|
|
17
|
+
*
|
|
18
|
+
* An exemption wins only where it is deeper than the protection it sits
|
|
19
|
+
* in: a workspace inside the protected home is reachable, and a protected
|
|
20
|
+
* path inside a workspace would still not be.
|
|
21
|
+
*
|
|
22
|
+
* A protected *file* also counts by inode, exemption or not: a hard link
|
|
23
|
+
* to `credentials.json` from inside a workspace is a different name for
|
|
24
|
+
* the same bytes, and no spelling reaches it. Files inside a protected
|
|
25
|
+
* directory are matched by path only, since enumerating them on every call
|
|
26
|
+
* is not worth it. Making a hard link to one takes a capability that could
|
|
27
|
+
* already read it, such as an approved shell command.
|
|
28
|
+
*
|
|
29
|
+
* A host that supplies nothing gets a guard that protects nothing. That is
|
|
30
|
+
* what `PluginContext.protectedPaths` says an omitting host gives up.
|
|
31
|
+
*/
|
|
32
|
+
export declare const protectedPathGuard: (paths: ProtectedPaths | undefined) => Promise<ProtectedPathGuard>;
|
|
33
|
+
//# sourceMappingURL=protected.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"protected.d.ts","sourceRoot":"","sources":["../src/protected.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AA6FhH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,kBAAkB,GAAU,OAAO,cAAc,GAAG,SAAS,KAAG,OAAO,CAAC,kBAAkB,CA4CtG,CAAC"}
|
|
@@ -0,0 +1,152 @@
|
|
|
1
|
+
import { realpath, stat } from 'node:fs/promises';
|
|
2
|
+
import path from 'node:path';
|
|
3
|
+
const identityKey = (identity) => `${identity.dev}:${identity.ino}`;
|
|
4
|
+
const within = (outer, candidate) => candidate === outer || candidate.startsWith(outer.endsWith(path.sep) ? outer : `${outer}${path.sep}`);
|
|
5
|
+
/**
|
|
6
|
+
* The same split as the provenance ledger's guard: nothing there, or a path
|
|
7
|
+
* that leads nowhere, is an answer. Anything else is the guard failing to
|
|
8
|
+
* ask, and it must not pass a path because it could not look.
|
|
9
|
+
*/
|
|
10
|
+
const answersMissing = (error) => {
|
|
11
|
+
const code = error.code;
|
|
12
|
+
return code === 'ENOENT' || code === 'ENOTDIR' || code === 'ELOOP';
|
|
13
|
+
};
|
|
14
|
+
/**
|
|
15
|
+
* The canonical spelling of a path that may not exist yet: its deepest
|
|
16
|
+
* existing ancestor resolved, the rest joined on. That is the spelling the
|
|
17
|
+
* root resolver hands a caller, so the two sides compare alike.
|
|
18
|
+
*/
|
|
19
|
+
const canonicalOf = async (target) => {
|
|
20
|
+
const missing = [];
|
|
21
|
+
let cursor = target;
|
|
22
|
+
for (;;) {
|
|
23
|
+
try {
|
|
24
|
+
return path.join(await realpath(cursor), ...missing);
|
|
25
|
+
}
|
|
26
|
+
catch (error) {
|
|
27
|
+
if (!answersMissing(error)) {
|
|
28
|
+
throw error;
|
|
29
|
+
}
|
|
30
|
+
const parent = path.dirname(cursor);
|
|
31
|
+
if (parent === cursor) {
|
|
32
|
+
return target;
|
|
33
|
+
}
|
|
34
|
+
missing.unshift(path.basename(cursor));
|
|
35
|
+
cursor = parent;
|
|
36
|
+
}
|
|
37
|
+
}
|
|
38
|
+
};
|
|
39
|
+
/** Both spellings of each path: the one given, and the canonical one. */
|
|
40
|
+
const spellingsOf = async (listed) => {
|
|
41
|
+
const spellings = [];
|
|
42
|
+
for (const named of listed) {
|
|
43
|
+
const absolute = path.resolve(named);
|
|
44
|
+
spellings.push({ spelling: absolute, named: absolute });
|
|
45
|
+
const canonical = await canonicalOf(absolute);
|
|
46
|
+
if (canonical !== absolute) {
|
|
47
|
+
spellings.push({ spelling: canonical, named: absolute });
|
|
48
|
+
}
|
|
49
|
+
}
|
|
50
|
+
return spellings;
|
|
51
|
+
};
|
|
52
|
+
/**
|
|
53
|
+
* Both spellings of each exemption, where the canonical one resolves the
|
|
54
|
+
* exemption's *ancestors* and never the exemption itself. A home behind a
|
|
55
|
+
* link still needs its workspaces exempt under the real spelling, but a
|
|
56
|
+
* workspace that is itself a link names wherever it points, and if that is
|
|
57
|
+
* `agents/juno` inside the protected home, following it would exempt Juno's
|
|
58
|
+
* sessions, memory, and grants. A link pointing outside the home needs no
|
|
59
|
+
* exemption, since nothing there is protected.
|
|
60
|
+
*/
|
|
61
|
+
const exemptSpellingsOf = async (listed) => {
|
|
62
|
+
const spellings = [];
|
|
63
|
+
for (const named of listed) {
|
|
64
|
+
const absolute = path.resolve(named);
|
|
65
|
+
spellings.push({ spelling: absolute, named: absolute });
|
|
66
|
+
const parent = path.dirname(absolute);
|
|
67
|
+
const canonical = parent === absolute ? absolute : path.join(await canonicalOf(parent), path.basename(absolute));
|
|
68
|
+
if (canonical !== absolute) {
|
|
69
|
+
spellings.push({ spelling: canonical, named: absolute });
|
|
70
|
+
}
|
|
71
|
+
}
|
|
72
|
+
return spellings;
|
|
73
|
+
};
|
|
74
|
+
/** The deepest of `spellings` that `candidate` lies within, if any. */
|
|
75
|
+
const deepestMatch = (spellings, candidate) => {
|
|
76
|
+
let best;
|
|
77
|
+
for (const entry of spellings) {
|
|
78
|
+
if (within(entry.spelling, candidate) && (best === undefined || entry.spelling.length > best.spelling.length)) {
|
|
79
|
+
best = entry;
|
|
80
|
+
}
|
|
81
|
+
}
|
|
82
|
+
return best;
|
|
83
|
+
};
|
|
84
|
+
/**
|
|
85
|
+
* Build the guard for one call from what the host protects right now.
|
|
86
|
+
*
|
|
87
|
+
* Each path counts under two spellings, the host's and the canonical one,
|
|
88
|
+
* because the path being judged arrives canonical from the root resolver,
|
|
89
|
+
* and `~/.stratus` behind a link would otherwise compare as somewhere else.
|
|
90
|
+
*
|
|
91
|
+
* An exemption wins only where it is deeper than the protection it sits
|
|
92
|
+
* in: a workspace inside the protected home is reachable, and a protected
|
|
93
|
+
* path inside a workspace would still not be.
|
|
94
|
+
*
|
|
95
|
+
* A protected *file* also counts by inode, exemption or not: a hard link
|
|
96
|
+
* to `credentials.json` from inside a workspace is a different name for
|
|
97
|
+
* the same bytes, and no spelling reaches it. Files inside a protected
|
|
98
|
+
* directory are matched by path only, since enumerating them on every call
|
|
99
|
+
* is not worth it. Making a hard link to one takes a capability that could
|
|
100
|
+
* already read it, such as an approved shell command.
|
|
101
|
+
*
|
|
102
|
+
* A host that supplies nothing gets a guard that protects nothing. That is
|
|
103
|
+
* what `PluginContext.protectedPaths` says an omitting host gives up.
|
|
104
|
+
*/
|
|
105
|
+
export const protectedPathGuard = async (paths) => {
|
|
106
|
+
const listed = paths === undefined ? [] : await paths.all();
|
|
107
|
+
if (listed.length === 0) {
|
|
108
|
+
return async () => undefined;
|
|
109
|
+
}
|
|
110
|
+
const protectedSpellings = await spellingsOf(listed);
|
|
111
|
+
const exemptSpellings = await exemptSpellingsOf(await paths.exempt());
|
|
112
|
+
const identities = new Map();
|
|
113
|
+
for (const named of listed) {
|
|
114
|
+
try {
|
|
115
|
+
const info = await stat(named);
|
|
116
|
+
if (info.isFile()) {
|
|
117
|
+
identities.set(identityKey(info), path.resolve(named));
|
|
118
|
+
}
|
|
119
|
+
}
|
|
120
|
+
catch (error) {
|
|
121
|
+
if (!answersMissing(error)) {
|
|
122
|
+
throw error;
|
|
123
|
+
}
|
|
124
|
+
}
|
|
125
|
+
}
|
|
126
|
+
return async (absolutePath, identity) => {
|
|
127
|
+
const guarded = deepestMatch(protectedSpellings, absolutePath);
|
|
128
|
+
if (guarded !== undefined) {
|
|
129
|
+
const exempted = deepestMatch(exemptSpellings, absolutePath);
|
|
130
|
+
if (exempted === undefined || exempted.spelling.length <= guarded.spelling.length) {
|
|
131
|
+
return guarded.named;
|
|
132
|
+
}
|
|
133
|
+
}
|
|
134
|
+
if (identities.size === 0) {
|
|
135
|
+
return undefined;
|
|
136
|
+
}
|
|
137
|
+
if (identity !== undefined) {
|
|
138
|
+
return identities.get(identityKey(identity));
|
|
139
|
+
}
|
|
140
|
+
try {
|
|
141
|
+
return identities.get(identityKey(await stat(absolutePath)));
|
|
142
|
+
}
|
|
143
|
+
catch (error) {
|
|
144
|
+
if (answersMissing(error)) {
|
|
145
|
+
// Nothing there: a write about to create a file is not a protected one.
|
|
146
|
+
return undefined;
|
|
147
|
+
}
|
|
148
|
+
throw error;
|
|
149
|
+
}
|
|
150
|
+
};
|
|
151
|
+
};
|
|
152
|
+
//# sourceMappingURL=protected.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"protected.js","sourceRoot":"","sources":["../src/protected.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAe7B,MAAM,WAAW,GAAG,CAAC,QAAsB,EAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;AAE1F,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,SAAiB,EAAW,EAAE,CAC3D,SAAS,KAAK,KAAK,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAExG;;;;GAIG;AACH,MAAM,cAAc,GAAG,CAAC,KAAc,EAAW,EAAE;IACjD,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;IACnD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC;AACrE,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG,KAAK,EAAE,MAAc,EAAmB,EAAE;IAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,WAAW,GAAG,KAAK,EAAE,MAAyB,EAAuD,EAAE;IAC3G,MAAM,SAAS,GAA+C,EAAE,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,KAAK,EAAE,MAAyB,EAAuD,EAAE;IACjH,MAAM,SAAS,GAA+C,EAAE,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjH,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,YAAY,GAAG,CACnB,SAA6D,EAC7D,SAAiB,EACgC,EAAE;IACnD,IAAI,IAAqD,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9G,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,KAAiC,EAA+B,EAAE;IACzG,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAC/B,CAAC;IACD,MAAM,kBAAkB,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAAC,MAAO,KAAwB,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,YAAY,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAC/D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;YAC7D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAClF,OAAO,OAAO,CAAC,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,wEAAwE;gBACxE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@stratusagent/plugins",
|
|
3
|
-
"version": "0.11.
|
|
3
|
+
"version": "0.11.10",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"main": "./dist/index.js",
|
|
6
6
|
"types": "./dist/index.d.ts",
|
|
@@ -18,8 +18,8 @@
|
|
|
18
18
|
"node": ">=22.13 <23 || >=23.4"
|
|
19
19
|
},
|
|
20
20
|
"dependencies": {
|
|
21
|
-
"@stratusagent/
|
|
22
|
-
"@stratusagent/
|
|
21
|
+
"@stratusagent/agents": "0.11.10",
|
|
22
|
+
"@stratusagent/core": "0.11.10"
|
|
23
23
|
},
|
|
24
24
|
"devDependencies": {
|
|
25
25
|
"@types/node": "^24.6.0",
|