@twinsearth/w2m-dsh-plugin 0.31.0 → 0.33.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +109 -0
- package/docs/1.0.0-ACCEPTANCE.md +2 -1
- package/package.json +5 -4
- package/src/agent/authority-choice.mjs +172 -0
- package/src/plugin/tools.mjs +43 -6
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,115 @@ All notable changes to this project are documented here. The format follows
|
|
|
4
4
|
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
|
|
5
5
|
adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
6
6
|
|
|
7
|
+
## [0.33.0] — 2026-10-15
|
|
8
|
+
|
|
9
|
+
**The authority level is chosen by name. Nobody types a number.**
|
|
10
|
+
|
|
11
|
+
`actorAuthorityLevel` is an integer in `0..100` whose four bands have names and gaps. Asking a person to type
|
|
12
|
+
it asks them to hold all of that in their head, and **getting it wrong fails silently**: `69` and `70` look
|
|
13
|
+
equally arbitrary and land in different bands, so a machine configured one point low **refuses a dispatch it
|
|
14
|
+
should have run and never says a threshold was the reason.**
|
|
15
|
+
|
|
16
|
+
`src/agent/authority-choice.mjs` turns the number into a choice:
|
|
17
|
+
|
|
18
|
+
| Choice | Level | What picking it permits |
|
|
19
|
+
|---|---|---|
|
|
20
|
+
| `ordinary` | **0** | create goals and session data within its own scope |
|
|
21
|
+
| `captain` | **50** | create team goals, manage team membership |
|
|
22
|
+
| `org_admin` | **70** | create organisation goals, register actors, set overrides |
|
|
23
|
+
| `system_admin` | **90** | create global goals, configure across organisations, override any lower constraint |
|
|
24
|
+
|
|
25
|
+
The options are **built from `AUTHORITY_BANDS`**, so a band added to the model appears here without anybody
|
|
26
|
+
remembering — and a band cannot be described in two places differently.
|
|
27
|
+
|
|
28
|
+
### A name resolves to its band FLOOR, and the consequence is stated
|
|
29
|
+
|
|
30
|
+
The floor is where the band's own description becomes true, and it is what `bandOf` answers with. Resolving to
|
|
31
|
+
a midpoint would mean **a choice labelled "captain" silently granting more than captain.**
|
|
32
|
+
|
|
33
|
+
The practical consequence is worth writing down because it decides what a machine may do: **`ordinary`
|
|
34
|
+
resolves to `0` and `dispatch_writing` costs `50`, so a machine whose operator picks "ordinary" cannot
|
|
35
|
+
dispatch a write at all** — it escalates and an approver must answer. Measured, all four:
|
|
36
|
+
|
|
37
|
+
```
|
|
38
|
+
ordinary level 0 -> write dispatch: needs_approval
|
|
39
|
+
captain level 50 -> write dispatch: allow
|
|
40
|
+
org_admin level 70 -> write dispatch: allow
|
|
41
|
+
system_admin level 90 -> write dispatch: allow
|
|
42
|
+
```
|
|
43
|
+
|
|
44
|
+
### Two vocabularies, and two different callers
|
|
45
|
+
|
|
46
|
+
**A number is refused by the selector**, because a selector that also accepts integers is a text field with a
|
|
47
|
+
helpful hint and every reason above applies again. **A number is accepted by the config**, because a profile
|
|
48
|
+
patch written by an earlier version must keep loading — and breaking every existing machine on upgrade is a
|
|
49
|
+
worse failure than accepting a number from a file nobody is looking at. The two rules are stated in one place
|
|
50
|
+
and tested against each other, including that the selector refuses `'captain '` while the config trims it.
|
|
51
|
+
|
|
52
|
+
### A misconfigured level no longer degrades in silence
|
|
53
|
+
|
|
54
|
+
`w2m_status` now reports `actor_authority` — whether it resolved, from which vocabulary, and **why not when it
|
|
55
|
+
did not, with the four choices attached**. A level that failed to parse used to become `null`, which reads
|
|
56
|
+
exactly like a machine that never chose one, and **those two need opposite responses.**
|
|
57
|
+
|
|
58
|
+
### Three of my own errors
|
|
59
|
+
|
|
60
|
+
* I asserted `UNKNOWN` for the integer `70`; it is `NOT_A_STRING`, because the codes distinguish "a number was
|
|
61
|
+
given" from "a string that did not match" — **on purpose, so a caller can message them differently.**
|
|
62
|
+
* I reused the selector's message in the config resolver, so a config author was told about names only while
|
|
63
|
+
**that function's own contract promised numbers too.** The implementation was changed, not the test.
|
|
64
|
+
* My captain test asserted success and instead reached the network, because it installed no fetch stub. **That
|
|
65
|
+
failure was the proof**: it did *not* throw `W2M_PERMISSION_*`. The assertion now checks the kind of failure
|
|
66
|
+
rather than the absence of one, which is what the test was always about.
|
|
67
|
+
|
|
68
|
+
**18 new tests, 0 failures.**
|
|
69
|
+
|
|
70
|
+
## [0.32.0] — 2026-10-15
|
|
71
|
+
|
|
72
|
+
**Widening real-machine verification: eight suites tried, none passed, and the cause is a hypothesis.**
|
|
73
|
+
|
|
74
|
+
### What was measured
|
|
75
|
+
|
|
76
|
+
The eight suites dispatched to MacMini all returned **non-zero there while passing here**. The packed code
|
|
77
|
+
that reported this was at times ambiguous, so the run was repeated with a simpler encoding — **one bit per
|
|
78
|
+
suite, exit 0 or not** — and that is unambiguous: **the packed result was `0`, meaning no suite passed.**
|
|
79
|
+
|
|
80
|
+
### What was NOT measured, and is therefore not claimed
|
|
81
|
+
|
|
82
|
+
The likely cause is a **missing `node_modules` on that machine** — the suites import from `src/`, and some of
|
|
83
|
+
those modules reach for a dependency. **That was not established.** It is a hypothesis, and this release
|
|
84
|
+
records it as one. The acceptance document now says so in a row of its own rather than in a footnote.
|
|
85
|
+
|
|
86
|
+
### Five dispatches spent on a channel that carries eight bits
|
|
87
|
+
|
|
88
|
+
The attempts, in order, and what each one actually answered:
|
|
89
|
+
|
|
90
|
+
| Attempt | Question asked | What came back |
|
|
91
|
+
|---|---|---|
|
|
92
|
+
| 1 | four suites, two bits each (status + reason) | 8 bits, but the tail truncated — **unreadable** |
|
|
93
|
+
| 2 | eight suites, three bits each | 24 bits packed into 8 — **arithmetically impossible, and it returned 0** |
|
|
94
|
+
| 3 | re-read the saved outputs | the parse matched nothing, because it guessed Node's summary format |
|
|
95
|
+
| 4 | eight suites, one bit each | **`0` — no suite passed. Unambiguous.** |
|
|
96
|
+
| 5 | print the environment facts | ran to completion, **and stdout is not visible through a dispatch** |
|
|
97
|
+
|
|
98
|
+
**Every one of those was the same mistake**: asking a channel more than it carries, then reading the
|
|
99
|
+
truncation as an answer. `exit code` is one byte, and the correct instinct — already written into
|
|
100
|
+
`machine-test-packet.mjs` and ignored here — is to ask **one bit per suite and nothing else**.
|
|
101
|
+
|
|
102
|
+
`--inline` was added to that script so its loop can be delivered as a `node -e` one-liner, because a real
|
|
103
|
+
machine's allow-list **admits `node -e` and refuses `node scripts/…`**. The generated command is 486 characters
|
|
104
|
+
and self-checks locally. **Its stdout is still invisible through a dispatch**, which the docstring now says
|
|
105
|
+
plainly: the inline form is useful when the packed code is enough, and **when it is not, the answer is one
|
|
106
|
+
command run by a person rather than a cleverer encoding.**
|
|
107
|
+
|
|
108
|
+
### What is unchanged
|
|
109
|
+
|
|
110
|
+
**Two of the three decisions the user made are not in this release.** The authority-level *selector* — the
|
|
111
|
+
request that the level be **chosen rather than typed** — is not built, and the permission gate remains
|
|
112
|
+
**off by default**, which §3.11 of the acceptance draft still records as incompatible with claiming 分权限.
|
|
113
|
+
|
|
114
|
+
**No new tests.** The suites that exist all still pass; what changed is a measurement and a docstring.
|
|
115
|
+
|
|
7
116
|
## [0.31.0] — 2026-10-15
|
|
8
117
|
|
|
9
118
|
**The approval gate got a caller, and a draft acceptance definition for 1.0.0.**
|
package/docs/1.0.0-ACCEPTANCE.md
CHANGED
|
@@ -89,7 +89,8 @@ Recorded here so that absence is a decision rather than an omission:
|
|
|
89
89
|
| **Field authority reaches the memory layer** | `field-authority.mjs` has no production caller; `w2m_memory` does not use it. |
|
|
90
90
|
| **The queue survives a restart** | it is per-plugin-lifetime by design, and is **not** an audit log. |
|
|
91
91
|
| **Any scale claim** | this fleet is 3 usable machines of 5 paired. `ROADMAP.md` refuses to plan v4.11.0+ for exactly this reason, and `fleet-scale.mjs` refuses to extrapolate from five. |
|
|
92
|
-
| **MacMini verification of everything** | four suites were verified on that machine in 0.28.0; the other 69 were not. |
|
|
92
|
+
| **MacMini verification of everything** | four suites were verified on that machine in 0.28.0; the other 69 were not. **Measured in 0.32.0: the eight suites tried there did not pass, and the cause is not yet established.** |
|
|
93
|
+
| **The eight suites tried on MacMini in 0.32.0** | every one of them returned non-zero there while passing here. The likely cause is a missing `node_modules` on that machine, but **that was not measured**, so it is a hypothesis and not a finding. |
|
|
93
94
|
| **`P2P_PUNCH_FAILED`** | cause UNVERIFIED; three hypotheses measured and excluded. |
|
|
94
95
|
|
|
95
96
|
---
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@twinsearth/w2m-dsh-plugin",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.33.0",
|
|
4
4
|
"description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "lib/index.js",
|
|
@@ -113,13 +113,13 @@
|
|
|
113
113
|
}
|
|
114
114
|
},
|
|
115
115
|
"scripts": {
|
|
116
|
-
"test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
|
|
116
|
+
"test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
|
|
117
117
|
"test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs",
|
|
118
118
|
"test:relay": "node --test --test-force-exit test/relay.test.mjs",
|
|
119
119
|
"test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
|
|
120
120
|
"test:tools": "node --test --test-force-exit test/tools.test.mjs",
|
|
121
121
|
"test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
|
|
122
|
-
"test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
|
|
122
|
+
"test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
|
|
123
123
|
"pack": "node scripts/pack.mjs",
|
|
124
124
|
"verify:join": "node scripts/verify-join.mjs",
|
|
125
125
|
"lint": "eslint .",
|
|
@@ -148,7 +148,8 @@
|
|
|
148
148
|
"test:permission": "node --test --test-force-exit test/permission.test.mjs",
|
|
149
149
|
"test:packet": "node --test --test-force-exit test/machine-test-packet.test.mjs",
|
|
150
150
|
"test:field-authority": "node --test --test-force-exit test/field-authority.test.mjs",
|
|
151
|
-
"test:approval-gate": "node --test --test-force-exit test/approval-gate.test.mjs"
|
|
151
|
+
"test:approval-gate": "node --test --test-force-exit test/approval-gate.test.mjs",
|
|
152
|
+
"test:authority-choice": "node --test --test-force-exit test/authority-choice.test.mjs"
|
|
152
153
|
},
|
|
153
154
|
"keywords": [
|
|
154
155
|
"dsh-bundle",
|
|
@@ -0,0 +1,172 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Choosing an authority level by name, so nobody has to remember what 70 means.
|
|
3
|
+
*
|
|
4
|
+
* ## Why this exists
|
|
5
|
+
*
|
|
6
|
+
* `actorAuthorityLevel` is an integer in `0..100`, and the four bands it falls into have names, prose about
|
|
7
|
+
* what each may do, and *gaps*. Asking a person to type a number means asking them to hold all of that in
|
|
8
|
+
* their head, and the failure mode of getting it wrong is silent: `69` and `70` look equally arbitrary and
|
|
9
|
+
* land in different bands, and a machine configured one point low **refuses a dispatch it should have run**
|
|
10
|
+
* with no indication that a threshold was the reason.
|
|
11
|
+
*
|
|
12
|
+
* This module turns the number into a choice. A caller presents {@link AUTHORITY_CHOICES} — four names with
|
|
13
|
+
* the sentence each one means — and gets back the level. **The number is never asked for.**
|
|
14
|
+
*
|
|
15
|
+
* ## Why a name resolves to its band FLOOR
|
|
16
|
+
*
|
|
17
|
+
* Each band spans a range and this picks the bottom of it, deliberately. The floor is the level at which the
|
|
18
|
+
* band's own description becomes true, and it is what `bandOf` answers with: a machine at the floor is *in*
|
|
19
|
+
* that band and no higher. Resolving to the midpoint or the ceiling would mean a choice labelled "captain"
|
|
20
|
+
* silently granted more than captain.
|
|
21
|
+
*
|
|
22
|
+
* **The consequence is worth stating plainly, because it decides what a machine can do:** `ordinary` resolves
|
|
23
|
+
* to `0`, and `dispatch_writing` costs `50`. So a machine whose operator picks "ordinary" **cannot dispatch a
|
|
24
|
+
* write at all** — it escalates, and an approver must answer. That is the intended reading of the label. It
|
|
25
|
+
* is also why this is a policy decision rather than a convenience: **the name a person picks decides what the
|
|
26
|
+
* machine is allowed to do.**
|
|
27
|
+
*
|
|
28
|
+
* ## Why a number is refused rather than accepted alongside the names
|
|
29
|
+
*
|
|
30
|
+
* A selector that also accepted integers would be a text field with a helpful hint, and every reason above
|
|
31
|
+
* would apply again. Refusing them keeps one way in, and the refusal names the four that exist.
|
|
32
|
+
*/
|
|
33
|
+
import { AUTHORITY_BANDS, AUTHORITY_BAND_FLOORS, AUTHORITY_MAX, isAuthorityLevel } from './authority.mjs';
|
|
34
|
+
|
|
35
|
+
/** Why a choice was refused. */
|
|
36
|
+
export const CHOICE_REFUSAL = Object.freeze({
|
|
37
|
+
UNKNOWN: 'AUTHORITY_CHOICE_UNKNOWN',
|
|
38
|
+
NOT_A_STRING: 'AUTHORITY_CHOICE_NOT_A_STRING',
|
|
39
|
+
NOT_CHOSEN: 'AUTHORITY_CHOICE_NOT_CHOSEN',
|
|
40
|
+
});
|
|
41
|
+
|
|
42
|
+
/**
|
|
43
|
+
* The options to present, in ascending order, each with the sentence it stands for.
|
|
44
|
+
*
|
|
45
|
+
* Built from `AUTHORITY_BANDS` rather than written out, so a band added to the model appears here without
|
|
46
|
+
* anybody remembering to add it — and, more importantly, **a band cannot be described in two places
|
|
47
|
+
* differently**.
|
|
48
|
+
*/
|
|
49
|
+
export const AUTHORITY_CHOICES = Object.freeze(
|
|
50
|
+
AUTHORITY_BANDS.map((band) => ({
|
|
51
|
+
/** The value a caller stores. Never a number. */
|
|
52
|
+
value: band.name,
|
|
53
|
+
/** What to show a person. */
|
|
54
|
+
label: band.name.replace(/_/g, ' '),
|
|
55
|
+
/** The level this resolves to, and the reason it is that one. */
|
|
56
|
+
level: AUTHORITY_BAND_FLOORS[band.name.toUpperCase()],
|
|
57
|
+
/** What picking this permits, in the model's own words. */
|
|
58
|
+
may: band.may,
|
|
59
|
+
/** The range, so a caller can show it without reading the model. */
|
|
60
|
+
range: band.max === null ? `${band.min}+` : `${band.min}–${band.max}`,
|
|
61
|
+
})),
|
|
62
|
+
);
|
|
63
|
+
|
|
64
|
+
/**
|
|
65
|
+
* Resolve a named choice to a level.
|
|
66
|
+
*
|
|
67
|
+
* @param {string|null|undefined} choice
|
|
68
|
+
* @returns {{ok: boolean, level: number|null, choice: string|null, code: string|null, detail: string,
|
|
69
|
+
* options: string[]}}
|
|
70
|
+
*/
|
|
71
|
+
export function resolveAuthorityChoice(choice) {
|
|
72
|
+
const options = AUTHORITY_CHOICES.map((c) => c.value);
|
|
73
|
+
|
|
74
|
+
if (choice === null || choice === undefined || choice === '') {
|
|
75
|
+
// Not the same as a wrong answer. "Nobody chose" is a state a caller has to be able to tell from "somebody
|
|
76
|
+
// chose badly", because only one of them is a mistake.
|
|
77
|
+
return {
|
|
78
|
+
ok: false,
|
|
79
|
+
level: null,
|
|
80
|
+
choice: null,
|
|
81
|
+
code: CHOICE_REFUSAL.NOT_CHOSEN,
|
|
82
|
+
detail: `no authority level was chosen; pick one of ${options.join(', ')}`,
|
|
83
|
+
options,
|
|
84
|
+
};
|
|
85
|
+
}
|
|
86
|
+
|
|
87
|
+
if (typeof choice !== 'string') {
|
|
88
|
+
return {
|
|
89
|
+
ok: false,
|
|
90
|
+
level: null,
|
|
91
|
+
choice: null,
|
|
92
|
+
code: CHOICE_REFUSAL.NOT_A_STRING,
|
|
93
|
+
detail: `${JSON.stringify(choice)} is not a choice; pick one of ${options.join(', ')} by name`,
|
|
94
|
+
options,
|
|
95
|
+
};
|
|
96
|
+
}
|
|
97
|
+
|
|
98
|
+
const found = AUTHORITY_CHOICES.find((c) => c.value === choice);
|
|
99
|
+
if (found === undefined) {
|
|
100
|
+
return {
|
|
101
|
+
ok: false,
|
|
102
|
+
level: null,
|
|
103
|
+
choice: null,
|
|
104
|
+
code: CHOICE_REFUSAL.UNKNOWN,
|
|
105
|
+
detail: `${JSON.stringify(choice)} is not one of ${options.join(', ')}; if it looks like a number, note that levels are chosen by name and not typed`,
|
|
106
|
+
options,
|
|
107
|
+
};
|
|
108
|
+
}
|
|
109
|
+
|
|
110
|
+
return {
|
|
111
|
+
ok: true,
|
|
112
|
+
level: found.level,
|
|
113
|
+
choice: found.value,
|
|
114
|
+
code: null,
|
|
115
|
+
detail: `${found.value} resolves to level ${found.level} (${found.range}): ${found.may}`,
|
|
116
|
+
options,
|
|
117
|
+
};
|
|
118
|
+
}
|
|
119
|
+
|
|
120
|
+
/**
|
|
121
|
+
* Resolve a plugin configuration value, which may be a name or already a level.
|
|
122
|
+
*
|
|
123
|
+
* ## Why this one DOES accept a number, when the selector does not
|
|
124
|
+
*
|
|
125
|
+
* These are different callers with different constraints. A person choosing is asked to choose, and the whole
|
|
126
|
+
* point is that they are not asked for a number. A **profile patch** is written by hand or by an earlier
|
|
127
|
+
* version of this plugin, and a config that used to hold `70` must not start refusing to load because the
|
|
128
|
+
* interface changed — that would break every existing machine on upgrade, which is the failure this module's
|
|
129
|
+
* own docstring warns about.
|
|
130
|
+
*
|
|
131
|
+
* So: a `string` is resolved as a choice, an integer is accepted as-is **only if it is a usable level**, and
|
|
132
|
+
* anything else is refused with a message naming both vocabularies.
|
|
133
|
+
*
|
|
134
|
+
* @param {unknown} value
|
|
135
|
+
* @returns {{ok: boolean, level: number|null, source: string|null, code: string|null, detail: string}}
|
|
136
|
+
*/
|
|
137
|
+
export function resolveConfiguredLevel(value) {
|
|
138
|
+
if (typeof value === 'string' && value.trim() !== '') {
|
|
139
|
+
const r = resolveAuthorityChoice(value.trim());
|
|
140
|
+
if (r.ok) return { ok: true, level: r.level, source: 'name', code: null, detail: r.detail };
|
|
141
|
+
// A config may hold EITHER vocabulary, so a string that is not a band name is not simply unknown -- the
|
|
142
|
+
// caller is told both what the names are and that an integer would also have worked. Reusing the
|
|
143
|
+
// selector's message here was the first version's mistake: it told a config author about names only,
|
|
144
|
+
// while the function's own contract promised numbers too.
|
|
145
|
+
return {
|
|
146
|
+
ok: false,
|
|
147
|
+
level: null,
|
|
148
|
+
source: null,
|
|
149
|
+
code: r.code === CHOICE_REFUSAL.NOT_CHOSEN ? CHOICE_REFUSAL.NOT_CHOSEN : CHOICE_REFUSAL.UNKNOWN,
|
|
150
|
+
detail: `${JSON.stringify(value)} is neither a choice nor a level; choose one of ${AUTHORITY_CHOICES.map((c) => c.value).join(', ')}, or a direct level as an integer 0..${AUTHORITY_MAX}`,
|
|
151
|
+
};
|
|
152
|
+
}
|
|
153
|
+
if (isAuthorityLevel(value)) {
|
|
154
|
+
return {
|
|
155
|
+
ok: true,
|
|
156
|
+
level: value,
|
|
157
|
+
source: 'number',
|
|
158
|
+
code: null,
|
|
159
|
+
detail: `level ${value} was configured directly; it is in the "${(AUTHORITY_BANDS.find((b) => value >= b.min && (b.max === null || value <= b.max)) ?? {}).name ?? 'unknown'}" band`,
|
|
160
|
+
};
|
|
161
|
+
}
|
|
162
|
+
if (value === null || value === undefined || value === '') {
|
|
163
|
+
return { ok: false, level: null, source: null, code: CHOICE_REFUSAL.NOT_CHOSEN, detail: 'no authority level is configured, so the permission gate is not enforced' };
|
|
164
|
+
}
|
|
165
|
+
return {
|
|
166
|
+
ok: false,
|
|
167
|
+
level: null,
|
|
168
|
+
source: null,
|
|
169
|
+
code: CHOICE_REFUSAL.UNKNOWN,
|
|
170
|
+
detail: `${JSON.stringify(value)} is neither a choice nor a level; choose one of ${AUTHORITY_CHOICES.map((c) => c.value).join(', ')}, or an integer 0..${AUTHORITY_MAX}`,
|
|
171
|
+
};
|
|
172
|
+
}
|
package/src/plugin/tools.mjs
CHANGED
|
@@ -132,6 +132,9 @@ import { createApprovalIndex } from '../agent/approval-index.mjs';
|
|
|
132
132
|
// v0.31.0: the approval queue's front door. Written in 0.30.0 and given a caller here.
|
|
133
133
|
import { createApprovalGate } from '../agent/approval-gate.mjs';
|
|
134
134
|
import { AUTHORITY_MAX, isAuthorityLevel } from '../agent/authority.mjs';
|
|
135
|
+
// v0.33.0: the level is chosen by NAME rather than typed. `resolveConfiguredLevel` also accepts a plain
|
|
136
|
+
// integer, because a profile patch written by an earlier version must keep loading.
|
|
137
|
+
import { AUTHORITY_CHOICES, resolveConfiguredLevel } from '../agent/authority-choice.mjs';
|
|
135
138
|
// v0.6.0: the device keypair and the offer's key distribution (`docs/P2P-CRYPTO.md` §4). Imported
|
|
136
139
|
// rather than reimplemented: the dispatcher and the executor have to derive the *same* keys, and two
|
|
137
140
|
// implementations of a handshake are two chances to disagree about it.
|
|
@@ -195,7 +198,7 @@ const MAX_STAGES = 16;
|
|
|
195
198
|
* `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
|
|
196
199
|
* overrides it at runtime for tests and packagers.
|
|
197
200
|
*/
|
|
198
|
-
const PLUGIN_VERSION = '0.
|
|
201
|
+
const PLUGIN_VERSION = '0.33.0';
|
|
199
202
|
|
|
200
203
|
/** How long any single HTTP call may take before it is aborted, in milliseconds. */
|
|
201
204
|
const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
|
|
@@ -700,11 +703,34 @@ function readConfig(config = {}) {
|
|
|
700
703
|
* null is not 0. An unset level means there is no actor to judge, and the gate reports that as
|
|
701
704
|
* unenforced rather than refusing every writing dispatch on a machine that never opted in.
|
|
702
705
|
*/
|
|
703
|
-
|
|
704
|
-
|
|
705
|
-
|
|
706
|
-
|
|
707
|
-
|
|
706
|
+
/**
|
|
707
|
+
* v0.33.0: the level, chosen by NAME or configured as a number.
|
|
708
|
+
*
|
|
709
|
+
* The plugin config takes either, through {@link resolveConfiguredLevel} — a name because nobody should
|
|
710
|
+
* have to remember what 70 means, and a number because a profile patch written by an earlier version
|
|
711
|
+
* must keep loading. `W2M_ACTOR_AUTHORITY` takes a name too, so a machine can be pointed at a band
|
|
712
|
+
* without editing a profile.
|
|
713
|
+
*
|
|
714
|
+
* `actorAuthorityChoice` carries the resolution — including WHY it failed, when it did — so `w2m_status`
|
|
715
|
+
* can report a level it refused instead of silently dispatching unenforced. A misconfigured level that
|
|
716
|
+
* degrades to `null` in silence is the failure this pair exists to prevent.
|
|
717
|
+
*/
|
|
718
|
+
...(() => {
|
|
719
|
+
const fromEnv = typeof process.env.W2M_ACTOR_AUTHORITY === 'string' && process.env.W2M_ACTOR_AUTHORITY.trim() !== ''
|
|
720
|
+
? process.env.W2M_ACTOR_AUTHORITY.trim()
|
|
721
|
+
: undefined;
|
|
722
|
+
const resolved = resolveConfiguredLevel(fromEnv !== undefined ? fromEnv : config.actorAuthorityLevel);
|
|
723
|
+
return {
|
|
724
|
+
actorAuthorityLevel: resolved.ok ? resolved.level : null,
|
|
725
|
+
actorAuthorityChoice: {
|
|
726
|
+
ok: resolved.ok,
|
|
727
|
+
level: resolved.level,
|
|
728
|
+
source: resolved.source,
|
|
729
|
+
reason_code: resolved.code,
|
|
730
|
+
detail: resolved.detail,
|
|
731
|
+
},
|
|
732
|
+
};
|
|
733
|
+
})(),
|
|
708
734
|
defaultTimeoutMs: shared.values.defaultTimeoutMs,
|
|
709
735
|
sharedConfig: shared,
|
|
710
736
|
pairingCode: typeof config.pairingCode === 'string' && config.pairingCode.trim() !== ''
|
|
@@ -4519,6 +4545,17 @@ export async function apply(ctx, config = {}) {
|
|
|
4519
4545
|
: targetRoutes.reason,
|
|
4520
4546
|
sessions_with_a_target: defaultSelectionStore.list().length,
|
|
4521
4547
|
},
|
|
4548
|
+
/**
|
|
4549
|
+
* v0.33.0: how the authority level was resolved, and why it failed when it did.
|
|
4550
|
+
*
|
|
4551
|
+
* A misconfigured level used to degrade to `null` in silence, which reads exactly like a machine
|
|
4552
|
+
* that never chose one -- and those need opposite responses. This reports the difference, and
|
|
4553
|
+
* carries the four choices so a reader can fix it without being told what they are elsewhere.
|
|
4554
|
+
*/
|
|
4555
|
+
actor_authority: {
|
|
4556
|
+
...cfg.actorAuthorityChoice,
|
|
4557
|
+
...(cfg.actorAuthorityChoice.ok ? {} : { choices: AUTHORITY_CHOICES.map((c) => ({ value: c.value, may: c.may, range: c.range })) }),
|
|
4558
|
+
},
|
|
4522
4559
|
approvals: approvalsBlock,
|
|
4523
4560
|
notes: statusNotes(relay, rtt, cfg, p2pStatus, approvalsBlock),
|
|
4524
4561
|
},
|