@wrongstack/core 0.267.0 → 0.269.0

package/dist/{secret-vault-gkvEZZfE.d.ts → secret-vault-BLsVmTIK.d.ts}

@@ -1,4 +1,4 @@
-import { S as SecretScrubber } from './permission-B75JAi3-.js';
+import { S as SecretScrubber } from './permission-CvYQNUqZ.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { R as RotatableSecretVault, S as SecretVault } from './secret-vault-BAKpgFw_.js';
 

package/dist/security/index.d.ts

@@ -1,8 +1,8 @@
-export { a as DefaultSecretScrubber, D as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, b as rotateConfigKeys } from '../secret-vault-gkvEZZfE.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-DlR9eJAM.js';
-export { D as DANGEROUS_FOR_SUBAGENTS, T as ToolCapabilities, a as ToolCapability, g as getDangerousCapabilities, h as hasCapability, b as hasDangerousCapabilityForSubagents } from '../index-IEuxQd-E.js';
-import '../permission-B75JAi3-.js';
-import '../context-dT5Ueund.js';
+export { a as DefaultSecretScrubber, D as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, b as rotateConfigKeys } from '../secret-vault-BLsVmTIK.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-D5Ss8j4B.js';
+export { D as DANGEROUS_FOR_SUBAGENTS, T as ToolCapabilities, a as ToolCapability, g as getDangerousCapabilities, h as hasCapability, b as hasDangerousCapabilityForSubagents } from '../index-whDfTANu.js';
+import '../permission-CvYQNUqZ.js';
+import '../context-Dp87Bcaq.js';
 import '../logger-B63L5bTg.js';
 import '../secret-vault-BAKpgFw_.js';
 import '../input-reader-E-ffP2ee.js';

package/dist/security/index.js

@@ -395,6 +395,41 @@ function safeParse(input, maxBytes = 5e6) {
   }
 }
 
+// src/utils/tool-subject.ts
+var GLOB_METACHARACTERS = /[*?[\]]/g;
+function escapeGlobSubject(value) {
+  return value.replace(GLOB_METACHARACTERS, (char) => `\\${char}`);
+}
+function normalizePathSubject(value) {
+  return escapeGlobSubject(value.replace(/\\/g, "/"));
+}
+function isPathSubjectKey(subjectKey) {
+  return subjectKey === "path" || subjectKey === "file" || subjectKey === "files";
+}
+function subjectForToolInput(toolName, input, subjectKey) {
+  if (!input || typeof input !== "object") return void 0;
+  const obj = input;
+  if (subjectKey) {
+    const value = obj[subjectKey];
+    if (typeof value === "string") {
+      return isPathSubjectKey(subjectKey) ? normalizePathSubject(value) : escapeGlobSubject(value);
+    }
+  }
+  if (toolName === "bash" && typeof obj.command === "string") {
+    return escapeGlobSubject(obj.command);
+  }
+  if (typeof obj.path === "string") {
+    return normalizePathSubject(obj.path);
+  }
+  if (typeof obj.url === "string") {
+    return escapeGlobSubject(obj.url);
+  }
+  if (typeof obj.name === "string") {
+    return escapeGlobSubject(obj.name);
+  }
+  return void 0;
+}
+
 // src/types/errors.ts
 var ERROR_CODES = {
   // Provider
@@ -1167,7 +1202,7 @@ var DefaultPermissionPolicy = class {
     if (!this.loaded) await this.reload();
     const namespaceEntry = this.findNamespaceEntry(tool.name);
     const entry = this.policy[tool.name] ?? namespaceEntry;
-    const subject = this.subjectFor(tool.name, input, tool.subjectKey);
+    const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
     const cacheKey = `${tool.name}::${subject ?? tool.name}`;
     if (tool.name !== "write") {
       const cached = this._evalCache.get(cacheKey);
@@ -1349,32 +1384,6 @@ var DefaultPermissionPolicy = class {
     this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();
   }
-  subjectFor(toolName, input, subjectKey) {
-    if (!input || typeof input !== "object") return void 0;
-    const obj = input;
-    const globChars = /[*?[\]]/g;
-    const escapeGlob = (s) => s.replace(globChars, (c) => `\\${c}`);
-    const normalizePath = (s) => escapeGlob(s.replace(/\\/g, "/"));
-    if (subjectKey) {
-      const v = obj[subjectKey];
-      if (typeof v === "string") {
-        return subjectKey === "path" || subjectKey === "file" || subjectKey === "files" ? normalizePath(v) : escapeGlob(v);
-      }
-    }
-    if (toolName === "bash" && typeof obj.command === "string") {
-      return escapeGlob(obj.command);
-    }
-    if (typeof obj.path === "string") {
-      return normalizePath(obj.path);
-    }
-    if (typeof obj.url === "string") {
-      return escapeGlob(obj.url);
-    }
-    if (typeof obj.name === "string") {
-      return escapeGlob(obj.name);
-    }
-    return void 0;
-  }
   findNamespaceEntry(toolName) {
     for (const { pattern, value } of this.wildcardEntries) {
       if (matchGlob(pattern, toolName)) return value;
@@ -1397,12 +1406,13 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
     const caps = tool.capabilities ?? [];
     const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
     const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
+    const mcpProxyAllowed = this.allowedCapabilities.includes(ToolCapabilities.MCP_PROXY);
     const dangerousNotAllowed = getDangerousCapabilities(tool).filter(
       (c) => !this.allowedCapabilities.includes(c)
     );
-    const blocked = tool.permission === "deny" || isMcp || !hasAllowedCap || dangerousNotAllowed.length > 0;
+    const blocked = tool.permission === "deny" || isMcp && !mcpProxyAllowed || !hasAllowedCap || dangerousNotAllowed.length > 0;
     if (blocked) {
-      const reason = isMcp ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow it explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
+      const reason = isMcp && !mcpProxyAllowed ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow mcp.proxy explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
       return {
         permission: "deny",
         source: "subagent_guard",