@wrongstack/core 0.310.1 → 0.313.1

package/dist/chunk-A455ATZB.js

@@ -0,0 +1,140 @@
+// src/security/capabilities.ts
+var ToolCapabilities = {
+  /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
+  SHELL_ARBITRARY: "shell.arbitrary",
+  /**
+   * Can execute the `exec` tool's allowlisted commands.
+   *
+   * "Restricted" describes the command NAME check, not the resulting power.
+   * Treat this as equivalent to {@link SHELL_ARBITRARY} when deciding what to
+   * grant: the allowlist includes general-purpose interpreters (`node`,
+   * `python`, `perl`, `ruby`) and, on Windows, the platform shells (`cmd`,
+   * `powershell`, `pwsh`) — deliberately, since without them `exec` cannot run
+   * `dir`/`type`/any cmdlet. `node -e …` or `cmd /c …` therefore reaches
+   * arbitrary execution, and per-argument denylisting cannot close that while
+   * the shells remain (blocking `node -e` still leaves `cmd /c node -e`).
+   *
+   * What actually bounds this is downstream, not the name check: the permission
+   * policy reconstructs the full command line and runs it through the
+   * destructive classifier, so destructive calls still require confirmation.
+   *
+   * Granting `shell.restricted` while withholding `shell.arbitrary` therefore
+   * buys no meaningful reduction in blast radius. Documented rather than
+   * silently implied, because the two read as a narrow/wide pair (WS-083).
+   */
+  SHELL_RESTRICTED: "shell.restricted",
+  /** Can run a restricted project formatter/linter-style command. */
+  SHELL_EXEC: "shell.exec",
+  /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
+  FS_READ: "fs.read",
+  /** Can write / modify / delete files inside the project. */
+  FS_WRITE: "fs.write",
+  /** Can write files outside the current project root (very high risk). */
+  FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project",
+  /** Can perform outbound network requests. */
+  NET_OUTBOUND: "net.outbound",
+  /** Can mutate in-memory session todos only. */
+  SESSION_TODO: "session.todo",
+  /** Can park after-task `<nextsteps>` suggestions for the current turn. */
+  SESSION_NEXTSTEPS: "session.nextsteps",
+  /** Can mutate in-memory session mode only. */
+  SESSION_MODE: "session.mode",
+  /** Can inspect registered tool metadata. */
+  TOOL_META: "tool.meta",
+  /** Can invoke arbitrary registered tools through a meta-tool. */
+  TOOL_MUTATE_ANY: "tool.mutate.any",
+  /** Can read persistent memory. */
+  MEMORY_READ: "memory.read",
+  /** Can write persistent memory. */
+  MEMORY_WRITE: "memory.write",
+  /** Can delete persistent memory. */
+  MEMORY_DELETE: "memory.delete",
+  /** Proxies tools from external MCP servers (unknown capability). */
+  MCP_PROXY: "mcp.proxy",
+  /** Can spawn or manage subagents / multi-agent tasks. */
+  SUBAGENT_SPAWN: "subagent.spawn",
+  /** Can inspect fleet/subagent coordination state without mutating it. */
+  COORDINATION_FLEET_READ: "coordination.fleet.read",
+  /** Can publish attributed, schema-checked events onto the fleet bus. */
+  COORDINATION_FLEET_EMIT: "coordination.fleet.emit",
+  /** Can submit a task-local structured result to the parent Director. */
+  COORDINATION_RESULT_SUBMIT: "coordination.result.submit",
+  /** Can read or write inter-agent mailbox messages. */
+  COORDINATION_MAIL: "coordination.mail",
+  /** Can schedule, inspect, or cancel in-session cron jobs. */
+  COORDINATION_CRON: "coordination.cron",
+  /** Can mutate global or session configuration / trust state. */
+  CONFIG_MUTATE: "config.mutate",
+  /** Can install packages or run package managers with side effects. */
+  PACKAGE_INSTALL: "package.install"
+};
+var DANGEROUS_FOR_SUBAGENTS = [
+  ToolCapabilities.SHELL_ARBITRARY,
+  ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
+  ToolCapabilities.FS_WRITE,
+  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
+  ToolCapabilities.TOOL_MUTATE_ANY,
+  ToolCapabilities.MEMORY_WRITE,
+  ToolCapabilities.MEMORY_DELETE,
+  ToolCapabilities.MCP_PROXY,
+  ToolCapabilities.SUBAGENT_SPAWN,
+  ToolCapabilities.CONFIG_MUTATE,
+  ToolCapabilities.PACKAGE_INSTALL
+];
+var WIDE_SUBAGENT_CAPABILITIES = [
+  ToolCapabilities.FS_READ,
+  ToolCapabilities.FS_WRITE,
+  ToolCapabilities.NET_OUTBOUND,
+  ToolCapabilities.SESSION_TODO,
+  ToolCapabilities.TOOL_META,
+  ToolCapabilities.MEMORY_READ,
+  ToolCapabilities.SHELL_ARBITRARY,
+  ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.SHELL_EXEC,
+  ToolCapabilities.PACKAGE_INSTALL,
+  // Read-only fleet visibility (fleet_status) — peer awareness has no blast
+  // radius and every fleet worker should coordinate around its peers.
+  ToolCapabilities.COORDINATION_FLEET_READ,
+  ToolCapabilities.COORDINATION_RESULT_SUBMIT
+];
+function clampSubagentCapabilities(requested, ceiling = WIDE_SUBAGENT_CAPABILITIES) {
+  const ceilingSet = new Set(ceiling);
+  const requestedSet = new Set(requested);
+  return {
+    granted: ceiling.filter((capability) => requestedSet.has(capability)),
+    dropped: [...requestedSet].filter((capability) => !ceilingSet.has(capability))
+  };
+}
+function hasDangerousCapabilityForSubagents(toolOrCaps) {
+  if (!toolOrCaps) return false;
+  const input = toolOrCaps;
+  const caps = Array.isArray(toolOrCaps) ? toolOrCaps : input.capabilities ?? [];
+  return caps.some((c) => DANGEROUS_FOR_SUBAGENTS.includes(c));
+}
+function hasCapability(toolOrCaps, capability) {
+  if (!toolOrCaps) return false;
+  const input = toolOrCaps;
+  const caps = Array.isArray(toolOrCaps) ? toolOrCaps : input.capabilities ?? [];
+  const toCheck = Array.isArray(capability) ? capability : [capability];
+  return toCheck.some((c) => caps.includes(c));
+}
+function getDangerousCapabilities(toolOrCaps) {
+  if (!toolOrCaps) return [];
+  const input = toolOrCaps;
+  const caps = Array.isArray(toolOrCaps) ? toolOrCaps : input.capabilities ?? [];
+  return caps.filter(
+    (c) => DANGEROUS_FOR_SUBAGENTS.includes(c)
+  );
+}
+
+export {
+  ToolCapabilities,
+  DANGEROUS_FOR_SUBAGENTS,
+  WIDE_SUBAGENT_CAPABILITIES,
+  clampSubagentCapabilities,
+  hasDangerousCapabilityForSubagents,
+  hasCapability,
+  getDangerousCapabilities
+};
+//# sourceMappingURL=chunk-A455ATZB.js.map

package/dist/chunk-AD7ZFZCS.js

@@ -0,0 +1,46 @@
+import {
+  ERROR_CODES,
+  FsError
+} from "./chunk-WOEZV3Q4.js";
+
+// src/utils/session-scoped-path.ts
+import * as path from "node:path";
+function sessionScopedPath(dir, sessionId, suffix) {
+  if (!sessionId || sessionId.includes("\\") || sessionId.includes("..")) {
+    throw invalid(sessionId);
+  }
+  const resolved = path.resolve(dir, `${sessionId}${suffix}`);
+  const rel = path.relative(path.resolve(dir), resolved);
+  if (rel.startsWith("..") || path.isAbsolute(rel)) {
+    throw invalid(sessionId);
+  }
+  return resolved;
+}
+var SESSION_SIDECAR_JSONL_SUFFIXES = [
+  ".replay.jsonl",
+  ".audit.jsonl",
+  ".annotations.jsonl"
+];
+var RESERVED_SESSION_JSONL_NAMES = /* @__PURE__ */ new Set([
+  "_index.jsonl",
+  "_mailbox.jsonl"
+]);
+function isSessionTranscriptFileName(name) {
+  if (!name.endsWith(".jsonl")) return false;
+  if (RESERVED_SESSION_JSONL_NAMES.has(name)) return false;
+  return !SESSION_SIDECAR_JSONL_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
+function invalid(sessionId) {
+  return new FsError({
+    message: `Invalid sessionId: ${sessionId}`,
+    code: ERROR_CODES.FS_DELETE_FAILED,
+    path: sessionId,
+    context: { reason: "path_traversal" }
+  });
+}
+
+export {
+  sessionScopedPath,
+  isSessionTranscriptFileName
+};
+//# sourceMappingURL=chunk-AD7ZFZCS.js.map