@yadsh/dsh-qa-surface 0.7.2 → 0.7.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/access/service.js +3 -0
- package/lib/access/service.js.map +1 -1
- package/lib/client/components/QaChangelog.js +12 -0
- package/lib/client/components/QaChangelog.js.map +1 -1
- package/lib/client.js +10 -2
- package/lib/client.js.map +1 -1
- package/lib/enforcement/tool-grants.js +21 -17
- package/lib/enforcement/tool-grants.js.map +1 -1
- package/lib/enforcement/tool-mask.js +52 -0
- package/lib/enforcement/tool-mask.js.map +1 -0
- package/lib/secure-session.js +28 -13
- package/lib/secure-session.js.map +1 -1
- package/lib/types/enforcement/tool-grants.d.ts +11 -7
- package/lib/types/enforcement/tool-mask.d.ts +38 -0
- package/lib/types/secure-session.d.ts +12 -0
- package/package.json +3 -3
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { installInheritableMask } from "./tool-mask.js";
|
|
1
2
|
function describe(tools) {
|
|
2
3
|
return tools.map((tool) => `"${tool}"`).join(", ");
|
|
3
4
|
}
|
|
@@ -14,7 +15,8 @@ function describe(tools) {
|
|
|
14
15
|
* attaches its tools to the agent itself, and such a registration is visible to
|
|
15
16
|
* the model without ever being nameable in a restriction: handing one to
|
|
16
17
|
* `restrict()` makes the registry refuse the whole call. Every restriction this
|
|
17
|
-
* class installs is therefore
|
|
18
|
+
* class installs is therefore installed through the mask helper, which admits
|
|
19
|
+
* the inherited names and leaves the self-registered ones out, and a grant is
|
|
18
20
|
* verified against the same view — a name no layer holds is dropped from the
|
|
19
21
|
* grant instead of breaking the session.
|
|
20
22
|
*/
|
|
@@ -33,19 +35,17 @@ export class QaAgentToolGrants {
|
|
|
33
35
|
return this.tools;
|
|
34
36
|
}
|
|
35
37
|
/**
|
|
36
|
-
* Whether the
|
|
38
|
+
* Whether the tool is callable for the agent at all, masks aside.
|
|
37
39
|
*
|
|
38
|
-
*
|
|
39
|
-
*
|
|
40
|
-
*
|
|
40
|
+
* The global view ignores restrictions and the agent's own view covers what
|
|
41
|
+
* the agent registered for itself, so a tool some layer holds stays grantable
|
|
42
|
+
* even while the current mask hides it.
|
|
41
43
|
*/
|
|
42
|
-
restrictable(tool) {
|
|
43
|
-
return this.options.agent.ctx.tools.get(tool) !== undefined;
|
|
44
|
-
}
|
|
45
|
-
/** Whether any layer makes this tool callable for the agent at all. */
|
|
46
44
|
mounted(tool) {
|
|
45
|
+
if (this.options.agentLocalTools.has(tool))
|
|
46
|
+
return true;
|
|
47
47
|
const tools = this.options.agent.ctx.tools;
|
|
48
|
-
return (
|
|
48
|
+
return (tools.get(tool) !== undefined ||
|
|
49
49
|
tools.get(tool, this.options.agent) !== undefined);
|
|
50
50
|
}
|
|
51
51
|
/** Grants currently held, newest last; one entry per activated skill. */
|
|
@@ -148,14 +148,18 @@ export class QaAgentToolGrants {
|
|
|
148
148
|
* unrestricted, and a rejected name would then leave it that way.
|
|
149
149
|
*/
|
|
150
150
|
applyRestriction(allow) {
|
|
151
|
-
// Only
|
|
152
|
-
// agent-local tool (the QA activation diagnostic is one) would
|
|
153
|
-
// make `restrict()` refuse the call and fail the whole
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
151
|
+
// Only names the scope INHERITS may reach the registry: a base set that
|
|
152
|
+
// carries an agent-local tool (the QA activation diagnostic is one) would
|
|
153
|
+
// otherwise make `restrict()` refuse the call and fail the whole
|
|
154
|
+
// attestation, and a name no layer holds would do the same.
|
|
155
|
+
const mask = installInheritableMask(this.options.agent.ctx.tools, allow, this.options.agentLocalTools);
|
|
156
|
+
if (mask.refused.length > 0) {
|
|
157
|
+
this.options.logger.warn("skill.tool-mask-incomplete", {
|
|
158
|
+
dropped: mask.refused,
|
|
159
|
+
});
|
|
160
|
+
}
|
|
157
161
|
const previous = this.disposeRestriction;
|
|
158
|
-
this.disposeRestriction =
|
|
162
|
+
this.disposeRestriction = mask.dispose;
|
|
159
163
|
previous?.();
|
|
160
164
|
}
|
|
161
165
|
restore(before) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tool-grants.js","sourceRoot":"","sources":["../../src/enforcement/tool-grants.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"tool-grants.js","sourceRoot":"","sources":["../../src/enforcement/tool-grants.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AA4CxD,SAAS,QAAQ,CAAC,KAAwB;IACxC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,iBAAiB;IAKC,OAAO;IAJnB,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzC,KAAK,CAAc;IAC5B,kBAAkB,CAA2B;IAErD,YAA6B,OAAiC;uBAAjC,OAAO;QAClC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,uDAAuD;IACvD,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACK,OAAO,CAAC,IAAY;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QAC3C,OAAO,CACL,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YAC7B,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,CAClD,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,YAAY;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CACN,SAAiB,EACjB,MAA+B;QAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3C,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC3C,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,yEAAyE;YACzE,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;gBACpE,iDAAiD;YACnD,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpE,IAAI,UAAU,EAAE,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,UAAU,SAAS,+CAA+C,QAAQ,CACvF,MAAM,CACP,uCAAuC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,KAAK,GAAiB,MAAM,CAAC,MAAM,CAAC;YACxC,SAAS;YACT,MAAM;YACN,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACxC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACrC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;YAChD,KAAK,EAAE,SAAS;YAChB,MAAM;YACN,OAAO,EAAE,QAAQ;YACjB,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,CAAC;YACjB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,yCAAyC;gBACzC,EAAE;gBACF,6BAA6B;gBAC7B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;aACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,KAAK;YACL,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,IAAI,CACF,SAAiB,EACjB,MAA+B,EAC/B,MAAc;QAEd,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CACT,SAAS,EACT,MAAM,EACN,QAAQ,EACR,UAAU,EAAE,aAAa,IAAI,EAAE,EAC/B,EAAE,EACF,UAAU,EAAE,aAAa,IAAI,EAAE,EAC/B,MAAM,CACP,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChE,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,KAAwB;QAC/C,wEAAwE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,IAAI,GAAG,sBAAsB,CACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAC5B,KAAK,EACL,IAAI,CAAC,OAAO,CAAC,eAAe,CAC7B,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBACrD,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACzC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,EAAE,CAAC;IACf,CAAC;IAEO,OAAO,CAAC,MAAyB;QACvC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAEO,MAAM,CACZ,SAAiB,EACjB,MAA+B,EAC/B,OAA2C,EAC3C,SAA4B,EAC5B,OAA0B,EAC1B,MAAyB,EACzB,MAAe;QAEf,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CACnB,MAAM,CAAC,MAAM,CAAC;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS;YACT,MAAM;YACN,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YAC7C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;YACzC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YACvC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;CACF"}
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
/** Quoted names in the registry's refusal of unnameable restriction entries. */
|
|
2
|
+
const QUOTED_NAME = /"([^"]+)"/gu;
|
|
3
|
+
function messageOf(error) {
|
|
4
|
+
if (error instanceof Error)
|
|
5
|
+
return error.message;
|
|
6
|
+
return String(error);
|
|
7
|
+
}
|
|
8
|
+
/**
|
|
9
|
+
* Install a scoped restriction over the names a QA session may see.
|
|
10
|
+
*
|
|
11
|
+
* `restrict()` filters what a scope INHERITS — the global layer and the
|
|
12
|
+
* ancestor layers, a preset's own tool rows among them. It refuses, with one
|
|
13
|
+
* error, three different things: a name no layer holds, a name the scope
|
|
14
|
+
* registers for itself, and an empty list. The QA tool catalog attaches its
|
|
15
|
+
* tools to the agent itself, so `qa_tools_selfcheck` is exactly the second
|
|
16
|
+
* case, and a single such entry used to make the registry refuse the whole
|
|
17
|
+
* call and fail every chat's attestation.
|
|
18
|
+
*
|
|
19
|
+
* This function therefore filters the self-registered names out first, and
|
|
20
|
+
* then gives up whatever the registry still refuses, one round at a time: an
|
|
21
|
+
* entry the mask cannot name costs that entry, never the session. The caller's
|
|
22
|
+
* execution guard is unaffected — it keeps enforcing the full policy — so an
|
|
23
|
+
* entry that never reaches the mask stays callable and denied, not allowed.
|
|
24
|
+
* @param tools - the agent's scoped registry.
|
|
25
|
+
* @param allow - names the mask should admit, in policy order.
|
|
26
|
+
* @param agentLocal - names the QA catalog registers on the agent itself.
|
|
27
|
+
* @returns the installed mask, plus the names that did not make it in.
|
|
28
|
+
*/
|
|
29
|
+
export function installInheritableMask(tools, allow, agentLocal) {
|
|
30
|
+
const refused = [];
|
|
31
|
+
let names = [...new Set(allow)].filter((name) => !agentLocal.has(name));
|
|
32
|
+
while (names.length > 0) {
|
|
33
|
+
try {
|
|
34
|
+
return { dispose: tools.restrict({ allow: names }), refused };
|
|
35
|
+
}
|
|
36
|
+
catch (error) {
|
|
37
|
+
const rejected = new Set([...messageOf(error).matchAll(QUOTED_NAME)].map((match) => match[1]));
|
|
38
|
+
const next = names.filter((name) => !rejected.has(name));
|
|
39
|
+
if (next.length === names.length) {
|
|
40
|
+
// The refusal named nothing this mask carries — an empty list and an
|
|
41
|
+
// unrecognized failure both land here. Stop instead of looping.
|
|
42
|
+
refused.push(...names);
|
|
43
|
+
return { dispose: () => undefined, refused };
|
|
44
|
+
}
|
|
45
|
+
refused.push(...names.filter((name) => rejected.has(name)));
|
|
46
|
+
names = next;
|
|
47
|
+
}
|
|
48
|
+
}
|
|
49
|
+
// Every name was self-registered: the model surface needs no mask.
|
|
50
|
+
return { dispose: () => undefined, refused };
|
|
51
|
+
}
|
|
52
|
+
//# sourceMappingURL=tool-mask.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tool-mask.js","sourceRoot":"","sources":["../../src/enforcement/tool-mask.ts"],"names":[],"mappings":"AAkBA,gFAAgF;AAChF,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAuB,EACvB,KAAwB,EACxB,UAA+B;IAE/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACrE,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjC,qEAAqE;gBACrE,gEAAgE;gBAChE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5D,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}
|
package/lib/secure-session.js
CHANGED
|
@@ -6,6 +6,7 @@ import { QaAccountsError } from "./accounts/store.js";
|
|
|
6
6
|
import { QaAttestationError } from "./attestation.js";
|
|
7
7
|
import { qaToolDenial, qaToolPolicyPlan } from "./lockdown-policy.js";
|
|
8
8
|
import { installQaSkillPolicy } from "./enforcement/skill-policy.js";
|
|
9
|
+
import { installInheritableMask } from "./enforcement/tool-mask.js";
|
|
9
10
|
import { QA_REPORT_SOURCES_TOOL } from "./provenance/host-store.js";
|
|
10
11
|
import { qaUserWorkspaceDenial } from "./user-workspace.js";
|
|
11
12
|
/** Grace period in which a fresh session may still be pinned to the QA preset. */
|
|
@@ -295,15 +296,6 @@ export class QaPolicyAdmission {
|
|
|
295
296
|
const prior = this.appliedPolicies.get(agent);
|
|
296
297
|
if (prior?.fingerprint !== fingerprint) {
|
|
297
298
|
const allowed = new Set(policy.allow);
|
|
298
|
-
// `restrict()` accepts only names the agent INHERITS, and the QA tool
|
|
299
|
-
// catalog attaches its tools to the agent itself. The activation
|
|
300
|
-
// diagnostic therefore passes the `unknown-tools` check above — the
|
|
301
|
-
// catalog declares it — and would still make `restrict()` refuse the
|
|
302
|
-
// whole call and fail every chat's attestation. It keeps its place in the
|
|
303
|
-
// policy and in the guard below; only the mask skips it, which is also
|
|
304
|
-
// what makes a name the registry does not hold globally a loud refusal
|
|
305
|
-
// above rather than a silent omission here.
|
|
306
|
-
const restrictable = policy.allow.filter((name) => this.ctx.tools.get(name) !== undefined);
|
|
307
299
|
// A capability policy owns the scoped restriction, because activating a
|
|
308
300
|
// skill has to widen it later. The account-free path keeps the static
|
|
309
301
|
// mask it has always used.
|
|
@@ -314,7 +306,7 @@ export class QaPolicyAdmission {
|
|
|
314
306
|
try {
|
|
315
307
|
disposeTools =
|
|
316
308
|
grants === undefined
|
|
317
|
-
?
|
|
309
|
+
? this.maskAgentTools(agent, policy.allow, sessionId)
|
|
318
310
|
: () => grants.dispose();
|
|
319
311
|
disposeGuard = agent.ctx.tools.guard((execution) => {
|
|
320
312
|
const subject = execution.agent;
|
|
@@ -394,11 +386,34 @@ export class QaPolicyAdmission {
|
|
|
394
386
|
approvalIsNever,
|
|
395
387
|
permissionPreset: lockdown.permissionPreset,
|
|
396
388
|
toolPolicyLoaded: true,
|
|
397
|
-
// The
|
|
398
|
-
//
|
|
399
|
-
|
|
389
|
+
// The deployment's pinned list, not this session's effective one: the
|
|
390
|
+
// browser answers this proof against the lockdown config it holds, and a
|
|
391
|
+
// subrole narrows that list — or the plugin adds its own internals to it —
|
|
392
|
+
// without changing the config either side treats as the contract.
|
|
393
|
+
toolAllowList: lockdown.toolPolicy.allow,
|
|
400
394
|
};
|
|
401
395
|
}
|
|
396
|
+
/**
|
|
397
|
+
* Mask one agent down to the policy's tool names, for the account-free path
|
|
398
|
+
* (a capability policy installs its own mask through its grants).
|
|
399
|
+
*
|
|
400
|
+
* The mask admits what the scope inherits — the global layer and the ancestor
|
|
401
|
+
* layers, which is where a preset's own tool rows live — and skips the names
|
|
402
|
+
* the QA catalog registers on the agent, since a restriction cannot name
|
|
403
|
+
* those. A name that is neither, or that the registry refuses for any other
|
|
404
|
+
* reason, is left out of the mask and reported instead of failing the chat:
|
|
405
|
+
* the guard below still denies it, so the effective set is unchanged.
|
|
406
|
+
*/
|
|
407
|
+
maskAgentTools(agent, allow, sessionId) {
|
|
408
|
+
const mask = installInheritableMask(agent.ctx.tools, allow, new Set(this.knownDynamicToolNames()));
|
|
409
|
+
if (mask.refused.length > 0) {
|
|
410
|
+
this.logger.warn("lockdown.tool-mask-incomplete", {
|
|
411
|
+
sessionId,
|
|
412
|
+
dropped: mask.refused,
|
|
413
|
+
});
|
|
414
|
+
}
|
|
415
|
+
return mask.dispose;
|
|
416
|
+
}
|
|
402
417
|
/** Resolve the deployment facts shared by creation and full attestation. */
|
|
403
418
|
deploymentPins(config) {
|
|
404
419
|
if (!config.lockdown.enabled)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secure-session.js","sourceRoot":"","sources":["../src/secure-session.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,sEAAsE;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAiC5D,kFAAkF;AAClF,MAAM,iCAAiC,GAAG,OAAO,CAAC;AAElD;;;;GAIG;AACH,SAAS,UAAU,CAAC,SAA6B,EAAE,MAAc;IAC/D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAClC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAcT,GAAG;IACH,MAAM;IACN,MAAM;IACN,QAAQ;IAMR,gBAAgB;IAIhB,gBAAgB;IAMhB,qBAAqB;IAhCvB,eAAe,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnE,gFAAgF;IAC/D,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1D;;;;OAIG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzD,qBAAqB,CAAa;IAEnD,YACmB,GAAY,EACZ,MAAqC,EACrC,MAAoB,EACpB,QAAyB;IAC1C;;;;OAIG;IACc,gBAAgB,GAER,GAAG,EAAE,CAAC,EAAE;IACjC,8EAA8E;IAC7D,gBAIgC;IACjD,0EAA0E;IACzD,qBAAqB,GAA4B,GAAG,EAAE,CAAC,EAAE;mBAnBzD,GAAG;sBACH,MAAM;sBACN,MAAM;wBACN,QAAQ;gCAMR,gBAAgB;gCAIhB,gBAAgB;qCAMhB,qBAAqB;QAEtC,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;YACzD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;YACzC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,OAAO,sEAAsE,CAAC;YAChF,CAAC;YACD,OAAO,qBAAqB,CAC1B,SAAS,EACT,MAAM,CAAC,IAAI,EACX,IAAI,CAAC,cAAc,EAAE,EACrB,MAAM,CACP,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YACrC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,4BAA4B,CAAC,KAAwB;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,GAAG,EAAE;YACV,KAAK,MAAM,IAAI,IAAI,UAAU;gBAAE,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QACjB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,cAAc;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CACC,CAAC;QAC1C,OAAO,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,SAAS,CAAC,SAAiB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,YAAY,CAC5D,SAAS,CAAC,SAAS,CAAC,CACrB,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,oEAAoE;YACpE,wEAAwE;YACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,YAAiD,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;oBACrC,MAAM,IAAI,kBAAkB,CAC1B,KAAK,CAAC,MAAM,KAAK,yBAAyB;wBACxC,CAAC,CAAC,yBAAyB;wBAC3B,CAAC,CAAC,eAAe,EACnB,KAAK,CAAC,OAAO,CACd,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO;gBACL,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;gBACtB,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,KAAK;gBACzB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,KAAK;gBACvB,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC7C,IAAI,gBAAoC,CAAC;QACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACrC,IAAI,YAAY,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,4CAA4C,CAC7C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAC7C,YAAY,CAAC,EAAE,EACf,eAAe,CAAC,IAAI,CACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QAClD,MAAM,kBAAkB,GACtB,CAAC,QAAQ,CAAC,uBAAuB;YACjC,cAAc,KAAK,IAAI;YACvB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC;QAErE,MAAM,gBAAgB,GACpB,CAAC,QAAQ,CAAC,qBAAqB;YAC/B,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YAC3D,CAAC,gBAAgB,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB;gBAChC,eAAe,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7D,CAAC,iBAAiB,KAAK,IAAI;gBACzB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI;gBAC3B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAErB,CAAC;QACF,MAAM,YAAY,GAChB,CAAC,QAAQ,CAAC,iBAAiB;YAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI;YAChC,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ;gBAC3C,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK;gBACtC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI;oBACtC,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,EACtB,+BAA+B,kBAAkB,cAAc,gBAAgB,UAAU,YAAY,EAAE,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAW,CAAC;QAEpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5E,oEAAoE;QACpE,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CACrD,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,cAAc,CAC7D,CAAC;QACF,IACE,iBAAiB,KAAK,QAAQ,CAAC,gBAAgB;YAC/C,CAAC,cAAc;gBACb,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS;oBACzC,iCAAiC,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,iEAAiE;QACjE,0EAA0E;QAC1E,uBAAuB;QACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAE1E,MAAM,eAAe,GACnB,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QACxD,MAAM,qBAAqB,GACzB,MAAM,CAAC,OAAO,CAAC,OAAO;YACtB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB;YACjD,CAAC,eAAe,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC/C,CAAC,CAAC,CAAC,GAAG,eAAe,EAAE,sBAAsB,CAAC;YAC9C,CAAC,CAAC,eAAe,CAAC;QACtB,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,WAAW,GAAG;YAClB,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,qBAAqB;gBACxB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;SACH,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,WAAW,EACX,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,SAAS;YACjD,IAAI,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAClD,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,uBAAuB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,MAAM,CAAC,KAAK;YACZ,UAAU,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC/B,UAAU,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;SACxC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,sEAAsE;YACtE,iEAAiE;YACjE,oEAAoE;YACpE,qEAAqE;YACrE,0EAA0E;YAC1E,uEAAuE;YACvE,uEAAuE;YACvE,4CAA4C;YAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,CACjD,CAAC;YACF,wEAAwE;YACxE,sEAAsE;YACtE,2BAA2B;YAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,YAAY,EAAE,CAAC;YAC1C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,IAAI,kBAAkB,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YACrD,IAAI,CAAC;gBACH,YAAY;oBACV,MAAM,KAAK,SAAS;wBAClB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;wBACnD,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7B,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;oBACjD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;oBAChC,OAAO,YAAY,CACjB,MAAM,EAAE,cAAc,EAAE,IAAI,OAAO,EACnC,SAAS,CAAC,IAAI,EACd,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;wBAC/C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;wBAChC,CAAC,CAAC,EAAE,CACP,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,uEAAuE;gBACvE,gEAAgE;gBAChE,KAAK,EAAE,kBAAkB,EAAE,CAAC;gBAC5B,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACrD,kBAAkB,GAAG,oBAAoB,CAAC;wBACxC,KAAK;wBACL,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,UAAU,EAAE,UAAU,CAAC,MAAM;wBAC7B,MAAM;wBACN,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,OAAO,EAAE,UAAU,CAAC,YAAY;qBACjC,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE;oBAC9B,WAAW;oBACX,YAAY;oBACZ,YAAY;oBACZ,kBAAkB;iBACnB,CAAC,CAAC;gBACH,KAAK,EAAE,YAAY,EAAE,CAAC;gBACtB,KAAK,EAAE,YAAY,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,kBAAkB,EAAE,CAAC;gBACrB,YAAY,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC5D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW,CAAC;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC;QACxD,IACE,mBAAmB,KAAK,QAAQ,CAAC,gBAAgB;YACjD,CAAC,kBAAkB;YACnB,CAAC,eAAe,EAChB,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE;oBAClC,IAAI,EAAE,gBAAgB;oBACtB,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;iBAClD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,gDAAgD;gBAChD,aAAa,CAAC,IAAI,GAAG,gBAAgB,CAAC;gBACtC,aAAa,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACrC,SAAS;YACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,aAAa,EAAE,MAAM,CAAC,KAAK;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,SAAS;YACT,OAAO,EAAE,IAAI;YACb,kBAAkB;YAClB,gBAAgB;YAChB,YAAY;YACZ,kBAAkB;YAClB,eAAe;YACf,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,gBAAgB,EAAE,IAAI;YACtB,wEAAwE;YACxE,4CAA4C;YAC5C,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK;SACrE,CAAC;IACJ,CAAC;IAED,4EAA4E;IACpE,cAAc,CAAC,MAA+B;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAExC,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GACnB,iBAAiB,KAAK,IAAI;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACrE,IAAI,iBAAiB,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,aAAa,iBAAiB,oBAAoB,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,UAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC7C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClI,CAAC;QACJ,CAAC;QACD,IACE,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW;YAClD,UAAU,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,cAAc,EACtD,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,wBAAwB,MAAM,CAAC,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAC7I,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE,UAAU,EAAE;YAChB,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,gFAAgF;IAChF,OAAO;QACL,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;CACF"}
|
|
1
|
+
{"version":3,"file":"secure-session.js","sourceRoot":"","sources":["../src/secure-session.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,sEAAsE;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAiC5D,kFAAkF;AAClF,MAAM,iCAAiC,GAAG,OAAO,CAAC;AAElD;;;;GAIG;AACH,SAAS,UAAU,CAAC,SAA6B,EAAE,MAAc;IAC/D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAClC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAcT,GAAG;IACH,MAAM;IACN,MAAM;IACN,QAAQ;IAMR,gBAAgB;IAIhB,gBAAgB;IAMhB,qBAAqB;IAhCvB,eAAe,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnE,gFAAgF;IAC/D,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1D;;;;OAIG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzD,qBAAqB,CAAa;IAEnD,YACmB,GAAY,EACZ,MAAqC,EACrC,MAAoB,EACpB,QAAyB;IAC1C;;;;OAIG;IACc,gBAAgB,GAER,GAAG,EAAE,CAAC,EAAE;IACjC,8EAA8E;IAC7D,gBAIgC;IACjD,0EAA0E;IACzD,qBAAqB,GAA4B,GAAG,EAAE,CAAC,EAAE;mBAnBzD,GAAG;sBACH,MAAM;sBACN,MAAM;wBACN,QAAQ;gCAMR,gBAAgB;gCAIhB,gBAAgB;qCAMhB,qBAAqB;QAEtC,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;YACzD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;YACzC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,OAAO,sEAAsE,CAAC;YAChF,CAAC;YACD,OAAO,qBAAqB,CAC1B,SAAS,EACT,MAAM,CAAC,IAAI,EACX,IAAI,CAAC,cAAc,EAAE,EACrB,MAAM,CACP,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YACrC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,4BAA4B,CAAC,KAAwB;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,GAAG,EAAE;YACV,KAAK,MAAM,IAAI,IAAI,UAAU;gBAAE,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QACjB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,cAAc;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CACC,CAAC;QAC1C,OAAO,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,SAAS,CAAC,SAAiB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,YAAY,CAC5D,SAAS,CAAC,SAAS,CAAC,CACrB,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,oEAAoE;YACpE,wEAAwE;YACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,YAAiD,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;oBACrC,MAAM,IAAI,kBAAkB,CAC1B,KAAK,CAAC,MAAM,KAAK,yBAAyB;wBACxC,CAAC,CAAC,yBAAyB;wBAC3B,CAAC,CAAC,eAAe,EACnB,KAAK,CAAC,OAAO,CACd,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO;gBACL,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;gBACtB,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,KAAK;gBACzB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,KAAK;gBACvB,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC7C,IAAI,gBAAoC,CAAC;QACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACrC,IAAI,YAAY,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,4CAA4C,CAC7C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAC7C,YAAY,CAAC,EAAE,EACf,eAAe,CAAC,IAAI,CACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QAClD,MAAM,kBAAkB,GACtB,CAAC,QAAQ,CAAC,uBAAuB;YACjC,cAAc,KAAK,IAAI;YACvB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC;QAErE,MAAM,gBAAgB,GACpB,CAAC,QAAQ,CAAC,qBAAqB;YAC/B,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YAC3D,CAAC,gBAAgB,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB;gBAChC,eAAe,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7D,CAAC,iBAAiB,KAAK,IAAI;gBACzB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI;gBAC3B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAErB,CAAC;QACF,MAAM,YAAY,GAChB,CAAC,QAAQ,CAAC,iBAAiB;YAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI;YAChC,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ;gBAC3C,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK;gBACtC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI;oBACtC,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,EACtB,+BAA+B,kBAAkB,cAAc,gBAAgB,UAAU,YAAY,EAAE,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAW,CAAC;QAEpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5E,oEAAoE;QACpE,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CACrD,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,cAAc,CAC7D,CAAC;QACF,IACE,iBAAiB,KAAK,QAAQ,CAAC,gBAAgB;YAC/C,CAAC,cAAc;gBACb,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS;oBACzC,iCAAiC,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,iEAAiE;QACjE,0EAA0E;QAC1E,uBAAuB;QACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAE1E,MAAM,eAAe,GACnB,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QACxD,MAAM,qBAAqB,GACzB,MAAM,CAAC,OAAO,CAAC,OAAO;YACtB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB;YACjD,CAAC,eAAe,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC/C,CAAC,CAAC,CAAC,GAAG,eAAe,EAAE,sBAAsB,CAAC;YAC9C,CAAC,CAAC,eAAe,CAAC;QACtB,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,WAAW,GAAG;YAClB,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,qBAAqB;gBACxB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;SACH,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,WAAW,EACX,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,SAAS;YACjD,IAAI,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAClD,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,uBAAuB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,MAAM,CAAC,KAAK;YACZ,UAAU,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC/B,UAAU,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;SACxC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,wEAAwE;YACxE,sEAAsE;YACtE,2BAA2B;YAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,YAAY,EAAE,CAAC;YAC1C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,IAAI,kBAAkB,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YACrD,IAAI,CAAC;gBACH,YAAY;oBACV,MAAM,KAAK,SAAS;wBAClB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC;wBACrD,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7B,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;oBACjD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;oBAChC,OAAO,YAAY,CACjB,MAAM,EAAE,cAAc,EAAE,IAAI,OAAO,EACnC,SAAS,CAAC,IAAI,EACd,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;wBAC/C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;wBAChC,CAAC,CAAC,EAAE,CACP,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,uEAAuE;gBACvE,gEAAgE;gBAChE,KAAK,EAAE,kBAAkB,EAAE,CAAC;gBAC5B,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACrD,kBAAkB,GAAG,oBAAoB,CAAC;wBACxC,KAAK;wBACL,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,UAAU,EAAE,UAAU,CAAC,MAAM;wBAC7B,MAAM;wBACN,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,OAAO,EAAE,UAAU,CAAC,YAAY;qBACjC,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE;oBAC9B,WAAW;oBACX,YAAY;oBACZ,YAAY;oBACZ,kBAAkB;iBACnB,CAAC,CAAC;gBACH,KAAK,EAAE,YAAY,EAAE,CAAC;gBACtB,KAAK,EAAE,YAAY,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,kBAAkB,EAAE,CAAC;gBACrB,YAAY,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC5D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW,CAAC;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC;QACxD,IACE,mBAAmB,KAAK,QAAQ,CAAC,gBAAgB;YACjD,CAAC,kBAAkB;YACnB,CAAC,eAAe,EAChB,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE;oBAClC,IAAI,EAAE,gBAAgB;oBACtB,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;iBAClD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,gDAAgD;gBAChD,aAAa,CAAC,IAAI,GAAG,gBAAgB,CAAC;gBACtC,aAAa,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACrC,SAAS;YACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,aAAa,EAAE,MAAM,CAAC,KAAK;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,SAAS;YACT,OAAO,EAAE,IAAI;YACb,kBAAkB;YAClB,gBAAgB;YAChB,YAAY;YACZ,kBAAkB;YAClB,eAAe;YACf,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,gBAAgB,EAAE,IAAI;YACtB,sEAAsE;YACtE,yEAAyE;YACzE,2EAA2E;YAC3E,kEAAkE;YAClE,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK;SACzC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,cAAc,CACpB,KAAY,EACZ,KAAwB,EACxB,SAAiB;QAEjB,MAAM,IAAI,GAAG,sBAAsB,CACjC,KAAK,CAAC,GAAG,CAAC,KAAK,EACf,KAAK,EACL,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CACtC,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAChD,SAAS;gBACT,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,4EAA4E;IACpE,cAAc,CAAC,MAA+B;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAExC,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GACnB,iBAAiB,KAAK,IAAI;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACrE,IAAI,iBAAiB,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,aAAa,iBAAiB,oBAAoB,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,UAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC7C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClI,CAAC;QACJ,CAAC;QACD,IACE,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW;YAClD,UAAU,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,cAAc,EACtD,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,wBAAwB,MAAM,CAAC,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAC7I,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE,UAAU,EAAE;YAChB,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,gFAAgF;IAChF,OAAO;QACL,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;CACF"}
|
|
@@ -25,6 +25,11 @@ export interface QaAgentToolGrantsOptions {
|
|
|
25
25
|
readonly baseTools: readonly string[];
|
|
26
26
|
/** Ceiling for grants, already narrowed to tools that exist right now. */
|
|
27
27
|
readonly grantableTools: readonly string[];
|
|
28
|
+
/**
|
|
29
|
+
* Names the QA tool catalog registers on the agent itself. A restriction
|
|
30
|
+
* cannot name one, so the mask leaves them out; the guard covers them.
|
|
31
|
+
*/
|
|
32
|
+
readonly agentLocalTools: ReadonlySet<string>;
|
|
28
33
|
/** Normalized `metadata.qa-surface` of every discovered skill. */
|
|
29
34
|
readonly descriptors: ReadonlyMap<string, QaSkillDescriptor>;
|
|
30
35
|
readonly logger: PluginLogger;
|
|
@@ -44,7 +49,8 @@ export interface QaAgentToolGrantsOptions {
|
|
|
44
49
|
* attaches its tools to the agent itself, and such a registration is visible to
|
|
45
50
|
* the model without ever being nameable in a restriction: handing one to
|
|
46
51
|
* `restrict()` makes the registry refuse the whole call. Every restriction this
|
|
47
|
-
* class installs is therefore
|
|
52
|
+
* class installs is therefore installed through the mask helper, which admits
|
|
53
|
+
* the inherited names and leaves the self-registered ones out, and a grant is
|
|
48
54
|
* verified against the same view — a name no layer holds is dropped from the
|
|
49
55
|
* grant instead of breaking the session.
|
|
50
56
|
*/
|
|
@@ -57,14 +63,12 @@ export declare class QaAgentToolGrants {
|
|
|
57
63
|
/** Whether the model would see this tool right now. */
|
|
58
64
|
effectiveTools(): ReadonlySet<string>;
|
|
59
65
|
/**
|
|
60
|
-
* Whether the
|
|
66
|
+
* Whether the tool is callable for the agent at all, masks aside.
|
|
61
67
|
*
|
|
62
|
-
*
|
|
63
|
-
*
|
|
64
|
-
*
|
|
68
|
+
* The global view ignores restrictions and the agent's own view covers what
|
|
69
|
+
* the agent registered for itself, so a tool some layer holds stays grantable
|
|
70
|
+
* even while the current mask hides it.
|
|
65
71
|
*/
|
|
66
|
-
private restrictable;
|
|
67
|
-
/** Whether any layer makes this tool callable for the agent at all. */
|
|
68
72
|
private mounted;
|
|
69
73
|
/** Grants currently held, newest last; one entry per activated skill. */
|
|
70
74
|
activeGrants(): readonly QaSkillGrant[];
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
import type { Context } from "@deepseek-ai/cordis";
|
|
2
|
+
/** The registry surface one mask needs: a single scoped restriction call. */
|
|
3
|
+
export type QaToolMaskTarget = Pick<Context["tools"], "restrict">;
|
|
4
|
+
/** One installed mask: how to lift it, and what it could not name. */
|
|
5
|
+
export interface QaToolMask {
|
|
6
|
+
/** Lift the mask. A no-op when the registry took no mask at all. */
|
|
7
|
+
readonly dispose: () => void;
|
|
8
|
+
/**
|
|
9
|
+
* Names left out of the mask, in the order they were given up: a name the
|
|
10
|
+
* agent registers for itself never enters a mask, and a name no layer holds
|
|
11
|
+
* is dropped by the registry. Reported so an operator learns that the
|
|
12
|
+
* deployment's allow-list names something this session cannot restrict.
|
|
13
|
+
*/
|
|
14
|
+
readonly refused: readonly string[];
|
|
15
|
+
}
|
|
16
|
+
/**
|
|
17
|
+
* Install a scoped restriction over the names a QA session may see.
|
|
18
|
+
*
|
|
19
|
+
* `restrict()` filters what a scope INHERITS — the global layer and the
|
|
20
|
+
* ancestor layers, a preset's own tool rows among them. It refuses, with one
|
|
21
|
+
* error, three different things: a name no layer holds, a name the scope
|
|
22
|
+
* registers for itself, and an empty list. The QA tool catalog attaches its
|
|
23
|
+
* tools to the agent itself, so `qa_tools_selfcheck` is exactly the second
|
|
24
|
+
* case, and a single such entry used to make the registry refuse the whole
|
|
25
|
+
* call and fail every chat's attestation.
|
|
26
|
+
*
|
|
27
|
+
* This function therefore filters the self-registered names out first, and
|
|
28
|
+
* then gives up whatever the registry still refuses, one round at a time: an
|
|
29
|
+
* entry the mask cannot name costs that entry, never the session. The caller's
|
|
30
|
+
* execution guard is unaffected — it keeps enforcing the full policy — so an
|
|
31
|
+
* entry that never reaches the mask stays callable and denied, not allowed.
|
|
32
|
+
* @param tools - the agent's scoped registry.
|
|
33
|
+
* @param allow - names the mask should admit, in policy order.
|
|
34
|
+
* @param agentLocal - names the QA catalog registers on the agent itself.
|
|
35
|
+
* @returns the installed mask, plus the names that did not make it in.
|
|
36
|
+
*/
|
|
37
|
+
export declare function installInheritableMask(tools: QaToolMaskTarget, allow: readonly string[], agentLocal: ReadonlySet<string>): QaToolMask;
|
|
38
|
+
//# sourceMappingURL=tool-mask.d.ts.map
|
|
@@ -101,6 +101,18 @@ export declare class QaPolicyAdmission {
|
|
|
101
101
|
*/
|
|
102
102
|
private liveAgent;
|
|
103
103
|
secureSession(token: string, sessionId: string): Promise<QaLockdownProof>;
|
|
104
|
+
/**
|
|
105
|
+
* Mask one agent down to the policy's tool names, for the account-free path
|
|
106
|
+
* (a capability policy installs its own mask through its grants).
|
|
107
|
+
*
|
|
108
|
+
* The mask admits what the scope inherits — the global layer and the ancestor
|
|
109
|
+
* layers, which is where a preset's own tool rows live — and skips the names
|
|
110
|
+
* the QA catalog registers on the agent, since a restriction cannot name
|
|
111
|
+
* those. A name that is neither, or that the registry refuses for any other
|
|
112
|
+
* reason, is left out of the mask and reported instead of failing the chat:
|
|
113
|
+
* the guard below still denies it, so the effective set is unchanged.
|
|
114
|
+
*/
|
|
115
|
+
private maskAgentTools;
|
|
104
116
|
/** Resolve the deployment facts shared by creation and full attestation. */
|
|
105
117
|
private deploymentPins;
|
|
106
118
|
/**
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@yadsh/dsh-qa-surface",
|
|
3
|
-
"version": "0.7.
|
|
3
|
+
"version": "0.7.3",
|
|
4
4
|
"description": "A focused end-user QA surface backed by native DeepSeek Harness sessions",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -174,9 +174,9 @@
|
|
|
174
174
|
"tsdown": "^0.22.14",
|
|
175
175
|
"typescript": "^7.0.2",
|
|
176
176
|
"vitest": "^4.1.11",
|
|
177
|
+
"@yadsh/dsh-config": "^0.0.0",
|
|
177
178
|
"@yadsh/dsh-plugin-kit": "^0.1.0",
|
|
178
|
-
"@yadsh/dsh-plugin-scripts": "^0.0.0"
|
|
179
|
-
"@yadsh/dsh-config": "^0.0.0"
|
|
179
|
+
"@yadsh/dsh-plugin-scripts": "^0.0.0"
|
|
180
180
|
},
|
|
181
181
|
"publishConfig": {
|
|
182
182
|
"access": "public",
|