@zackbart/connecta 0.28.1 → 0.29.0

package/dist/tool-safety.d.ts

@@ -1,35 +1,9 @@
-import type { Connector, ToolDef } from "./types.js";
-/**
- * The one fail-closed classification shared by discovery and invocation.
- *
- * A tool is read-only only when it says so without also saying it is
- * destructive. Missing, false, and contradictory annotations all require the
- * approval-visible call path.
- */
-export declare function isExplicitlyReadOnly(definition: ToolDef): boolean;
-/**
- * A deployment's approval exemptions, resolved once at construction from
- * `execute.approval` (#566). Config is the only source: nothing an agent, the
- * operator UI, or a downstream catalog says can add an entry.
- */
-export interface ApprovalPolicy {
-    /** Connector id → the default for that connector's tools. */
-    readonly connectors: ReadonlyMap<string, "never" | "ask">;
-    /** Canonical `connector.tool` address → that tool's own setting. */
-    readonly tools: ReadonlyMap<string, "never" | "ask">;
-}
-export declare const NO_EXEMPTIONS: ApprovalPolicy;
-/**
- * Whether a program may call this tool without asking for approval.
- *
- * Only a tool that is *not* explicitly read-only can be exempt — a read-only
- * tool needs no exemption, and reporting one would blur the two classes an
- * exemption must never merge. The most specific setting wins: the tool's
- * address, then its connector's entry, then the connector's own default,
- * then `"ask"`. Annotations play no part beyond that first test: a downstream
- * that could annotate its way out of approval would be granting itself the
- * capability this exists to keep in config. Exempt never means read-only:
- * discovery keeps it in the approval-required class, and `call_tool` still
- * refuses it.
- */
-export declare function isApprovalExempt(policy: ApprovalPolicy, connector: Pick<Connector, "id" | "approval">, toolName: string, definition: ToolDef): boolean;
+import type { ToolDef, ToolVerdict } from "./types.js";
+export type PoolTrust = "trusted" | "read-only";
+/** Deployment override, then verified provider review, then fail-closed hints. */
+export declare function classifyTool(definition: ToolDef, override?: "read" | "write", review?: {
+    verdict: ToolVerdict;
+    stale?: boolean;
+}): "read" | "write";
+/** The only permission decision for a connector call. Approval is host-owned. */
+export declare function surfaceAllowsTool(classification: ToolDef["classification"], surface: string, trust?: PoolTrust): boolean;

package/dist/tool-safety.js

@@ -1,42 +1,22 @@
-/**
- * The one fail-closed classification shared by discovery and invocation.
- *
- * A tool is read-only only when it says so without also saying it is
- * destructive. Missing, false, and contradictory annotations all require the
- * approval-visible call path.
- */
-export function isExplicitlyReadOnly(definition) {
-    return (definition.annotations?.readOnlyHint === true &&
-        definition.annotations?.destructiveHint !== true);
+/** Deployment override, then verified provider review, then fail-closed hints. */
+export function classifyTool(definition, override, review) {
+    if (override !== undefined)
+        return override;
+    if (review) {
+        if (review.stale || review.verdict !== "read")
+            return "write";
+        // An explicit downstream contradiction invalidates a reviewed read (#721).
+        if (definition.annotations?.readOnlyHint === false || definition.annotations?.destructiveHint === true)
+            return "write";
+        return "read";
+    }
+    return definition.annotations?.readOnlyHint === true && definition.annotations?.destructiveHint !== true
+        ? "read"
+        : "write";
 }
-export const NO_EXEMPTIONS = {
-    connectors: new Map(),
-    tools: new Map(),
-};
-/**
- * Whether a program may call this tool without asking for approval.
- *
- * Only a tool that is *not* explicitly read-only can be exempt — a read-only
- * tool needs no exemption, and reporting one would blur the two classes an
- * exemption must never merge. The most specific setting wins: the tool's
- * address, then its connector's entry, then the connector's own default,
- * then `"ask"`. Annotations play no part beyond that first test: a downstream
- * that could annotate its way out of approval would be granting itself the
- * capability this exists to keep in config. Exempt never means read-only:
- * discovery keeps it in the approval-required class, and `call_tool` still
- * refuses it.
- */
-export function isApprovalExempt(policy, connector, toolName, definition) {
-    if (isExplicitlyReadOnly(definition))
-        return false;
-    // This tool starts another program. Letting a program call it while holding
-    // the only executor permit would deadlock; manual refresh is a top-level
-    // action, even though other artifact writes are exempt inside programs.
-    if (connector.id === "artifacts" && toolName === "run_refresh")
-        return false;
-    const setting = policy.tools.get(`${connector.id}.${toolName}`) ??
-        policy.connectors.get(connector.id) ??
-        connector.approval ??
-        "ask";
-    return setting === "never";
+/** The only permission decision for a connector call. Approval is host-owned. */
+export function surfaceAllowsTool(classification, surface, trust = "read-only") {
+    return (classification === "read" ||
+        surface === "call_destructive_tool" ||
+        (surface === "execute_code" && trust === "trusted"));
 }