@zackbart/connecta 0.28.1 → 0.30.0

package/dist/timeout.js

@@ -1,12 +1,14 @@
 // The deadline vocabulary shared by downstream discovery probes and tool calls.
 // One definition keeps those waits bounded consistently.
+import { ConnectorCallError } from "./errors.js";
+import { CONFIG_DEFAULTS } from "./config-defaults.js";
 import { Effect } from "effect";
 import { runEdge, withDeadlineEffect } from "./runtime/run.js";
 /**
  * Generous default bound for a single downstream probe/catalog call. High enough
  * to trip only on a pathological hang, not a realistically slow probe.
  */
-export const DEFAULT_PROBE_TIMEOUT_MS = 30_000;
+export const DEFAULT_PROBE_TIMEOUT_MS = CONFIG_DEFAULTS.discovery.probeTimeoutMs;
 /** A finite, positive integer number of milliseconds, or undefined. */
 export function normalizeTimeoutMs(value) {
     if (value === undefined || !Number.isFinite(value) || !(value > 0)) {
@@ -65,6 +67,6 @@ export async function underAnySignal(signals, operation) {
 export function withAbortableTimeout(operation, ms, label) {
     return withDeadline(operation, {
         timeoutMs: ms,
-        timeoutError: new Error(`${label} timed out after ${ms}ms`),
+        timeoutError: new ConnectorCallError("timeout", `${label} timed out after ${ms}ms`),
     });
 }

package/dist/tool-name.js

@@ -0,0 +1,17 @@
+/** C0, DEL, and C1 cannot occur in a callable downstream tool name. */
+export function hasControlCharacters(name) {
+    for (let index = 0; index < name.length; index++) {
+        const code = name.charCodeAt(index);
+        if (code <= 0x1f || (code >= 0x7f && code <= 0x9f))
+            return true;
+    }
+    return false;
+}
+/** Refuse static configuration before errors or warnings can render its names. */
+export function assertStaticToolNames(tools, path) {
+    for (const [index, tool] of tools.entries()) {
+        if (hasControlCharacters(tool.name)) {
+            throw new Error(`${path}[${index}].name contains a control character.`);
+        }
+    }
+}

package/dist/tool-safety.d.ts

@@ -1,35 +1,9 @@
-import type { Connector, ToolDef } from "./types.js";
-/**
- * The one fail-closed classification shared by discovery and invocation.
- *
- * A tool is read-only only when it says so without also saying it is
- * destructive. Missing, false, and contradictory annotations all require the
- * approval-visible call path.
- */
-export declare function isExplicitlyReadOnly(definition: ToolDef): boolean;
-/**
- * A deployment's approval exemptions, resolved once at construction from
- * `execute.approval` (#566). Config is the only source: nothing an agent, the
- * operator UI, or a downstream catalog says can add an entry.
- */
-export interface ApprovalPolicy {
-    /** Connector id → the default for that connector's tools. */
-    readonly connectors: ReadonlyMap<string, "never" | "ask">;
-    /** Canonical `connector.tool` address → that tool's own setting. */
-    readonly tools: ReadonlyMap<string, "never" | "ask">;
-}
-export declare const NO_EXEMPTIONS: ApprovalPolicy;
-/**
- * Whether a program may call this tool without asking for approval.
- *
- * Only a tool that is *not* explicitly read-only can be exempt — a read-only
- * tool needs no exemption, and reporting one would blur the two classes an
- * exemption must never merge. The most specific setting wins: the tool's
- * address, then its connector's entry, then the connector's own default,
- * then `"ask"`. Annotations play no part beyond that first test: a downstream
- * that could annotate its way out of approval would be granting itself the
- * capability this exists to keep in config. Exempt never means read-only:
- * discovery keeps it in the approval-required class, and `call_tool` still
- * refuses it.
- */
-export declare function isApprovalExempt(policy: ApprovalPolicy, connector: Pick<Connector, "id" | "approval">, toolName: string, definition: ToolDef): boolean;
+import type { ToolDef, ToolVerdict } from "./types.js";
+export type PoolTrust = "trusted" | "read-only";
+/** Deployment override, then verified provider review, then fail-closed hints. */
+export declare function classifyTool(definition: ToolDef, override?: "read" | "write", review?: {
+    verdict: ToolVerdict;
+    stale?: boolean;
+}): "read" | "write";
+/** The only permission decision for a connector call. Approval is host-owned. */
+export declare function surfaceAllowsTool(classification: ToolDef["classification"], surface: string, trust?: PoolTrust): boolean;

package/dist/tool-safety.js

@@ -1,42 +1,22 @@
-/**
- * The one fail-closed classification shared by discovery and invocation.
- *
- * A tool is read-only only when it says so without also saying it is
- * destructive. Missing, false, and contradictory annotations all require the
- * approval-visible call path.
- */
-export function isExplicitlyReadOnly(definition) {
-    return (definition.annotations?.readOnlyHint === true &&
-        definition.annotations?.destructiveHint !== true);
+/** Deployment override, then verified provider review, then fail-closed hints. */
+export function classifyTool(definition, override, review) {
+    if (override !== undefined)
+        return override;
+    if (review) {
+        if (review.stale || review.verdict !== "read")
+            return "write";
+        // An explicit downstream contradiction invalidates a reviewed read (#721).
+        if (definition.annotations?.readOnlyHint === false || definition.annotations?.destructiveHint === true)
+            return "write";
+        return "read";
+    }
+    return definition.annotations?.readOnlyHint === true && definition.annotations?.destructiveHint !== true
+        ? "read"
+        : "write";
 }
-export const NO_EXEMPTIONS = {
-    connectors: new Map(),
-    tools: new Map(),
-};
-/**
- * Whether a program may call this tool without asking for approval.
- *
- * Only a tool that is *not* explicitly read-only can be exempt — a read-only
- * tool needs no exemption, and reporting one would blur the two classes an
- * exemption must never merge. The most specific setting wins: the tool's
- * address, then its connector's entry, then the connector's own default,
- * then `"ask"`. Annotations play no part beyond that first test: a downstream
- * that could annotate its way out of approval would be granting itself the
- * capability this exists to keep in config. Exempt never means read-only:
- * discovery keeps it in the approval-required class, and `call_tool` still
- * refuses it.
- */
-export function isApprovalExempt(policy, connector, toolName, definition) {
-    if (isExplicitlyReadOnly(definition))
-        return false;
-    // This tool starts another program. Letting a program call it while holding
-    // the only executor permit would deadlock; manual refresh is a top-level
-    // action, even though other artifact writes are exempt inside programs.
-    if (connector.id === "artifacts" && toolName === "run_refresh")
-        return false;
-    const setting = policy.tools.get(`${connector.id}.${toolName}`) ??
-        policy.connectors.get(connector.id) ??
-        connector.approval ??
-        "ask";
-    return setting === "never";
+/** The only permission decision for a connector call. Approval is host-owned. */
+export function surfaceAllowsTool(classification, surface, trust = "read-only") {
+    return (classification === "read" ||
+        surface === "call_destructive_tool" ||
+        (surface === "execute_code" && trust === "trusted"));
 }