@zhin.js/agent 0.2.0 → 0.2.1

package/lib/security/file-role-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-role-policy.js","sourceRoot":"","sources":["../../src/security/file-role-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAgCH,iEAAiE;AAEjE,MAAM,sBAAsB,GAAqD;IAC/E,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IAC/D,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;IAChE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;CAClE,CAAC;AAEF,4DAA4D;AAE5D;;;GAGG;AACH,MAAM,uBAAuB,GAAa;IACxC,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,UAAU;IACV,YAAY;IACZ,UAAU;IACV,WAAW;IACX,qBAAqB;IACrB,aAAa;IACb,UAAU;IACV,mBAAmB;IACnB,qBAAqB;IACrB,gBAAgB;IAChB,oBAAoB;IACpB,SAAS;IACT,SAAS;CACV,CAAC;AAEF;;GAEG;AACH,MAAM,yBAAyB,GAAa;IAC1C,UAAU;IACV,YAAY;IACZ,aAAa;IACb,eAAe;IACf,YAAY;IACZ,eAAe;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,wBAAwB,GAAa;IACzC,UAAU;IACV,WAAW;IACX,aAAa;IACb,YAAY;CACb,CAAC;AAEF,+DAA+D;AAE/D;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAc,EACd,SAAwB,EACxB,QAAiB;IAEjB,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;IAExD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM;YAC5B,CAAC,CAAC,6BAA6B,SAAS,OAAO;YAC/C,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,KAAK,QAAQ;gBAC1C,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,QAAQ,IAAI,SAAS,SAAS,MAAM,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM;YACN,IAAI;YACJ,SAAS;SACV,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEjH,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,iBAAiB,EAAE,IAAI;gBACvB,MAAM,EAAE,QAAQ;oBACd,CAAC,CAAC,SAAS,QAAQ,OAAO,SAAS,YAAY;oBAC/C,CAAC,CAAC,IAAI,SAAS,YAAY;gBAC7B,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,sBAAsB,EAAE,IAAI;gBAC5B,MAAM,EAAE,QAAQ;oBACd,CAAC,CAAC,YAAY,QAAQ,OAAO,SAAS,iBAAiB;oBACvD,CAAC,CAAC,SAAS,SAAS,iBAAiB;gBACvC,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAwB,EAAE,QAAgB;IACjF,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAExC,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QACrD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAID;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAA0C;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAChG,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAgD;IAC1F,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC;QAC9B,KAAK,SAAS,CAAC,CAAC,OAAO,OAAO,CAAC;QAC/B,KAAK,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC;QAC5B,KAAK,SAAS,CAAC,CAAC,OAAO,OAAO,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE9C,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1E,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpO,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEzE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE5G,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACrM,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAElD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAc,EACd,OAAe;IAEf,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAElD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI;YACJ,SAAS,EAAE,MAAM;YACjB,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAA4B,EAAE,QAAgB,EAAE,MAAe;IACzG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,MAAM,CAAC,SAAS,cAAc,CAAC;QAC/E,OAAO,sBAAsB,IAAI,8CAA8C,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,MAAM,CAAC,SAAS,SAAS,CAAC;QAC1E,OAAO,sBAAsB,IAAI,sCAAsC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qCAAqC;IACnD,OAAO;QACL,+FAA+F;QAC/F,kFAAkF;QAClF,0GAA0G;QAC1G,qEAAqE;QACrE,6EAA6E;QAC7E,sDAAsD;QACtD,+LAA+L;KAChM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAc;IAChD,MAAM,UAAU,GAA6B;QAC3C,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,YAAY;KACnB,CAAC;IAEF,MAAM,WAAW,GAA6B;QAC5C,KAAK,EAAE,4CAA4C;QACnD,KAAK,EAAE,4CAA4C;QACnD,IAAI,EAAE,yBAAyB;KAChC,CAAC;IAEF,OAAO;QACL,WAAW,UAAU,CAAC,IAAI,CAAC,EAAE;QAC7B,WAAW,CAAC,IAAI,CAAC;QACjB,IAAI,KAAK,OAAO;YACd,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,IAAI,KAAK,OAAO;gBAChB,CAAC,CAAC,kDAAkD;gBACpD,CAAC,CAAC,6BAA6B;KACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"file-role-policy.js","sourceRoot":"","sources":["../../src/security/file-role-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAgCH,iEAAiE;AAEjE,MAAM,sBAAsB,GAAqD;IAC/E,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IAC/D,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;IAChE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;CAClE,CAAC;AAEF,4DAA4D;AAE5D;;;GAGG;AACH,MAAM,uBAAuB,GAAa;IACxC,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,UAAU;IACV,YAAY;IACZ,UAAU;IACV,WAAW;IACX,qBAAqB;IACrB,aAAa;IACb,UAAU;IACV,mBAAmB;IACnB,qBAAqB;IACrB,gBAAgB;IAChB,oBAAoB;IACpB,SAAS;IACT,SAAS;CACV,CAAC;AAEF;;GAEG;AACH,MAAM,yBAAyB,GAAa;IAC1C,UAAU;IACV,YAAY;IACZ,aAAa;IACb,eAAe;IACf,YAAY;IACZ,eAAe;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,wBAAwB,GAAa;IACzC,UAAU;IACV,WAAW;IACX,aAAa;IACb,YAAY;CACb,CAAC;AAEF,+DAA+D;AAE/D;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAc,EACd,SAAwB,EACxB,QAAiB;IAEjB,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;IAExD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM;YAC5B,CAAC,CAAC,6BAA6B,SAAS,OAAO;YAC/C,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,KAAK,QAAQ;gBAC1C,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,QAAQ,IAAI,SAAS,SAAS,MAAM,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM;YACN,IAAI;YACJ,SAAS;SACV,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEjH,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,iBAAiB,EAAE,IAAI;gBACvB,MAAM,EAAE,QAAQ;oBACd,CAAC,CAAC,SAAS,QAAQ,OAAO,SAAS,YAAY;oBAC/C,CAAC,CAAC,IAAI,SAAS,YAAY;gBAC7B,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,sBAAsB,EAAE,IAAI;gBAC5B,MAAM,EAAE,QAAQ;oBACd,CAAC,CAAC,YAAY,QAAQ,OAAO,SAAS,iBAAiB;oBACvD,CAAC,CAAC,SAAS,SAAS,iBAAiB;gBACvC,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAwB,EAAE,QAAgB;IACjF,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAExC,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QACrD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAID;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAA0C;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAgD;IAC1F,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC;QAC9B,KAAK,SAAS,CAAC,CAAC,OAAO,OAAO,CAAC;QAC/B,KAAK,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC;QAC5B,KAAK,SAAS,CAAC,CAAC,OAAO,OAAO,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE9C,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1E,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpO,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEzE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE5G,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACrM,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAElD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAc,EACd,OAAe;IAEf,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAElD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI;YACJ,SAAS,EAAE,MAAM;YACjB,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAA4B,EAAE,QAAgB,EAAE,MAAe;IACzG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,MAAM,CAAC,SAAS,cAAc,CAAC;QAC/E,OAAO,sBAAsB,IAAI,8CAA8C,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,MAAM,CAAC,SAAS,SAAS,CAAC;QAC1E,OAAO,sBAAsB,IAAI,sCAAsC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qCAAqC;IACnD,OAAO;QACL,+FAA+F;QAC/F,kFAAkF;QAClF,0GAA0G;QAC1G,6EAA6E;QAC7E,mIAAmI;QACnI,+LAA+L;KAChM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAc;IAChD,MAAM,UAAU,GAA6B;QAC3C,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,YAAY;KACnB,CAAC;IAEF,MAAM,WAAW,GAA6B;QAC5C,KAAK,EAAE,4CAA4C;QACnD,KAAK,EAAE,4CAA4C;QACnD,IAAI,EAAE,yBAAyB;KAChC,CAAC;IAEF,OAAO;QACL,WAAW,UAAU,CAAC,IAAI,CAAC,EAAE;QAC7B,WAAW,CAAC,IAAI,CAAC;QACjB,IAAI,KAAK,OAAO;YACd,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,IAAI,KAAK,OAAO;gBAChB,CAAC,CAAC,kDAAkD;gBACpD,CAAC,CAAC,6BAA6B;KACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/lib/security/index.d.ts

@@ -16,7 +16,7 @@ export * from './exec-policy.js';
 export * from './network-policy.js';
 export * from './budget-limiter.js';
 export * from './audit-logger.js';
-export * from './bash-tool-context.js';
+export * from './comm-message-context.js';
 export * from './owner-approve-always-store.js';
 export * from './sandbox.js';
 export * from './sandbox-enhanced.js';

package/lib/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iCAAiC,CAAC;AAChD,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC;AAI3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAqD,MAAM,mBAAmB,CAAC;AACnG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAA2D,MAAM,qBAAqB,CAAC;AAC7G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAA2D,MAAM,qBAAqB,CAAC;AAE7G,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,GAAE,oBAAyB,GAAG;IACvE,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;CAC9B,CAMA;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI;IACzC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD,CA4BA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC;AAI3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAqD,MAAM,mBAAmB,CAAC;AACnG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAA2D,MAAM,qBAAqB,CAAC;AAC7G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAA2D,MAAM,qBAAqB,CAAC;AAE7G,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,GAAE,oBAAyB,GAAG;IACvE,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;CAC9B,CAMA;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI;IACzC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD,CA4BA"}

package/lib/security/index.js

@@ -17,7 +17,7 @@ export * from './exec-policy.js';
 export * from './network-policy.js';
 export * from './budget-limiter.js';
 export * from './audit-logger.js';
-export * from './bash-tool-context.js';
+export * from './comm-message-context.js';
 export * from './owner-approve-always-store.js';
 export * from './sandbox.js';
 export * from './sandbox-enhanced.js';

package/lib/security/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,mEAAmE;AAEnE,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iCAAiC,CAAC;AAChD,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC;AAK3C,OAAO,EAAe,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEnG,OAAO,EAAiB,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7G,OAAO,EAAiB,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAQ7G;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA+B,EAAE;IAKpE,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAE7D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC;QAAC,gBAAgB,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC;QAAC,kBAAkB,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC;QAAC,kBAAkB,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB;IAKrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,OAAO;YACL,KAAK,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO;gBAClC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,WAAW;aACzC;YACD,OAAO,EAAE;gBACP,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO;gBACpC,UAAU,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC;oBAClD,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC;aAC7D;YACD,MAAM,EAAE;gBACN,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO;gBACnC,cAAc,EAAE,CAAC;aAClB;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE;YACxC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE;YAC1C,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;SAC9C,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,mEAAmE;AAEnE,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC;AAK3C,OAAO,EAAe,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEnG,OAAO,EAAiB,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7G,OAAO,EAAiB,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAQ7G;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA+B,EAAE;IAKpE,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAE7D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC;QAAC,gBAAgB,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC;QAAC,kBAAkB,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC;QAAC,kBAAkB,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB;IAKrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,OAAO;YACL,KAAK,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO;gBAClC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,WAAW;aACzC;YACD,OAAO,EAAE;gBACP,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO;gBACpC,UAAU,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC;oBAClD,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC;aAC7D;YACD,MAAM,EAAE;gBACN,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO;gBACnC,cAAc,EAAE,CAAC;aAClB;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE;YACxC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE;YAC1C,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;SAC9C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/lib/security/owner-approve-always-store.d.ts

@@ -1,4 +1,4 @@
-import type { Message, Plugin, ToolContext } from '@zhin.js/core';
+import type { Message, Plugin } from '@zhin.js/core';
 export declare const OWNER_APPROVE_ALWAYS_TOOL: "bash";
 export type ToolRequesterRole = 'master' | 'trusted' | 'other' | 'unknown';
 /** 需 Owner 审批的 icqq 子命令（正则匹配整段子命令文本，大小写不敏感） */
@@ -12,44 +12,46 @@ export interface BashApprovalBotEntry {
     bashAlways?: boolean;
     bashRules: BashRuleEntry[];
 }
-export declare function getBotMaster(plugin: Plugin, ctx: ToolContext): string | undefined;
-export declare function resolveToolRequesterRole(plugin: Plugin, ctx: ToolContext): ToolRequesterRole;
-export declare function getOwnerToolContextOrUndefined(plugin: Plugin, message: Message<any>): ToolContext | undefined;
+export declare function getEndpointMaster(plugin: Plugin, commMessage: Message): string | undefined;
+export declare function resolveToolRequesterRole(plugin: Plugin, commMessage: Message): ToolRequesterRole;
+export declare function getOwnerCommMessageOrUndefined(plugin: Plugin, message: Message): Message | undefined;
 /** 编排层：是否已「永久放行」bash 的 Owner 硬确认（ZHIN_NEEDS_OWNER 路径） */
-export declare function hasOwnerApproveAlways(plugin: Plugin, ctx: ToolContext, toolName: string): boolean;
-export declare function setBashAlways(plugin: Plugin, ctx: ToolContext, value: boolean): void;
-export declare function addOwnerApproveAlways(plugin: Plugin, ctx: ToolContext, toolName: string): {
+export declare function hasOwnerApproveAlways(plugin: Plugin, commMessage: Message, toolName: string): boolean;
+export declare function setBashAlways(plugin: Plugin, commMessage: Message, value: boolean): void;
+export declare function addOwnerApproveAlways(plugin: Plugin, commMessage: Message, toolName: string): {
     ok: true;
 } | {
     ok: false;
     error: string;
 };
-export declare function removeOwnerApproveAlways(plugin: Plugin, ctx: ToolContext, toolName: string): {
+export declare function removeOwnerApproveAlways(plugin: Plugin, commMessage: Message, toolName: string): {
     ok: true;
 } | {
     ok: false;
     error: string;
 };
-export declare function addBashApproveRule(plugin: Plugin, ctx: ToolContext, pattern: string): {
+export declare function addBashApproveRule(plugin: Plugin, commMessage: Message, pattern: string): {
     ok: true;
     id: string;
 } | {
     ok: false;
     error: string;
 };
-export declare function removeBashApproveRule(plugin: Plugin, ctx: ToolContext, ruleId: string): {
+export declare function removeBashApproveRule(plugin: Plugin, commMessage: Message, ruleId: string): {
     ok: true;
 } | {
     ok: false;
     error: string;
 };
 /** exec 策略：bashAlways 或任一 bashRules 匹配 commandLine */
-export declare function matchesBashOwnerExecBypass(plugin: Plugin, ctx: ToolContext, commandLine: string): boolean;
-export declare function formatBashApproveList(plugin: Plugin, ctx: ToolContext): string;
+export declare function matchesBashOwnerExecBypass(plugin: Plugin, commMessage: Message, commandLine: string): boolean;
+export declare function formatBashApproveList(plugin: Plugin, commMessage: Message): string;
 /** 兼容旧单测：返回 bash 与 rule 摘要行 */
-export declare function listOwnerApproveAlways(plugin: Plugin, ctx: ToolContext): string[];
+export declare function listOwnerApproveAlways(plugin: Plugin, commMessage: Message): string[];
 export declare function isIcqqSensitiveSubcommand(fullSubCommand: string): boolean;
-export declare function setPendingOrchestrationTool(plugin: Plugin, ctx: ToolContext, toolName: string): void;
-export declare function clearPendingOrchestrationTool(plugin: Plugin, ctx: ToolContext): void;
-export declare function getPendingOrchestrationTool(plugin: Plugin, ctx: ToolContext): string | undefined;
+export declare function getPendingOrchestrationCount(): number;
+export declare function evictPendingOrchestrationIfOverPressure(): number;
+export declare function setPendingOrchestrationTool(plugin: Plugin, commMessage: Message, toolName: string): void;
+export declare function clearPendingOrchestrationTool(plugin: Plugin, commMessage: Message): void;
+export declare function getPendingOrchestrationTool(plugin: Plugin, commMessage: Message): string | undefined;
 //# sourceMappingURL=owner-approve-always-store.d.ts.map

package/lib/security/owner-approve-always-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-approve-always-store.d.ts","sourceRoot":"","sources":["../../src/security/owner-approve-always-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAW,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG3E,eAAO,MAAM,yBAAyB,EAAG,MAAe,CAAC;AAEzD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAK3E,+CAA+C;AAC/C,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAoB9D,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,aAAa,EAAE,CAAC;CAC5B;AAkFD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAMjF;AAqBD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,iBAAiB,CAa5F;AAwBD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,GAAG,SAAS,CAe7G;AAED,yDAAyD;AACzD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKjG;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAapF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAYrI;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAgBxI;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,GACd;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAwBzD;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,GACb;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAmB7C;AAED,sDAAsD;AACtD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAgBzG;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CAa9E;AAED,+BAA+B;AAC/B,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,EAAE,CAQjF;AAED,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAIzE;AASD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CASpG;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAKpF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAehG"}
+{"version":3,"file":"owner-approve-always-store.d.ts","sourceRoot":"","sources":["../../src/security/owner-approve-always-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAW,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAI9D,eAAO,MAAM,yBAAyB,EAAG,MAAe,CAAC;AAEzD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAK3E,+CAA+C;AAC/C,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAoB9D,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,aAAa,EAAE,CAAC;CAC5B;AAkFD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAM1F;AAqBD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,iBAAiB,CAqBhG;AAwBD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAKpG;AAED,yDAAyD;AACzD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKrG;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAaxF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAYzI;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAgB5I;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,EACpB,OAAO,EAAE,MAAM,GACd;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAwBzD;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,EACpB,MAAM,EAAE,MAAM,GACb;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAmB7C;AAED,sDAAsD;AACtD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAgB7G;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAalF;AAED,+BAA+B;AAC/B,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE,CAQrF;AAED,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAIzE;AASD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,uCAAuC,IAAI,MAAM,CAUhE;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CASxG;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,IAAI,CAKxF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAepG"}

package/lib/security/owner-approve-always-store.js

@@ -9,6 +9,7 @@
 import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { hasSenderRole, resolveSubjectRoles, senderRolesFromMessage } from '@zhin.js/core';
 import { getDataDir } from '../discovery/utils.js';
 export const OWNER_APPROVE_ALWAYS_TOOL = 'bash';
 const STORE_FILE = 'owner-approve-always.json';
@@ -39,10 +40,10 @@ function storePath() {
     return path.join(getDataDir(), STORE_FILE);
 }
 function emptyV2() {
-    return { version: STORE_VERSION, bots: {} };
+    return { version: STORE_VERSION, endpoints: {} };
 }
-function normalizeBotKey(adapter, botId, ownerId) {
-    return `${adapter}|${botId}|${ownerId}`;
+function normalizeBotKey(adapter, endpointId, ownerId) {
+    return `${adapter}|${endpointId}|${ownerId}`;
 }
 function migrateV1ToV2(data) {
     const out = emptyV2();
@@ -52,12 +53,12 @@ function migrateV1ToV2(data) {
         const parts = e.split('|');
         if (parts.length !== 4)
             continue;
-        const [adapter, botId, ownerId, scope] = parts;
+        const [adapter, endpointId, ownerId, scope] = parts;
         if (scope === 'orchestration:bash') {
-            const k = normalizeBotKey(adapter, botId, ownerId);
-            if (!out.bots[k])
-                out.bots[k] = { bashRules: [] };
-            out.bots[k].bashAlways = true;
+            const k = normalizeBotKey(adapter, endpointId, ownerId);
+            if (!out.endpoints[k])
+                out.endpoints[k] = { bashRules: [] };
+            out.endpoints[k].bashAlways = true;
         }
     }
     return out;
@@ -69,10 +70,10 @@ function readStore() {
         const data = JSON.parse(raw);
         if (!data || typeof data !== 'object')
             return emptyV2();
-        if (data.version === STORE_VERSION && data.bots && typeof data.bots === 'object') {
+        if (data.version === STORE_VERSION && data.endpoints && typeof data.endpoints === 'object') {
             const v2 = data;
-            for (const k of Object.keys(v2.bots)) {
-                const ent = v2.bots[k];
+            for (const k of Object.keys(v2.endpoints)) {
+                const ent = v2.endpoints[k];
                 if (!ent.bashRules)
                     ent.bashRules = [];
             }
@@ -101,11 +102,11 @@ function writeStore(data) {
     fs.writeFileSync(tmp, body, 'utf-8');
     fs.renameSync(tmp, p);
 }
-export function getBotMaster(plugin, ctx) {
+export function getEndpointMaster(plugin, commMessage) {
     const root = plugin.root ?? plugin;
-    const adapter = root.inject(ctx.platform);
-    const bot = adapter?.bots?.get(ctx.botId);
-    const master = bot?.$config?.master;
+    const adapter = root.inject(commMessage.$adapter);
+    const endpoint = adapter?.endpoints?.get(commMessage.$endpoint);
+    const master = endpoint?.$config?.master;
     return master != null ? String(master) : undefined;
 }
 function normalizeIdList(input) {
@@ -119,92 +120,93 @@ function normalizeIdList(input) {
     }
     return [];
 }
-function getBotTrustedIds(plugin, ctx) {
+function getEndpointTrustedIds(plugin, commMessage) {
     const root = plugin.root ?? plugin;
-    const adapter = root.inject(ctx.platform);
-    const bot = adapter?.bots?.get(ctx.botId);
-    const botConfig = bot?.$config ?? {};
-    return normalizeIdList(botConfig.trusted);
+    const adapter = root.inject(commMessage.$adapter);
+    const endpoint = adapter?.endpoints?.get(commMessage.$endpoint);
+    const endpointConfig = endpoint?.$config ?? {};
+    return normalizeIdList(endpointConfig.trusted);
 }
-export function resolveToolRequesterRole(plugin, ctx) {
-    if (ctx.roles?.length) {
-        if (ctx.roles.includes('master'))
+export function resolveToolRequesterRole(plugin, commMessage) {
+    const roles = senderRolesFromMessage(commMessage);
+    if (commMessage.$sender.isMaster !== undefined || commMessage.$sender.isTrusted !== undefined) {
+        if (hasSenderRole(roles, 'master'))
             return 'master';
-        if (ctx.roles.includes('trusted'))
+        if (hasSenderRole(roles, 'trusted'))
+            return 'trusted';
+        return 'other';
+    }
+    try {
+        const resolved = resolveSubjectRoles(plugin.root ?? plugin, commMessage);
+        if (hasSenderRole(resolved.roles, 'master'))
+            return 'master';
+        if (hasSenderRole(resolved.roles, 'trusted'))
+            return 'trusted';
+        return 'other';
+    }
+    catch {
+        if (!commMessage.$adapter || !commMessage.$endpoint || !commMessage.$sender?.id)
+            return 'unknown';
+        const senderId = String(commMessage.$sender.id);
+        const masterId = getEndpointMaster(plugin, commMessage);
+        if (masterId && senderId === String(masterId))
+            return 'master';
+        const trusted = getEndpointTrustedIds(plugin, commMessage);
+        if (trusted.includes(senderId))
             return 'trusted';
         return 'other';
     }
-    if (!ctx.platform || !ctx.botId || !ctx.senderId)
-        return 'unknown';
-    const senderId = String(ctx.senderId);
-    const masterId = getBotMaster(plugin, ctx);
-    if (masterId && senderId === String(masterId))
-        return 'master';
-    const trusted = getBotTrustedIds(plugin, ctx);
-    if (trusted.includes(senderId))
-        return 'trusted';
-    return 'other';
 }
-function getEntry(plugin, ctx) {
-    if (!ctx.platform || !ctx.botId)
+function getEntry(plugin, commMessage) {
+    if (!commMessage.$adapter || !commMessage.$endpoint)
         return undefined;
-    const ownerId = getBotMaster(plugin, ctx);
+    const ownerId = getEndpointMaster(plugin, commMessage);
     if (ownerId == null)
         return undefined;
-    const key = normalizeBotKey(ctx.platform, ctx.botId, ownerId);
+    const key = normalizeBotKey(String(commMessage.$adapter), commMessage.$endpoint, ownerId);
     const data = readStore();
-    return data.bots[key];
+    return data.endpoints[key];
 }
-function ensureEntry(plugin, ctx) {
-    if (!ctx.platform || !ctx.botId)
+function ensureEntry(plugin, commMessage) {
+    if (!commMessage.$adapter || !commMessage.$endpoint)
         return { bashRules: [] };
-    const ownerId = getBotMaster(plugin, ctx);
+    const ownerId = getEndpointMaster(plugin, commMessage);
     if (ownerId == null)
         return { bashRules: [] };
-    const key = normalizeBotKey(ctx.platform, ctx.botId, ownerId);
+    const key = normalizeBotKey(String(commMessage.$adapter), commMessage.$endpoint, ownerId);
     const data = readStore();
-    if (!data.bots[key]) {
-        data.bots[key] = { bashRules: [] };
+    if (!data.endpoints[key]) {
+        data.endpoints[key] = { bashRules: [] };
         writeStore(data);
     }
-    return data.bots[key];
+    return data.endpoints[key];
 }
-export function getOwnerToolContextOrUndefined(plugin, message) {
+export function getOwnerCommMessageOrUndefined(plugin, message) {
     if (message.$channel?.type !== 'private')
         return undefined;
-    const ctx = {
-        platform: message.$adapter,
-        botId: message.$bot,
-        sceneId: message.$channel?.id ?? message.$sender.id,
-        senderId: message.$sender.id,
-        message,
-        scope: 'private',
-        roles: ['master'],
-        fileRole: 'owner',
-    };
-    const ownerId = getBotMaster(plugin, ctx);
+    const ownerId = getEndpointMaster(plugin, message);
     if (ownerId == null || String(message.$sender.id) !== String(ownerId))
         return undefined;
-    return ctx;
+    return message;
 }
 /** 编排层：是否已「永久放行」bash 的 Owner 硬确认（ZHIN_NEEDS_OWNER 路径） */
-export function hasOwnerApproveAlways(plugin, ctx, toolName) {
+export function hasOwnerApproveAlways(plugin, commMessage, toolName) {
     if (toolName !== OWNER_APPROVE_ALWAYS_TOOL)
         return false;
-    if (!ctx.platform || !ctx.botId)
+    if (!commMessage.$adapter || !commMessage.$endpoint)
         return false;
-    const ent = getEntry(plugin, ctx);
+    const ent = getEntry(plugin, commMessage);
     return !!ent?.bashAlways;
 }
-export function setBashAlways(plugin, ctx, value) {
-    if (!ctx.platform || !ctx.botId)
+export function setBashAlways(plugin, commMessage, value) {
+    if (!commMessage.$adapter || !commMessage.$endpoint)
         return;
-    const ownerId = getBotMaster(plugin, ctx);
+    const ownerId = getEndpointMaster(plugin, commMessage);
     if (ownerId == null)
         return;
-    const key = normalizeBotKey(ctx.platform, ctx.botId, ownerId);
+    const key = normalizeBotKey(String(commMessage.$adapter), commMessage.$endpoint, ownerId);
     const data = readStore();
-    const prev = data.bots[key] ?? { bashRules: [] };
+    const prev = data.endpoints[key] ?? { bashRules: [] };
     const ent = { bashRules: prev.bashRules ?? [] };
     if (prev.bashAlways !== undefined)
         ent.bashAlways = prev.bashAlways;
@@ -212,40 +214,40 @@ export function setBashAlways(plugin, ctx, value) {
         ent.bashAlways = true;
     else
         delete ent.bashAlways;
-    data.bots[key] = ent;
+    data.endpoints[key] = ent;
     writeStore(data);
 }
-export function addOwnerApproveAlways(plugin, ctx, toolName) {
-    if (!ctx.platform || !ctx.botId) {
-        return { ok: false, error: '缺少 platform / botId' };
+export function addOwnerApproveAlways(plugin, commMessage, toolName) {
+    if (!commMessage.$adapter || !commMessage.$endpoint) {
+        return { ok: false, error: '缺少 platform / endpointId' };
     }
     if (toolName.trim().toLowerCase() !== OWNER_APPROVE_ALWAYS_TOOL) {
         return { ok: false, error: '永久放行仅支持 bash（shell 安全确认）。' };
     }
-    if (getBotMaster(plugin, ctx) == null) {
-        return { ok: false, error: '当前 Bot 未配置 owner' };
+    if (getEndpointMaster(plugin, commMessage) == null) {
+        return { ok: false, error: '当前 Endpoint 未配置 owner' };
     }
-    setBashAlways(plugin, ctx, true);
+    setBashAlways(plugin, commMessage, true);
     return { ok: true };
 }
-export function removeOwnerApproveAlways(plugin, ctx, toolName) {
-    if (!ctx.platform || !ctx.botId) {
-        return { ok: false, error: '缺少 platform / botId' };
+export function removeOwnerApproveAlways(plugin, commMessage, toolName) {
+    if (!commMessage.$adapter || !commMessage.$endpoint) {
+        return { ok: false, error: '缺少 platform / endpointId' };
     }
     if (toolName.trim().toLowerCase() !== OWNER_APPROVE_ALWAYS_TOOL) {
         return { ok: false, error: '仅可撤销 bash 的永久放行。' };
     }
-    if (getBotMaster(plugin, ctx) == null) {
-        return { ok: false, error: '当前 Bot 未配置 owner' };
+    if (getEndpointMaster(plugin, commMessage) == null) {
+        return { ok: false, error: '当前 Endpoint 未配置 owner' };
     }
-    const ent = getEntry(plugin, ctx);
+    const ent = getEntry(plugin, commMessage);
     if (!ent?.bashAlways) {
         return { ok: false, error: '当前未对 bash 设置永久放行。' };
     }
-    setBashAlways(plugin, ctx, false);
+    setBashAlways(plugin, commMessage, false);
     return { ok: true };
 }
-export function addBashApproveRule(plugin, ctx, pattern) {
+export function addBashApproveRule(plugin, commMessage, pattern) {
     const trimmed = pattern.trim();
     if (!trimmed) {
         return { ok: false, error: '正则不能为空。' };
@@ -257,32 +259,32 @@ export function addBashApproveRule(plugin, ctx, pattern) {
     catch (e) {
         return { ok: false, error: `无效正则: ${e instanceof Error ? e.message : String(e)}` };
     }
-    if (!ctx.platform || !ctx.botId || getBotMaster(plugin, ctx) == null) {
-        return { ok: false, error: '缺少 platform/botId 或未配置 owner。' };
+    if (!commMessage.$adapter || !commMessage.$endpoint || getEndpointMaster(plugin, commMessage) == null) {
+        return { ok: false, error: '缺少 platform/endpointId 或未配置 owner。' };
     }
-    const ownerId = getBotMaster(plugin, ctx);
-    const key = normalizeBotKey(ctx.platform, ctx.botId, ownerId);
+    const ownerId = getEndpointMaster(plugin, commMessage);
+    const key = normalizeBotKey(String(commMessage.$adapter), commMessage.$endpoint, ownerId);
     const data = readStore();
-    const ent = { ...(data.bots[key] ?? { bashRules: [] }), bashRules: [...(data.bots[key]?.bashRules ?? [])] };
-    if (data.bots[key]?.bashAlways)
+    const ent = { ...(data.endpoints[key] ?? { bashRules: [] }), bashRules: [...(data.endpoints[key]?.bashRules ?? [])] };
+    if (data.endpoints[key]?.bashAlways)
         ent.bashAlways = true;
     const id = crypto.randomUUID();
     ent.bashRules.push({ id, pattern: trimmed, createdAt: Date.now() });
-    data.bots[key] = ent;
+    data.endpoints[key] = ent;
     writeStore(data);
     return { ok: true, id };
 }
-export function removeBashApproveRule(plugin, ctx, ruleId) {
+export function removeBashApproveRule(plugin, commMessage, ruleId) {
     const id = ruleId.trim();
     if (!id)
         return { ok: false, error: '请提供规则 id。' };
-    if (!ctx.platform || !ctx.botId || getBotMaster(plugin, ctx) == null) {
-        return { ok: false, error: '缺少 platform/botId 或未配置 owner。' };
+    if (!commMessage.$adapter || !commMessage.$endpoint || getEndpointMaster(plugin, commMessage) == null) {
+        return { ok: false, error: '缺少 platform/endpointId 或未配置 owner。' };
     }
-    const ownerId = getBotMaster(plugin, ctx);
-    const key = normalizeBotKey(ctx.platform, ctx.botId, ownerId);
+    const ownerId = getEndpointMaster(plugin, commMessage);
+    const key = normalizeBotKey(String(commMessage.$adapter), commMessage.$endpoint, ownerId);
     const data = readStore();
-    const ent = data.bots[key];
+    const ent = data.endpoints[key];
     if (!ent?.bashRules?.length)
         return { ok: false, error: '当前无自定义规则。' };
     const next = ent.bashRules.filter((r) => r.id !== id && !r.id.startsWith(id));
@@ -290,15 +292,15 @@ export function removeBashApproveRule(plugin, ctx, ruleId) {
         return { ok: false, error: `未找到 id 前缀或全名为「${id}」的规则。` };
     }
     ent.bashRules = next;
-    data.bots[key] = ent;
+    data.endpoints[key] = ent;
     writeStore(data);
     return { ok: true };
 }
 /** exec 策略：bashAlways 或任一 bashRules 匹配 commandLine */
-export function matchesBashOwnerExecBypass(plugin, ctx, commandLine) {
-    if (!ctx.platform || !ctx.botId)
+export function matchesBashOwnerExecBypass(plugin, commMessage, commandLine) {
+    if (!commMessage.$adapter || !commMessage.$endpoint)
         return false;
-    const ent = getEntry(plugin, ctx);
+    const ent = getEntry(plugin, commMessage);
     if (!ent)
         return false;
     if (ent.bashAlways)
@@ -318,8 +320,8 @@ export function matchesBashOwnerExecBypass(plugin, ctx, commandLine) {
     }
     return false;
 }
-export function formatBashApproveList(plugin, ctx) {
-    const ent = getEntry(plugin, ctx);
+export function formatBashApproveList(plugin, commMessage) {
+    const ent = getEntry(plugin, commMessage);
     const always = ent?.bashAlways ? '是' : '否';
     const rules = ent?.bashRules ?? [];
     if (!ent || (!ent.bashAlways && rules.length === 0)) {
@@ -333,8 +335,8 @@ export function formatBashApproveList(plugin, ctx) {
     return lines.join('\n');
 }
 /** 兼容旧单测：返回 bash 与 rule 摘要行 */
-export function listOwnerApproveAlways(plugin, ctx) {
-    const ent = getEntry(plugin, ctx);
+export function listOwnerApproveAlways(plugin, commMessage) {
+    const ent = getEntry(plugin, commMessage);
     const out = [];
     if (ent?.bashAlways)
         out.push(OWNER_APPROVE_ALWAYS_TOOL);
@@ -350,37 +352,51 @@ export function isIcqqSensitiveSubcommand(fullSubCommand) {
     return ICQQ_SENSITIVE_SUBCOMMAND_REGEXES.some((re) => re.test(line));
 }
 const pendingOrchestration = new Map();
-function pendingKey(adapter, botId, ownerId) {
-    return `${adapter}|${botId}|${ownerId}`;
+function pendingKey(adapter, endpointId, ownerId) {
+    return `${adapter}|${endpointId}|${ownerId}`;
+}
+export function getPendingOrchestrationCount() {
+    return pendingOrchestration.size;
+}
+export function evictPendingOrchestrationIfOverPressure() {
+    const now = Date.now();
+    let removed = 0;
+    for (const [key, value] of pendingOrchestration) {
+        if (now > value.expiresAt) {
+            pendingOrchestration.delete(key);
+            removed++;
+        }
+    }
+    return removed;
 }
-export function setPendingOrchestrationTool(plugin, ctx, toolName) {
+export function setPendingOrchestrationTool(plugin, commMessage, toolName) {
     if (toolName !== OWNER_APPROVE_ALWAYS_TOOL)
         return;
-    if (!ctx.platform || !ctx.botId)
+    if (!commMessage.$adapter || !commMessage.$endpoint)
         return;
-    const ownerId = getBotMaster(plugin, ctx);
+    const ownerId = getEndpointMaster(plugin, commMessage);
     if (ownerId == null)
         return;
-    pendingOrchestration.set(pendingKey(ctx.platform, ctx.botId, ownerId), {
+    pendingOrchestration.set(pendingKey(String(commMessage.$adapter), commMessage.$endpoint, ownerId), {
         toolName: OWNER_APPROVE_ALWAYS_TOOL,
         expiresAt: Date.now() + 15 * 60 * 1000,
     });
 }
-export function clearPendingOrchestrationTool(plugin, ctx) {
-    if (!ctx.platform || !ctx.botId)
+export function clearPendingOrchestrationTool(plugin, commMessage) {
+    if (!commMessage.$adapter || !commMessage.$endpoint)
         return;
-    const ownerId = getBotMaster(plugin, ctx);
+    const ownerId = getEndpointMaster(plugin, commMessage);
     if (ownerId == null)
         return;
-    pendingOrchestration.delete(pendingKey(ctx.platform, ctx.botId, ownerId));
+    pendingOrchestration.delete(pendingKey(String(commMessage.$adapter), commMessage.$endpoint, ownerId));
 }
-export function getPendingOrchestrationTool(plugin, ctx) {
-    if (!ctx.platform || !ctx.botId)
+export function getPendingOrchestrationTool(plugin, commMessage) {
+    if (!commMessage.$adapter || !commMessage.$endpoint)
         return undefined;
-    const ownerId = getBotMaster(plugin, ctx);
+    const ownerId = getEndpointMaster(plugin, commMessage);
     if (ownerId == null)
         return undefined;
-    const key = pendingKey(ctx.platform, ctx.botId, ownerId);
+    const key = pendingKey(String(commMessage.$adapter), commMessage.$endpoint, ownerId);
     const p = pendingOrchestration.get(key);
     if (!p || p.toolName !== OWNER_APPROVE_ALWAYS_TOOL) {
         if (p)